`https://github.com/iconstorages`

https://github.com/iconstorages is a GitHub account that 4 published sources report in connection with Lazarus Group and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from piyokango, Volexity, Cyble and Huntress. The earliest of those reports is dated 2023-03-30 and the most recent 2023-04-02.

github profile Lazarus GroupDPRK (cluster unattributed) MATCHED IN SOURCE removed checked 2026-09-18

Listed as iconstorages

First seen 2023-03-30 · last seen 2023-04-02

removed checked 2026-09-18

Sources

…https://github.com/IconStorages/images )に対して接続を行う。同リポジトリには16個のICO形式ファイルが蔵置されていたが、実際にはICOファイルの末尾にC2接続先の情報が含まれており、先ほどの読み込んだ処理を通じてBase64のデコードとAESによる暗号化の復号を行いC2情報（URL）の取得を行う。なお、どのICO…
3CXのソフトウエア改ざんによるサプライチェーン攻撃についてまとめてみた - piyolog — piyokango · under “3CXのソフトウエア改ざんによるサプライチェーン攻撃” · published 2023-04-02 · pulled 2026-09-11
…to as “ICONIC”, is as follows: Download various files that contain additional code, with names such as icon[0-15].ico , hosted at https://github.com/IconStorages/images/ .…
3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “Stage #1: Supply Chain Attacks – ICONIC” · published 2023-03-30 · pulled 2026-09-11
…cloudeservices.com pbxphonenetwork.com pbxsources.com qwepoi123098.com sbmsa.wiki sourceslabs.com visualstudiofactory.com zacharryblogs.com github.com/IconStorages/images azureonlinestorage.com convieneonline.com Soyoungjun.com URL Malicious URL…
Cyble - A Comprehensive Analysis Of The 3CX Attack — Cyble · under “Indicators of Compromise (IOCs)” · published 2023-03-31 · pulled 2026-09-11
…repository and raw file contents: https://raw.githubusercontent.com/IconStorages/images/main/icon%d.ico This Github repository, https://github.com/IconStorages/images , stored 16 separate .…
3CX VoIP Software Compromise & Supply Chain Threats | Huntress — Huntress · under “Analysis & Investigation” · published 2023-03-30 · pulled 2026-09-11

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 7 are shown, chosen across types.

All 24 indicators from this source

Cited by the same report: Cyble - A Comprehensive Analysis Of The 3CX Attack

Cyble lists 60 other indicators in this source. 5 are shown, chosen across types.

All 61 indicators from this source