iiinova — where your digital self keeps evolving

Team Cymru - S2 Threat Research @teamcymrus2.bsky.social · 25/04/2025

This ferry service has taken on greater significance in recent months. When a North Korean soldier, taken as a prisoner of war by Ukrainian forces, claimed he had travelled from North Korea into Russia aboard a “Russian cargo ferry”. kyivindependent.com/zelensky-rel...

kyivindependent.com

'I didn't know who I'd be fighting' — North Korean soldier captured by Ukraine speaks in new footage

The POW said he arrived in Russia on a cargo ferry with over 100 other North Korean soldiers.

000

Team Cymru - S2 Threat Research @teamcymrus2.bsky.social · 25/04/2025

The IPs in this case, which have entered the public domain in recent days: 188.43.33.250 188.43.33.251 Are part of a small cluster assigned to InvestStroyTrest. This company operates a ferry service between North Korea and Russia, maintaining an office in the port of Rajin, KP.

100

Team Cymru - S2 Threat Research @teamcymrus2.bsky.social · 25/04/2025

This infrastructure was controlled via IPs assigned to Russian #TransTelecom, as pointed out in Trend Micro’s recent analysis. These IPs reside in several ranges (some disclosed publicly, some not) which we have observed in concert with DPRK-linked activity for several years.

100

Team Cymru - S2 Threat Research @teamcymrus2.bsky.social · 25/04/2025

Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC (blocknovas[.]com) in DPRK-linked #ContagiousInterview campaigns. We thought we'd share our overview of network telemetry surrounding this activity.

100

Team Cymru - S2 Threat Research @teamcymrus2.bsky.social · 04/02/2025

BLOG POST: A write-up on some infrastructure we were tracking during 2024, connected to both SmartApeSG and NetSupportRAT activities. They do usually follow one another around but we've exposed direct links from a management and oversight perspective. www.team-cymru.com/post/tracing...

team-cymru.com

Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT | Cymru

Explore how Internet telemetry analysis exposed hidden cyber threat connections between SmartApeSG, NetSupport RAT, Quasar RAT, and cryptocurrency scams. Request a demo!

030