Inside North Korea’s Cybercrime Ecosystem: Fake IT Workers, Gambling Networks and Malware

This report consolidates investigations linking DPRK-associated actors to cybercrime and state-influenced operations: it connects the FakeCalls Android banking trojan and Emotet loader activity to a DPRK-linked operator (“Bismarck”), describes stolen credential/stealer log evidence and overlapping IP IOCs, outlines gambling infrastructure potentially used for money laundering, and reconstructs internal naming, network, and GEOINT attributes of fake IT worker teams tied to North Korean universities and bases.