`93.183.93.185`

93.183.93.185 is an IP address that 7 published sources report in connection with Konni, Kimsuky, APT37 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians, Rewterz, LAC, S2W and Threat Book. The earliest of those reports is dated 2024-05-25 and the most recent 2026-01-20.

ip address Konni Kimsuky APT37DPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2024-05-25 · last seen 2026-01-20

Network

Kind	data centre
Network	Hosting technology LTD
Announced by	AS48282 Hosting technology LTD
Country	Russia
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…62.113.118.157 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 3 첨부1_소명자료 목록(탈세제보).hwp.lnk 93.183.93.185 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 4 ㅇㅇ재단_24년도장학금신청서.hwp.lnk 62.113.118.157 [RU]…
AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-07-31 · pulled 2026-09-11
…○ 참고로 ' 62.113.118.157 ', ' 185.231.154.22 ', ' 93.183.93.185 ', ' 94.103.87.212 ' C2는 2024년부터 AutoIt 악성 스크립트를 이용한 통신 주소로 계속 관찰되고 있는 상황입니다.…
경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석 — Genians · under “4-1. 사건 관련 목격자의 진술서.pdf.lnk” · published 2025-04-01 · pulled 2026-09-11
…IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5 d5669c046c78f54d2acb353626bb3bcf ec6842538f6166462d498279b8a462b3 29b0a6b9608540b9446c0fb14a36f0b0…
North Korea-Linked Konni APT Group - Active IOCs - Rewterz — Rewterz · under “IP” · published 2025-04-03 · pulled 2026-09-12
…16.202.99.218 192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135 이 글 공유하기…
국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술 — Genians · under “IP” · published 2025-11-09 · pulled 2026-09-12
…path contains " Bay ", the development path contains interesting information © 2026 LAC Co., Ltd. Infrastructures 36 94.103.87.212 93.183.93.185 Custom Lilith RAT Hosting technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online…
Konni’s New Arsenal: Unmasking GSRAT in North Korea-linked APT Operation — LAC · published 2026-01-20 · pulled 2026-09-12
…Execute Command 이후 Lilith RAT 악성코드 내 하드코딩된 C&C 서버의 IP 주소 및 포트 번호를 통해 Socket 통신을 수행하며, C&C 서버로부터 임의의 명령어를 수신받아 실행한다. 공격자 서버 IP: 93.183.93.185 (RU) 포트 번호: 57860 공격자가 재구현한 Lilith RAT과 공개된 소스코드를 비교했을 때, Client 측 기능 중에서는 리버스 쉘 기능을 수행하는 remoteControl 명령어만이 일부 구현된 점을 확인할 수 있다.…
Threat Tracking: Analysis of puNK-003’s Lilith RAT ported to AutoIt Script — S2W · under “2.3. Execute Command” · published 2024-08-22 · pulled 2026-09-12
…ensures that the script runs automatically upon system startup, maintaining persistence. Then it establishes a socket connection to 93.183.93.185 on port 57860, and subsequently enters a loop to continuously receive and execute commands. The length of the received command is 1…
APT Group - Konni Launches New Attacks on South Korea — Threat Book · under “3.2 Detailed Analysis” · published 2024-05-25 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석

Genians lists 12 other indicators in this source. 5 are shown, chosen across types.

All 13 indicators from this source

Cited by the same report: 경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석

Genians lists 18 other indicators in this source. 4 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: North Korea-Linked Konni APT Group - Active IOCs - Rewterz

Rewterz lists 13 other indicators in this source. 3 are shown, chosen across types.

All 14 indicators from this source