Autonomous system numbers

25 autonomous system numbers reported in published sources on North Korean (DPRK) cyber operations, ordered by value. Each value links to its own page, which carries every source that reported it and the text around it. Other types are listed in the browse directory.

ValueCampaignFiled underSources
AS131279 IT Worker FraudDPRK (cluster unattributed) 14
AS133073 DPRK (cluster unattributed) 1
AS134544 IT Worker FraudDPRK (cluster unattributed) 12
AS135377 Kimsuky 2
AS14956 Contagious InterviewLazarus GroupAPT38 2
AS16276 Contagious Interview 1
AS174 Lazarus Group 1
AS20473 APT38Kimsuky 3
AS20485 IT Worker FraudKimsukyDPRK (cluster unattributed) 17
AS23470 Contagious Interview 1
AS29073 Lazarus Group 1
AS30377 KimsukyDPRK (cluster unattributed)Lazarus Group 1
AS3741 Lazarus Group 1
AS396073 Contagious Interview 1
AS399629 Konni 1
AS400897 APT38 1
AS44476 Konni 1
AS44477 Contagious Interview 1
AS45996 Kimsuky 2
AS47583 Contagious Interview 1
AS4837 DPRK (cluster unattributed) 2
AS54290 APT38Contagious Interview 4
AS6698 APT38 1
AS8359 IT Worker FraudContagious Interview 2
AS9341 IT Worker FraudDPRK (cluster unattributed) 12
Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Compromised packages and repositories name victims. See the sourcing methodology.