Inside the Cyber Infrastructure Behind DPRK Fake IT Worker Operations

This report maps and analyzes networks and infrastructure attributed to suspected DPRK 'fake IT workers' used for offensive operations, documenting four private network ranges, numerous services (CI/CD, code hosting, ELK, mobile security tooling), operator-linked public VPS exit nodes, and observed targeting of OT, energy, aeronautics and defense sectors; evidence includes Hudsonrock stealer logs and public IPs tied to prior attacks.