Kudelski Security linked a DPRK-associated operator known as Bismarck to gambling administration infrastructure and IP addresses that overlap earlier FakeCalls research. A separate fake IT worker manager held credentials for two systems later associated with Emotet delivery, which the researchers assess with moderate confidence were used to deploy the malware. The report also maps fake IT worker teams associated with North Korean universities and describes a five-location Base system used to provide internet access. Parts of the physical-site reconstruction remain low confidence, and the PYITC identity and possible student participation are unresolved.