Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns

North Korean threat actors Lazarus and Kimsuky are operating a globally interconnected infrastructure—reusing open directories, credential theft toolkits, FRP tunnels, and certificates—that reveals consistent, trackable patterns across their espionage and financial campaigns.