- Company
Silent Push Inc. ©2025
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors
KEY FINDINGS
- Multiple threat actors from North Korea’s Lazarus Group continue to use Astrill VPN to hide their IP address during attacks, as of February 24, 2025.
- Recent infrastructure and logs acquired from the North Korean threat group “Contagious Interview,” also known as “Famous Chollima,” confirmed ongoing use of the Astrill VPN during infrastructure testing processes.
- Silent Push analysts recently confirmed details originally released by Google’s Mandiant in September 2024, indicating the DPRK Fake IT worker threats also continue to use Astrill VPN to hide their IPs from prospective employers.
- Silent Push analysts have developed a “Bulk Data Feed” of all the Astrill VPN IPs our team has mapped—updated in real time—that our customers can utilize to protect against any threats, whether North Korean or otherwise, when using our service.
Background
Silent Push analysts have been tracking North Korean hacking groups for years. We share private feeds and reports with clients, doing our best to make details public whenever it won’t compromise ongoing tracking efforts.
Our most recent research focused on the Lazarus subgroup Contagious Interview, also known as Famous Chollima. We explained there how we acquired some of their infrastructure, including log details from both the malicious operators and their victims.
Within these logs, we saw numerous references to a virtual private network (VPN) called “Astrill VPN” (astrill[.]com) that we have been tracking for some time.
We soon heard from several research sharing partners, who separately confirmed both Contagious Interview’s usage of Astrill VPN and the DPRK Fake IT workers’ continued use of this provider.
For months, it’s been public that attackers from Lazarus Group—from several of their subgroups—prefer to use the Astrill VPN to obfuscate their location during attacks.
Google’s Mandiant released details on September 23, 2024 about the DPRK fake IT worker threats and noted, “Connections to these remote management solutions primarily originated from IP addresses associated with Astrill VPN, likely originating from China or North Korea.”
And more recently, in February 2025, Recorded Future’s Insikt Group released additional details on DPRK IT worker scams, writing, “Insikt Group tracks PurpleBravo (formerly Threat Activity Group 120 [TAG-120]), a North Korean-linked cluster that overlaps with the “Contagious Interview” campaign, which primarily targets software developers in the cryptocurrency industry. …Insikt Group found evidence that PurpleBravo uses Astrill VPN to manage its command-and-control (C2) servers.”
Sign Up for a Free Silent Push Community Account
Register now for our free Community Edition to use all of the tools and queries mentioned in this blog.
Test Logs Confirm Lazarus Subgroup “Contagious Interview” Still Using Astrill VPN IPs
Silent Push Threat Analysts found a domain registered hours before the $1.4 billion ByBit heist – “bybit-assessment[.]com” – which had WHOIS records showing the email address “trevorgreer9312@gmail[.]com,” was used to register the domain. That email address had been found and documented in Tayvano’s GitHub repo, “BlueNoroff Research,” which is the public name of another Lazarus APT subgroup.
Details from Tayvano’s “BlueNoroff Research” folder also include two Astrill VPN IP addresses that were apparently used in the attack: “104.223.97[.]2 (an Astrill VPN IP), and 91.239.130[.]102 (also Astrill).”
After our team found this new domain that aligned with previous Lazarus research, we were able to make additional pivots (previously described in our public post) to acquire some of their infrastructure, which included admin and victim logs.
Within those logs, our team discovered and then shared 27 unique Astrill VPN IP addresses linked to test records created while configuring their setup, further confirming they heavily favor this VPN.
Astrill VPN IP Bulk Data Feed
In this post, Silent Push is sharing a sample list of some active IP addresses in our Bulk Data Feed that are used by Astrill VPN to support ongoing efforts within the community to track VPN tools utilized by North Korean APT groups. Our enterprise users have access to a feed containing many times this number, with more being added in real time as our investigation continues.
Here is the sample list of IP addresses:
- 103.130.145.210
- 104.129.22.2
- 113.20.30.139
- 134.195.197.175
- 167.88.61.250
- 169.38.132.135
- 169.57.129.31
- 172.93.100.166
- 172.96.141.172
- 185.108.128.54
Continuing to Track Astrill VPN
Our team continues to track Astrill VPN and will report our findings to the security community as we identify new developments around North Korean and other threat actors utilizing them as a resource.
We will also continue to share our research on threats we discover with law enforcement. If you have any tips about threat actors engaging in criminal activities, our team would love to hear from you.
Mitigation
While not all domains associated with Astrill VPN are malicious, Silent Push believes all domains associated with North Korean threat actors using VPNs – the Lazarus Group in particular – represent some level of risk.
Our analysts have constructed a series of Silent Push IOFA™ Feeds that provide a growing list of Indicators of Future Attack™ focused on scams supported by this technique as well as on North Korean APT groups, which are all available to our enterprise customers.
Silent Push Indicators of Future Attack™ (IOFA™) Feeds are available as part of an Enterprise subscription. Enterprise users can ingest IOFA™ Feed data into their security stack to inform their detection protocols or use it to pivot across attacker infrastructure using the Silent Push Console and Feed Analytics screen.
Register for Community Edition
Silent Push Community Edition is a free threat-hunting and cyber defense platform that offers advanced offensive and defensive lookups, web content queries, and enriched data types.
Click here to sign up for a free account.
Silent Push Events: Q1 2025
Adversaries don’t stand still, and neither do we…
It’s a new year. That means a new set of attack vectors to analyse and combat, so that we’re always able to provide a solution which takes into account evolving attacker TTPs, and reveals unknown threat infrastructure as it’s being set up.
We’re on a constant mission to make sure that organizations are aware of our approach to preemptive threat intelligence, and the value of an TTP-led cyber defense strategy. One of the ways we achieve this is to remain active within the cyber intelligence community across the yearly event schedule.
The Silent Push team has been busy throughout Q1 disseminating our research in global events, and revealing how the latest trends in cyber attacks are being formulated and launched, so that security teams are best placed to locate and stop them.
Monaco FIRST Regional Symposium Europe, January 14-16
Held at the beautiful Le Méridien Beach Plaza, the FIRST Regional Symposium was a unique setting for exchanging ideas with cybersecurity experts around the globe, bringing together national incident response centers (CERTs), and private and academic sectors.
At the event, our Senior Threat Analyst, Zach Edwards, gave a well-attended talk entitled “Investigating Triad Nexus and Pivoting from a Pig Butchering Investment Scam Website into an Entire Malicious Network”, based off our research into the Triad Nexus published late last year.
You can view Zach’s presentation here.
Our investigation into the FUNNULL CDN has revealed an enormous cluster of malicious infrastructure and exposed the pivotal role it plays in facilitating a wide array of cyber-criminal activities, many of which are orchestrated by Chinese Triad groups.
Zach’s talk also made it into local news coverage. Included was our findings on the various criminal networks involved, and how threat hunters can map them, and look at the various retail phishing scams hosted on FUNNULL CDN that target some of the world’s largest brands.
SANS CTI Summit, Jan 27-28
SANS events are a great way for cybersecurity professionals to obtain fresh perspectives and insights from leading practitioners in the field, in the form of case studies, innovative techniques, and practical solutions designed to challenge assumptions and deepen a security teams’ understanding of any given problem.
Our Solutions Engineer, Noah Plotkin, was on-hand to talk to attendees about how Indicators of Future Attack (IOFAs)™ achieve all of this and more, by allowing teams to proactively locate the 98% of threat infrastructure lurking under the surface that isn’t being tracked by the industry at any given time.
IOFA™ solve a huge problem faced by security teams worldwide, who are forced into a reactive security stance by using stale lists of post-breach IOCs that only indicate where an attack has BEEN, rather than where it’s coming FROM.
Cyber Policy Awards Dinner, Feb 6-8
Next up was our sponsorship of the Cyber Policy Awards Dinner, held at the US Chamber of Commerce in February, which recognized members of the cyber policy community whose work shaped the cybersecurity landscape in 2024.
The Silent Push Leadership Team – including our CEO Ken Bagnall, Chief Customer Officer, Brad Arnold, and Chief Revenue Officer, David Troha – chatted with senior policy leaders, veteran cyber experts, and eminent members of the industry about how our IOFA™-led approach is enabling security teams to re-think their cyber defense strategies and pivot towards preemptively locating attacker infrastructure.
Congratulations to all the award winners! We’ll see you again in 2025.
RISE Finland, Feb 10-12
Regional Information Security Events (RISE) are centered on threat intelligence, cybercrime and general cyber security issues, with a range of TLP Amber and TLP Red case studies for attendees to take in and use to inform their own security postures.
This year, RISE Finland was held on a cruise ship – the Tallink Silija Symphony – where our Director of Sales Engineering, Maulik Limbachiya, and Solutions Engineer, Noah Plotkin, delivered a workshop on how to use Silent Push IOFA™ to unmask the APT group Sapphire Sleet, including advanced detection of North Korean-sponsored threats to the cryptocurrency community.
Our Threat Analyst team has recently published a TLP Amber report on Sapphire Sleet, available to Enterprise users, that performs a deep dive into the North Korean APT group’s use of hosting providers to evade detection.
Attendees were extremely interested in the value that Silent Push provides security teams in their quest to identify emerging APT and stop attacks before they’re launched, and as always, had lots of questions on what the platform is capable of and how it could be used within their own organizations.
ITSDI Partner Summit, Feb 11
In February we hosted a preemptive threat intelligence summit with Information Technology Security Distribution (ITSD) – a cybersecurity reseller in the Philippines with over 90 years combined experience in the information and communications technology industry.
Chief Customer Officer, Brad Arnold, and Senior Director APJ, Anthony Ng, provided an exclusive platform preview to 40 partner companies that demonstrated how Silent Push exposes attacker behavior before a strike occurs using IOFA, and showed how security teams can use the platform to block unknown attacks, stop breaches, and avoid financial loss.
The partnership between ITSDI and Silent Push represents a commitment to providing cutting-edge solutions, and we’re confident that IOFA™ will revolutionize how APJ partners protect their organizations.
Come meet us at the FS-ISAC Summit, Mar 9-12
Let’s connect in New Orleans at the upcoming FS-ISAC Americas Spring Summit.
This year’s theme is Safeguarding Trust. With a track on intelligence, attendees will be exploring ways to better defend their organizations. We’re looking forward to those conversations and sharing how we expose threat actor infrastructure as it’s being set up using IOFA™.
It’s going to be a great opportunity to meet with our customers in the global financial industry, and getting to know new security leaders.
Let’s set up a time to meet at the event. Contact us below, and note the day and time that is best for you.
Silent Push Pivots into New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to $1.4B ByBit Hack and Past Attacks
Key Findings
- Silent Push analysts have managed to acquire sensitive infrastructure used by the Lazarus Advanced Persistent Threat (APT) Group.*
- We discovered the Lazarus APT Group registered the domain bybit-assessment[.]com a few hours before the historic $1.4 billion Bybit crypto heist. This domain is connected to the email address trevorgreer9312@gmail[.]com, which was used in previous Lazarus attacks.
- The name “Lazaro” was identified in the logs as part of a test entry that the threat actors created, which appears to allude to the Lazarus Group.
- Our team discovered 27 unique Astrill VPN IP addresses in the logs linked to test records created by Lazarus members while configuring their setup, further confirming they heavily favor this VPN.
- Fake job interviews continue to be used to lure victims on LinkedIn to download malware.
On further investigation, it appears the ByBit heist was conducted by the DPRK threat actor group known as TraderTraitor, also known as Jade Sleet and Slow Pisces—whereas the crypto interview scam is being led by a DPRK threat actor group known as Contagious Interview, also known as Famous Chollima. Due to both groups targeting ByBit, our team was able to pivot from one campaign into the other, and eventually acquire infrastructure from the Contagious Interview group.
After publishing, our team continued to review the files we had acquired and eventually discovered a file containing brands that Lazarus appears to be impersonating. We’re exposing those brands publicly to help warn those companies and anyone applying for jobs with those brands. They include:
Stripe, Coinbase, Binance, Block, Ripple, Robinhood, Tether, Circle, Kraken, Gemini, Polygon, Chainalysis, KuCoin, eToro, Bitstamp, Bitfinex, Gate[.]io, Pantera Capital, Galaxy, Bitwise Asset Management, Bitwise Investments, BingX, Gauntlet, XY Labs, YouHodler, MatChain, Bemo, Barrowwise, Bondex, Halliday, Holidu, Hyphen Connect, and Windranger.
*Note: Full details will soon be available to our enterprise users in an upcoming report.
Background
The North Korean state-sponsored cyber threat, Lazarus Group, has been attributed to the Reconnaissance General Bureau and has been active since at least 2009. North Korean group definitions have significant overlap, and some reports simply include all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters (or subgroups), such as APT37, Andariel (APT45), APT38, or Kimsuky (APT43) individually.
Following news of Lazarus Group successfully compromising “ByBit” with the largest crypto theft in history, our team redoubled its efforts to hunt for any new infrastructure being utilized, quickly discovering much more than is publicly available.
Lazarus Compromised ByBit
ZachXBT was the first to flag the crypto heist, with credible details connecting it to Lazarus Group. Arkham crypto intelligence put out a bounty on the morning of February 21, 2025, asking for any researchers to confirm who was behind the ByBit attack. Just hours later, ZachXBT submitted details, and Arkham confirmed, “His analysis, based on on-chain transactions, wallet movements, and historical Lazarus tactics, techniques, and procedures (TTPs), provided early warning signs linking the attack to North Korean cyber operations and reinforcing existing intelligence assessments.”
Initial Intelligence
Silent Push analysts immediately began combing through everything our team had seen associated with Lazarus Group and any Democratic People’s Republic of Korea (DPRK) threat actors over the last few months that could have been associated with the ByBit campaign, looking for new leads. On December 28, 2024, X/Twitter user Tayvano issued a warning about “nasty malware,” which aligned with past DPRK attacks of complex hiring lures focused on targeting crypto users.
Twitter Thread Provides Useful Lazarus Pivots & Important Context
The late December thread included a screenshot that embedded a hostname “api.nvidia-release[.]org,” and our threat research team was able to use this to pivot into new infrastructure. More details can be found below.*
Through the X/Twitter post, we discovered that Tayvano also created a GitHub repository to share in relation to additional research details. We created several queries based on the information from Tayvano’s GitHub and discovered the campaign is still ongoing.
*Note: Our threat analysts have noticed malicious actors routinely change their infrastructure and tactics based on the details included in our public blog posts, so we have omitted many of the key details needed to circumvent detection from this post as well as the true extent of our discoveries for operational security reasons. Enterprise customers have access to IOFA™ feeds that enable easy blocking of all associated Lazarus APT infrastructure and will soon have access to an in-depth report containing all of our research and the methodologies we have observed by this actor.
Bybit-assessment[.]com Pivot Leads to “Trevor Greer” Connection Seen in Past Lazarus Attacks
Our team decided to take a holistic look at any fresh infrastructure referencing ByBit, hoping to find new pivots that could be associated with the DPRK theft.
Silent Push Threat Analysts soon discovered that Lazarus had registered the domain “bybit-assessment[.]com” at 22:21:57 on February 20, 2025—mere hours before the $1.4 billion crypto heist.
Looking at this domain’s WHOIS records in our WHOIS Scanner revealed the email address “trevorgreer9312@gmail[.]com,” which was used to register the domain.
This email address trevorgreer9312@gmail[.]com is seen in both the WHOIS data for the “bybit-assessment[.]com” domain as well as the same name, “Trevor Greer,” which has been noted as a Lazarus persona with a unique GitHub account used in previous attacks based on the public research included in Tayvano’s GitHub repo, “BlueNoroff Research.”*
*Note: BlueNoroff is the public name of a Lazarus APT subgroup. Our enterprise customers have access to several IOFA™ feeds that cover this particular subgroup.
Details from Tayvano’s “BlueNoroff Research” folder also mention Trevor Greer, trevorgreer9312@gmail[.]com, github[.]com/trevor9312, 104.223.97[.]2 (an Astrill VPN IP), and 91.239.130[.]102 (also Astrill).
Infiltrating Lazarus APT Infrastructure
Silent Push Threat analysts successfully infiltrated the Lazarus infrastructure associated with this campaign, gathering key intelligence vital to our ongoing investigation. For obvious reasons, we can share very little about this effort and what we found publicly, however we regularly collaborate with law enforcement partners to analyze acquired data, identify those responsible, and mitigate further threats as part of a broader initiative to track, disrupt, and hold malicious actors accountable. What we can share publicly is available below.
During our investigation, interesting details arose from within the files associated with this APT’s infrastructure. Lazarus extensively tests its own configurations, particularly in relation to phishing data. Our analysis reveals that this group repeatedly refined its methods for collecting and transmitting stolen credentials prior to assumed use, suggesting a focus on optimizing the infrastructure and configurations.
The first testing records were found on December 7, 2024; the first IP address on line 46 is from the person submitting the form on 38.170.181[.]10, and the second, 199.188.200[.]35, is the hosted server receiving the data.
We have not detected any ByBit victims within the log files yet, nor have we seen the ByBit domain being weaponized. However the registration of this domain, having been done so soon before the attack, understandably grabbed our attention, and pivots from this intelligence treasure trove helped us find additional infrastructure that wasn’t yet locked down, providing an opportunity to analyze their internal files. This analysis is ongoing, but our team felt it prudent to share what we could as soon as possible.
![Example of Josep@gmail[.]com email address](https://www.silentpush.com/wp-content/uploads/lax-7.png)
Josep@gmail[.]com was matched across more than a dozen lines, which shows the threat actor actively using this email address for testing. We do not believe this email address to be legitimate, given the “test” keyword frequently used in combination with it.
Interestingly, Silent Push Threat Analysts also identified the threat actor wrote “Lazaro” for a test, only a few characters off of the APT group’s name, “Lazarus.”
![Example of the Josep@gmail[.]com email used for testing](https://www.silentpush.com/wp-content/uploads/laz-6-1.png)
As part of this analysis, our team discovered 27 unique Astrill VPN IP addresses in the logs linked to test records created by Lazarus members while configuring their setup, further confirming they heavily favor this VPN. We are sharing these at the end of our post alongside our sample IOFA™ in an effort to help the community proactively respond to this threat. Our enterprise users can expect a TLP: Amber report with full details on our findings later this week, and our public readers can look forward to another Astrill VPN-focused post coming soon.
IP address Pivot Leads to More Domains Likely Part of Lazarus Infrastructure
Our team has connected the IP address 91.222.173[.]30 to Lazarus, which itself connects to several malicious domains.
From February 21st until today, the Lazarus domain bybit-assessment[.]com was mapped with DNS A records to 91.222.173[.]30. The domain also had TXT records referencing this same IP address.
Our analysts parsed all the domains mapped to this IP address, or were referenced in their TXT records, and found a small group of potential false positives. However, we have also confirmed that this IP is associated with yet more crypto scams and interview scams, and we are currently working to associate these domains with Lazarus Group. We’re including many of the domains from these pivots at the end of this blog and encourage organizations to be extremely cautious if interacting with any of them.
Fake Job Interviews Luring Victims to Execute MacOS Malware
Many of the domains seen in this Lazarus research appear to be part of “employment scams”, which are common among North Korean threat actors. The previously discussed domain “api.nvidia-release[.]org”, seen in the Tayvano thread, was also acquired from one of these malicious employment campaigns.
Victims are typically approached via LinkedIn, where they are socially engineered into participating in fake job interviews.
These interviews serve as an entry point for targeted malware deployment, credential harvesting, and further compromise of financial and corporate assets. Here are a few screenshots of the job scams from the malicious Lazarus domain “Blockchainjobhub[.]com” as well as some additional details:
Newer fake interview camera/picture-taking request ploy:
The next screen informs the viewer that their camera and microphone are having problems, stating that their setup access is currently being blocked. The viewer is directed to update their camera drivers with a malicious .sh file (a bash script).
One of the malicious payloads seen in this campaign from the original Twitter thread was also analyzed by DMPdump in their piece “North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign.” This malware teardown is a must-read for technical experts.
Mitigation
Silent Push Threat Analysts recommend organizations use our Enterprise edition to receive the latest Indicators of Future Attack™ (IOFA™) in real-time and enrich them in their security solutions to detect, prevent, and respond to future cyberattacks. Our proprietary analytics and persistent manual reviews match patterns against known malicious examples to ensure our IOFA™ feeds do not contain false positives.
We are continuously searching to uncover emerging threats from APTs, financial crimes, malvertising, and more. Please do not hesitate to reach out if you or your organization are interested in cooperating on research.
Register for a Free Silent Push Community Edition Account
Silent Push Community Edition offers free access to our threat-hunting and cyber defense platform. It features a range of advanced offensive and defensive lookups, web content queries, and enriched data types, including both the Silent Push Web Scanner and Live Scan.
Sample list of IOFA™
Silent Push is sharing a sample list of 20 of the IOFA™ we have associated with active Lazarus APT infrastructure related to this campaign to support ongoing efforts within the community. Our enterprise users have access to an IOFA™ feed currently containing many times this number, with more being added in real time as our investigation continues.
- blockchainjobhub[.]com
- bybit-assessment[.]com
- camdriversupport[.]com
- camtechdrivers[.]com
- easyinterview360[.]com
- gethirednow[.]org
- hiringinterview[.]org
- jobinterview360[.]com
- nvidia-release[.]org
- quickhire360[.]com
- quickinterview360[.]com
- screenquestion[.]com
- skillmasteryhub[.]org
- skill-share[.]org
- talentcompetency[.]com
- talentsnaptest[.]com
- talentview360[.]com
- wilio-talent[.]net
- willoassessment[.]com
- willorecruit[.]com
Unique Astrill VPN IPs included in Lazarus Group infrastructure logs include:
- 104.223.97[.]2
- 104.223.98[.]2
- 107.172.242[.]4
- 107.174.131[.]204
- 155.94.255[.]2
- 189.1.170[.]50
- 194.33.45[.]162
- 198.23.241[.]254
- 199.115.99[.]34
- 204.188.233[.]66
- 208.115.228[.]234
- 209.127.117[.]234
- 23.106.161[.]1
- 23.106.169[.]120
- 23.83.129[.]1
- 38.170.181[.]10
- 38.32.68[.]195
- 38.75.137[.]213
- 45.86.208[.]162
- 66.118.255[.]35
- 70.32.3[.]15
- 70.36.99[.]82
- 70.39.103[.]3
- 70.39.70[.]194
- 74.222.14[.]83
- 77.247.126[.]189
- 91.239.130[.]102
Related Reading
Here are a few more blogs that may interest you: