← All actor clusters

185.224.138.29

185.224.138.29 is an IP address that 4 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESTsecurity ALYac, Ahnlab and FSI. The earliest of those reports is dated 2019-02-26 and the most recent 2026-10-18.

ip address Kimsuky MATCHED IN SOURCE

First seen 2019-02-26 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …29) - www.kaist-ac.xyz (185.224.138.29) - mail.kaist-ac.xyz (143.248.155.65) - vpn.karist.cf (216.189.159 .…

  北 연계 탈륨조직, '블루 에스티메이트(Blue Estimate)' APT 캠페인 지속 — ESTsecurity ALYac · under “본문” · published 2020-11-11 · pulled 2026-09-12

• …악성코드 유포지 및 C&C 서버 악성코드 분석 과정에서 추출한 악성코드 유포지 , C&C 서버 는 185.224.138.29 (NE) 와 연결되는데 , 해당 IP 와 다수의 URL 이 연결되어 있었다 . 그 중 일부 URL 을 [ 표 9 ] 와 같이 정리했다 . [ 표 9 ] 에서 볼 수 있는…

  Operation Kabar Cobra: Kimsuky 공격 그룹의 최신 타깃 공격 사례 분석 — Ahnlab · published 2019-02-26 · pulled 2026-09-12

• …기능이 존재하며, 해당 파일은 DLL이므로 Rundll32.exe를 통해 다음과 같은 형식으로 실행된다. [+] sen.a의 실행 예시: Rundll32.exe sen.a, Query() sen.a의 C&C 서버는 navor-net.hol.es(185.224.138.29, NE)이지만 암호화되어 있으며, 동적 분 석 당시 [그림 2]와 같이 주기적으로 C&C 서버와 통신이 가능한 것을 확인했다.…

  오퍼레이션 고스트 유니온(Operation Ghost Union) — Ahnlab · published 2020-03-27 · pulled 2026-09-12

• …C&C § [CASE 1-1] Directory Listing – HWP Malware § fontchk.jse (f22db1e3ea74af791e34ad5aa0297664) § C&C : suppcrt-seourity . esy.es ( 185.224.138.29 , NL) 47 /155 Tracking Malware & Monitoring C&C § [CASE 1-1] Directory Listing – HWP…

  Kimsuky Group: Track the King of the Spear-Phishing — FSI · published 2019-10-08 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 北 연계 탈륨조직, '블루 에스티메이트(Blue Estimate)' APT 캠페인 지속

ESTsecurity ALYac lists 7 other indicators in this source. 5 are shown, chosen across types.

• nextstepphp@gmail.com email address
• parksonghui1910@gmail.com email address
• yourtest111@outlook.com email address
• 216.189.159.36 IP address
• 45.13.135.103 IP address

All 8 indicators from this source

Cited by the same report: Operation Kabar Cobra: Kimsuky 공격 그룹의 최신 타깃 공격 사례 분석

Ahnlab lists 5 other indicators in this source. 4 are shown, chosen across types.

• countineprotectormail@gmail.com email address
• human-ad@hanmail.net email address
• 0eb739c8faf77dae0546ff447ad06038 file hash
• a45ba001c3abee03bda49c6816d9a17c file hash

All 6 indicators from this source

Cited by the same report: 오퍼레이션 고스트 유니온(Operation Ghost Union)

Ahnlab lists 5 other indicators in this source. 3 are shown, chosen across types.

• 6dbc4dcd05a16d5c5bd431538969d3b8 file hash
• 7b0c06c96caadbf6976aa1c97be1721c file hash
• 177.234.145.204 IP address

All 6 indicators from this source