`23.254.164.92`

23.254.164.92 is an IP address that 5 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware, SafeDep, Snyk, Decryption Digest and Microsoft. The earliest of those reports is dated 2026-06-16 and the most recent 2026-06-24.

ip address Lazarus Group APT38 MATCHED IN SOURCE

First seen 2026-06-16 · last seen 2026-06-24

Network

Kind	data centre
Network	HostPapa (Hostwinds LLC)
Announced by	AS54290 HostPapa
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…verification off, detached spawn, self-delete Identical pattern (see Stage One) Hosting Hostwinds, delivery on port 8000 Hostwinds ( 23.254.164.92:8000 / .123 ), reverse DNS hwsrv-1327786 / hwsrv-1327785.hostwindsdns.com Objective Crypto-wallet credential theft Crypto-wallet…
Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier | OpenSourceMalware — OpenSourceMalware · under “Shared tradecraft with the axios compromise” · published 2026-06-18 · pulled 2026-09-11
…is short: it turns off TLS verification so an HTTPS fetch works against a self-signed cert on a raw IP, downloads the real malware from 23.254.164.92 instead of shipping it in the package, runs it as a detached background process with no console output, and then deletes itself.…
Mastra npm Scope Takeover: 143 Packages Drop a RAT - Real-time Open Source Software Supply Chain Security — SafeDep · under “The dropper” · published 2026-06-17 · pulled 2026-09-11
…on a raw IP. Writes marker files ( ~/.pkg_history, ~/.pkg_logs ) to track installs. Downloads a second-stage payload from https://23.254.164.92:8000/update/49890878 (Hostwinds-hosted). Writes it to the temp directory and spawns it as a detached, hidden background process with no…
Mastra npm Scope Takeover | Snyk — Snyk · under “The malware dropper: TLS off, fetch, detach, delete” · published 2026-06-16 · pulled 2026-09-11
…On first execution, it connected to 23.254.164.92:8000 and downloaded a 41 KB Node.js tasking client. The second-stage payload supported Windows, macOS, and Linux.…
Sapphire Sleet: 144 npm Packages Backdoored — Decryption Digest · under “How Does the Sapphire Sleet npm Supply Chain Attack Work?” · published 2026-06-24 · pulled 2026-09-11
…The dropper issues a GET request to https://23.254.164.92:8000/update/49890878 and reads the response body as text. The second-stage payload is a ~41 KB cross-platform Node.js tasking client.…
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet | Microsoft Security Blog — Microsoft · under “TLS bypass to self-deletion” · published 2026-06-18 · pulled 2026-09-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier | OpenSourceMalware

OpenSourceMalware lists 1 other indicator in this source.

Cited by the same report: Mastra npm Scope Takeover: 143 Packages Drop a RAT - Real-time Open Source Software Supply Chain Security

SafeDep lists 6 other indicators in this source. 5 are shown, chosen across types.

All 7 indicators from this source