`AS20473`

AS20473 is an autonomous system number that 3 published sources report in connection with APT38 and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist and Break Glass Intelligence. The earliest of those reports is dated 2022-12-27 and the most recent 2026-04-04.

asn APT38 Kimsuky MATCHED IN SOURCE

First seen 2022-12-27 · last seen 2026-04-04

Sources

…offerings.cloud 172.86.121.130 HIVELOCITY AS29802 www.capmarketreport.com 149.28.247.34 The Constant Company, LLC AS20473 ms.msteam.biz www.onlinecloud.cloud 155.138.159.45 The Constant Company, LLC AS20473 The actor usually used fake domains…
BlueNoroff introduces new methods bypassing MoTW | Securelist — Kaspersky Securelist · under “Infrastructure” · published 2022-12-27 · pulled 2026-09-12
…phishing URLs All published in our STIX bundle and raw text files Indicators of Compromise Primary IP 158.247.219.150 (Vultr, AS20473) Sequential Pattern auth-umblog[1-98]s.dynv6.net (98 active subdomains) Detection Detection rules and IOCs: YARA rules…
850 Hostnames, 6 Servers, 1 Kill Chain: Mapping Kimsuky's 2026 Korean Credential Harvesting Machine — Break Glass Intelligence · under “Primary IP” · published 2026-04-04 · pulled 2026-09-12
…The campaign has been running since November 2025 across 7 rotating Vultr VPS nodes in France , all on AS20473, with 51 memo transactions posted to the dead-drop wallet over roughly four months.…
Lazarus Group is Using the Solana Blockchain as a Dead-Drop C2 Channel -- and Nobody Noticed for 4 Months — Break Glass Intelligence · under “TL;DR” · published 2026-03-16 · pulled 2026-09-12

Find this indicator in the index, or see every autonomous system number this site holds under Autonomous system numbers in the browse listing.

Related indicators

Cited by the same report: BlueNoroff introduces new methods bypassing MoTW | Securelist

Kaspersky Securelist lists 8 other indicators in this source. 5 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: 850 Hostnames, 6 Servers, 1 Kill Chain: Mapping Kimsuky's 2026 Korean Credential Harvesting Machine

Break Glass Intelligence lists 1 other indicator in this source.

Cited by the same report: Lazarus Group is Using the Solana Blockchain as a Dead-Drop C2 Channel -- and Nobody Noticed for 4 Months

Break Glass Intelligence lists 11 other indicators in this source. 6 are shown, chosen across types.

All 12 indicators from this source