`95.164.17.24`

95.164.17.24 is an IP address that 15 published sources report in connection with Contagious Interview, Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Datadog Security Labs, Break Glass Intelligence, Threat Intel Report, Unit 42, Group-IB, SentinelOne, ESET, NVISO, Objective-See, Red Asgard, Threat Book, Deriv Tech, OpenSourceMalware and JPCERT/CC. The earliest of those reports is dated 2024-08-19 and the most recent 2026-11-09.

ip address Contagious Interview Lazarus Group APT38 MATCHED IN SOURCE

First seen 2024-08-19 · last seen 2026-11-09

Network

Kind	data centre
Network	Netassist International EOOD
Country	Bulgaria
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…The BeaverTail samples described in this blog all communicate with a web server hosted at the IP address 95.164.17.24 on port 1224.…
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview | Datadog Security Labs — Datadog Security Labs · under “Links to Contagious Interview” · published 2024-10-24 · pulled 2026-09-01
…Starting Point The investigation began with two IPs flagged in an InvisibleFerret IOC report: 95.216.37.186 (Hetzner, Finland) and 95.164.17.24 (TheHosting/WorkTitans, Netherlands).…
Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover - Breakglass Intelligence — Breakglass Intelligence — Break Glass Intelligence · under “The Starting Point” · published 2026-04-01 · pulled 2026-09-09
…) SHA-256 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77feail (macOS Mach-O) Unit 42 Contagious Interview update ( Unit 42 ) IP 95.164.17.24 Reported BeaverTail and InvisibleFerret C2 Unit 42 Contagious Interview update ( Unit 42 ) IP 185.235.241.208 Reported BeaverTail and…
DPRK fake interview lures and recruitment-driven access operations summary — ThreatIntelReport — Threat Intel Report · under “5. Indicators of Compromise (IOCs)” · published 2026-02-25 · pulled 2026-09-09
…purposefully ran the code in a virtual environment, which eventually connected back to the attacker's command and control (C2) server 95.164.17.24:1224 , as noted below in Figure 2. Figure 2.…
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware — Unit 42 · under “Social Engineering and Infection: Fake Recruiters and Job Interviews” · published 2024-10-09 · pulled 2026-09-12
…1.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.2…
APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog — Group-IB · under “Supercharge your cybersecurity with Group-IB Threat Intelligence” · published 2024-09-04 · pulled 2026-09-12
…backdoor capable of keylogging, file exfiltration and installing remote control software. Detection Opportunities Network Comms 95.164.17.24 45.140.147.208 Persistence Although persistence was not observed on macOS in earlier reports, a recent report identifies a LaunchAgent…
2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise | SentinelOne — SentinelOne · under “Detection Opportunities” · published 2025-01-20 · pulled 2026-09-12
…Network IP Domain Hosting provider First seen Details 95.164.17.24 N/A STARK INDUSTRIES SOLUTIONS LTD 2024‑06‑06 BeaverTail/InvisibleFerret C&C and staging server.…
DeceptiveDevelopment targets freelance developers — ESET · under “Network” · published 2025-02-20 · pulled 2026-09-12
…45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ :// ]23.254.164.156/introduction-video https[ :// ]pastebin.com/u/NotingRobe2871_FranzStill8494…
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12
…FUD on VT, "MiroTalk.dmg": 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c Payload / next stages are coming from 95.164.17.24:1224 (Stark AS 44477). From a quick look, the next stages includes stealing from browsers, keylogging, installing AnyDesk,……
The Mac Malware of 2024 👾 — Objective-See · under “👾 BeaverTail” · published 2025-01-01 · pulled 2026-09-12
…the compromise. C2 Infrastructure The AnyDesk RAT component communicates with a different C2 server than the credential stealer: C2: 95.164.17.24:1224 The IP is obfuscated in the script using base64 with an 8-character rotation: host = "LjE3LjI0OTUuMTY0" decoded =…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “C2 Infrastructure” · published 2026-02-03 · pulled 2026-09-12
…5.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store hirog.io freeconference.io ipcheck.cloud mirotalk.net regioncheck.net…
Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12
…(cleartext Python) http://95.164.17.24:1224/any || Stage 4: Downloads AnyDesk installer (if needed) || Temp location, then deleted http://95.164.17.24:1224/keys || Stage 4: Uploads hijacked AnyDesk config || No (upload only) Unique Domains loopsoft.tech api.npoint.io ip-api.com…
How a fake AI recruiter delivers five staged malware disguised as a dream job — Deriv Tech · under “C2 URLs and File Drops” · published 2025-10-20 · pulled 2026-09-12
…8,493,056 bytes Network IOCs C2 Infrastructure: 95.216.37.186:5000 (primary C2) 95.216.37.186:3011 (secondary exfiltration) 95.164.17.24:1224 (documented InvisibleFerret C2) Host-Based IOCs Registry Keys (Windows):…
A Comprehensive Analysis of DPRK's Contagious Interview — OpenSourceMalware · under “Network IOCs” · published 2026-01-20 · pulled 2026-09-18
…7 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.7…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18
…the number of targeted browser extensions by adding kaikas, rabby, argent X, exodus web3 #beavertail indicators: 185.235.241.208:1224 95.164.17.24:1224 dc77044fe8d35882015eaa99ca31f826 b9693b6541a22d01b100b867375279e6 8ebca0b7ef7dbfc14da3ee39f478e880 ed60b3913e6694f4a0ed2fe25551bd1f…
Group-IB on a Windows BeaverTail and trojanised ReactJS games (archived post) — Group-IB · under “Group-IB researchers noticed a Windows version of #BeaverTail , which was attributed to #Lazarus . We also discovered that the #javascript version of BeaverTail is now being distributed through trojanised games built with ReactJS and distributed as an NPM-based package.” · published 2024-08-19 · pulled 2026-10-02

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview | Datadog Security Labs

Datadog Security Labs lists 6 other indicators in this source. 5 are shown, chosen across types.

All 7 indicators from this source

Cited by the same report: Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover - Breakglass Intelligence — Breakglass Intelligence

Break Glass Intelligence lists 9 other indicators in this source. 4 are shown, chosen across types.

All 10 indicators from this source

Cited by the same report: DPRK fake interview lures and recruitment-driven access operations summary — ThreatIntelReport

Threat Intel Report lists 3 other indicators in this source.