Silent Push reports that Lazarus-linked operators, including Contagious Interview or Famous Chollima and DPRK fake IT worker actors, continue to use Astrill VPN to mask their locations. Infrastructure and logs acquired from Contagious Interview showed Astrill references during setup testing, and Silent Push identified 27 unique Astrill VPN IP addresses tied to those records. The post also connects the pattern to prior Mandiant, Recorded Future, and BlueNoroff research, including Bybit-themed infrastructure and Astrill IPs observed around Lazarus activity.