← All actor clusters

94.103.87.212

94.103.87.212 is an IP address that 5 published sources report in connection with Konni, Kimsuky and APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians, Rewterz and LAC. The earliest of those reports is dated 2024-07-31 and the most recent 2026-01-20.

ip address KonniKimsukyAPT37 MATCHED IN SOURCE

First seen 2024-07-31 · last seen 2026-01-20

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …om professionaltutors.net believeinsanta.com samosol.com 93.183.93.185 185.231.154.22 62.113.118.157 5.161.182.109 5.78.68.117 5.75.181.118 94.103.87.212 이 글 공유하기 Facebook LinkedIn Email…

  AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석 — Genians · under “6. 침해 지표 (Indicator of Compromise)” · published 2024-07-31 · pulled 2026-09-11

• …○ 참고로 ' 62.113.118.157 ', ' 185.231.154.22 ', ' 93.183.93.185 ', ' 94.103.87.212 ' C2는 2024년부터 AutoIt 악성 스크립트를 이용한 통신 주소로 계속 관찰되고 있는 상황입니다.…

  경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석 — Genians · under “4-1. 사건 관련 목격자의 진술서.pdf.lnk” · published 2025-04-01 · pulled 2026-09-11

• …IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5 d5669c046c78f54d2acb353626bb3bcf ec6842538f6166462d498279b8a462b3 29b0a6b9608540b9446c0fb14a36f0b0 SHA-256…

  North Korea-Linked Konni APT Group - Active IOCs - Rewterz — Rewterz · under “IP” · published 2025-04-03 · pulled 2026-09-12

• …192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135 이 글 공유하기 Facebook LinkedIn…

  국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술 — Genians · under “IP” · published 2025-11-09 · pulled 2026-09-12

• …when the compile path contains " Bay ", the development path contains interesting information © 2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology…

  Konni’s New Arsenal: Unmasking GSRAT in North Korea-linked APT Operation — LAC · published 2026-01-20 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석

Genians lists 12 other indicators in this source. 5 are shown, chosen across types.

• no-reply.trustmaster@hometax.go.kr email address
• 16eb2cceb920319eaddd5d7b85483cc4 file hash
• 61f65bd593ea0e52ac0dfdc6bc9cd73a file hash
• 162.241.216.224 IP address
• 162.241.253.27 IP address

All 13 indicators from this source

Cited by the same report: 경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석

Genians lists 18 other indicators in this source. 4 are shown, chosen across types.

• 7449b3528dffeb2babfc113308e47bb7 file hash
• 7c22515a47e94581cc7b62b88a205808 file hash
• 185.231.154.22 IP address
• 192.109.119.113 IP address

All 19 indicators from this source

Cited by the same report: North Korea-Linked Konni APT Group - Active IOCs - Rewterz

Rewterz lists 13 other indicators in this source. 3 are shown, chosen across types.

• d5669c046c78f54d2acb353626bb3bcf file hash
• e25c696a6d4b6eafde43f2d6b8db45701cafc329df111ec48d63c5d0fb80f80c file hash
• e9239ba649aec746e3c0088bc56400460b4a03e5f2df132ec7e47c14ccb70c0c file hash

All 14 indicators from this source