Researchers Uncovered New Lazarus and Kimsuky Infrastructure with Active Tools and Tunnelling Nodes
An investigation by Hunt.io and the Acronis Threat Research Unit has identified a network of North Korean state-sponsored infrastructure, revealing links between the Lazarus and Kimsuky groups across global operations.
An investigation by Hunt.io and the Acronis Threat Research Unit has identified a network of North Korean state-sponsored infrastructure, revealing links between the Lazarus and Kimsuky groups across global operations.
The research identified active tool-staging servers, credential-theft environments, FRP tunneling nodes, and a certificate-linked infrastructure fabric controlled by DPRK operators. This discovery offers insight into how these threat actors maintain persistent access and coordinate attacks across multiple targets.
A new Linux variant of the Badcall backdoor was detected, featuring enhanced logging capabilities that write timestamped entries to /tmp/sslvpn.log . This mechanism allows attackers to confirm proper execution and monitor behavior throughout intrusions. The variant was hosted on infrastructure previously linked to Lazarus campaigns , indicating ongoing malware development.
Hunt.io researchers noted consistent operational patterns across DPRK subgroups, with open directories serving as staging points for deploying credential theft kits and FRP tunnels across multiple VPS hosts. The reuse of certificates links separate clusters to the same operators, creating a detectable footprint even when malware or lures change. These patterns enable tracking through infrastructure analysis rather than relying solely on payload examination.
The investigation uncovered multiple active infrastructure nodes. A server at 207.254.22.248:8800 exposed a 112 MB credential-theft toolkit with various binaries for data exfiltration. Another node at 149.28.139.62:8080 hosted a Quasar RAT environment with 270 MB of tooling. The most significant discovery was 154.216.177.215:8080, which exposed nearly 2 GB of operational data, including offensive security tools and development artifacts.
This discovery offers insight into how these threat actors maintain persistent access and coordinate attacks across multiple targets.
The researchers identified eight FRP tunneling nodes on port 9999 across VPS hosts in China and the APAC region, each serving identical 10 MB binaries. This uniformity suggests automated provisioning rather than manual configuration. The nodes act as redirectors between compromised hosts and operator-controlled servers, providing reliable access even when traditional C2 channels are blocked.
Certificate analysis linked 12 IP addresses to the subject hwc-hwp-7779700 , with 10 directly associated with Lazarus malware on port 443. This certificate reuse exposes entire infrastructure clusters before they become active in campaigns.
The Badcall variant's infection mechanism begins with processing command-line arguments. It checks for a process ID argument, simulates a kill command, and then daemonizes itself to start primary operations. The logging function, shown below, writes timestamped entries:
void logMessage(const char *message) { time_t now = time(NULL); struct tm *t = localtime(&now); char timestamp[20]; strftime(timestamp, sizeof(timestamp), "%Y-%m-%d %H:%M:%S", t); fprintf(log_file, "[%s] %s\n", timestamp, message); }
Defenders can detect this activity by monitoring for exposed directories containing credential harvesting tools, FRP binaries on port 9999, and certificate subjects reused across RDP-enabled hosts. These signals provide advance warning of DPRK activity as it forms. The research demonstrates that infrastructure analysis offers more reliable tracking than payload examination alone.
Based on reporting by Cyber Security News.