Hunt.io blog
‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces · 2025-01-14T00:00:00.000Z
While scanning for DPRK-related infrastructure, Hunt researchers identified a server with HTTP response headers consistent with previously reported activity. Further analysis of the IP uncovered a small cluster of domains and a landing page on port 80 referencing 'JustJoin,' a macOS app designed for monitoring Zoom meetings. ... The group often registers domains that mimic legitimate businesses, particularly in the cryptocurrency and fintech sectors, leveraging these deceptive names to support phishing campaigns and malware delivery.