`112.216.9.171`

112.216.9.171 is an IP address that 2 published sources report in connection with Kimsuky and APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The reports are dated 2026-08-09.

ip address Kimsuky APT37 MATCHED IN SOURCE

First seen 2026-08-09 · last seen 2026-08-09

Network

Kind	fixed line
Network	LG DACOM Corporation (LG Uplus)
Announced by	AS3786 LG DACOM Corporation
Country	South Korea

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

…Code Analysis of "rTom.exe_r" In contrast, "fox.png", "leopard.png", "lion.png", and "wolf.png" were found to use the C2 address "112.216.9.171", an IP address located in South Korea.…
Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM — Genians · under “2-4. Analysis of AsyncRAT Distribution Using Git-Based C2 Infrastructure” · published 2026-08-09 · pulled 2026-09-11
…[그림 2-11] rTom.exe_r 코드 분석 화면 반면, fox.png, leopard.png, lion.png, wolf.png는 C2 주소가 112.216.9.171(한국 소재 IP)로 변경된 것으로 확인되었습니다.…
AI를 공격 체계에 접목하는 김수키, 미끼 문서 제작부터 로컬 LLM 구축까지 — Genians · under “2-4. Git 기반 C2를 이용한 AsyncRAT 배포 사례 분석” · published 2026-08-09 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM

Genians lists 53 other indicators in this source. 7 are shown, chosen across types.

All 54 indicators from this source

Cited by the same report: AI를 공격 체계에 접목하는 김수키, 미끼 문서 제작부터 로컬 LLM 구축까지

Genians lists 52 other indicators in this source. 5 are shown, chosen across types.

All 53 indicators from this source