Chollima Hunter

← DPRK Hunting library

NetKey and OConnect: DPRK Internal-Network Clients on an Endpoint

Windows

IOC Hunt medium DPRK IT Worker Fraud

Process names, install paths and vendor directories for NetKey and OConnect, which Flare assesses are used to authenticate to North Korean internal networks, with the internal URL paths that accompany them.

What this hunt looks for

Flare's infiltrator research records two applications, NetKey and OConnect, on machines it assesses belong to North Korean IT workers, and says both are highly likely used to authenticate operators to North Korean internal networks. Neither appears to be sold commercially. They are Windows products, so this hunt covers Windows endpoints only.

The strongest artefact is the install directory: Flare records vendor folders STN Corp and rb corp in Program Files (x86). Flare also documents two internal web applications whose URL paths, such as machine_info_new or a netkey_id parameter, can be searched; their private addresses are deliberately not listed. IP Messenger is weaker, supporting evidence only.

Chollima Group's October 2024 analysis of infostealer logs from five DPRK IT worker sets found NetKey on every one, v4.0 and v4.1 on four Khabarovsk hosts and v5.0 on a Hong Kong host, and assesses it as the utility that authenticates access to Kwangmyong, North Korea's intranet. It does not mention OConnect, STN Corp or rb corp.

Technique
Valid-account misuse through fraudulent employment (MITRE ATT&CK T1078), with operator-side tooling for authenticating to attacker-controlled infrastructure (T1133) and reconnaissance of that infrastructure over internal web applications (T1083).
Data sources
EDR process-execution telemetry, Windows Security event log (4688), Sysmon (Event ID 1), Installed-software inventory and registry Uninstall keys, osquery, Proxy and web-server logs
Last updated
2026-10-04

Indicators

The atomic values this hunt matches on, listed separately from the queries so they can be lifted into tooling that speaks none of the query languages below. Every value here is reported by one of the sources cited at the foot of this page.

TypeValueNote
File path C:\Program Files (x86)\STN Corp\OConnect 5.7\OConnect.exe Recorded by Flare on a machine it assesses belongs to a North Korean IT worker. The vendor directory is what makes this high-fidelity, so match on the path rather than on the executable name alone.
File path C:\Program Files (x86)\STN Corp\OConnect 6.0.0\OConnect.exe As above, for the 6.0.0 install.
File path C:\Program Files (x86)\rb corp\oconnect 5\NetKey.exe The NetKey binary installed under a second vendor directory, rb corp, in a folder named for OConnect. Flare records the two products shipping alongside one another.
Vendor directory STN Corp, rb corp The two Program Files (x86) vendor folders Flare observed. A directory named for either is the anchor for this hunt: neither corresponds to software a corporate estate would normally hold.
Process name NetKey.exe Observed running on machines Flare assesses belong to North Korean IT workers. Weaker on its own than the full path, and worth corroborating against the install location.
Process name OConnect.exe As above. OConnect is a generic enough name that a bare process match needs the vendor directory to confirm it.
Installed application NetKey 4.0, NetKey 4.1, NetKey 5.0, NetKey 5.1 Flare records 4.1, 5.0 and 5.1 as installed on operator machines. Chollima Group independently records 4.0 and 4.1 on four hosts and 5.0 on a fifth, from infostealer logs captured in 2020 and 2021, which is where 4.0 comes from. Useful against software-inventory data where process telemetry has not been retained.
Installed application OConnect 5.3, OConnect 5.5, OConnect 5.7, OConnect 5.9.3, OConnect 6.0.0 The OConnect versions Flare records as installed.
URL path /machine_info_new, /machine_info, /network_reports, /blocked_urls Paths on the internal application Flare calls the RB Site, whose page is titled Add Machine Info. The private address that served them is not listed; generic paths Flare also records, such as login, user and payment, are omitted because they match most web applications.
URL path /register-form?netkey_id=, /register-port, /register-service Paths on the NetkeyRegister application, which Flare observed on port 8000. The netkey_id parameter ties it to the NetKey client; generic paths such as register, change-password and upload are omitted.
Software IP Messenger (IPMsg) Open-source, serverless local-network messaging application Flare records as a communication tool among these operators. Legitimate software with ordinary uses, so supporting evidence only.

Logic

Every query below implements these steps, so the same hunt returns the same result in each product.

  1. Collect: process starts on Windows endpoints, installed programs through osquery, and proxy requests
  2. Match: a process runs from an STN Corp or rb corp folder, or is named NetKey.exe or OConnect.exe (the bare names are weaker)
  3. Match: or an installed product, vendor or publisher is NetKey, OConnect, STN Corp or rb corp (software inventory)
  4. Match: or a request URL holds an internal application path (/machine_info, /network_reports, /blocked_urls, netkey_id=, /register-port)
  5. Report: devices with the signals seen, first and last time, newest first

Queries

Defender / Sentinel KQL

Written for this site, from indicators reported by Flare, Chollima Group

One row per device across process, software-inventory and proxy records, where a process from a vendor directory is the strongest hit and the inventory rows carry no time.

// NetKey and OConnect: process, software inventory and proxy signals, reported per device
union
  (DeviceProcessEvents
   | where Timestamp > ago(90d)
   | where FolderPath contains @"\STN Corp\"
        or FolderPath contains @"\rb corp\"
        // optional: other vendors also use the names NetKey and OConnect
        or FileName in~ ("NetKey.exe", "OConnect.exe")
   | project Timestamp, DeviceName, Signal = "process", Detail = FolderPath),
  (DeviceTvmSoftwareInventory
   | where SoftwareName has_any ("NetKey", "OConnect") or SoftwareVendor has_any ("STN Corp", "rb corp")
        // optional: IP Messenger is legitimate open-source software, supporting evidence only
        or SoftwareName has_any ("IP Messenger", "IPMsg")
   | project Timestamp = now(), DeviceName, Signal = "inventory", Detail = strcat(SoftwareVendor, " ", SoftwareName, " ", SoftwareVersion)),
  (CommonSecurityLog
   | where TimeGenerated > ago(90d)
   | where RequestURL contains "/machine_info"
        or RequestURL contains "/network_reports"
        or RequestURL contains "/blocked_urls"
        or RequestURL contains "netkey_id="
        or RequestURL contains "/register-port"
        or RequestURL contains "/register-service"
   | project Timestamp = TimeGenerated, DeviceName = SourceIP, Signal = "url", Detail = RequestURL)
| summarize Signals = make_set(Signal), Events = count(), Examples = make_set(Detail, 5), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName
| sort by LastSeen desc
Lower-fidelity parts (2)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the `// optional: other vendors` line and the `or FileName in~ ("NetKey.exe", "OConnect.exe")` line below it.
  • the IP Messenger names — IP Messenger is legitimate open-source software and counts only as supporting evidence. Remove: delete the `// optional: IP Messenger` line and the `or SoftwareName has_any ("IP Messenger", "IPMsg")` line below it.

Splunk SPL

Written for this site, from indicators reported by Flare, Chollima Group

Reads the vendor directory from the process command line and the request path from the proxy URL, reporting one row per device.

```index=endpoint holds Windows process events (Security 4688 or Sysmon 1) with the Endpoint fields, index=proxy holds proxy events; the vendor directory is read from the command line because no image-path field is assumed```
(index=endpoint OR index=proxy) earliest=-90d
| eval cmd=replace(lower(process), "\\\\", "/"), proc=lower(process_name), web=lower(url)
| eval signal=case(
    match(cmd, "/stn corp/|/rb corp/"), "process",
    ```optional: other vendors also use the names NetKey and OConnect```
    in(proc, "netkey.exe", "oconnect.exe"), "process",
    match(web, "/machine_info|/network_reports|/blocked_urls|netkey_id=|/register-port|/register-service"), "url",
    true(), null())
| where isnotnull(signal)
| eval detail=coalesce(process, url), device=if(signal="url", src_ip, host)
| stats count AS events values(signal) AS signals values(detail) AS examples min(_time) AS first_seen max(_time) AS last_seen BY device
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen
Lower-fidelity parts (1)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the ```optional: other vendors``` comment and the `in(proc, "netkey.exe", "oconnect.exe"), "process",` line below it.

Sigma

Written for this site, from indicators reported by Flare, Chollima Group

A process-creation rule anchored on the vendor directories and a proxy rule for the internal application paths, so the proxy rule needs a source mapped to c-uri.

title: NetKey or OConnect Execution From a DPRK-Associated Vendor Directory
id: 6f1c9a24-3d70-4a1e-9c58-0b2e7d4a51c3
status: experimental
description: >
  Execution from the STN Corp or rb corp vendor directories that Flare records
  NetKey and OConnect installing under, applications Flare assesses are used to
  authenticate North Korean IT workers to internal DPRK networks, and execution
  of either binary by name.
references:
  - https://flare.io/learn/resources/north-korean-infiltrator-threat
  - https://chollima-group.io/posts/analysis-of-it-worker-logs
logsource:
  category: process_creation
detection:
  selection_path:
    Image|contains:
      - '\STN Corp\'
      - '\rb corp\'
  # optional: other vendors also use the names NetKey and OConnect
  selection_name:
    Image|endswith:
      - '\NetKey.exe'
      - '\OConnect.exe'
  condition: 1 of selection_*
falsepositives:
  - Unrelated software sharing the OConnect or NetKey name; confirm against the install directory
level: high
---
title: Request to the Internal Applications Flare Records Beside NetKey
id: a4d8e2b6-7c13-5f90-b6e4-3a1c9d5f7e28
status: experimental
description: >
  A proxy request whose path matches the RB Site or NetkeyRegister applications
  Flare documents, such as machine_info, network_reports, blocked_urls or a
  netkey_id parameter; the private addresses that served them are not listed.
references:
  - https://flare.io/learn/resources/north-korean-infiltrator-threat
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - '/machine_info'
      - '/network_reports'
      - '/blocked_urls'
      - 'netkey_id='
      - '/register-port'
      - '/register-service'
  condition: selection
falsepositives:
  - Other internal applications that use the same path names
level: medium
Lower-fidelity parts (1)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the `# optional: other vendors` comment and the `selection_name` block; `1 of selection_*` needs no change.

CrowdStrike LogScale

Written for this site, from indicators reported by Flare, Chollima Group

Covers the process line only, because Falcon has no software inventory or proxy URL in this field set.

// Falcon has no software inventory or proxy URL in this field set, so only the process line is expressible
#event_simpleName=/^(Synthetic)?ProcessRollup2$/
| (
    ImageFileName=/\\(STN Corp|rb corp)\\/i
    // optional: other vendors also use the names NetKey and OConnect
    or ImageFileName=/\\(NetKey|OConnect)\.exe$/i
  )
| groupBy([ComputerName, aid, ImageFileName], function=[count(as=events), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(last_seen, order=desc)
Lower-fidelity parts (1)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the `// optional: other vendors` line and the `or ImageFileName=/\\(NetKey|OConnect)\.exe$/i` line below it.

Elastic

Written for this site, from indicators reported by Flare, Chollima Group

Each signal is a boolean column and the bare-name match is labelled low fidelity in the result, so it can be dropped without touching the core conditions.

FROM logs-*
| WHERE @timestamp > NOW() - 90 days
| EVAL path = REPLACE(TO_LOWER(process.executable), "\\\\", "/"), proc = TO_LOWER(process.name), web = TO_LOWER(url.original)
| EVAL f_path = path LIKE "*/stn corp/*" OR path LIKE "*/rb corp/*"
| EVAL f_url = web LIKE "*/machine_info*" OR web LIKE "*/network_reports*" OR web LIKE "*/blocked_urls*" OR web LIKE "*netkey_id=*" OR web LIKE "*/register-port*" OR web LIKE "*/register-service*"
| EVAL f_name = proc IN ("netkey.exe", "oconnect.exe")
| WHERE f_path OR f_url OR f_name
| EVAL signal = CASE(f_path, "process", f_url, "url", "low fidelity")
| STATS events = COUNT(*), signals = VALUES(signal), paths = VALUES(path), urls = VALUES(web), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp) BY host.name, source.ip
| SORT last_seen DESC
| LIMIT 100
Lower-fidelity parts (1)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the `| EVAL f_name` line and ` OR f_name` from the `| WHERE` line.

Cortex XQL

Written for this site, from indicators reported by Flare, Chollima Group

Counts process starts per host and image path, and has no software inventory or proxy URL to match the other lines.

config case_sensitive = false
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and (
            action_process_image_path contains "\\STN Corp\\"
         or action_process_image_path contains "\\rb corp\\"
         // optional: other vendors also use the names NetKey and OConnect
         or action_process_image_name in ("NetKey.exe", "OConnect.exe")
         )
| comp count() as events, min(_time) as first_seen, max(_time) as last_seen by agent_hostname, action_process_image_path
| sort desc last_seen
Lower-fidelity parts (1)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the `// optional: other vendors` line and the `or action_process_image_name in ("NetKey.exe", "OConnect.exe")` line below it.

osquery

Written for this site, from indicators reported by Flare, Chollima Group

Checks running processes, the two vendor directories and installed programs on hosts without an EDR agent.

SELECT 'process' AS signal, p.name AS name, p.path AS detail
FROM processes p
WHERE p.path LIKE '%\STN Corp\%' OR p.path LIKE '%\rb corp\%'
   -- optional: other vendors also use the names NetKey and OConnect
   OR lower(p.name) IN ('netkey.exe', 'oconnect.exe')
UNION ALL
SELECT 'directory' AS signal, path AS name, path AS detail
FROM file
WHERE path IN ('C:\Program Files (x86)\STN Corp', 'C:\Program Files (x86)\rb corp')
UNION ALL
SELECT 'program' AS signal, name, publisher || ' ' || version || ' ' || install_location AS detail
FROM programs
WHERE name LIKE '%NetKey%' OR name LIKE '%OConnect%' OR publisher LIKE '%STN Corp%' OR publisher LIKE '%rb corp%'
   -- optional: IP Messenger is legitimate open-source software, supporting evidence only
   OR name LIKE '%IP Messenger%' OR name LIKE '%IPMsg%'
Lower-fidelity parts (2)
  • the bare process names NetKey.exe and OConnect.exe — other vendors also use these names, so the vendor directory is the real anchor. Remove: delete the first `-- optional: other vendors` line and the `OR lower(p.name) IN (...)` line below it.
  • the IP Messenger names — IP Messenger is legitimate open-source software and counts only as supporting evidence. Remove: delete the second `-- optional: IP Messenger` line and the `OR name LIKE '%IP Messenger%' OR name LIKE '%IPMsg%'` line below it.

False positives and tuning

A vendor directory named STN Corp or rb corp holding these binaries is close to unambiguous; a bare name is weaker, since other vendors use NetKey and OConnect, so check the install path.

NetKey rests on two independent sources and a leaked receipt naming Pyongyang Internet Communications; OConnect and the vendor paths rest on Flare alone, which states the purpose as highly likely, not confirmed.

Hunt on machine_info_new, network_reports, blocked_urls and netkey_id. The research shows where these binaries were found, not what they do when run.

IP Messenger is legitimate open-source software and supporting evidence only. Flare's private addresses are not indexed: reserved ranges exist on countless networks.

Sources

Tuning required before use This hunt is a starting point. Adapt the queries to your schema, validate them against your baseline and tune them for the false positives noted above. Indicators go stale as operators rotate hosts.