---
id: 6205
title: "Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns"
source_domain: hunt.io
source_url: "https://hunt.io/blog/dprk-lazarus-kimsuky-infrastructure-uncovered"
published_at: "2025-12-17T00:00:00Z"
tags: ["supply-chain", "threat-intelligence", "malware", "credential-theft", "threat-hunting", "dprk", "lazarus", "kimsuky"]
phying_url: "https://phying.com/item/6205"
lang: en
---

# Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns

## Summary

A Hunt.io–Acronis investigation maps DPRK infrastructure: unlinked Lazarus and Kimsuky clusters, credential-theft toolkits in open directories, FRP tunneling nodes, and a 3CX supply-chain link.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-12-17T00:00:00Z
- **Original:** https://hunt.io/blog/dprk-lazarus-kimsuky-infrastructure-uncovered
- **Phying News:** https://phying.com/item/6205