`ttzcloud.com`

ttzcloud.com is a domain that one published source reports in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Frost (@fr0s7_). The report is dated 2023-09-01.

domain Konni RESEARCHER POST

First seen 2023-09-01 · last seen 2023-09-01

Registration

The registry had no record of ttzcloud.com when it was looked up on 2026-10-05: the registration had lapsed or been deleted.

Source

Two posts the researcher tags #APT #Konni, three days apart. The first gives a sample, its C2 domain and the address it resolved to; the second gives another sample and says it uses the same domain.
x.com/fr0s7_/status/1697506531724419277 — Frost (@fr0s7_) · under “Konni samples sharing the ttzcloud.com C2” · published 2023-09-01 · pulled 2026-08-30

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: x.com/fr0s7_/status/1697506531724419277

Frost (@fr0s7_) lists 2 other indicators in this source.