`178.16.54.208`

178.16.54.208 is an IP address that 2 published sources report in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The reports are dated 2026-03-15.

ip address Konni MATCHED IN SOURCE

First seen 2026-03-15 · last seen 2026-03-15

Network

Kind	fixed line
Network	Omegatech LTD
Announced by	AS202412 Omegatech LTD
Country	The Netherlands

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

…157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL) [Table 4-1] Types and C2 Infrastructure by Malicious AutoIt Script All three collected files use the AutoIt script…
Analysis of the Spear-Phishing and KakaoTalk-Linked Threat Campaign by the Konni Group — Genians · under “4-4. Analysis of Additional Malware Delivered via the C2” · published 2026-03-15 · pulled 2026-09-11
…157.180.88.26 (FI) cliconfg.au3 RftRAT 96.62.214.5 (JP) sqlite4.au3 RemcosRAT 178.16.54.208 (NL) [표 4-1] 악성 AutoIt 스크립트별 유형 및 C2 채증된 3개 파일은 모두 AutoIt 스크립트 확장자(.au3)를 사용하고 있으나, 분석 결과 원본 스크립트 파일이 아닌 컴파일된(Compiled)…
Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석 — Genians · under “4-4. C2 추가 유입 악성코드 분석” · published 2026-03-15 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Analysis of the Spear-Phishing and KakaoTalk-Linked Threat Campaign by the Konni Group

Genians lists 10 other indicators in this source. 7 are shown, chosen across types.

All 11 indicators from this source

Cited by the same report: Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석

Genians lists 10 other indicators in this source. 3 are shown, chosen across types.

All 11 indicators from this source