`opencodeoptlons.com`

opencodeoptlons.com is a domain that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Sysdig. The reports are dated 2026-10-12.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x277852e1c349b03c79e348018a8391bd21c412e8`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-10-12	2026-10-12
`0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-10-12	2026-10-12

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-10-12 · last seen 2026-10-12

Registration

Registered	2026-08-24
Registrar	Dominet (HK) Limited
Expires	2027-08-24
Last changed	2026-10-12
Status	active

From the registry’s RDAP record for opencodeoptlons.com, looked up 2026-10-12.

Sources

Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-10-12, replacing luxmaxing.southafricanorth.cloudapp.azure.com, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. RDAP shows the domain registered on 2026-08-24, a day before opencode-setup-al.com, which the same wallet wrote on 2026-09-06, through the same registrar, Dominet (HK) Limited, with Cloudflare nameservers. The name imitates OpenCode, as that one does. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.
Ethereum transaction 0x9ef8a01937e01878641797f6484370520e66d84a9e3d4fc4c1065d6f55f2a83f — Chollima Hunter (on-chain observation) · pulled 2026-10-12
Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-10-12, replacing luxmaxing.southafricanorth.cloudapp.azure.com, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. RDAP shows the domain registered on 2026-08-24, a day before opencode-setup-al.com, which the same wallet wrote on 2026-09-06, through the same registrar, Dominet (HK) Limited, with Cloudflare nameservers. The name imitates OpenCode, as that one does. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.
EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · pulled 2026-10-12

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 12 are shown, chosen across types.

All 57 indicators from this source