rversl.centralus.cloudapp.azure.com
rversl.centralus.cloudapp.azure.com is a domain
that 3 published sources report
in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Sysdig.
The reports are dated 2026-11-04.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x45729d7424d7310a0c041a2906ba95a4bd5ebfca |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-11-04 | 2026-11-04 |
0x6e044e19000487c4a6e6af15b4132a5561b5ee1f |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-11-04 | 2026-11-04 |
0x788a5336c0ef70be87619a3c13a43050c426f7ec |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-11-04 | 2026-11-04 |
0xa001d3863b138ed523f255f62725ab1ddc82af87 |
Etherscan | Wallet, ethereum | owner wallet | EtherRAT | 2026-11-04 | 2026-11-04 |
domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED
Sources
-
Value written on 2026-11-04 both to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca, by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 (transaction 0x322b507895d02a0ec3d650cb118efd215bdd8571d4a8d2a1b730fbfaabe5c1aa), and to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0xef15f033a0e0ded65d99758c30cf4384105e9350df4560d6862e29e71bd764b2). It replaced fsecure.centralus.cloudapp.azure.com and was replaced by tsmpl.centralus.cloudapp.azure.com two days later. An Azure cloudapp.azure.com name in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. This is an on-chain observation by this site, not a value carried in published reporting. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, and the Teams campaign is attributed to an unidentified actor, so this entry carries low confidence and is not itself a DPRK attribution.
Ethereum transaction 0x322b507895d02a0ec3d650cb118efd215bdd8571d4a8d2a1b730fbfaabe5c1aa — Chollima Hunter (on-chain observation) -
Value written on 2026-11-04 both to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca, by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 (transaction 0x322b507895d02a0ec3d650cb118efd215bdd8571d4a8d2a1b730fbfaabe5c1aa), and to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0xef15f033a0e0ded65d99758c30cf4384105e9350df4560d6862e29e71bd764b2). It replaced fsecure.centralus.cloudapp.azure.com and was replaced by tsmpl.centralus.cloudapp.azure.com two days later. An Azure cloudapp.azure.com name in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. This is an on-chain observation by this site, not a value carried in published reporting. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, and the Teams campaign is attributed to an unidentified actor, so this entry carries low confidence and is not itself a DPRK attribution.
Ethereum transaction 0xef15f033a0e0ded65d99758c30cf4384105e9350df4560d6862e29e71bd764b2 — Chollima Hunter (on-chain observation) -
Value written on 2026-11-04 both to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca, by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 (transaction 0x322b507895d02a0ec3d650cb118efd215bdd8571d4a8d2a1b730fbfaabe5c1aa), and to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0xef15f033a0e0ded65d99758c30cf4384105e9350df4560d6862e29e71bd764b2). It replaced fsecure.centralus.cloudapp.azure.com and was replaced by tsmpl.centralus.cloudapp.azure.com two days later. An Azure cloudapp.azure.com name in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. This is an on-chain observation by this site, not a value carried in published reporting. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, and the Teams campaign is attributed to an unidentified actor, so this entry carries low confidence and is not itself a DPRK attribution.
EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.