North Korea's Hangro Revisited

This analysis covers updates to Hangro, North Korea's state VPN and mail product, which operates on infrastructure spanning North Korea, Russia, and China. The July 2026 deployment introduced a new certificate hierarchy with cryptographic anomalies, including signature verification failures. The infrastructure includes network assignments linked to Silibank in Chinese address space and Russian Far East networks. Hangro evolved from a commercial email gateway to a certificate-bound VPN service used by trade representatives. The mail systems support bulk transfers with large message limits and intermittent connectivity features.

• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14
• Unmasking DPRK Cyber Threat Actors: Fake IT Worker InfrastructureCampaign2026-04-23