Wired • 1h
Counter-Intelligence Operation Against North Korean State-Sponsored APT Infrastructure
Security researcher Vangelis Stykas conducted an active defense operation by infiltrating the command-and-control (C2) infrastructure of North Korean state-sponsored threat actors. Through two years of persistent access to adversary servers, Stykas exfiltrated internal databases, C2 configurations, and victim lists, revealing hundreds of compromised networks worldwide. The operation uncovered a significant "visibility gap," demonstrating that current industry telemetry drastically underestimates the scale of North Korean espionage and financial theft. The breach provided direct access to the actors' custom toolsets, persistence mechanisms, and lateral movement logs across diverse sectors including finance, defense, and cryptocurrency.