Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure

Reported 23 Apr 2026 by otx · Severity: medium

Investigation of DPRK-linked fake IT worker infrastructure began after cryptocurrency researcher ZachXBT identified domain luckyguys[.]site connected to illicit payments. Analysis of 30 days of network activity associated with IP 163.245.219[.]19 revealed concentrated VPN usage p