North Korea’s Hangro VPN and mail platform has deployed a new certificate hierarchy that exposes an apparent cross-border management environment spanning systems in Pyongyang and Russia’s Far East.
The certificate’s Subject Alternative Name field lists the platform’s publicly exposed servers alongside a carrier-grade NAT address, offering an unusual glimpse into how the service may be addressed internally.
The new infrastructure surfaced around July 2026 on TCP port 6006, operating alongside Hangro’s older, technically flawed 2024 certificate chain.
The VPN leak exposes internal network architecture and infrastructure fingerprints, giving defenders valuable intelligence.
The Russia–North Korea overlap suggests shared infrastructure, but does not prove common operational control.