`157.180.88.26`

157.180.88.26 is an IP address that 2 published sources report in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The reports are dated 2026-03-15.

ip address Konni MATCHED IN SOURCE

First seen 2026-03-15 · last seen 2026-03-15

Network

Kind	data centre
Network	Hetzner Online GmbH (Hetzner)
Announced by	AS24940 Hetzner Online GmbH
Country	Finland
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…File Name Type C2 mmlib.au3 EndRAT 157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL)…
Analysis of the Spear-Phishing and KakaoTalk-Linked Threat Campaign by the Konni Group — Genians · under “4-4. Analysis of Additional Malware Delivered via the C2” · published 2026-03-15 · pulled 2026-09-11
…File Name Type C2 mmlib.au3 EndRAT 157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL)…
Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석 — Genians · under “4-4. C2 추가 유입 악성코드 분석” · published 2026-03-15 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Analysis of the Spear-Phishing and KakaoTalk-Linked Threat Campaign by the Konni Group

Genians lists 10 other indicators in this source. 7 are shown, chosen across types.

All 11 indicators from this source

Cited by the same report: Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석

Genians lists 10 other indicators in this source. 3 are shown, chosen across types.

All 11 indicators from this source