Data breachcritical
Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure Across Two Countries
AI summary · glm-5.3Summaries by Vani AI
North Korea's Hangro VPN exposed detailed infrastructure across North Korea and Russia via TLS certificates.
North Korea's Hangro VPN platform exposed detailed infrastructure across North Korea and Russia, revealing internal addresses and sensitive network metadata in TLS certificates.
Key facts
- North Korea's Hangro VPN platform exposed detailed infrastructure across North Korea and Russia.
- Malware
- Hangro
- Countries
- North KoreaRussia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aeoncredit.com.cn | NS hostname observed in a related Chinese assignment Domain aeoncredit.com.cn Passive DNS hostname observed in a related Chinese assignme |
| domain | dns.chinact.net | NS hostname observed in a related Chinese assignment Domain dns.chinact.net Passive DNS hostname observed in a related Chinese assignme |
| domain | hero-huishan.cn | NS hostname observed in a related Chinese assignment Domain hero-huishan.cn Passive DNS hostname observed in a related Chinese assignme |
| domain | hero-huishan.com | NS hostname observed in a related Chinese assignment Domain hero-huishan.com Passive DNS hostname observed in a related Chinese assignme |
| domain | lnnk.com | domain referenced in Hangro infrastructure research Domain lnnk.com Passive DNS hostname observed in a related Chinese assignme |
| domain | mall.dssodr.com | NS hostname observed in a related Chinese assignment Domain mall.dssodr.com Passive DNS hostname observed in a related Chinese assignme |
| domain | mx2.sompo-japanchina.com | NS hostname observed in a related Chinese assignment Domain mx2.sompo-japanchina.com Passive DNS hostname observed in a related Chinese assignme |
| domain | ps.ppokkugi.com | Hangro installers were reported to have been hosted Domain ps.ppokkugi.com Site carrying a Hangro icon and description of the service |
| domain | silibank.com | at 218.25.43.211, near Hangro’s configured endpoint Domain silibank.com Domain associated with the historical registry contact and |
| ipv4 | 175.45.176.21 | ssing plan. The same management certificate was observed on 175.45.176.21 in Pyongyang and on both Russian systems, 188.43.136.115 an |
| ipv4 | 175.45.176.22 | Hangro endpoint and port 6006 management service IP address 175.45.176.22 North Korean Hangro endpoint IP address 175.45.176.32 North |
| ipv4 | 175.45.176.32 | dress 175.45.176.22 North Korean Hangro endpoint IP address 175.45.176.32 North Korean Hangro endpoint IP address 188.43.136.115 Russ |
| ipv4 | 175.45.177.33 | dentified in the broader infrastructure analysis IP address 175.45.177.33 Address for mail.silibank.net.kp Note: IP addresses and dom |
| ipv4 | 175.45.178.56 | dentified in the broader infrastructure analysis IP address 175.45.178.56 Address for smtp.star-co.net.kp Hostname smtp1.star-co.net. |
| ipv4 | 175.45.178.57 | dentified in the broader infrastructure analysis IP address 175.45.178.57 Address for smtp1.star-co.net.kp Hostname mail.silibank.net |
| ipv4 | 188.43.136.115 | on 175.45.176.21 in Pyongyang and on both Russian systems, 188.43.136.115 and 188.43.136.116. Hangro client window (Source – Malwareb |
| ipv4 | 188.43.136.116 | n Pyongyang and on both Russian systems, 188.43.136.115 and 188.43.136.116. Hangro client window (Source – Malwarebox) The matching ce |
| ipv4 | 218.24.140.88 | range containing the default Hangro endpoint Network range 218.24.140.88/29 Chinese network assignment tied to the same registry con |
| ipv4 | 218.24.161.240 | assignment tied to the same registry contact Network range 218.24.161.240/29 Chinese network assignment tied to the same registry con |
| ipv4 | 218.25.125.144 | assignment tied to the same registry contact Network range 218.25.125.144/28 Chinese network assignment tied to the same registry con |
| ipv4 | 218.25.171.88 | assignment tied to the same registry contact Network range 218.25.171.88/31 Chinese network assignment tied to the same registry con |
| ipv4 | 218.25.43.208 | nt TestIP address in the same Chinese network Network range 218.25.43.208/28 Chinese range containing the default Hangro endpoint Net |
| ipv4 | 218.25.43.209 | lt Hangro client target in Chinese address space IP address 218.25.43.209 Hangro client TestIP address in the same Chinese network Ne |
| ipv4 | 218.25.43.211 | t Domain mail.silibank.com Passive DNS hostname observed at 218.25.43.211, near Hangro’s configured endpoint Domain silibank.com Doma |
| ipv4 | 218.25.43.212 | o revisits a Chinese endpoint configured in Hangro clients, 218.25.43.212. Its network registration named a technical contact using a |
| ipv4 | 61.189.49.233 | twork assignment tied to the same registry contact IP range 61.189.49.233-61.189.49.240 Chinese assignment tied to the same registry |
| ipv4 | 61.189.49.240 | nt tied to the same registry contact IP range 61.189.49.233-61.189.49.240 Chinese assignment tied to the same registry contact Domain |
| sha256 | 5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b | the older Hangro VPN certificate Management TLS fingerprint 5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b Fingerprint of the TLS certificate served on port 6006 Cert |
| sha256 | b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01 | d on North Korean and Russian hosts VPN certificate SHA-256 b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01 SHA-256 fingerprint of the older Hangro VPN certificate Man |
From the original article
5 min read at cybersecuritynews.com
North Korea’s Hangro platform has exposed an unusually detailed view of infrastructure used to connect officials and trade representatives abroad with systems inside the country. A newly observed TLS certificate listed servers in North Korea and Russia, along with an internal address that should not have appeared in a public-facing certificate. Hangro is not malware […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.