DPRK Fake IT Workers: Inside Their Evolving Network Infrastructure

This report analyzes DPRK-linked fake IT worker and offensive infrastructure using stealer logs and a public leak, mapping public-facing and private IPs, VPN exit-node patterns (Astrill, Mullvad), and identifying clusters and team structures (e.g., Team 313, KUT, RB, PUG, Team 821-39). It documents active C2 infrastructure and reuse of long-lived exit nodes, provides specific IOCs and VPN ranges for detection, and highlights internal comms and operational tradecraft useful for tracking and attribution.