`AS54290`

AS54290 is an autonomous system number that 4 published sources report in connection with APT38 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Daylight, N3mes1s, Hunt.io and DCSO. The earliest of those reports is dated 2026-03-31 and the most recent 2026-09-02.

asn APT38 Contagious Interview MATCHED IN SOURCE

First seen 2026-03-31 · last seen 2026-09-02

Sources

…on 2026-01-15) microsmeet.xyz (Created on 2025-11-07) supportzm.com (Created on 2025-06-30) IP Addresses 23.254.130.131 (Hostwinds AS54290) 23.254.204.184 (Hostwinds AS54290) File Paths / File names…
North Korea’s “Prospect Call” Trap: Lazarus Turns Teams Meetings into macOS Credential Theft — Daylight · under “IP Addresses” · published 2026-09-02 · pulled 2026-09-12
…identical User-Agent across 3 years Same libcurl C2 pattern (POST, 60s beacon, Base64 JSON) Same Hostwinds AS54290 infrastructure (same /18 netblock) NukeSped AV classification (Lazarus-exclusive) Developer persona rotation consistent with documented…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “8. Attribution Verdict” · published 2026-03-31 · pulled 2026-09-12
…swaps in clean v4.2.0 stub C2 infrastructure links to TA444/BlueNoroff (DPRK) via shared ETag with known JustJoin server, same Hostwinds AS54290 subnet, and NukeSped malware classification Here is how the whole thing played out. Attack Timeline Here's how the whole thing plays…
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444 — Hunt.io · under “Key Findings” · published 2026-04-01 · pulled 2026-09-12
…This IP is located in AS54290 belonging to Hostwinds LLC.…
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff — DCSO · under “Ties to BlueNoroff” · published 2026-04-02 · pulled 2026-09-12

Find this indicator in the index, or see every autonomous system number this site holds under Autonomous system numbers in the browse listing.

Related indicators

Cited by the same report: North Korea’s “Prospect Call” Trap: Lazarus Turns Teams Meetings into macOS Credential Theft

Daylight lists 7 other indicators in this source. 5 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution

N3mes1s lists 47 other indicators in this source. 4 are shown, chosen across types.

All 48 indicators from this source

Cited by the same report: Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444

Hunt.io lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source