WatchTowr describes a research project that registered expired domains embedded in old web shells and used them to observe compromised hosts reporting back to abandoned backdoor infrastructure. The researchers say more than 4,000 live backdoors checked in, including systems tied to governments and universities in several countries. The post frames abandoned callback domains in attacker tooling as an infrastructure-takeover weakness that can let a third party inherit access originally obtained by other intruders. It does not attribute the exposed web shells or compromised hosts to a specific DPRK actor.