`27.102.128.152`

27.102.128.152 is an IP address that 2 published sources report in connection with Andariel and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from AhnLab ASEC. The earliest of those reports is dated 2023-11-16 and the most recent 2023-11-17.

ip address Andariel Lazarus Group MATCHED IN SOURCE

First seen 2023-11-16 · last seen 2023-11-17

Network

Kind	data centre
Network	Daou Technology (KCInfra Inc)
Announced by	AS45996 DAOU TECHNOLOGY
Country	South Korea
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Huntress의 보고서에는 구체적인 악성코드는 언급되어 있지 않지만 CVE-2023-46604 취약점 공격을 통해 “http://27.102.128.152:8098/bit.ico” URL에서 악성 페이로드를 설치하는 사례도 소개하였다. 이 주소는 이전 블로그에서도 언급된 URL로서 TigerRat이 다운로드된 주소이다.…
Andariel 그룹의 Apache ActiveMQ 취약점 (CVE-2023-46604) 공격 정황 - ASEC — AhnLab ASEC · under “2.1. CVE-2023-46604 취약점 공격 정황” · published 2023-11-17 · pulled 2026-09-12
…no specific malware was mentioned in the Huntress report, a case was covered where a malicious payload was installed from the URL “http://27.102.128.152:8098/bit.ico” through exploitation of the CVE-2023-46604 vulnerability.…
Circumstances of the Andariel Group Exploiting an Apache ActiveMQ Vulnerability (CVE-2023-46604) - ASEC — AhnLab ASEC · under “2.1. Circumstances of an Attack Exploiting CVE-2023-46604 Vulnerability” · published 2023-11-16 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Andariel 그룹의 Apache ActiveMQ 취약점 (CVE-2023-46604) 공격 정황 - ASEC

AhnLab ASEC lists 7 other indicators in this source.