But according to this, all the phone home addresses are generic open proxies that have been well publicised across the Internet and already abused for quite som

But according to this, all the phone home addresses are generic open proxies that have been well publicised across the Internet and already abused for quite some time. None of the proxies listed appear to be in NK, and (to date) no evidence that NK IP addresses were on the other end of those proxies at the time. It's a bit like saying "the attackers used malware which made DNS queries via the IP address 8.8.8.8, which has been used by NK in the past" - if anyone were really building a case on that key evidence, they should prepare to be laughed at.