Comment on North Korea whois records hijacked? by Marco Pisco

<!-- wp:paragraph --> <p>congrats to whoever did it lmao</p> <!-- /wp:paragraph -->

North Korea whois records hijacked?

Manbang Set Top Box Manual

A short post since 38North has a much longer write up about the Manbang set top box here: https://www.38north.org/2019/02/mwilliams022219/ But I recently came across the manual to the Manbang set top box that was part of an .apk file. The app is corrupted but I was able to extract some of the contents. Specs from … Continue reading Manbang Set Top Box Manual

Comment on Hangro: Investigating North Korean VPN Infrastructure Part 1 by Észak-koreai VPN-infrastruktúra  – Yet Another News Aggregator Channel

[…] FORRÁS […]

Hangro: Investigating North Korean VPN Infrastructure Part 1

In a post from a now-deleted user on the webdev subreddit, someone asked about how to acquire a .kp TLD. While there were a few decent responses, the original poster shared an update: they successfully obtained a domain but noted that a VPN is required to access the website. This raised intriguing questions about VPN … Continue reading Hangro: Investigating North Korean VPN Infrastructure Part 1

Inspecting North Korea’s Digital Map App: Licensing & API Insights

I’ve been meaning to write this for a while but it turned into a much longer write up than I was expecting so it’s being broken into multiple parts. Martyn at 38 North did a great write up on the app earlier this year but I wanted to dive into it more. If you’re not … Continue reading Inspecting North Korea’s Digital Map App: Licensing & API Insights

Investigating korfilm.com.kp DNS Errors

There’s an interesting DNS misconfiguration for korfilm.com.kp, the website for the Korea Film Export & Import Corporation. It appears that someone made a typo when configuring the DNS records leading to one of the entries pointing to an Apple owned IP instead of a North Korean one. This is the current A record for korfim.com.kp: … Continue reading Investigating korfilm.com.kp DNS Errors

Exploring the North Korean Email Client: Features and Functionality

Now that it’s been leaked, lets take a look at the North Korean email client that was part of the leak. It’s made up of a main executable, a couple of dll files, and a config file. Before even diving into it there’s a couple of interesting things that we can find looking at the … Continue reading Exploring the North Korean Email Client: Features and Functionality

Comment on AS9341 – North Korea Government by nkinternet

In reply to <a href="https://nkinternet.wordpress.com/2024/08/09/as9341-north-korea-government/comment-page-1/#comment-147">marco2abdb61a22</a>. interesting, appreciate the information! figured it was a mistake but was secretly hoping that something interesting would appear in that range

Comment on AS9341 – North Korea Government by marco2abdb61a22

<!-- wp:paragraph --> I've contacted the people behind those AS numbers. One of them replied to me saying that it's a mistake, and they've contacted their provider and fixed it (since I've found more AS numbers related to what appears to be the same provider reporting that the country is North Korea) <!-- /wp:paragraph --><!-- wp:image {"sizeSlug":"medium"} --> <!-- /wp:image --><!-- wp:image {"sizeSlug":"medium"} --> <!-- /wp:image -->

April Spring Friendship Art Festival

Found some application forms and the rules for the 32nd April Spring Friendship Art Festival. “The April Spring Friendship Art Festival is an international event that is held in Pyongyang to mark the Day of the Sun (April 15, the birthday of President Kim Il Sung). The festival, which began in 1982, aims at promoting … Continue reading April Spring Friendship Art Festival

Comment on Exposed Nextcloud Instance by nkinternet

In reply to <a href="https://nkinternet.wordpress.com/2023/12/17/exposed-nextcloud-instance/comment-page-1/#comment-145">anon</a>. it sure did have some auth issues https://www.wired.com/story/north-korea-amazon-max-animation-exposed-server/

Comment on Exposed Nextcloud Instance by anon

<!-- wp:paragraph --> <p>seems like this instance had authentication issues and had its info dumped: </p> <!-- /wp:paragraph --><!-- wp:paragraph --> <p><a href="https://twitter.com/vxunderground/status/1828791572512874617" rel="nofollow ugc">https://twitter.com/vxunderground/status/1828791572512874617</a></p> <!-- /wp:paragraph -->

capitalsloan.com Follow Up

It’s gone offline since posted last week so that’s fun # ping capitalsloan.comPING capitalsloan.com (206.119.65.51): 56 data bytesRequest timeout for icmp_seq 0Request timeout for icmp_seq 1^C--- capitalsloan.com ping statistics ---3 packets transmitted, 0 packets received, 100.0% packet loss

AS9341 – North Korea Government

Looks like within the last month AS9341 is now reporting as North Korea Government Other than the fact that it’s a tremendous amount of IP’s I’m curious to see what happens with this. Poking around the routing it doesn’t seem to be associated with anything that North Korea currently peers with on AS131279. Even just … Continue reading AS9341 – North Korea Government

Rim Jong Hyok and Maui Ransomware

Been looking through the Rim Jong Hyok indictment and maui ransomware affidavit. A couple of interesting things that I’ve found. Rim Jong Hyok indictment: https://www.justice.gov/d9/2024-07/hyok_filed_indictment.pdfMaui affidavit: https://s3.documentcloud.org/documents/25002601/maui-ransomware.pdf The email whas1985@yahoo.com has apparently been in a number of database leaks over the years including nitrocloud and 000webhost. Looks like they used the same password globalhades19930709 for … Continue reading Rim Jong Hyok and Maui Ransomware

Comment on korstamp.com.kp Authors by nkinternet

In reply to <a href="https://nkinternet.wordpress.com/2021/05/31/korstamp-com-kp-authors/comment-page-1/#comment-140">Ibrahim</a>. phone number is super interesting. not sure why it shows the IP in Los Angeles.

Comment on korstamp.com.kp Authors by Ibrahim

<!-- wp:paragraph --> <p>idk for sure but it looks like the koreans have gotten access to US numbers? <a href="https://i.imgur.com/PqNBYL4.png" rel="nofollow ugc">https://i.imgur.com/PqNBYL4.png</a><br><br>perhaps google voice or something. another interesting observation is ip-api.com returns Los angeles for a north korean ip</p> <!-- /wp:paragraph --><!-- wp:paragraph --> <p>{ "query": "175.45.176.21", "status": "success", "continent": "North America", "continentCode": "NA", "country": "United States", "countryCode": "US", "region": "CA", "regionName": "California", "city": "Los Angeles", "district": "", "zip": "90009", "lat": 34.0522, "lon": -118.244, "timezone": "America/Los_Angeles", "offset": -25200, "currency": "USD", "isp": "Star Joint Venture Co. Ltd.", "org": "Star Joint Venture Co. Ltd", "as": "AS131279 Ryugyong-dong", "asname": "STAR-KP", "mobile": false, "proxy": false, "hosting": false }<br></p> <!-- /wp:paragraph -->

Comment on New Website – Kim Il Sung- Kim Jong Il Foundation by nkinternet

In reply to <a href="https://nkinternet.wordpress.com/2023/07/27/new-website-kim-il-sung-kim-jong-il-foundation/comment-page-1/#comment-103">luk</a>. just emailed

Comment on New Website – Kim Il Sung- Kim Jong Il Foundation by luk

Can you please send me email, I have something to discuss.