North Korea’s Hangro VPN Certificate Exposes Internal Network and Russia-Linked Infrastructure
New Hangro VPN certificates tie North Korean and Russian Far East servers to a shared management PKI, exposing an internal carrier-grade NAT address.
DPRK-linked Hangro VPN and mail platform deployed a new certificate hierarchy in July 2026 on TCP port 6006, issued by an internal root named "KEVIN ROOT CA" (RSA-4096, SHA-256, valid 2026-2036) and presented from three North Korean and two Russian IP addresses. The certificate's SAN enumerates all five public-facing Hangro systems plus 100.100.100.170, an address in the RFC 6598 carrier-grade NAT range, indicating an internal management reference. The Russian endpoints sit in TransTeleCom's Far East network in Khabarovsk, and the shared fingerprint across Pyongyang and Russian hosts suggests administration as one environment. The software is derived from SoftEther VPN with mutual TLS, and contrasts with a cryptographically flawed 2024 certificate chain that showed handshake failures.
- SAN lists public servers plus CGNAT address 100.100.100.170
- Same certificate fingerprint on Pyongyang and Russian systems
- Russian IPs in TransTeleCom's Khabarovsk Far East range
- Legacy 2024 HBS2024 chain had signature handshake failures
- Historic client callbacks pointed to China Unicom space linked to Silibank
- Vendors
- SoftEtherTransTeleCom
- Products
- Hangro VPN
- Threat actors
- DPRK (Lazarus-linked infrastructure)
- Countries
- North KoreaRussiaChinaJapan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 175.45.176.22 | om Hangro-linked IP addresses in North Korea 175.45.176.21, 175.45.176.22 and 175.45.176.32 and two Russian systems, 188.43.136.115 a |
| ipv4 | 175.45.176.32 | P addresses in North Korea 175.45.176.21, 175.45.176.22 and 175.45.176.32 and two Russian systems, 188.43.136.115 and 188.43.136.116. |
| ipv4 | 188.43.136.115 | 1, 175.45.176.22 and 175.45.176.32 and two Russian systems, 188.43.136.115 and 188.43.136.116. It is valid from July 26, 2026, through |
| ipv4 | 188.43.136.116 | d 175.45.176.32 and two Russian systems, 188.43.136.115 and 188.43.136.116. It is valid from July 26, 2026, through July 23, 2036, use |
| ipv4 | 218.25.43.212 | rarchy. Hangro’s historical client configuration pointed to 218.25.43.212 on port 8888, an address in China Unicom space in Liaoning. |
From the original article
4 min read at gbhackers.com
North Korea’s Hangro VPN and mail platform has deployed a new certificate hierarchy that exposes an apparent cross-border management environment spanning systems in Pyongyang and Russia’s Far East. The certificate’s Subject Alternative Name field lists the platform’s publicly exposed servers alongside a carrier-grade NAT address, offering an unusual glimpse into how the service may be […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.