Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Registration of fake video conferencing domains for spear phishing (e.g. web001-zoom.us, zoomsdk.us, secure-meeting.cloud) · March and April 2025
(MSMT/2025/2, report p. 101 (Annex 2)) Annex 2: “According to an MSMT Participating State, in March and April 2025, DPRK actors associated with CryptoCore purchased registrations for web domains resembling video conferencing websites for use in a spear phishing campaign.” Domains included “web001-zoom.us, zoomsdk.us, secure-meeting.cloud, video-meeting.cloud, secure-meeting.site, secure-meeting.store, video-meeting.online, secure-meeting.xyz, zoom-client.xyz, communicationhub.us, webus05.us, bizmeet.org, bizmeet.pro”.