DTEX-ExposingDPRKCyberSyndicateandHiddenITWorkforce.pdf (2 MB)

DTEX analyzed records from an exposed internal DPRK payment server containing 390 accounts, chat logs, cryptocurrency transactions, and organizational self-identifications. Workers reported crypto or fiat transfers through luckyguys.site to administrator PC-1234, after which funds were pooled and moved through structures associated with Unit 1020, Command 710, and an "RB wallet" assessed as likely tied to sanctioned Korea Ryonbong General Corporation. Infrastructure pivots identified luckyguys.cloud, rbluckyguys.com, and two server IP addresses, while the records also connected the payment system to sanctioned front companies supporting the DPRK Munitions Industry Department. DTEX assesses that overseas IT salaries feed a centralized state revenue system associated with weapons procurement and other sanctioned activity.