Kudelski Security: North Korean IT-worker infrastructure overlaps a Bismarck-linked gambling-platform operation and the FakeCalls Android banking trojan
A Swiss research lab traces a stealer-log leak into DPRK gambling infrastructure and the fake-IT-worker university pipelines behind it
Analysis
Kudelski Security, a Swiss research lab headquartered in Cheseaux-sur-Lausanne, reconstructs connections between North Korean state-linked cybercrime and fake-IT-worker operations via a stealer-log leak. An actor the researchers designate "Bismarck," linked to DPRK-run gambling platforms, reused infrastructure that overlaps with the FakeCalls Android banking trojan (previously documented by Check Point targeting South Korean banking customers via voice-phishing app impersonation): "we recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed 'Bismarck.' The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea" (Kudelski Security, 2026-08-12). Kudelski assesses the infrastructure reuse most plausibly reflects that the gambling-operation domains were purchased by DPRK associates rather than by Bismarck directly.
Separately, a DPRK-affiliated manager's own WinSCP credential vault (stolen in a 2021 leak) held access to historical Emotet botnet loader infrastructure, and cross-referencing that infrastructure's later reuse ties it into a loader role for subsequent campaigns. The investigation names operational bases and identifies university-affiliated IT-worker pipelines at named North Korean technical universities, plus organisational entities supporting fake IT-worker placement across multiple countries, directly relevant tradecraft for this constituency's HR and identity-vetting teams screening remote-hire pipelines, where a DPRK IT worker's fabricated identity and credentials are the initial-access vector rather than a technical exploit.
Kudelski does not relate Bismarck to any previously named North Korean IT-worker cluster: its report names Bismarck, several DPRK universities and the "Base" system, and makes no comparison to other tracked clusters either way. This is a research/awareness finding for HR and identity-vetting process design rather than a technical exposure with a specific patch, hunt or block action.
Cited evidence
We recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed "Bismarck." The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea.
We assess that DPRK actors may have reused IP addresses from the gambling operation because the domains were purchased by the associates rather than by [Bismarck directly].
Updates1
Kudelski's report does not distinguish Bismarck from the PurpleDelta IT-worker cluster, because it never mentions PurpleDelta. This entry previously presented that distinction as the source's own analytic position. The report names Bismarck, the DPRK universities behind it and the "Base" system, and draws no comparison to any other tracked cluster (Kudelski Security, 2026-08-26). Whether Bismarck overlaps an existing cluster is therefore an open question, not one this reporting answers.
Sources1
Revision history
- Published 2026-08-28T0409Z-intel
- Correction 2026-08-30T1312Z-audit
This entry said Kudelski's report treats Bismarck as distinct from the already-tracked PurpleDelta IT-worker cluster rather than as an alias. Kudelski's report never mentions PurpleDelta at all, so it makes no such judgement in either direction, and presenting a silence as a stated analytic position is a claim the source does not support. Replaced with what the report does and does not say.
Changed: body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.