Chollima Hunter

← Remote Workers

147.124.214.129

147.124.214.129 is an IP address that 9 published sources report in connection with Contagious Interview, Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, ESET, NVISO, Red Asgard, Recorded Future, Threat Book, JPCERT/CC and Security Scorecard. The earliest of those reports is dated 2024-09-04 and the most recent 2026-11-09.

ip address Contagious InterviewLazarus GroupAPT38 MATCHED IN SOURCE

First seen 2024-09-04 · last seen 2026-11-09

Network

Kinddata centre
NetworkMajestic Hosting Solutions, LLC
Announced byAS396073 Majestic Hosting Solutions, LLC
CountryUnited States
Flagshosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

  • …5 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.79.23 147.124.212.89 147.124.213.11 147.124.213.29 147.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35…
    APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog — Group-IB · under “Supercharge your cybersecurity with Group-IB Threat Intelligence” · published 2024-09-04 · pulled 2026-09-12
  • …147.124.214.129 N/A Majestic Hosting Solutions, LLC 2024‑03‑22 BeaverTail/InvisibleFerret C&C and staging server.…
    DeceptiveDevelopment targets freelance developers — ESET · under “Network” · published 2025-02-20 · pulled 2026-09-12
  • …144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166…
    Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12
  • …1224 AnyDesk RAT C2 Active 147.124.213.232 1244 BeaverTail victim C2 Active 147.124.212.125 1244 BeaverTail victim C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail…
    Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12
  • …When the string MTQ3LjEyNCaHR0cDovLw4yMTQuMTI5OjEyNDQ is decoded from Base64, it reveals a previously identified BeaverTail C2 IP address 147.124.214.129 . Figure 2 : HTTP POST instructions identified in the GitHub repository (Source: GitHub )…
    PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Food Manufacturing Industry Scam” · published 2026-01-21 · pulled 2026-09-12
  • …0.99.223.36 144.172.74.108 144.172.74.48 144.172.79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80…
    Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12
  • …4.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86…
    Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18
  • …The same physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234,…
    Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01
  • …C2 Server Analysis The obfuscated JS backdoor linked to this malicious repository communicated to a C2 server with the IP address of 147.124.214.129 .…
    Inside a North Korean Phishing Operation Targeting DevOps Employees — Security Scorecard · under “C2 Server Analysis” · published 2024-10-30 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog

Group-IB lists 33 other indicators in this source. 5 are shown, chosen across types.

All 34 indicators from this source

Cited by the same report: DeceptiveDevelopment targets freelance developers

ESET lists 5 other indicators in this source. 4 are shown, chosen across types.

All 6 indicators from this source

Cited by the same report: Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

NVISO lists 67 other indicators in this source. 3 are shown, chosen across types.

All 68 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.