Silent Push linked fresh Lazarus infrastructure to the February 2025 Bybit theft, including bybit-assessment[.]com, which it says was registered hours before the $1.4 billion heist. The domain's WHOIS data tied it to trevorgreer9312@gmail[.]com, a persona and GitHub identity also seen in earlier BlueNoroff research. Analysts pivoted from api.nvidia-release[.]org and Tayvano's public research into active infrastructure, found 27 Astrill VPN IPs in test records, and described continued fake job-interview lures aimed at cryptocurrency users.