North Korean Internet

There’s been plenty of coverage on the bridge between North Korea and Russia that is opening soon.

In 2018, Check Point published a deep dive into SiliVaccine, North Korea’s homegrown antivirus, and found its scanning engine was built on stolen, decade-old Trend Micro code.

In 2017, a United Nations Panel of Experts submitted a report to the UN Security Council that identified Global Communications Co.

The North Korean embassy has been in the news lately, so it felt like a good time to finally write this up.

Taking a break from fake DPRK companies for a while, there was some interesting activity that I recently noticed on 175.45.176.97.

If you haven’t read part 1, you can read it here: https://nkinternet.com/2026/04/07/npm-malware-fake-devs-and-deepfake-videos-these-are-a-few-of-my-favorite-dprk-things/ In order to keep the first part of this short the plan was to break it into a series…

What started as what I thought was going to be a quick look into a suspicious GitHub organization turned into a much deeper rabbit hole with an active npm backdoor, more than a dozen fake developer personas, and recruitment posts looking for overseas faci…

An email discovered last year that was sent from North Korea’s internet infrastructure offers a rare look at how DPRK software developers market their work abroad.

Over the years I’ve come across a number of sources and log files that provides some insight into what is on North Korea’s Kwangmyong.

A recent post by Hudson Rock detailed information derived from infostealer logs tied to activity associated with the Trevor Greer persona, you know the one trevorgreer9312@gmail[.]com.