Inside a Misconfigured North Korean Server: Uncovering Overseas IT Operations
Nick Roy, Martyn Williams
A misconfigured North Korean server discovered earlier this year provided unique insights into the operations of North Korean animators and IT workers stationed abroad. The server's data includes logs, documentation, and animation files for outsourced projects potentially linked to shows like The Octonauts, Iyanu, and Invincible. Beyond animation, it revealed video tours of factories, evidence of overseas shopping activities, new details about internet functionality in North Korea, and software that highlights the conditions under which these workers operate.
Supported by additional research, we’ll explore how North Korean software and cell phones enable these workers to communicate and manage projects under tight restrictions. Insights from separately obtained stealer logs offer further context on the tools and techniques North Korean IT workers use daily. Attendees will gain an understanding of how to identify similar activities and gain a detailed look at the discoveries from the server, providing a deeper understanding of North Korea’s overseas workforce.
Speaker BioS:
Nick Roy lives in Boston with his wife and two cats, enjoys solving math problems on college chalkboards at night, and runs a website dedicated to the city's best dive bars. He works at a security startup and maintains a blog focused on OSINT and North Korea
Martyn Williams is a Senior Fellow at The Stimson Center in Washington, DC, where he works on the 38 North program that analyzes North Korea. He has researched North Korean IT for 20 years and founded the North Korea Tech website."
