- DPRK IT workers use a payment remittance platform called luckyguys[.]site to report earnings to handlers, with minimal internal security like a default password.
- Payments are verified by an administrator account (PC-1234) and follow a pattern of crypto or fiat conversion, often through Chinese channels.
- Funds are consolidated upward to wallets like the 'RB wallet' (linked to sanctioned Ryongbong General Corporation) and ultimately to entities like Unit 1020 and Command 710.
- The money trails support DPRK weapons development and sanctions evasion, involving front companies like Sobaeksu, Saenal, and Songkwang.
- DPRK IT workers use proxies and facilitators in countries like Nigeria, Pakistan, and Ukraine to obscure their identity and scale operations.
- Revenue from these schemes funds not only domestic programs but also military aid to Russia, including ammunition and troops.
- Entities like the Reconnaissance General Bureau and Munitions Industry Department oversee this cyber activity and money laundering.
- Leaked data from an internal payment server exposed 390 accounts, chat logs, and organizational ties, reinforcing the connection to state-sponsored cyber operations.