← EtherHiding Tracker

apollo.australiaeast.cloudapp.azure.com

apollo.australiaeast.cloudapp.azure.com is a domain that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-06-29.

DPRK link unconfirmed Unit 42, as reported by Decryption Digest, attributes this campaign to an unidentified actor; no DPRK attribution is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

domain EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-06-29 · last seen 2026-06-29

Source

• Command-and-control host the EtherRAT fake Microsoft Teams campaign stored on chain: written as https://apollo.australiaeast.cloudapp.azure.com to contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec by the campaign's resolver address on 2026-06-29. The name is a Microsoft Azure virtual machine's public DNS name, so it points at whatever machine holds it now. Recovered by this site's hunt; recorded as a host the malware was pointed at, not one this site has observed serving anything.

  Ethereum transaction 0x68305bd5533917f0a1b724f4f9abcd26373c5bd991e0850b730d10af3274beaf — Chollima Hunter (on-chain observation) · published 2026-06-29 · pulled 2026-10-20

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.