Stealer-log analysis exposed changes in the public and private network infrastructure supporting North Korean fake IT workers, including an apparent route through Russian exit nodes and VPN endpoints in the United States and Japan. Internal records linked operational networks to entities including the Second Economy Committee, Ryonbong, and Kim Chaek University of Technology, while revealing multiple teams and administrative systems. The operators used commercial VPNs, shared some infrastructure with offensive teams, and routed substantial DNS activity through MikroTik devices. The research also identified persistent DPRK address reuse, several team-specific IP clusters, and a newly observed but unresolved offensive-infrastructure cluster labeled PUG.