So far, this amounts to 856 entries with 174 unique user/hostname combinations...we identified a consistent period of downtime for the operators from ~8am to ~1pm UTC (5pm to 10pm Pyongyang time), which suggests that they do have a structured schedule or consistent ‘working hours’.