2026-08-28 · view entry permalink →
Kudelski Security: North Korean IT-worker infrastructure overlaps a Bismarck-linked gambling-platform operation and the FakeCalls Android banking trojan
Kudelski Security, a Swiss research lab headquartered in Cheseaux-sur-Lausanne, reconstructs connections between North Korean state-linked cybercrime and fake-IT-worker operations via a stealer-log leak. An actor the researchers designate "Bismarck," linked to DPRK-run gambling platforms, reused infrastructure that overlaps with the FakeCalls Android banking trojan (previously documented by Check Point targeting South Korean banking customers via voice-phishing app impersonation): "we recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed 'Bismarck.' The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea" (Kudelski Security, 2026-08-12). Kudelski assesses the infrastructure reuse most plausibly reflects that the gambling-operation domains were purchased by DPRK associates rather than by Bismarck directly.
Separately, a DPRK-affiliated manager's own WinSCP credential vault — stolen in a 2021 leak — held access to historical Emotet botnet loader infrastructure, and cross-referencing that infrastructure's later reuse ties it into a loader role for subsequent campaigns. The investigation names operational bases and identifies university-affiliated IT-worker pipelines at named North Korean technical universities, plus organisational entities supporting fake IT-worker placement across multiple countries — directly relevant tradecraft for this constituency's HR and identity-vetting teams screening remote-hire pipelines, where a DPRK IT worker's fabricated identity and credentials are the initial-access vector rather than a technical exploit.
Both actor:bismarck-dprk-cybercrime (new) and the already-tracked actor:purpledelta North Korean IT-worker cluster are referenced here; Kudelski's own article treats Bismarck as distinct from PurpleDelta rather than as an alias. actions[] is empty: this is a research/awareness finding for HR and identity-vetting process design rather than a technical exposure with a specific patch, hunt or block action; the transferable lesson belongs in the body's defender-facing framing rather than a do-now task list.
We recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed "Bismarck." The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea.
We assess that DPRK actors may have reused IP addresses from the gambling operation because the domains were purchased by the associates rather than by [Bismarck directly].