TLDR Tech / InfoSec
Inside the computers of DPRK IT workers
NoxHunt shifted from ZachXBT's April 8 investigation into the luckyguys[.]site payment hub to retrieve infostealer logs from two DPRK IT worker devices via STEALINT, revealing the tradecraft behind the fraudulent freelance ecosystem. Both operators ("SuperDev" and "DevWisdom") used Korean Windows installs behind Astrill VPN with US/Japan exit nodes, used DeskIn and AnyDesk for remote work, maintained multiple fake GitHub portfolios with many repos across languages, and used AI interview copilots like jobright.ai and ntro.io while targeting Middle East clients, including fake Saudi gym brands linked to the Memvera/Shijazi88 persona. Defenders should look for Astrill VPN ranges, DeskIn/AnyDesk pairings, recent fake GitHub accounts with diverse languages and recycled repos, and virtual number providers on freelance platform signups.
Read the full story