← EtherHiding Tracker

dns1.southafricanorth.cloudapp.azure.com

dns1.southafricanorth.cloudapp.azure.com is a domain that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Sysdig. The reports are dated 2026-10-03.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-10-03 · last seen 2026-10-03

Sources

• Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-06-21, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.

  EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 — Chollima Hunter (on-chain observation) · pulled 2026-10-03

• Value written to the EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8 by operator wallet 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 on 2026-06-21, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.

  EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · pulled 2026-10-03

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0x277852e1c349b03c79e348018a8391bd21c412e8

Chollima Hunter (on-chain observation) lists 12 other indicators in this source. 7 are shown, chosen across types.

• fdffofofofo4.com domain
• kadmecnp-643laolmd.com domain
• lermontov-656idlop.com domain
• lotus-vista-additions-joshua.trycloudflare.com domain
• luxmaxing.southafricanorth.cloudapp.azure.com domain
• opencode-setup-al.com domain
• perrine90-deltajohnsons.com domain

All 13 indicators from this source

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 5 are shown, chosen across types.

• egyptinfo.shop domain
• 193.24.123.68 IP address
• 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 smart contract address
• 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 smart contract address
• 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d cryptocurrency wallet address

All 57 indicators from this source