From Payroll to Pyongyang: The DPRK IT Worker Money Trail

12 hours ago

DPRK IT workers use a payment remittance platform called luckyguys[.]site to report earnings to handlers, with minimal internal security like a default password.
Payments are verified by an administrator account (PC-1234) and follow a pattern of crypto or fiat conversion, often through Chinese channels.
Funds are consolidated upward to wallets like the 'RB wallet' (linked to sanctioned Ryongbong General Corporation) and ultimately to entities like Unit 1020 and Command 710.
The money trails support DPRK weapons development and sanctions evasion, involving front companies like Sobaeksu, Saenal, and Songkwang.
DPRK IT workers use proxies and facilitators in countries like Nigeria, Pakistan, and Ukraine to obscure their identity and scale operations.
Revenue from these schemes funds not only domestic programs but also military aid to Russia, including ammunition and troops.
Entities like the Reconnaissance General Bureau and Munitions Industry Department oversee this cyber activity and money laundering.
Leaked data from an internal payment server exposed 390 accounts, chat logs, and organizational ties, reinforcing the connection to state-sponsored cyber operations.

Hasty Briefsbeta