Tracking DPRK operator IPs over time

This post highlights one of my neatest discoveries from tracking FAMOUS CHOLLIMA malware on npm. It is a pretty substantial oversight on their part, or perhaps they just don’t care!

If you’re interested in other minor opsec failures, check out part 1 and part 2.

FAMOUS CHOLLIMA typically uses Gmail or Outlook to register npm accounts, so imagine my excitement when, in mid 2025, I started seeing unique domains being used to publish malicious packages.

Between July 2025 and February 2026, aside from Proton, Gmail, and Outlook, FAMOUS CHOLLIMA used the following domains to register npm users and subsequently publish malicious packages:

ℹ️ Note

The table above is annotated with the associated temporary email service, where applicable.

Notably, they have also used dedicated domains like shabakinc.com, which purports to be a digital services provider and is still active.

To take an example, on 18 November 2025, npm user nastiagoman (nastiagoman[@]dsantoro.es) published npm package chai-status, which was a simple downloader that pulled a remote payload from jsonkeeper[.]com and evaluated it. See the sample on the dprk-research site or download the whole package tgz.

Actual malware aside, the domain dsantoro.es previously pointed its MX record to emailfake.com (it has since been updated).

Simply by visiting hxxps://emailfake[.]com/nastiagoman[@]dsantoro.es, anyone can see the mailbox.

I was able to check their mailbox directly to reveal their active IP of 216.227.145[.]218, which is an exit IP for Astrill VPN. Astrill VPN has consistently been used by FAMOUS CHOLLIMA, most recently reported by GitLab in their knockout report on North Korean adversary operations on their platform.

Following FAMOUS CHOLLIMA’s IPs over time

Unfortunately, I didn’t have the time or patience to set up the automated pipeline to identify these temp mailboxes and subsequently monitor them automatically, so the indicators below are all from screenshots or notes I took over time. I also lost much of my evidence as my laptop was stolen last year (was it you, North Korea?).

Below is an incomplete history of IP addresses and activities. These are high-confidence indicators for their given time periods.

💬 Comment

The China Unicom IP 203[.]160[.]80[.]72 is consistent with Gitlab’s observation of this ASN, however the geolocation differs.

The Russian IP 62[.]33[.]223[.]164 geolocated in Moscow, Russia, is also consistent with behaviour observed in GitLab’s report. However, in GitLab’s instance, the user was solely reported operating under the IT Worker workstream.

It is possible these two IPs represent de-anonymised operator source IPs.

Overall, this IP spread is relatively small over an extended period, indicating lax operational security.

Other sign-up activity observed

FAMOUS CHOLLIMA also used these temp mailboxes for other operational procedures.

For example, topflite9[@]freyaglam.shop, who published several malicious npm packages under the username topflite9 from September 2025 to December 2025, also signed up to HireLatam under the name “Olena” (screenshot below). HireLatam connects U.S. companies with pre-vetted remote professionals across marketing, finance, technology, and more, according to their website.

On 23 January 2026, flyjack2[@]tandlplith.se signed up to bayt.com under the name “Daniel.” Bayt is the leading job site in the Middle East and North Africa, according to their own website.

💬 Comment

The sign-up events highlighted above are highly likely for the purposes of identifying potential targets for their fake recruitment scam and supports the assessment that the malware operators are almost certainly responsible for other parts of the killchain in FAMOUS CHOLLIMA’s Contagious Interview operations.

Which temp email services have this privacy flaw?

OSINT and threat intel numpties might be curious about automating the snooping methodology here, and this is something I don’t have the interest in pursuing but I did spend some time looking at temporary mail services.

It turns out several temporary email services are actually just reskins of the same underlying infrastructure, and they all (currently) point to the same IP addresses of 91.196.52[.]205:

• generator.email
• emailfake.com
• email-temp.com
• tempm.com
• mail-temp.com
• email-fake.com
• mail-fake.com

This cluster of email services are all subject to the same privacy flaw where you can plug the email address into the URL and view the inbox.

The SMTP banner for 91.196.52[.]205 advertises mx.add5000[.]com, which is also present on two other IPs: 37.115.109[.]158 and 37.115.26[.]54. Ostensibly any temp mail services associated with these IP addresses are subject to the same flaw. Other temporary mail services tend to have secret tokens to protect mailboxes.

Hunting and blocking temp mail sign-ups

My main question throughout this is — why hasn’t npm blocked temporary email sign ups? Any sign-up from a temp mail provider is going to be highly suspicious, and there is abundant historical evidence of abuse.

In fact, temporary email services are a real trouble for any public subscription platform. A cursory search on GitHub reveals hundreds of repositories offering “free” access to LLM services by automating temporary email issuance.

Email is an area where observables like IP addresses can be highly actionable and those IOCs will tend to have a longer shelf-life than domains.

Collating the IP addresses associated with the top temp mail services returned by a Google search is an achievable goal that would significantly minimise attack surface from temp mail.

A contrived implementation would be:

1. Receive user sign-up
2. Check MX record
3. If that MX record’s IP resolves to my list of temporary mail infrastructure, reject user sign-up and return a 403 status.

In terms of historical impact assessment, you can hunt for outbound registration mail to those services using the same logic as above.

For instance, if I saw that registration[@]kmsec-awesome-intel-service.uk sent an email to 91.196.52[.]205, I know that user was using a temp mail service to sign up and is a high risk user whose activity is worth reviewing on my platform.

ℹ️ Note

As mentioned in RFC5321 Section 5, if an MX record is omitted, email senders will attempt delivery to the A record of the domain itself

For example, I could set up a working temporary mailbox by setting the A record for kmsec.uk to a temp mail server’s IP address.

Just something to keep in mind if you’re hunting for domains that use temp mail.

I will leave curation of temp mail IOCs in your hands, however I will share some fingerprints (Shodan queries, naturally) that I used. Some of these services rotate IPs more regularly than others:

So this is my call to action for any service provider out there with blind email sign-up. Do something!

Assessment

By publishing this piece, I possibly have burnt this intelligence source, however some of the historical IOCs are important to share and are highly relevant to any developer or recruitment-focussed service. It is highly likely that FAMOUS CHOLLIMA will continue to leverage the same anonymising services like hide.me and Astrill in the long term.

Closing thoughts

This was a major achievement for someone like me who is just watching FAMOUS CHOLLIMA from the sidelines. It just goes to show how much is waiting to be found out there.

Appendix

I wanted to share one more screenshot of the mailboxes, as this one demonstrates the pace of FAMOUS CHOLLIMA’s malware operations:

On that day, 30 October 2025, eleven npm packages attributed to FAMOUS CHOLLIMA were published.

If you made it this far, thanks for reading!