`AS20485`

AS20485 is an autonomous system number that 17 published sources report in connection with IT Worker Fraud, Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Group, NKInternet, Logpresso, Intelx and Recorded Future. The earliest of those reports is dated 2018-03-16 and the most recent 2026-11-13.

asn IT Worker Fraud KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2018-03-16 · last seen 2026-11-13

Sources

…The infected hosts showing external IPs in Khabarovsk all originated from a /24 range within TransTeleCom (AS20485)'s IP space.…
Sample Blog Post | Chollima Group — Chollima Group · under “The Mysterious Case of NetKey” · published 2024-10-01 · pulled 2026-09-01
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Finding North Korean IT Workers On GitHub | North Korean Internet — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2025-04-24 · pulled 2026-09-01
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things | North Korean Internet — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2026-04-07 · pulled 2026-09-01
…analysis of the 66 extracted IP addresses revealed a significant concentration within a specific Russian telecommunications provider. AS20485 Joint Stock Company TransTeleCom (Russia): 7 IP addresses, 11 associated email accounts TransTeleCom is a major backbone…
[Logpresso CTI] DPRK Remote IT Worker OSINT Analysis Report | Logpresso — Logpresso · under “Key Finding 5: Russian ISP TransTeleCom Identified as Core Infrastructure” · published 2026-03-10 · pulled 2026-09-01
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
More Fake Devs, More Fake Companies: vexxloso and Nixsora.com | North Korean Internet — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2026-04-26 · pulled 2026-09-09
…취업자들의 취업 활동이 이루어지는 주된 사이클로 판단합니다. 핵심 발견 5: 러시아 TransTeleCom이 핵심 인프라입니다 IP 66개를 ASN 기준으로 분류한 결과, 특정 러시아 통신사 ASN이 큰 비중임을 확인했습니다. AS20485 Joint Stock Company TransTeleCom (러시아): 7개 IP, 11개 이메일 계정 연결 TransTeleCom은 러시아의 주요 백본 통신 사업자입니다.…
[로그프레소 CTI] 북한 IT 인력 위장 취업 OSINT 분석 보고서 | 로그프레소 — Logpresso · under “핵심 발견 5: 러시아 TransTeleCom이 핵심 인프라입니다” · published 2026-03-09 · pulled 2026-09-12
…3, 2019 at 16:00 UTC. North Korea currently has 2 existing uplinks, one via China (AS4837 China Unicom Backbone) and another via Russia (AS20485 Closed Joint Stock Company TransTeleCom).…
North Korea just got a 3rd internet connection (and no one noticed) — Intelx · under “North Korea just got a 3rd internet connection (and no one noticed)” · published 2019-04-11 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Additional Notes on the Trevor Greer Infostealer Logs — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2025-12-16 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Exploring the North Korean Email Client: Features and Functionality — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2024-09-13 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
What We Discovered On a North Korean Server Part 1 — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2025-06-16 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
DPRK Captive Portal Infrastructure Found in Testing — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2026-05-26 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Hunting For North Korean Fiber Optic Cables — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2025-12-08 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Hangro: Investigating North Korean VPN Infrastructure Part 2 — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2025-07-16 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Hangro: Investigating North Korean VPN Infrastructure Part 1 — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2025-01-06 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Hato Tsusin: A Long-Forgotten DPRK Front Company Hiding in Plain Sight? — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2026-07-28 · pulled 2026-09-12
…as we identified back in April , the 175.45.176.0/22 range is routed by both China Unicom ( AS4837 ) and Russia’s TransTelekom ( AS20485 ).…
Shifting Patterns in Internet Use Reveal Adaptable and Innovative North Korean Ruling Elite — Recorded Future · under “Background” · published 2018-03-16 · pulled 2026-09-12
…– Ryugyong-dong 175.45.176.0/24 175.45.177.0/24 175.45.178.0/24 AS134544 – Cenbong Int’l Holdings Limited AS20485 – Joint Stock Company TransTeleCom Kwangmyong DNS Requests Software Media Documents Photos Videos…
Made for Export: North Korea’s Software Catalog — NKInternet · under “Insights from Internet Scanning and Open Source Intelligence” · published 2026-03-10 · pulled 2026-09-12

Find this indicator in the index, or see every autonomous system number this site holds under Autonomous system numbers in the browse listing.

Related indicators

Cited by the same report: Sample Blog Post | Chollima Group

Chollima Group lists 27 other indicators in this source. 5 are shown, chosen across types.

All 28 indicators from this source

Cited by the same report: Finding North Korean IT Workers On GitHub | North Korean Internet

NKInternet lists 3 other indicators in this source. 2 are shown, chosen across types.

All 4 indicators from this source

Cited by the same report: npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things | North Korean Internet

NKInternet lists 31 other indicators in this source. 5 are shown, chosen across types.

All 32 indicators from this source