https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn