# Beyond Lazarus: Organization of DPRK Cyber Capabilities (GRIB/NIA structure, six Lazarus sub-clusters, fake IT worker and laundering ecosystem)

> Sekoia TDR, with Kudelski Security, maps how North Korea organizes its cyber operations. GRIB (ex-RGB) and NIA (ex-MSS) lead offensive activity, the former Lazarus umbrella is split into six sub-clusters, and revenue from crypto theft, ransomware/RaaS partnerships and fake IT workers funds the regime.

- **Published:** 2026-11-10T20:35:23Z
- **Last reviewed:** 2026-11-10T20:35:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5678
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5678.png
- **ID:** TL-2026-5678
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** DPRK cyber apparatus - Lazarus sub-clusters (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Sekoia's Threat Detection & Research team and Kudelski Security (published 2026-09-07) treat DPRK cyber operations as an 'all-purpose sword': an intelligence tool, a sanctions-evasion mechanism and a revenue stream. The report places the General Reconnaissance and Information Bureau (GRIB, ex-RGB, administratively KPA Unit 586, formed in 2009 from the KPA Reconnaissance Bureau, KWP Operations Department and Office 35) at the top of offensive capability. The National Intelligence Agency (NIA, ex-MSS, renamed June 2026) is a counterintelligence body linked to the Reaper cluster. The United Front Department was dismantled in 2024 and its cyber operators reportedly moved to GRIB and NIA. Sub-units discussed include the 110th Research Institute (linked to APT38), Bureau 121, and the 3rd and 5th Bureaus, whose affiliations are debated. Green Pine Associated Corporation (KPe.010) is named as a UN-designated front company.

The authors split the historical Lazarus umbrella into six sub-clusters by TTPs and operation type: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima. CryptoCore and Jade Sleet are described as splits of APT38. Moonstone Sleet has a dual mandate (FakePenny malware in 2024, Qilin RaaS in 2025). Famous Chollima conducts fake IT worker activity that supports other units. Other clusters covered are Kimsuky (described by some experts as a mega-cluster including TA406 and TA408), Andariel (Maui and H0lyGh0st ransomware, collaboration with Play ransomware in 2024) and Reaper. Forklog notes that this clustering is the authors' own analytical taxonomy, not a confirmed organizational chart of DPRK state cyber units.

Revenue generation is central. The report cites the Bybit theft of $1.5B (2025, attributed by the FBI), the 2016 Bangladesh Bank heist (about $101M), and IT-worker-linked thefts from OnyxDAO ($3.8M), Munchables ($62.5M, partly returned) and Exclusible Penthouse ($827,000). The fake IT worker workforce is estimated in the thousands. It sends salaries to the regime and gives insider access to client organizations. It uses US laptop farms, Slack, IP Messenger, 'PC-call' machines and a Ryonbong proxy. Internal communications moved from Korean to English around October 2022. Stealer logs show IT workers and offensive teams sharing VPN exit nodes. The article lists 13 exit-node IPs tied to Contagious Interview (Recorded Future, SentinelOne) and the Bybit attack (Silent Push). Kudelski's companion research on IT worker infrastructure adds Astrill and Mullvad VPN use and Russian and Japanese exit ranges.

Laundering relies on centralized exchanges and OTC desks using proxy accounts to bypass KYC, decentralized exchanges and P2P platforms. The report cites at least 19 Chinese banks and Chinese OTC traders (the 'Chinese Laundromat'). It also cites Southeast Asian casinos and exchanges, and about $37.6M in DPRK-linked crypto laundered through Cambodia's Huione Group from 2021 to 2025. The enabling ecosystem covers DPRK STEM institutions, Chinese and Russian universities, and physical relay networks in China, Russia, Southeast Asia and Africa. No CVEs are cited and CVSS does not apply. The report cites no MITRE ATT&CK technique IDs. The mappings here are analyst-derived from behaviors the sources describe.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1090 Proxy
- T1684.001 Impersonation
- T1657 Financial Theft
- T1485 Data Destruction
- T1561 Disk Wipe

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**DPRK Fake IT Worker Exit-Node Logons - Windows Network/RDP (Exploitation: Valid Accounts)** (`TL-2026-5678-SPL-001`)

Flags successful network (type 3) and RDP (type 10) Windows logons whose source address is one of the TL-2026-5678 exit-node IPs from Contagious Interview (Recorded Future/SentinelOne), Bybit (Silent Push) and Kudelski fake IT worker research. Covers the fake IT worker and contractor access path (T1078, T1656) through shared VPN exit infrastructure (T1090) and persona accounts (T1585).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078, T1090, T1585, T1656
- **Data sources:** windows_security (index=wineventlog, sourcetype=WinEventLog:Security, EventCode 4624)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type IN (3,10) earliest=-24h
| eval user=mvindex(Account_Name,-1), src_ip=Source_Network_Address
```Flag successful network/RDP logons from DPRK fake-IT-worker exit nodes (Contagious Interview / Bybit / Kudelski lists)```
| where src_ip!="-" AND (in(src_ip, "23.237.102.130", "37.120.154.98", "38.75.137.97", "45.86.208.162", "50.7.159.34", "91.239.130.102", "103.214.44.138", "167.88.61.117", "185.135.76.89", "188.43.33.252", "211.21.6.181", "70.32.3.15", "66.118.255.35", "175.45.178.222", "80.83.238.59", "83.234.227.10") OR cidrmatch("185.242.4.0/24", src_ip) OR cidrmatch("37.120.154.0/24", src_ip) OR cidrmatch("80.83.238.0/24", src_ip))
| stats count AS logons min(_time) AS first_seen max(_time) AS last_seen values(Logon_Type) AS logon_types dc(ComputerName) AS hosts_touched values(ComputerName) AS hosts BY user, src_ip
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - logons
````

### Microsoft KQL

```kql
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == '0'
| where IPAddress in ('23.237.102.130', '37.120.154.98', '38.75.137.97', '45.86.208.162', '50.7.159.34', '91.239.130.102', '103.214.44.138', '167.88.61.117', '185.135.76.89', '188.43.33.252', '211.21.6.181', '70.32.3.15', '66.118.255.35', '175.45.178.222', '80.83.238.59', '83.234.227.10') or ipv4_is_in_any_range(IPAddress, dynamic(['185.242.4.0/24', '37.120.154.0/24', '80.83.238.0/24']))
| summarize SignIns=count(), Apps=make_set(AppDisplayName, 20), Countries=make_set(tostring(LocationDetails.countryOrRegion), 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserPrincipalName, IPAddress
| project UserPrincipalName, IPAddress, SignIns, Apps, Countries, FirstSeen, LastSeen
| order by SignIns desc
```

### Sigma

```yaml
title: DPRK Fake IT Worker Exit-Node Logon - Windows Network or RDP Logon
id: 7c3e5a1d-9b24-4f6e-8a0d-3d51c2b94e17
status: experimental
description: Detects successful Windows network (type 3) or RDP (type 10) logons from exit-node IPs and ranges tied to DPRK fake IT workers, Contagious Interview and Bybit infrastructure (TL-2026-5678).
references:
    - https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities
    - https://kudelskisecurity.com/research/dprk-fake-it-workers-inside-their-evolving-network-infrastructure
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial_access
    - attack.t1078
    - attack.command_and_control
    - attack.t1090
logsource:
    product: windows
    service: security
detection:
    selection_base:
        EventID: 4624
        LogonType:
            - 3
            - 10
    selection_ip:
        IpAddress:
            - '23.237.102.130'
            - '37.120.154.98'
            - '38.75.137.97'
            - '45.86.208.162'
            - '50.7.159.34'
            - '91.239.130.102'
            - '103.214.44.138'
            - '167.88.61.117'
            - '185.135.76.89'
            - '188.43.33.252'
            - '211.21.6.181'
            - '70.32.3.15'
            - '66.118.255.35'
            - '175.45.178.222'
            - '80.83.238.59'
            - '83.234.227.10'
    selection_ip_cidr:
        IpAddress|cidr:
            - '185.242.4.0/24'
            - '37.120.154.0/24'
            - '80.83.238.0/24'
    condition: selection_base and 1 of selection_ip*
falsepositives:
    - Exit-node IPs sit in shared hosting and VPN ranges reused by unrelated customers
    - Employees or contractors using the same commercial VPN provider
level: high

```

**Known false positives:**

- Exit-node IPs sit in shared hosting/VPN ranges (M247, Transtelecom) and may be reused by unrelated customers
- Legitimate employees or contractors using the same commercial VPN provider

**Tuning notes:** Validate hits against HR/contractor rosters and expected geolocation. Add an allowlist for approved VPN egress and re-baseline the CIDR matches; refresh the IP list from the Sekoia/Kudelski annexes and the research IOC feed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- DPRK Fake IT Worker Exit-Node Sign-ins - Entra ID (Exploitation: Valid Accounts) (locked: unlock with TL Creds)
- DPRK-Linked Ransomware and Wiper Activity - Defender File and Process Events (Post-Exploitation: Impact) (locked: unlock with TL Creds)
- DPRK Contagious Interview, Bybit and Community Free-Host C2 Network Connections - Defender (C2) (locked: unlock with TL Creds)
- DPRK Fake IT Worker Exit-Node Logon - Windows Security 4624 (Exploitation: Valid Accounts) (locked: unlock with TL Creds)
- DPRK-Linked Ransomware Artifact Creation - Maui, H0lyGh0st, Play, Qilin (Post-Exploitation: Impact) (locked: unlock with TL Creds)
- DPRK Community-Linked Free-Host C2 and Lure Domain DNS Queries (C2) (locked: unlock with TL Creds)
- DPRK-Linked Ransomware and Wiper Activity - Maui, H0lyGh0st, Play, Qilin, KillDisk-Style Destruction (Post-Exploitation: Impact) (locked: unlock with TL Creds)
- DPRK Community-Linked Free-Host C2 and Contagious Interview/Bybit Infrastructure Connections (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `23.237.102[.]130`
- Domain: `DZHV-gw[.]transtelecom[.]net`
- IP address: `37.120.154[.]98`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Beyond Lazarus: Organization of DPRK cyber capabilities (Sekoia TDR and Kudelski Security)](https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities)
- [Kudelski Security: Beyond Lazarus (co-published)](https://kudelskisecurity.com/research/beyond-lazarus-organization-of-dprk-cyber-capabilities)
- [Kudelski: DPRK fake IT workers - inside their evolving network infrastructure](https://kudelskisecurity.com/research/dprk-fake-it-workers-inside-their-evolving-network-infrastructure)
- [Kudelski: How DPRK's Contagious Interview campaign targets developers](https://kudelskisecurity.com/research/how-dprks-contagious-interview-campaign-targets-developers)
- [SentinelOne: Contagious Interview threat actors scout cyber intel platforms](https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/)
- [Silent Push: Lazarus Bybit infrastructure](https://www.silentpush.com/blog/lazarus-bybit/)
- [Recorded Future: PurpleBravos targeting IT software supply chain](https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain)
- [FBI: North Korea responsible for $1.5 billion Bybit hack](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack)
- [US State Department: Alert regarding North Korean IT workers (2026-07)](https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers)
- [FinCEN: Huione Group primary money laundering concern](https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern)
- [Unit 42: North Korean threat group Andariel and Play ransomware](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/)
- [Google Cloud/Mandiant: APT38 details on new North Korean regime-backed threat group](https://cloud.google.com/blog/topics/threat-intelligence/apt38-details-on-new-north-korean-regime-backed-threat-group)
- [HRNK: The Reconnaissance General Bureau - the Kim regime's precious treasured sword](https://www.hrnk.org/documentations/the-reconnaissance-general-bureau-the-kim-regimes-precious-treasured-sword/)
- [CSIS: Hidden Enablers - third countries in North Korea's cyber playbook](https://www.csis.org/analysis/hidden-enablers-third-countries-north-koreas-cyber-playbook)
- [Infosecurity Magazine: North Korea's Lazarus operates through six distinct cyber clusters](https://infosecurity-magazine.com/news/north-korea-lazarus-six-cyber)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5678