North Korean cybercriminals and overseas IT workers are leveraging Russian digital infrastructure to carry out malicious cyber activities, according to an American-Japanese security company.

In a blog post published on Wednesday, Trend Micro said it has identified five Russian IP ranges linked to a threat cluster it tracks under the name “Void Dokkaebi,” noting that the use of infrastructure outside the DPRK helps its cybercriminals overcome the technical limitations of a national network that only has only 1,024 assigned IP addresses.

Also known as “Famous Chollima” and “UNC5267,” the loosely defined cluster relates primarily to North