`52.202.193.124`

52.202.193.124 is an IP address that 2 published sources report in connection with Lazarus Group and Andariel activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cisco Talos and Threatray. The earliest of those reports is dated 2021-12-22 and the most recent 2022-09-07.

ip address Lazarus Group Andariel MATCHED IN SOURCE

First seen 2021-12-22 · last seen 2022-09-07

Network

Kind	data centre
Network	Amazon.com, Inc. (AWS EC2 (us-east-1))
Announced by	AS14618 Amazon.com, Inc.
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…[://]64.188.27.73/board/pct.gif http[://]64.188.27.73/board/logo_adm_org.gif http[://]64.188.27.73/board/tour_upt.html IPs 193.56.28.251 52.202.193.124 64.188.27.73 151.106.2.139 66.154.102.91 Share this post Related…
MagicRAT: Lazarus’ latest gateway into victim networks — Cisco Talos · under “IPs” · published 2022-09-07 · pulled 2026-09-12
…VARIANT C2 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 52.202.193.124 ed11e94fd9aa3c7d4dd0b4345c106631fe52929c6e26a0daec2ed7d22e47ada0 x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 185.208.158.208…
Establishing the TigerRAT and TigerDownloader malware families — Threatray · under “Extracted C2s” · published 2021-12-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: MagicRAT: Lazarus’ latest gateway into victim networks

Cisco Talos lists 4 other indicators in this source.

Cited by the same report: Establishing the TigerRAT and TigerDownloader malware families

Threatray lists 5 other indicators in this source.