Because they're part of APT45 which has been documented doing this as part of the North Korean military for over a decade now [0][1][2] You can also read the D

Because they're part of APT45 which has been documented doing this as part of the North Korean military for over a decade now [0][1][2] You can also read the DoJ press release if you want [3], but you'll probably be blocked by their WAF as you're based in Russia [0] - https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-korea-digital-military-machine https://cloud.google.com/blog/topics/threat-intelligence/apt... [1] - https://duo.com/decipher/north-korean-apt45-goes-for-the-money https://duo.com/decipher/north-korean-apt45-goes-for-the-mon... [2] - https://malpedia.caad.fkie.fraunhofer.de/actor/apt45 https://malpedia.caad.fkie.fraunhofer.de/actor/apt45 [3] - https://www.justice.gov/usao-mdtn/pr/department-disrupts-north-korean-remote-it-worker-fraud-schemes-through-charges-and https://www.justice.gov/usao-mdtn/pr/department-disrupts-nor...