Kaspersky Securelist
IT Threat Evolution: Q3 2013 (DPRK-related paragraph 6) · 2013-11-14
Third – two email addresses to which bots send reports on status and transmit infected system information via attachments – iop110112@hotmail.com and rsh1213@hotmail.com – are registered with the following “kim” names: “kimsukyang” and “Kim asdfa”. Even though this registration data does not provide hard data about the attackers, the source IP addresses of the attackers fit the profile: there are 10 originating IP addresses, and all of them lie in the Jilin Province Network and Liaoning Province Network in China. The ISPs providing Internet access in these provinces are also believed to maintain lines into parts of North Korea.