Technical researchers have identified a newly deployed TLS certificate that’s shedding light on North Korea’s once opaque VPN service, Hangro. Analysts found this certificate—used to manage back-end infrastructure—active on servers in both Pyongyang and Russia’s Far East, illustrating an operational overlap that was previously unknown.
What was discovered
The certificate in question appeared around July 2026, running on port 6006. It uses RSA-4096 encryption, is valid through July 2036, and is issued by a root authority named “KEVIN ROOT CA.” Significantly, the certificate’s Subject Alternative Name (SAN) field lists five public-facing systems—three hosted in North Korea and two in Russia. One SAN entry, 100.100.100.170, falls into carrier-grade NAT space and is not publicly routable, suggesting internal addressing leaked into a public-facing certificate. Crucially, the same certificate is used for servers on IP addresses 175.45.176.21, 175.45.176.22, and 175.45.176.32 (North Korea) and 188.43.136.115 and 188.43.136.116 (Russia). Mutual TLS is enforced: clients must present their own certificate to engage with this management layer.
How this differs from Hangro’s older infrastructure
The legacy Hangro setup—including VPN and email services—used in 2024 was built on elliptic-curve certificates for components like SoftEther VPN, Postfix SMTP, and Dovecot mail. Analysts found that the old certificate chain contained cryptographic inconsistencies: many certificates stopped signing correctly when verified against their listed issuers’ public keys. This includes the self-signed root certificate. Handshakes over the older ports often failed signature verification during TLS key exchange.
By contrast, the newer management layer operates cleanly. TLS 1.3 verifications complete successfully, the handshake is valid, and the system then demands a client certificate. These differences suggest that the operators do own the private key tied to the new certificate, while older certificates may have had misconfigurations or missing private keys.
What this reveals—and why it matters
This discovery provides rare insight into DPRK’s VPN architecture. Hangro isn’t merely a generic remote access tool—it combines VPN, email, and chat features and has reportedly been used by trade reps and officials abroad. The fact that servers in Russia are sharing certificates and infrastructure with those in North Korea implies a shared management or provisioning system. The inclusion of an internal-style address further reveals operational exposure, giving clues about internal layout and design practices.
The findings also reflect a technical evolution. Moving from flawed EC-based certificates in 2024 to a robust RSA-4096 TLS 1.3 deployment indicates a generational upgrade. It suggests increasing sophistication in how Hangro is administered—at least for its management segment—even as the VPN/email portions show signs of earlier build problems.
Though certificate reuse across borders isn’t definitive proof of centralized control, the overlapping metadata gives strong technical signals. Whether Russia is simply hosting some Hangro infrastructure or actively co-managing it—those questions remain open. What can be stated is that certificates, SAN entries, ports, IP ranges, and cryptographic behavior together map out building blocks of Hangro’s operational footprint.
This case highlights how certificate metadata—validity dates, issuer fields, SAN entries, etc.—becomes intelligence. Researchers don’t need root access to servers to begin unearthing infrastructure patterns. In environments where secrecy is the norm, even management certificates can leak enough to shed light.
The certificate reuse between Pyongyang and Russian Far East, the internal NAT address leaking into the public SANs, the long-duration cert, the switch to RSA-4096—all offer crucial clues. Watch for future certificate replacements, SAN changes, new client certificate requests, and infrastructure behavior around port 6006. These may indicate further consolidation—or deeper division—within Hangro’s architecture.
