CYFIRMA research
From North Korean Phishing to Underground Online Hosting Services (Konni campaigns) · (no date on page)
Since the beginning of 2022 CYFIRMA and 3rd party researchers alike have been observing a few of the same domains below repeatedly used in Konni Campaigns by suspected APT37 from North Korea.