`68.183.78.131`

68.183.78.131 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Threat Book. The report is dated 2020-12-18.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2020-12-18 · last seen 2020-12-18

Network

Kind	data centre
Network	DigitalOcean, LLC
Announced by	AS14061 DigitalOcean, LLC
Country	Germany
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

…execution. 3.2.2Powershell Backdoor Component mini.ps1, more like a test version, just establishes communication with the server 68.183.78.131：4444 and then echoes the return data. And mm.ps1 completes the backdoor function based on mini.ps1.Same as mini.ps1, it also…
Thief in the Dark: Lazarus Uses Dtrack RAT Tool to Steal Massive Medical Data — Threat Book · under “3.2.2Powershell Backdoor Component” · published 2020-12-18 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Thief in the Dark: Lazarus Uses Dtrack RAT Tool to Steal Massive Medical Data

Threat Book lists 5 other indicators in this source.