Ransom-ISAC and Bridewell examined infrastructure from a suspected DPRK-linked cryptocurrency and data theft attempt that began with a weaponized private GitHub repository and used blockchain-based command-and-control. The intrusion involved a Python dropper using an HTTP API C2 channel over port 27017 and a Loader/RAT using HTTP API and socket.io channels over ports 27017 and 443. Four C2 IPs were tied to the activity, including 23.27.20[.]143, 136.0.9[.]8, 166.88.4[.]2, and 23.27.202[.]27, with shared traits such as EmbedIO/3.5.2 server headers, unusual cache-control headers, and specific keep-alive behavior. The infrastructure fingerprinting is useful because these rare service configurations and port choices can help defenders cluster related activity without relying solely on earlier attribution assumptions.