Post

4/ Here is one of the WebMsg users 'Rascal' and their DMs with PC-1234 detailing payment transfers and the use of fraudulent identities from December 2025 through April 2026. All payments are processed and confirmed through the server admin account: PC-1234. Addresses in Hong Kong were used for bills and goods, though the authenticity of it requires further verification.

5/ Since late November 2025 $3.5M+ was received across the payment wallet addresses. The remittance pattern was consistent across users: Users transfer crypto originating from an exchange or service, or convert to fiat via Chinese bank accounts through platforms like Payoneer. PC-1234 then confirms receipt and provides account credentials, varying between crypto exchanges and fintech payment platforms depending on the user.

6/ Using the full dataset I mapped out the complete organizational structure of the network, including payment totals per user and group. The interactive org chart can be accessed here: investigation.io/dprk-itw-brea… Password: 123456 Note: Data range is Dec 2025 through Feb 2026. Payment totals are derived from scraped transaction data and may vary slightly.

7/ Tracing the internal payment addresses revealed links onchain to several attributed DPRK IT worker's from known clusters. The Tron payment address was frozen by Tether in December 2025. Payment addresses: 0xb51DA55047Fd899aD08Ab5CE349823664d311998 TSxYS91qoXrJUoMhWaQfMz9p2b7FTw57L3

8/ Jerry's compromised device shows usage of Astrill VPN and various fake personas applying for jobs. An internal Slack showed 'Nami' sharing a blog post about a DPRK IT worker deepfake job applicant. A second user asked if it was them, while a third noted they aren't allowed to share external links. Another screenshot shows 33 DPRK IT workers communicating on the same network via IPMsg.

9/ Jerry actively discussed stealing from a project with another DPRK IT worker via Nigerian proxy targeting Arcano, a GalaChain game. However, it remains unclear if the attack later materialized. x.com/zachxbt/status/204187354…

10/ The admin sent 43 examples of Hex-Rays/IDA Pro training modules to the group from Nov 2025 to Feb 2026. The trainings covered disassembly, decompilation, local and remote debugging, and various cybersecurity topics. A link sent on November 20 explicitly stated: 'using-ida-debugger-to-unpack-an-hostile-pe-executable'

11/ This cluster of DPRK IT worker activity is less sophisticated compared to groups like AppleJeus and TraderTraitor, which operate far more efficiently and present the greatest risks to the industry. I previously estimated DPRK IT workers generate multiple seven figures per month in revenue, and the data here supports that. Unpopular opinion: threat actors are leaving an opportunity on the table by not targeting low-tier DPRK groups. The risk of repercussions is low, competition is minimal, and the targets are arguably deserving. I plan to continue building out investigation.io with future findings. Special thanks to @domain for helping me purchase two premium domains.

@zachxbt fire song choice 🔥🔥

@zachxbt good stuff once again

@zachxbt Appreciate you

@zachxbt LMAO ends the thread with a cta for scammers x.com/cometcalls/status/204187…

@zachxbt @SoWWhitEE Hey @grok, how many times has @zachxbt written “blocked for AI slop”? Also, what does this suggest regarding the current number of X accounts that have bots writing content?

@drunkd234 blue bands blue bands

@zachxbt wow, great analysis per the usual sir! 🫡 none of this should surprise people though, bad actors all over the place.

@zachxbt lmao this is gold

@zachxbt bro really said "muhahah" 😭

@zachxbt @pudgypenguins 😂😂😂😂

@celestineia @zachxbt I am banned on reddit because of this question

@syntackx @zachxbt You mean retarded because of pumpfun

@bellx_crypto thank you

@zachxbt @SpecterAnalyst x.com/traviswalkerark/status/2…

@zachxbt Amazing work, congrats, well done! 👏

@zachxbt You are always brilliant with your investigations and a real inspiration. Thanks for your work, Zach!

@zachxbt "KYC is not a problem"🙆

@zachxbt @Anthropicary Yeah prefer threads too

@zachxbt I will never forgive u polymarket.com/@bilobilobilo

@zachxbt @pudgypenguins @@inversebrah

@cometcalls Imagine if the govt started weaponizing social engineering scammers like Malone, CX, Trent, Dritan, Danish, etc against low tier DPRK groups

@zachxbt Operation paperclip pt 2

@zachxbt @SpecterAnalyst "And we provide KYC just for 1$ per user "

@zachxbt @launderedfunds 😂

@zachxbt @Anthropicary Because u r old news Crypto was created for scamming plebs Move on m8

@MDSAGORISL19566 TLDR they’re practicing to attack projects/teams

@zachxbt Investigation.io is such a cool domain name Zach!

@payloadartist Thank you. Going to get a proper home page built / host future work on it. Will share the other domain once the ICAAN 60 day period is up.

@SpecterAnalyst song indian scammer inc

@zachxbt @SpecterAnalyst x.com/jesusfuel/status/2041888…

@zachxbt @tayvano_ Bro is gonna get a Kalshi badge 👌

@zachxbt Thank you for this

@chargememan @zachxbt @inversebrah smol help desk customer not happy 😠

@zachxbt @pudgypenguins Zach is North Korean confirmed

@zachxbt @davemerl01 Yeah it required IQ

@FoxtAlpha @payloadartist It’s a joke bc the DPRK ITW pw was 123456

@zachxbt Attention to detail 🫡

@zachxbt @tayvano_ @SpecterAnalyst 😭😭😭😭

@iamgaurangdesai password = 123456

@zachxbt cant make this shit up

@zachxbt x.com/BeamCTO/status/204190288…

@zachxbt @SpecterAnalyst LOL