Validin pivots from Huntress-reported BlueNoroff infrastructure tied to a targeted Web3 intrusion that used Telegram and a fake Zoom extension to compromise a cryptocurrency organization. The investigation starts with support[.]us05web-zoom[.]biz, which often resolved to 8.8.8.8 but briefly exposed patterns that led to related Zoom-, meeting-, and conference-themed domains across multiple TLDs. DNS history, host connections, RDP certificates, and HTTP certificate pivots linked the cluster to IPs including 23.254.247[.]53, 23.254.247[.]32, and 23.254.244[.]248, some previously associated with DPRK activity. The research expands the suspected BlueNoroff campaign from one lure domain to nearly 200 likely related domains and hundreds of subdomains, giving defenders infrastructure patterns for proactive tracking of fake meeting-extension operations.