← All actor clusters

107.6.12.135

107.6.12.135 is an IP address that 3 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Paloalto Networks, SentinelOne and CISA. The earliest of those reports is dated 2017-08-14 and the most recent 2020-02-26.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2017-08-14 · last seen 2020-02-26

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …IPv4 104.192.193.149 176.35.250.93 213.152.51.169 108.222.149.173 197.246.6.83 118.140.97.6 210.202.40.35 59.90.93.97 107.6.12.135 URLs…

  The Blockbuster Saga Continues — Paloalto Networks · under “Indicators of Compromise” · published 2017-08-14 · pulled 2026-09-12

• …159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE ATT&CK Lazarus Group – G0032 Commonly Used Port – T1043 Connection Proxy – T1090 Credential Dumping – T1003…

  DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs — SentinelOne · under “IOCs” · published 2020-02-26 · pulled 2026-09-28

• …MAR-10271944-3.v1.stix . Submitted Files (1) 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 (smss.exe) IPs (2) 107.6.12.135 210.202.40.35 Findings 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 Tags trojan Details Name…

  MAR-10271944-3.v1 – North Korean Trojan: BUFFETLINE — CISA · under “IPs (2)” · published 2020-02-14 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: The Blockbuster Saga Continues

Paloalto Networks lists 22 other indicators in this source. 5 are shown, chosen across types.

• 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e file hash
• 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd file hash
• 2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb file hash
• 108.222.149.173 IP address
• 118.140.97.6 IP address

All 23 indicators from this source

Cited by the same report: DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs

SentinelOne lists 57 other indicators in this source. 4 are shown, chosen across types.

• 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 file hash
• 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 file hash
• 112.175.92.57 IP address
• 113.114.117.122 IP address

All 58 indicators from this source

Cited by the same report: MAR-10271944-3.v1 – North Korean Trojan: BUFFETLINE

CISA lists 4 other indicators in this source. 3 are shown, chosen across types.

• 11cb4f1cdd9370162d67945059f70d0d file hash
• 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 file hash
• 210.202.40.35 IP address

All 5 indicators from this source