Kudelski Security: North Korean IT-worker infrastructure overlaps a Bismarck-linked gambling-platform operation and the FakeCalls Android banking trojan
A Swiss research lab traces a stealer-log leak into DPRK gambling infrastructure and the fake-IT-worker university pipelines behind it
Analysis
Kudelski Security, a Swiss research lab headquartered in Cheseaux-sur-Lausanne, reconstructs connections between North Korean state-linked cybercrime and fake-IT-worker operations via a stealer-log leak. An actor the researchers designate "Bismarck," linked to DPRK-run gambling platforms, reused infrastructure that overlaps with the FakeCalls Android banking trojan (previously documented by Check Point targeting South Korean banking customers via voice-phishing app impersonation): "we recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed 'Bismarck.' The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea" (Kudelski Security, 2026-08-12). Kudelski assesses that DPRK actors may have reused IP addresses from the gambling operation because the domains were purchased by associates rather than by Bismarck or other North Korean operatives.
Separately, a DPRK-affiliated manager's own WinSCP credential vault (stolen in a 2021 leak) held access to historical Emotet botnet loader infrastructure, and cross-referencing that infrastructure's later reuse ties it into a loader role for subsequent campaigns. The investigation names operational bases and identifies university-affiliated IT-worker pipelines at named North Korean technical universities, plus organisational entities supporting fake IT-worker placement across multiple countries, directly relevant tradecraft for this constituency's HR and identity-vetting teams screening remote-hire pipelines, where a DPRK IT worker's fabricated identity and credentials are the initial-access vector rather than a technical exploit.
Kudelski does not relate Bismarck to any previously named North Korean IT-worker cluster: its report names Bismarck, several DPRK universities and the "Base" system, and makes no comparison to other tracked clusters either way. This is a research/awareness finding for HR and identity-vetting process design rather than a technical exposure with a specific patch, hunt or block action.
Cited evidence
We recently observed a stealer log leak involving an actor linked to the DPRK, nicknamed "Bismarck." The actor used two IP addresses that overlap with indicators of compromise (IOCs) documented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea.
We assess that DPRK actors may have reused IP addresses from the gambling operation because the domains were purchased by the associates rather than by “Bismarck” or other North Korean operatives.
Updates2
Kudelski's report does not distinguish Bismarck from the PurpleDelta IT-worker cluster, because it never mentions PurpleDelta. This entry previously presented that distinction as the source's own analytic position. The report names Bismarck, the DPRK universities behind it and the "Base" system, and draws no comparison to any other tracked cluster (Kudelski Security, 2026-08-12). Whether Bismarck overlaps an existing cluster is therefore an open question, not one this reporting answers.
Kudelski's explanation for the infrastructure overlap is hedged, and this entry stated it more firmly and more narrowly than the report does. The report says: "We assess that DPRK actors may have reused IP addresses from the gambling operation because the domains were purchased by the associates rather than by “Bismarck” or other North Korean operatives" (Kudelski Security, 2026-08-12). The analysis above now carries that wording instead of "most plausibly" and "Bismarck directly". The overlap itself is unchanged.
Sources1
Revision history
- Published 2026-08-28T0409Z-intel
- Correction 2026-08-30T1312Z-audit
This entry said Kudelski's report treats Bismarck as distinct from the already-tracked PurpleDelta IT-worker cluster rather than as an alias. Kudelski's report never mentions PurpleDelta at all, so it makes no such judgement in either direction, and presenting a silence as a stated analytic position is a claim the source does not support. Replaced with what the report does and does not say.
Changed: body
- Correction 2026-09-29T2134Z-audit
The analysis stated Kudelski's explanation for the infrastructure overlap more firmly and more narrowly than Kudelski does. Kudelski says DPRK actors "may have" reused the gambling operation's IP addresses because associates, rather than Bismarck or other North Korean operatives, bought the domains. The analysis and the evidence quotation now carry that wording, and the 2026-08-30 correction cites the report under its publication date of 2026-08-12. The sourcing note no longer describes the quotes as redacted, since they are now verbatim.
Changed: evidence sourcing_note body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.