Trend Micro links Void Dokkaebi, also tracked as Famous Chollima, to North Korea aligned cybercrime activity routed through Russian IP ranges assigned around Khasan and Khabarovsk. The infrastructure is hidden behind VPN, proxy, VPS and RDP layers and is used to reach job platforms, collaboration tools and cryptocurrency services. Trend Micro assesses that DPRK IT workers connect through these ranges from countries including China, Russia and Pakistan, while related activity targets software professionals with fake cryptocurrency and Web3 job interviews. The reporting also ties the cluster to Beavertail command and control setup material and wallet password cracking activity, showing how DPRK operations combine remote worker fraud, malware delivery and crypto theft infrastructure.