Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure
A misconfigured TLS certificate has inadvertently revealed the operational infrastructure of North Korea's Hangro VPN, exposing servers in North Korea and Russia and offering a rare glimpse into how overseas personnel connect to domestic services.
North Korea's state-linked Hangro platform, a VPN client that also offers email and chat functions for overseas personnel, has exposed a significant portion of its infrastructure due to a misconfigured TLS certificate. The certificate, discovered by Malwarebox, listed servers located in both North Korea and Russia, along with an internal IP address that should not have been publicly accessible. This exposure provides a rare technical trail into how individuals operating outside the country connect to domestic services, a method distinct from typical North Korean phishing and social engineering campaigns.
The certificate, observed on port 6006, detailed five public IP addresses: three in North Korea and two in Russia. Crucially, it also included the internal, non-routable IP address 100.100.100.170, effectively disclosing part of the deployment's internal addressing plan. This same management certificate was found on systems in Pyongyang (175.45.176.21) and on the Russian servers (188.43.136.115 and 188.43.136.116), suggesting a jointly administered environment.
While the discovery does not directly link Hangro to a specific intrusion campaign, it underscores the security risks posed by certificate misconfigurations and weak key handling. Even with access controls like client certificates and unusual network ports, such errors can reveal sensitive operational details. The report notes that certificate reuse, as seen here, can be a valuable tool for defenders, allowing them to group and monitor related servers that might otherwise appear disparate.
Further analysis revealed weaknesses in Hangro's certificate validation. The newer service on port 6006 used TLS 1.3 and required a client certificate, but older services on ports 465 and 7443 returned errors, indicating that their private keys did not match the presented certificates. Alarmingly, the Hangro client itself reportedly trusts installed certificates without rigorous signature chain validation, allowing it to function even with improperly configured certificates that would be rejected by standard security products.
The investigation also revisited a Chinese endpoint (218.25.43.212) previously configured in Hangro clients. Network registration data for this endpoint pointed to a technical contact using a Silibank email address, with related address assignments linked to the same record. This evidence supports a connection to North Korean activity within Chinese address space, rather than direct ownership of Chinese networks by North Korea.
For network defenders, the immediate recommendation is to monitor for connections to the exposed addresses, inspect TLS certificates on unusual ports like 6006 and 6008, and investigate any suspicious traffic involving Hangro-related hostnames. Techniques such as certificate transparency, passive DNS, and handshake fingerprinting can aid in identifying new nodes if the operators decide to relocate or expand the service.
Indicators of compromise (IoCs) provided include specific certificate hashes, IP addresses associated with North Korean and Russian infrastructure, an internal carrier-grade NAT address, and a Chinese network range. These details are crucial for organizations seeking to detect and defend against potential misuse of this exposed infrastructure.