← All actor clusters

75.99.63.27

75.99.63.27 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from CISA. The report is dated 2018-12-21.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2018-12-21 · last seen 2018-12-21

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Source

• …(Injection_API_log_generating_s...) f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2 (inject_api) IPs (1) 75.99.63.27 Findings 820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6 Tags backdoorproxytrojan Details Name…

  MAR-10201537 – HIDDEN COBRA FASTCash-Related Malware | CISA — CISA · under “IPs (1)” · published 2018-12-21 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: MAR-10201537 – HIDDEN COBRA FASTCash-Related Malware | CISA

CISA lists 40 other indicators in this source. 12 are shown, chosen across types.

• saycisa@cisa.dhs.gov email address
• 10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba file hash
• 18e346aa6ee6d3faeae21474f33f5a4601a99213 file hash
• 1c9a437ed876a0ce0e5374bd93acdfd9e9023f1f file hash
• 1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d file hash
• 274b0bccb1bfc2731d86782de7babdeece379cf4 file hash
• 3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c file hash
• 4215312bc485628dca703e26b9c891d0 file hash
• 46b318bbb72ee68c9d9183d78e79fb5a file hash
• 4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756 file hash
• 4f67f3e4a7509af1b2b1c6180a03b3e4 file hash
• 5375ad3746ce42a6f262f55c4f1f0d273fb69c54 file hash

All 41 indicators from this source