`fsecure.centralus.cloudapp.azure.com`

fsecure.centralus.cloudapp.azure.com is a domain that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Hokage Vanguard. The earliest of those reports is dated 2026-05-22 and the most recent 2026-09-30.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x45729d7424d7310a0c041a2906ba95a4bd5ebfca`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-10-01	2026-10-01
`0xa001d3863b138ed523f255f62725ab1ddc82af87`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-10-01	2026-10-01
`0x8a7c8497991dea66910e70979a5961aee347ff50`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-09-30	2026-09-30
`0x8d7e3cc5342439ff28c589a902b685ea4d398c12`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-09-30	2026-09-30
`0xe26c57b7fa8de030238b0a71b3d063397ac127d3`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-09-30	2026-09-30
`0xea4337aa83496f0b91cdcdd8bf2734df9eef1774`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-09-30	2026-09-30

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-05-22 · last seen 2026-09-30

Sources

EtherRAT command-and-control host the operator wrote to the resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 on 2026-09-30. This is an on-chain observation by this site, not a value carried in published reporting. An Azure-hosted name imitating the security vendor F-Secure. It was the operator's current value when this site read the contract on 2026-10-03.
EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 — Chollima Hunter (on-chain observation) · published 2026-09-30 · pulled 2026-10-03
EtherRAT command-and-control host the operator wrote to the resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 on 2026-09-30. This is an on-chain observation by this site, not a value carried in published reporting. An Azure-hosted name imitating the security vendor F-Secure. It was the operator's current value when this site read the contract on 2026-10-03.
EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus — Hokage Vanguard · published 2026-05-22 · pulled 2026-10-03

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3

Chollima Hunter (on-chain observation) lists 14 other indicators in this source. 7 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus

Hokage Vanguard lists 20 other indicators in this source. 5 are shown, chosen across types.

All 21 indicators from this source