← Remote Workers

172.86.93.139

172.86.93.139 is an IP address that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from GitLab Threat Intelligence, Break Glass Intelligence and JPCERT/CC. The earliest of those reports is dated 2025-09-17 and the most recent 2026-11-09.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2025-09-17 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …technique we typically observe in BeaverTail delivery. The BeaverTail and InvisibleFerret samples associated with this campaign both use 172.86.93.139 as a command and control address and use tttttt as the campaign identifier. Related Infrastructure and Personas The threat actor’s web…

  Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure - GitLab Security Tech Notes — GitLab Threat Intelligence · under “BeaverTail Variant” · published 2025-09-17 · pulled 2026-09-09

• …Secondary C2 (port 1224) 45.59.163.23 Tier.Net US (Florida) Windows C2 node (port 1244) -- SMB/RDP exposed, CVE-2020-0796 vulnerable 172.86.93.139 FranTech/BuyVM (PONYNET) US (Wyoming) Credential exfiltration endpoint (port 3000) nvidiasdk.fly.dev Fly.io US Serverless payload…

  Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover - Breakglass Intelligence — Breakglass Intelligence — Break Glass Intelligence · under “Five Servers, Five Domains, One Campaign” · published 2026-04-01 · pulled 2026-09-09

• …7.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

• …attempts to read a user’s password from the variable MY_PASWOR in the file ~/.myvars and exfiltrate it to a remote IP address, http://172.86.93.139:3000/pawr/ .…

  Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure - GitLab Security Tech Notes — GitLab Threat Intelligence · under “macOS Delivery Chain” · published 2025-09-17 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure - GitLab Security Tech Notes

GitLab Threat Intelligence lists 36 other indicators in this source. 5 are shown, chosen across types.

• nvidiasdk.fly.dev domain
• yash1511@gmail.com email address
• 65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086 file hash
• downx64.sh file name
• 188.43.33.250 IP address

All 37 indicators from this source

Cited by the same report: Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover - Breakglass Intelligence — Breakglass Intelligence

Break Glass Intelligence lists 9 other indicators in this source. 4 are shown, chosen across types.

• api.camdriverstore.cloud domain
• api.driversnap.cloud domain
• 45.59.163.23 IP address
• 95.164.17.24 IP address

All 10 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 3 are shown, chosen across types.

• 172.86.96.111 IP address
• 172.94.3.25 IP address
• 172.98.73.57 IP address

All 540 indicators from this source