Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure Across Two Countries

North Korea’s Hangro platform has exposed an unusually detailed view of infrastructure used to connect officials and trade representatives abroad with systems inside the country.

A newly observed TLS certificate listed servers in North Korea and Russia, along with an internal address that should not have appeared in a public-facing certificate.

Hangro is not malware or a conventional cyberattack tool. It is a state-linked VPN client that also includes email and real-time chat functions, reportedly intended for North Korean personnel outside the country.

Its servers provide a rare technical trail into how overseas users may reach domestic services, unlike the North Korean fake worker campaigns that typically rely on stolen identities and commercial remote-access tools.

Malwarebox identified the exposed certificate data while reviewing a newer management layer deployed around July 2026.

Malwarebox said in a report shared with Cyber Security News (CSN) that the finding links a matching service surface in Pyongyang with hosts in Russia’s Far East, while also revealing older infrastructure in Chinese address space.

The discovery does not prove that the platform has been used in a specific intrusion campaign. It does, however, show that certificate mistakes, weak key handling, and exposed network metadata can reveal sensitive infrastructure even when operators attempt to restrict access through client certificates and unusual network ports.

Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure

The certificate presented on port 6006 listed five public addresses: three in North Korea and two in Russia. It also included 100.100.100.170, an address from carrier-grade NAT space that is not publicly routable. Publishing it effectively disclosed part of the deployment’s internal addressing plan.

The same management certificate was observed on 175.45.176.21 in Pyongyang and on both Russian systems, 188.43.136.115 and 188.43.136.116.

The matching certificate, service exposure, and mutual TLS requirement point to a jointly administered environment, although the report stops short of claiming proof of a central control system.

This type of certificate reuse can be valuable to defenders. As seen in earlier reporting on certificate linked DPRK infrastructure, a reused certificate can allow researchers to group servers that would otherwise appear unrelated and monitor them for changes.

The newer service appears more carefully built than Hangro’s older VPN and mail layer. Port 6006 completed a TLS 1.3 handshake and required a client certificate, while services on ports 465 and 7443 returned a bad-signature error. That failure indicates the older servers did not hold private keys matching the certificates they presented.

Broken Keys and Overseas Access

Researchers found that every signature in Hangro’s 2024 certificate chain failed verification, including the root certificate against itself.

The most likely explanation is that private keys in use do not match the public keys embedded in the certificates, though Malwarebox noted that confirming the cause would require access to the signing environment.

That weakness matters because the Hangro client reportedly trusts certificates installed with the software rather than correctly validating their signature chain.

In practical terms, the platform can continue operating despite a certificate setup that normal browsers, mail clients, and many security products would reject.

The report also revisits a Chinese endpoint configured in Hangro clients, 218.25.43.212. Its network registration named a technical contact using a Silibank email address, and related address assignments were tied to the same record.

The evidence supports a DPRK-linked connection in Chinese address space, not ownership of Chinese networks by North Korea.

Organizations monitoring state-linked activity should track the exposed addresses, certificate hashes, unusual TLS ports, and associated domains.

Analysts should also avoid treating a single registry contact as attribution on its own, a restraint that remains important when examining the modular DPRK cyber ecosystem or infrastructure shared with legitimate providers.

For network defenders, the immediate recommendation is to alert on connections to the listed systems, inspect TLS certificates on ports 6006 and 6008, and investigate unexpected traffic involving Hangro-related hostnames.

Certificate transparency, passive DNS, and handshake fingerprinting can help identify new nodes if the operators move or expand the service.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure Across Two Countries appeared first on Cyber Security News.