North Korea’s Hangro VPN and mail platform has deployed a new management certificate across infrastructure in Pyongyang and Russia’s Far East, indicating that the services may be jointly administered across both locations.
The new certificate hierarchy appeared around July 2026 on port 6006. It was found on Hangro servers in North Korea and on two Russian-hosted systems.
Hangro is a North Korean VPN client that also includes email and real-time chat features. It has reportedly been used by North Korean trade representatives and officials working abroad.
The management certificate is identical on servers using the North Korean addresses 175.45.176.21, 175.45.176.22, and 175.45.176.32, as well as Russian addresses 188.43.136.115 and 188.43.136.116.
Its Subject Alternative Name field lists all five public-facing systems. It also includes 100.100.100.170, an address within carrier-grade NAT space that is not publicly routable.
The presence of this internal-style address in a public certificate provides an unusual view of how the Hangro environment may be addressed internally.
The certificate uses a newer RSA-4096 configuration and is valid from July 26, 2026, through July 23, 2036. It is issued by a root certificate named “KEVIN ROOT CA.”
The management interface requires client certificates, preventing unauthenticated users from accessing the service after the TLS handshake.
Hangro Reuses Pyongyang-Russia Certificate
The new management layer differs sharply from Hangro’s older 2024 certificate hierarchy, which supports the VPN and mail services.
The 2024 infrastructure used a chain of EC certificates for the Hangro VPN, Postfix SMTP service, and Dovecot email service.
These certificates were apparently issued within a short time frame and used the same template, suggesting that the VPN and mail components were provisioned together.
However, the older certificate chain contains major cryptographic problems. The signatures of the certificates do not verify against the public keys of their listed issuers.
This failure reportedly affects every certificate in the chain, including the self-signed root certificate. TLS handshakes also show a difference between the old and new systems.
On legacy Hangro mail and VPN ports, servers fail signature verification during key exchange. On port 6006, the newer management layer completes TLS 1.3 certificate verification successfully before requesting a client certificate.
This suggests that the operators possess the correct private key for the new management certificate, while the keys used by the older VPN and mail certificates may not match their published public keys.
Hangro has previously been linked to the SoftEther VPN project. Its Windows network driver retains SoftEther’s “NeoAdapter_VPN” hardware ID, even though the visible adapter name was changed to “HangroVPN Adapter”, synapticsystems said.
The Russian servers are hosted in address space associated with TransTeleCom’s Far East network. The North Korean systems operate from the country’s known 175.45.176.0/22 address range.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
