`tanesshasamuel@gmail.com`

tanesshasamuel@gmail.com is an email address that 8 published sources report in connection with APT37 and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from AhnLab ASEC, Genians and DTEX Systems. The earliest of those reports is dated 2024-04-22 and the most recent 2025-12-21.

email address APT37 IT Worker Fraud MATCHED IN SOURCE

Listed as tanessha.samuel@gmail.com

First seen 2024-04-22 · last seen 2025-12-21

Sources

Nearby text:

…분석 과정에서 확인된 공격자의 이메일 주소는 다음과 같다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com ASEC에서는 자사 블로그를 통해 악성 바로 가기 파일에 대해 꾸준히 공유해 온 만큼 해당 악성코드의 유포가…
RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장) - ASEC — AhnLab ASEC · under “RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장)” · published 2024-04-23 · pulled 2026-09-11
Nearby text:

…The email addresses of the threat actor identified during the analysis process are as follows. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com Through its blog, ASEC has been consistently sharing…
LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC — AhnLab ASEC · under “LNK File Disguised as Certificate Distributing RokRAT Malware” · published 2024-04-22 · pulled 2026-09-11
…● C2 172.86.115.125 141.164.60.25 mailattachmentimageurlxyz.site imagedownloadsupport.com tianling0315@gmail.com tanessha.samuel@gmail.com 이 글 공유하기 Facebook LinkedIn Email…
K 메신저로 유포된 'APT37' 그룹의 악성 HWP 사례 분석 — Genians · under “6. 침해 지표 (Indicator of Compromise)” · published 2025-02-03 · pulled 2026-09-11
Nearby text:

…Cyber Reconnaissance Activities Attributed to APT37 ,” disclosed five Gmail accounts used by the threat actor. Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on…
Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story) — Genians · under “5-1. Traces of the Threat Actor” · published 2025-05-12 · pulled 2026-09-11
Nearby text:

…식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된…
APT37 위협 배후의 사이버 정찰 활동 분석 — Genians · under “3. 유사 악성프로그램 (Similar malware)” · published 2024-11-05 · pulled 2026-09-12
…위협 배후 연관성 Yandex 클라우드 로그인 계정으로 사용된 tanessha.samuel은 ' 작전명 토이박스 스토리 '에서 식별된 pCloud 가입 계정(tanessha.samuel@gmail.com)과 동일한 사용자 ID를 공유하고 있습니다.…
작전명 아르테미스: HWP 기반 DLL 사이드 로딩 공격 분석 — Genians · under “5-4. 위협 배후 연관성” · published 2025-12-21 · pulled 2026-09-12
Nearby text:

…○ 한편, 2024년 11월 06일 ' APT37 위협 배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인…
한국 국가안보전략 싱크탱크 위장 APT37 공격 사례 분석 (작전명. 토이박스 스토리) — Genians · under “5-1. 위협 행위자(Threat Actor)의 흔적” · published 2025-05-12 · pulled 2026-09-12
Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.
i3 Threat Advisory: Identifying North Korean IT Workers: Key Threat Indicators — DTEX Systems · published 2025-05-14 · pulled 2026-10-26

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장) - ASEC

AhnLab ASEC lists 8 other indicators in this source. 5 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC

AhnLab ASEC lists 8 other indicators in this source. 3 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: K 메신저로 유포된 'APT37' 그룹의 악성 HWP 사례 분석

Genians lists 6 other indicators in this source. 4 are shown, chosen across types.

All 7 indicators from this source