`23.229.111.197`

23.229.111.197 is an IP address that 2 published sources report in connection with Andariel and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist and Threatray. The earliest of those reports is dated 2021-06-15 and the most recent 2021-12-22.

ip address Andariel Lazarus Group MATCHED IN SOURCE

First seen 2021-06-15 · last seen 2021-12-22

Network

Kind	proxy or VPN
Network	B2 Net Solutions Inc.
Announced by	AS36352 HostPapa
Country	United States
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…Three C2 addresses then get extracted and decrypted using DES, with all addresses pointing to the same IP (23.229.111.197) in this sample.…
Andariel evolves to target South Korea with ransomware | Securelist — Kaspersky Securelist · under “Third stage payload: Backdoor” · published 2021-06-15 · pulled 2026-09-12
…10.101.30.127 8b3c8046fa776b70821b7e50baa772a395d3d245c10bdaa4b6171e0c5ce3f717 x64 RAT (3rd stage) RAT-Kaspersky-x64 (TigerRAT) 23.229.111.197 bbddcb280af742ce10842b18b9d7120632cc042a8fe42eed90fc4bc94f2d71ac x64 RAT (3rd stage) RAT-Kaspersky-x64 (TigerRAT) 45.58.112.77…
Establishing the TigerRAT and TigerDownloader malware families — Threatray · under “Extracted C2s” · published 2021-12-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Andariel evolves to target South Korea with ransomware | Securelist

Kaspersky Securelist lists 6 other indicators in this source.

Cited by the same report: Establishing the TigerRAT and TigerDownloader malware families

Threatray lists 5 other indicators in this source. 3 are shown, chosen across types.

All 6 indicators from this source