Team Cymru - S2 Threat Research

'I didn't know who I'd be fighting' — North Korean soldier captured by Ukraine speaks in new footage The POW said he arrived in Russia on a cargo ferry with over 100 other North Korean soldiers.

This ferry service has taken on greater significance in recent months. When a North Korean soldier, taken as a prisoner of war by Ukrainian forces, claimed he had travelled from North Korea into Russia aboard a “Russian cargo ferry”.

kyivindependent.com/zelensky-rel...

The IPs in this case, which have entered the public domain in recent days:

188.43.33.250
188.43.33.251

Are part of a small cluster assigned to InvestStroyTrest. This company operates a ferry service between North Korea and Russia, maintaining an office in the port of Rajin, KP.

This infrastructure was controlled via IPs assigned to Russian #TransTelecom, as pointed out in Trend Micro’s recent analysis. These IPs reside in several ranges (some disclosed publicly, some not) which we have observed in concert with DPRK-linked activity for several years.

Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC (blocknovas[.]com) in DPRK-linked #ContagiousInterview campaigns. We thought we'd share our overview of network telemetry surrounding this activity.

BLOG POST: A write-up on some infrastructure we were tracking during 2024, connected to both SmartApeSG and NetSupportRAT activities. They do usually follow one another around but we've exposed direct links from a management and oversight perspective.

www.team-cymru.com/post/tracing...

Jingle Shells: How Virtual Offices Enable a Facade of Legitimacy Virtual offices have revolutionized the way businesses operate. They provide cost-effective flexibility by eliminating the need for permanent physical spaces. For startups, entrepreneurs, and global companies, virtual offices are powerful tools for establishing a presence in new markets and enhancing professional credibility.However, this innovation has a darker side. The same features that benefit legitimate businesses also create opportunities for exploitation. Virtual offices have become a lo

BLOG POST: We examine the use of virtual offices by cybercriminals, and the organizations that enable them, to create a facade of legitimacy for their malicious activities.

www.team-cymru.com/post/how-vir...