111.92.246.145
111.92.246.145 is an IP address
that 3 published sources report
in connection with Konni and Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from wezard4u, SOCRadar and Genians.
The earliest of those reports is dated 2026-09-22 and the most recent 2026-10-11.
ip address KonniKimsuky MATCHED IN SOURCE
Network
| Kind | fixed line |
|---|---|
| Network | IPCORE |
| Announced by | AS38638 OnairNet Inc. |
| Country | Japan |
Sources
-
…111.92.246.145 DNS를 사용하지 않고 IP로 직접 TCP 연결->통신은 HTTPS나 일반적인 웹 프로토콜이 아니라 System.Net.Sockets.TcpClient를 사용 커스텀 TCP 프로토콜 C2 인증 방식은 연결 후 먼저 다음 문자열을 서버에…
우크라이나 를 노리는 북한 해킹 단체 Konni 악성코드-CV OlesiaTsvientukh Social Researcher Sociologist — wezard4u -
…scripts retrieved and executed on demand. More specifically, VelvetCake initiates communication by establishing a raw TCP connection to 111.92.246.145:12345 and authenticates using the command PASSWORD MySecurePass123 .…
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures — SOCRadar -
…"update2.ps1" connects to TCP port 12345 on the hardcoded IP address " 111.92.246.145 " in Japan.…
Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War — Genians
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.
Related indicators
Cited by the same report: Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures
All 19 indicators from this source