What is DPRK?

LLM phonetically decodes DPRK passwords that human analysts missed entirely.

“The LLM was able to deconstruct that and understand that it was actually the same password as the others just that if you were a native Korean speaker typing on an English language keyboard but in Korean then these two letters actually would make phonetically the sound of the first letter in that other password and the second two letters phonetically made the sound of the second letter in that other password all the way through and we completely missed that.”

An LLM linked seemingly different DPRK actor passwords by recognizing phonetic equivalence of Korean characters typed on an English keyboard, a pattern human analysts had entirely missed.

“The LLM was able to deconstruct that and understand that it was actually the same password as the others just that if you were a native Korean speaker typing on an English language keyboard but in Korean then these two letters actually would make phonetically the sound of the first letter in that other password and the second two letters phonetically made the sound of the second letter in that other password all the way through and we completely missed that.”

A researcher embedded in DPRK systems for 22 months observed operations touching 1,600 companies across 57 countries.

“He was he was in these systems for something like 22 months just watching them do their you know, 1,600 companies, 57 countries are impacted.”

DPRK hackers were found inside major enterprises including Aon, Oppo, Coinbase, Uniswap Labs, and Italy's Supreme Judicial Council, contradicting the assumption that their campaigns mostly hit small to medium targets.

“I've always just thought that the other stuff going on is probably a long tail of small to medium actors on small to But these are big names that they were found in this research set like Aon Smart Technologies, Chinese phone manufacturer Oppo, crypto currency firms like Coinbase, Uniswap Labs, Italy Supreme Judicial Council.”

KVM switch hardware is now a first-day detection signal for North Korean remote IT workers plugging into corporate devices, making it a low-cost physical indicator worth monitoring in onboarding workflows.

“In any case, DPRK person gets hired and the signal for that is first day they plug in a KVM switch into their device.”

Google's Gemini was used by DPRK IT workers to generate fake IDs during a fake DeFi company sting operation, raising questions about AI misuse for identity fraud.

“Some of the fake ID stuff was stamped through Google's Gemini.”

DPRK hackers are moving away from crypto for initial payments because blockchain tracking is too effective, preferring traditional and neo-banks instead.

“They're increasingly not a big fan of crypto cuz we track them too much.”

Tom Uren on the rarity of North Korean hacker defections.

“One interesting thing when I was researching this is that you basically never see North Korean hackers defect.”

Ransomware-as-a-service is the most plausible vector for DPRK hackers to skim personal funds because it lets individual hackers get paid directly for hacking work, bypassing state control of proceeds.

“The whole point of ransomware particularly ransomware as a service is that it enables skilled individual hackers to get paid for doing hacking.”

Patrick Gray on the imminent tightening of North Korean APT operator constraints due to regime-level fear.

“Being a North Korean hacker is about to be a lot less because they are about to put really tight operational constraints on these guys because their bosses are worried that their bloodlines are going to get as they go off to a firing squad, right?”