ANY.RUN provides interactive sandboxing and threat intelligence solutions. In this investigation, ANY.RUN Sandboxes were used to safely observe suspected DPRK operatives' activity, and its Threat Intelligence Lookup and Feeds help organizations detect and respond to malicious infrastructure.