DPRK Tradecraft Evolution: From Email to QR Code to Blockchain

Patrick Duggan · Jan 8, 2026 · 4 min read

The FBI Warning (January 8, 2026)

"As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) codes in spearphishing campaigns."

The technique is called "Quishing"—QR code phishing. Here's why it works:

Traditional Phishing	Quishing
Malicious URL in email body	Malicious URL encoded in QR image
Email security scans and flags URL	QR code is just an image—no URL to scan
Victim clicks on corporate endpoint	Victim scans with mobile phone
Corporate DLP, proxy, EDR all watching	Mobile device has none of that

They're forcing targets off defended infrastructure onto undefended personal devices.

The June 2025 Attack

The FBI documented a specific incident:

Kimsuky sends spearphishing email to a strategic advisory firm
Email invites recipients to a (non-existent) conference
Email contains QR code for "registration"
QR code leads to fake Google login page
Credentials harvested

No malicious attachment. No suspicious URL in the email body. Just an image that your phone happily decodes and opens.

Why This Matters: The Evasion Chain

Email security has gotten better. Defenders improved. So DPRK adapted.

Kimsuky exploited weak DMARC policies to spoof trusted senders
NSA/FBI joint advisory documented the technique
Defense: Organizations hardened DMARC, SPF, DKIM

Email body now clean—no URLs to flag
QR code forces victim to mobile
Bypasses corporate security stack entirely
Defense: ...still emerging

Once inside, DPRK deploys EtherRAT
C2 stored in Ethereum smart contract
Can't be taken down—blockchain is forever
We documented this December 28

The Full Kill Chain

Connect the dots:

┌─────────────────────────────────────────────────────────────────�����
│                    DPRK 2026 KILL CHAIN                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. INITIAL ACCESS                                              │
│     └── Quishing: QR code in spearphishing email                │
│         └── Target: Think tanks, academia, foreign policy       │
│         └── Evasion: Bypasses email security via image          │
│                                                                 │
│  2. CREDENTIAL HARVEST                                          │
│     └── Fake login page (Google, Microsoft, etc.)               │
│         └── Mobile browser—no corporate proxy                   │
│         └── MFA bypass via real-time phishing frameworks        │
│                                                                 │
│  3. PERSISTENCE                                                 │
│     └── EtherRAT deployment                                     │
│         └── C2 stored in Ethereum smart contract                │
│         └── Queries 9 RPC endpoints with consensus voting       │
│         └── Can't be seized, taken down, or poisoned            │
│                                                                 │
│  4. COLLECTION                                                  │
│     └── Intelligence gathering on NK policy                     │
│         └── Credential reuse across accounts                    │
│         └── Lateral movement to high-value targets              │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

This is a mature, evolving operation. They're not script kiddies. They're reading the defensive landscape and adapting faster than most enterprises can patch.

Detection Opportunities

For Quishing (QR Code Phishing)

User training: If an email contains a QR code and asks you to scan it, that's suspicious. Legitimate organizations provide clickable links.

QR code scanning in email gateway: Some advanced email security can now decode QR codes and analyze embedded URLs. Enable it if you have it.

Mobile device management: If your users scan a QR code on a corporate mobile device, MDM should be logging and potentially blocking suspicious domains.

Report suspicious QR codes: Establish clear protocols. "I got an email with a QR code" should trigger review.

For EtherRAT/Blockchain C2

eth_call
eth_getStorageAt
Connections to Infura, Alchemy, Ankr, QuickNode

Your web server should not be talking to blockchain nodes. If it is, you're already compromised.

Check persistence locations:
``
~/.config/systemd/user/*.service
~/.config/autostart/*.desktop
@reboot cron jobs
.bashrc / .profile injections
``

IOCs

EtherRAT Staging (from our December 28 analysis)
```
193.24.123.68
```

React2Shell C2 (used in same DPRK campaign)
```
193.34.213.150
154.89.152.240
107.174.123.91
38.165.44.205
45.76.155.14
216.238.68.169
78.153.140.16
80.64.16.241
2.56.176.35
```

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

Domains
```
gfxnick.emerald.usbx.me
api.qtss.cc
conclusion-ideas-cover-customise.trycloudflare.com
proxy1.ip2worlds.vip
```

The Pattern

DPRK isn't standing still. They're evolving on three fronts simultaneously:

Front	Evolution	Our Coverage
Initial Access	Email → QR code (quishing)	This post
Exploitation	Zero-days within 48 hours of disclosure	Sunday Threat Sweep
Persistence	Traditional C2 → Blockchain C2	DPRK Read Our Math

They read the same research we do. They adapt faster than most defenders. And they're getting better.

Recommendations

Treat QR codes in emails as suspicious by default
Implement phishing-resistant MFA (FIDO2, hardware keys)
Monitor for blockchain RPC traffic from non-blockchain systems
Block the IOCs in this post and our STIX feed
Brief your foreign policy / academic contacts — they're the targets

Get Protected

All IOCs available in machine-readable formats:

STIX 2.1 Feed:
``bash
curl https://analytics.dugganusa.com/api/v1/stix-feed
``

Free. Machine-readable. No enterprise contract required.

Sources

About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed tracks 2,200+ blocked IPs with MITRE ATT&CK attribution. Built on $77/month of Azure Container Apps.

STIX Feed | OTX Profile

Her name is Renee Nicole Good.

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=dprk-tradecraft-evolution-from-email-to-qr-code-to-blockchain