Researchers tracked three Lazarus-linked RATs to a vast DNS network, uncovering dormant domains, geolocated IPs, and artifacts tied to financial and cryptocurrency sector intrusions.