DPRK Hangro State VPN Infrastructure Exposed: Silibank Mail Relays & Rogue Certificate Hierarchy — OTX Detection Pack

---
title: Network Connection to DPRK Hangro / Silibank Infrastructure
description: Detects DNS resolution or network connection to known North Korean Hangro VPN and mail relay infrastructure identified in OTX pulse 'North Korea's Hangro Revisited'
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - 'silibank.net.kp'
      - 'silibank.com'
      - 'star-co.net.kp'
      - 'hangro'
  condition: selection
fields:
  - query
  - answer
  - Image
falsepositives:
  - Academic DPRK research networks
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1090
---
title: Outbound Connection to DPRK 175.45.176.0/22 Address Space
description: Detects outbound network connections to North Korea's primary allocated IPv4 range used by Hangro VPN and state mail relays
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
detection:
  selection_ip:
    DestinationIp|cidr:
      - '175.45.176.0/22'
  filter_initiated:
    Initiated: 'true'
  condition: selection_ip and filter_initiated
fields:
  - DestinationIp
  - DestinationPort
  - Image
  - User
falsepositives:
  - Threat intelligence research activity
level: critical
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1090.003
---
title: TLS Certificate With Failed Signature Verification - Hangro Certificate Anomaly
description: Detects TLS sessions presenting X.509 certificates with signatures that fail verification, a fingerprint of the Hangro July 2026 and 2024 certificate hierarchies
status: experimental
author: Security Arsenal Threat Intel
logsource:
  product: zeek
  service: x509
detection:
  selection:
    validation_status|contains:
      - 'self signed'
      - 'invalid'
      - 'signature failure'
  filter_issuer:
    certificate.issuer|contains:
      - 'KP'
      - 'Pyongyang'
      - 'silibank'
      - 'star-co'
  condition: selection and filter_issuer
fields:
  - certificate.subject
  - certificate.issuer
  - id.orig_h
  - id.resp_h
falsepositives:
  - Misconfigured internal PKI
level: high
tags:
  - attack.command_and_control
  - attack.t1573
  - attack.t1557

// Hunt: DPRK Hangro infrastructure contact + SoftEther-style TLS VPN behavior
let DprkIPs = dynamic(["175.45.176.21","175.45.176.22","175.45.178.56","175.45.178.57","175.45.177.33"]);
let DprkDomains = dynamic(["mail.silibank.net.kp","mail.silibank.com","smtp.star-co.net.kp"]);
let DprkRange = "175.45.176.0/22";
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (DprkIPs) or ipv4_is_in_range(RemoteIP, DprkRange)
   or RemoteUrl has_any (DprkDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, RemoteUrl, RemotePort;
let DnsHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl endswith ".kp" or RemoteUrl has_any ("silibank","star-co","hangro")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP;
// SoftEther default ports used by Hangro VPN concentrators
let SoftEtherVpn = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort in (443, 992, 1194, 5555)
| where ipv4_is_in_range(RemoteIP, DprkRange)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort;
union NetworkHits, DnsHits
| sort by TimeGenerated desc;
// Run SoftEtherVpn separately for VPN-tunnel-specific hunting

# Hangro / DPRK Infrastructure IOC Hunt - Security Arsenal
# Checks active connections, DNS cache, and certificate store for DPRK indicators

$DprkCidr = "175.45.176.0/22"
$DprkIPs  = @("175.45.176.21","175.45.176.22","175.45.178.56","175.45.178.57","175.45.177.33")
$DprkDomains = @("silibank","star-co.net.kp","hangro",".net.kp")

Write-Host "`n[1] Active TCP connections to DPRK address space..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $DprkIPs -contains $_.RemoteAddress } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
  Format-Table -AutoSize

Write-Host "`n[2] DNS client cache for .kp / Silibank / Star-co entries..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue |
  Where-Object { $d = $_.Entry; ($DprkDomains | Where-Object { $d -like "*$_*" }) } |
  Select-Object Entry, Data, Type | Format-Table -AutoSize

Write-Host "`n[3] Persistent routes or VPN adapters toward DPRK range..." -ForegroundColor Cyan
Get-NetRoute -ErrorAction SilentlyContinue |
  Where-Object { $_.DestinationPrefix -like "175.45.176*" } |
  Format-Table -AutoSize
Get-VpnConnection -AllUserConnection -ErrorAction SilentlyContinue |
  Where-Object { $_.ServerAddress -match "175\.45\.17[6-9]" -or $_.ServerAddress -match "silibank|star-co|hangro" } |
  Format-Table Name, ServerAddress, TunnelType -AutoSize

Write-Host "`n[4] Certificate store check for Hangro-style KP issuers..." -ForegroundColor Cyan
Get-ChildItem -Recurse Cert:\LocalMachine\Root, Cert:\LocalMachine\CA, Cert:\CurrentUser\Root -ErrorAction SilentlyContinue |
  Where-Object { $_.Issuer -match "KP|Pyongyang|silibank|star-co" -or $_.Subject -match "KP|Pyongyang|silibank|star-co" } |
  Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter | Format-List

Write-Host "`n[5] SoftEther client artifacts..." -ForegroundColor Cyan
$SoftEtherPaths = @("$env:ProgramFiles\SoftEther VPN Client","${env:ProgramFiles(x86)}\SoftEther VPN Client","$env:LOCALAPPDATA\SoftEther")
foreach ($p in $SoftEtherPaths) { if (Test-Path $p) { Write-Host "FOUND: $p" -ForegroundColor Red; Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime } }
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "sevpn|softether" -or $_.DisplayName -match "SoftEther" } | Format-Table Name, DisplayName, Status

Write-Host "`nHunt complete. Any hit above = escalate to IR immediately (OFAC compliance + intrusion risk)." -ForegroundColor Yellow