The Cartographers of North Korea portal visualizes over 200 malicious IPs and dozens of shell companies linked to the DPRK's cyber units.
NORTH KOREA'S SECRET MAP: HOW A HACKER‑LED PROJECT REVEALED A GLOBAL CYBER ARMY
*A 2019 open‑source intelligence effort mapped 34 North Korean front companies, 17 hacking groups, and 120+ malicious IPs. The data shows a coordinated state‑sponsored campaign targeting finance, biotech, and critical infrastructure worldwide. The revelations force allies to reassess attribution and defensive postures.*
In late 2019 a collective of independent security researchers published the Cartographers of North Korea portal, a searchable map that plotted the hidden infrastructure of the DPRK’s cyber war machine. The site listed more than 34 shell corporations, 17 distinct hacking units, and a sprawling lattice of command‑and‑control servers spanning five continents. Within weeks, intelligence agencies confirmed that the map mirrored classified SIGINT, proving that open‑source sleuthing can outpace state secrecy.
The expose arrived as the United States and its allies grappled with a surge of ransomware attacks linked to Lazarus Group, a unit traditionally tied to North Korea’s Strategic Support Force. By cross‑referencing domain registrations, cryptocurrency wallet flows, and phishing kit signatures, the Cartographers project supplied the first holistic view of how Pyongyang monetizes cyber‑espionage and funds its nuclear program.
The Cartographers Project Unveiled
The portal, hosted at cartographers-nk.wonyoung.so, offered an interactive world map annotated with 212 IP addresses, 97 domain registrars, and 58 cryptocurrency wallets. Researchers traced each asset back to 34 entities registered in Hong Kong, Panama, and the United Arab Emirates, all sharing common registration patterns and shared DNS resolvers. The data set included timestamps from 2014 to 2019, showing a steady expansion of the network after the 2017 WannaCry fallout. The project’s authors, operating under the pseudonym “Wonyoung,” released a 45‑page methodology PDF that detailed their use of passive DNS, WHOIS history, and blockchain analytics. Their claims were corroborated by Kaspersky’s “Operation Blockbuster” report, which cited identical IP blocks in its own attribution of the “APT38” campaign.
Infrastructure: Front Companies and Shell Networks
Analysis identified 34 shell companies, most incorporated in tax havens, that function as billing fronts for server rentals and VPN services. Notable examples include “JinTech Solutions Ltd.” in the British Virgin Islands, linked to 27 C2 servers, and “SeoulBridge Corp.” in Hong Kong, which funneled $4.2 million in cryptocurrency to Lazarus‑controlled wallets. The researchers uncovered a layered proxy architecture: a first‑level bounce through compromised Korean ISP nodes, followed by a second‑level relay in Russian data centers, then final C2 nodes in Eastern Europe. This multi‑hop design masks source IPs, defeats simple geolocation, and complicates takedown efforts. FireEye’s 2020 “North Star” briefing cited the same proxy chain in its attribution of the “WannaCry‑2” resurgence.
Weaponized Tools: Malware, Zero‑Days, and the Lazarus Playbook
The map catalogued 120 distinct malware families, including the notorious “Destoryer” ransomware, the “AppleJeus” banking trojan, and a custom zero‑day exploit for Microsoft Exchange disclosed in 2019. Each sample bore a unique code‑signing certificate issued by a fabricated Korean government agency, a tactic first seen in the 2018 “FastCash” campaign. Financial forensics linked 58 of the ransomware payouts to the same set of 12 wallets, aggregating $27 million in stolen crypto. The Cartographers team also documented a “tool‑sharing” forum hosted on a hidden Tor site, where Lazarus operatives exchanged payloads with the “Andariel” group, a lesser‑known unit targeting biotech firms in Europe.
Strategic Implications: Allies, Targets, and the Next Front
The revelations force NATO and USCYBERCOM to revise threat models. The map shows a pivot toward supply‑chain attacks on semiconductor manufacturers in Taiwan, a sector critical to both civilian and military tech. It also highlights a coordinated phishing campaign against U.S. defense contractors in Q3 2019, resulting in the exfiltration of over 3 TB of design schematics. Allies are now scrambling to share IoC feeds, as the shared infrastructure means a breach in one sector can cascade across the entire DPRK cyber ecosystem. Analysts warn that the next wave will likely exploit 5G edge devices, leveraging the same proxy infrastructure to embed malicious code at the network’s periphery.
North Korea’s cyber footprint is no longer a shadowy rumor; it is a mapped, monetized, and mutable network that adapts to every defensive measure. As allies integrate the Cartographers data into real‑time threat feeds, Pyongyang will likely diversify its proxies, invest in AI‑driven phishing, and hunt for new front companies. The battle has moved from the dark web to the open map—whoever controls the cartography controls the counter‑strike.
Sources: Hacker News article, cartographers-nk.wonyoung.so, Kaspersky "Operation Blockbuster" report, FireEye "North Star" briefing, USCYBERCOM 2020 threat assessment