`AS14956`

AS14956 is an autonomous system number that 2 published sources report in connection with Contagious Interview, Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from SafeDep and Jumpsec. The earliest of those reports is dated 2026-04-02 and the most recent 2026-07-24.

asn Contagious Interview Lazarus Group APT38 MATCHED IN SOURCE

First seen 2026-04-02 · last seen 2026-07-24

Sources

…(tracked as Famous Chollima, UNC5342, DeceptiveDevelopment, and Sapphire Sleet by various vendors). C2 hosting on RouterHosting/Cloudzy (AS14956): The C2 IP 216.126.237.71 is hosted on AS14956 (RouterHosting LLC, operating as Cloudzy), documented by FOFA as Contagious Interview’s…
Malicious npm Package express-session-js Drops Full RAT Payload - Real-time Open Source Software Supply Chain Security — SafeDep · under “Campaign Attribution: Contagious Interview (DPRK/Lazarus)” · published 2026-04-02 · pulled 2026-09-12
…45.61.163.113 Microsoft typosquat secure.inteam.live 45.61.163.113 Subdomain of inteam.live cluster IP Addresses (all AS14956 RouterHosting LLC / Cloudzy) IP PTR Record 144.172.110.53 53.110.172.144.static.cloudzy.com 144.172.115.16…
Inside a DPRK BlueNoroff ClickFix Kit — Jumpsec · under “IP Addresses (all AS14956 RouterHosting LLC / Cloudzy)” · published 2026-07-24 · pulled 2026-09-12

Find this indicator in the index, or see every autonomous system number this site holds under Autonomous system numbers in the browse listing.

Related indicators

Cited by the same report: Malicious npm Package express-session-js Drops Full RAT Payload - Real-time Open Source Software Supply Chain Security

SafeDep lists 6 other indicators in this source.

Cited by the same report: Inside a DPRK BlueNoroff ClickFix Kit

Jumpsec lists 19 other indicators in this source. 6 are shown, chosen across types.

All 20 indicators from this source