Chollima Hunter

← EtherHiding Tracker

tklovers.com

tklovers.com is a domain that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-07-09.

DPRK link unconfirmed Unit 42, as reported by Decryption Digest, attributes this campaign to an unidentified actor; no DPRK attribution is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

AddressTransactionTypeRoleMalware familyFirst writtenLast written
0x6e044e19000487c4a6e6af15b4132a5561b5ee1f Etherscan Contract, ethereum mapping contract EtherRAT 2026-07-09 2026-07-09
0x788a5336c0ef70be87619a3c13a43050c426f7ec Etherscan Contract, ethereum mapping contract EtherRAT 2026-07-09 2026-07-09

domain EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-07-09 · last seen 2026-07-09

Registration

Registered2026-07-09
RegistrarTucows Domains Inc.
Expires2027-07-09
Last changed2026-07-09
Statusclient transfer prohibited, client update prohibited

From the registry’s RDAP record for tklovers.com, looked up 2026-10-20.

Source

  • Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://tklovers.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-07-09. The domain was registered on 2026-07-09, the day it was first written, through the same registrar as the campaign's reported fallback domain necropatia.com. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.
    Ethereum transaction 0x579cf4ab66e5d75c7b2ee88cd7b3528ab0ccfea325971048b550ba7247b859ec — Chollima Hunter (on-chain observation) · published 2026-07-09 · pulled 2026-10-20

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.