← All actor clusters

210.202.40.35

210.202.40.35 is an IP address that 3 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Paloalto Networks, SentinelOne and CISA. The earliest of those reports is dated 2017-08-14 and the most recent 2020-02-26.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2017-08-14 · last seen 2020-02-26

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …IPv4 addresses (210.202.40.35) hosting the weaponized documents have also been hardcoded as command and control servers for previous samples…

  The Blockbuster Saga Continues — Paloalto Networks · under “New Activity” · published 2017-08-14 · pulled 2026-09-12

• …159.100.250.231 BUFFETLINE SHA-256: 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 107.6.12.135 210.202.40.35 MITRE ATT&CK Lazarus Group – G0032 Commonly Used Port – T1043 Connection Proxy – T1090 Credential Dumping – T1003 Custom…

  DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs — SentinelOne · under “IOCs” · published 2020-02-26 · pulled 2026-09-28

• …. Submitted Files (1) 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 (smss.exe) IPs (2) 107.6.12.135 210.202.40.35 Findings 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 Tags trojan Details Name smss.exe Size…

  MAR-10271944-3.v1 – North Korean Trojan: BUFFETLINE — CISA · under “IPs (2)” · published 2020-02-14 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: The Blockbuster Saga Continues

Paloalto Networks lists 22 other indicators in this source. 5 are shown, chosen across types.

• 7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd file hash
• acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897 file hash
• ad075279d2ee6958105889d852e0d7f4266f746cb0078ac1b362f05a45b5828d file hash
• 213.152.51.169 IP address
• 59.90.93.97 IP address

All 23 indicators from this source

Cited by the same report: DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs

SentinelOne lists 57 other indicators in this source. 4 are shown, chosen across types.

• 83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a file hash
• 8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520 file hash
• 217.117.4.110 IP address
• 218.255.24.226 IP address

All 58 indicators from this source

Cited by the same report: MAR-10271944-3.v1 – North Korean Trojan: BUFFETLINE

CISA lists 4 other indicators in this source. 3 are shown, chosen across types.

• 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 file hash
• f59c7ce763c4d5717f986e578e3bce8a43f721d2 file hash
• 107.6.12.135 IP address

All 5 indicators from this source