← All actor clusters

ndocs0link.dns.army

ndocs0link.dns.army is a domain that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Break Glass Intelligence. The report is dated 2026-03-12.

domain Kimsuky MATCHED IN SOURCE

First seen 2026-03-12 · last seen 2026-03-12

Source

• …MMC Console File ID 1225e4fe-5c83-4d7f-a643-606b18e5f890 Network Indicators # C2 Domains (defanged) ndocs0link.dns.army a7f3q.v6.navy 3tg8i.dns.army link-nid-log.oq7n2.dynv6.net link-nid-log.oc9bk.dynv6.net elecviews85.dynv6.net mhjjh.dynv6.net # C2 IPs…

  Kimsuky's Five-Stage GrimResource Loader: When an MMC File Becomes a Shellcode Injector — Break Glass Intelligence · under “Network Indicators” · published 2026-03-12 · pulled 2026-09-12

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: Kimsuky's Five-Stage GrimResource Loader: When an MMC File Becomes a Shellcode Injector

Break Glass Intelligence lists 28 other indicators in this source. 12 are shown, chosen across types.

• AS135377 autonomous system number
• AS45996 autonomous system number
• 3tg8i.dns.army domain
• a7f3q.v6.navy domain
• elecviews85.dynv6.net domain
• 253d232e1485e7e60ff3380999412c773d0a9a14 file hash
• 66126fa42accfb183f72e25b20750b97 file hash
• 95f4954ad79fa972bfd4fe217608ed5216c674e8ae6662cb8ffb31dbed50ec63 file hash
• f239e3fedc4926ff3cf58f95bacff9d8f11289e58036ed507ab3f435dce1b2b1 file hash
• 152.32.139.149 IP address
• 152.32.243.178 IP address
• 152.32.243.215 IP address

All 29 indicators from this source