← All actor clusters

38.180.148.108

38.180.148.108 is an IP address that one published source reports in connection with Konni, Kimsuky and APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The report is dated 2025-11-09.

ip address KonniKimsukyAPT37 MATCHED IN SOURCE

First seen 2025-11-09 · last seen 2025-11-09

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

• …이 과정에 사용된 패스워드 문자열은 다음과 같습니다. BFigyOed7KVjU993ZCJzYb8R [그림 6-5] cliconfg.au3 디코딩 과정 분석 결과, RftRAT은 일본 소재의 38.180.148.108 C2 서버와 통신을 시도하며, 후속 명령 수신을 위해 지속적으로 연결을 유지하는 동작을 합니다.…

  국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술 — Genians · under “6-3. RAT 상관관계 분석” · published 2025-11-09 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술

Genians lists 22 other indicators in this source. 12 are shown, chosen across types.

• 53aea290d7245ee902a808fd87a6a173 file hash
• 56c7b448dbc37aa50eb1c2a6475aca5e file hash
• 5ab26df9c161a6c5f0497fde381d7fca file hash
• 8230af6642f5f1927bbbbc7fd6e5427f file hash
• 8f82226b2f24d470c02f6664f67f23f7 file hash
• 99ee7852b8041a540fdb74b3784d0409 file hash
• 109.234.36.135 IP address
• 116.202.99.218 IP address
• 77.246.101.72 IP address
• 77.246.108.96 IP address
• 89.110.83.245 IP address
• 91.107.208.93 IP address

All 23 indicators from this source