← All actor clusters

31.59.138.144

31.59.138.144 is an IP address that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Frost (@fr0s7_). The report is dated 2026-10-01.

ip address Kimsuky RESEARCHER POST

First seen 2026-10-01 · last seen 2026-10-01

Network

Looked up 2026-10-02 at ip-api.com. A hosting range is not evidence on its own.

Source

• A self-thread the researcher tags #DPRK #Kimsuky #UAT-5394. A .docx.lnk and a macro-enabled .xls carve XOR-encoded stages from the LNK, run anti-VM and reconnaissance checks, register a scheduled task every 30 minutes, fetch a list (gho.txt) that allowlists victim IDs, and load a GZIP-compressed .NET payload whose first bytes the server masks as an RTF header. The payload is a fork of XenoRAT the researcher calls Stella. 31.59.138.144 serves the stages; 107.172.249.140 is the C2. The hash is the delivery ZIP.

  x.com/fr0s7_/status/2105549565210624266 — Frost (@fr0s7_) · under “Kimsuky crypto-trader lure delivering the XenoRAT fork Stella” · published 2026-10-01 · pulled 2026-08-30

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: x.com/fr0s7_/status/2105549565210624266

Frost (@fr0s7_) lists 1 other indicator in this source.

• 107.172.249.140 IP address