#ParsedReport #CompletenessMedium
20-09-2026

North Korea’s Hangro Revisited

https://blog.synapticsystems.de/north-koreas-hangro-revisited/

Report completeness: Medium

Actors/Campaigns:
Bluenoroff
Andariel
Kimsuky
Uac-0184

Threats:
Fog_ransomware
Dead_drop_technique

Victims:
North korean trade representatives, North korean government communications

Industry:
Telco, Education, Healthcare

Geo:
Korea, North korea, Northkorea, North korean, Dprk, Korean, Chinese, North koreas, China, Japanese, Russian, Deutsche, North koreans

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1102.002, T1105, T1132.001, T1567.001

IOCs:
IP: 22
Domain: 14
Hash: 1
Email: 1
File: 1

Soft:
angro Re, Hangro, HangroVPN, SoftEthers, gro.net, Hangros, OpenSSH, MySQL, HAProxys, JBoss, have more...

Algorithms:
rsa-4096, ecdsa, base64, sha1, sha384, curve25519, sha256

Win API:
Hermit

Win Services:
bits

Languages:
php

Links:
https://github.com/SoftEtherVPN/SoftEtherVPN/blob/master/src/bin/hamcore/DriverPackages/Neo6\_Win8/x86/Neo6\_x86\_VPN.inf
https://github.com/gost-engine/engine