North Korea's Hangro platform offers a remarkably detailed glimpse into the infrastructure used to connect officials and trade representatives abroad to systems within the country.
Indicators of Compromise (IoCs): - Type: Indicator Description - Certificate Name: Hangro VPN certificate common name observed on North Korean and Russian hosts - Certificate Fingerprint: Fingerprint of the older Hangro VPN certificate - Management TLS Fingerprint: Fingerprint of the TLS certificate served on management and older services - Certificate: Value for the certificate exposed on management and older services - IP Address: North Korean Hangro endpoint and management service - IP Address: North Korean Hangro endpoint - IP Address: Russian Hangro endpoint serving management and older services - IP Address: Russian Hangro endpoint serving management and older services - Internal IP Address: Carrier-grade NAT address exposed in the management certificate SAN - IP Address: Default Hangro client target in Chinese address space - IP Address: Hangro client TestIP address in the same Chinese network - Network Range: Chinese range containing the default Hangro endpoint - Network Range: Chinese network assignment tied to the same registry contact - Network Range: Chinese network assignment tied to the same registry contact - Network Range: Chinese network assignment tied to the same registry contact - Network Range: Chinese network assignment tied to the same registry contact - IP Range: - Chinese assignment tied to the same registry contact - Domain: mail.silibank.com Passive DNS hostname observed at near Hangro’s configured endpoint - Domain: silibank.com Domain associated with the historical registry contact and Hangro distribution paths - URL Path: silibank.com/fog/update_files/ Historical location where Hangro installers were reported to have been hosted - Domain: ps.ppokkugi.com Site carrying a Hangro icon and description of the service - Domain: futurere.com.kp Historical DPRK-related domain referenced in Hangro infrastructure research - Domain: lnnk.com Passive DNS hostname observed in a related Chinese assignment - Domain: dns.chinact.net Passive DNS hostname observed in a related Chinese assignment -...
