216.189.149.78
216.189.149.78 is an IP address
that one published source reports
in connection with Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from QiAnXin Threat Intelligence.
The earliest of those reports is dated 2026-09-12 and the most recent 2026-10-18.
ip address Kimsuky MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | HostUS |
| Announced by | AS7489 HostUS |
| Country | United States |
| Flags | hosting range |
Source
-
…读取PMS*文件信息 溯源与关联 奇安信威胁情报中心分析人员通过对此次捕获样本所带的恶意代码、释放的木马文件进行分析后，判断本次攻击活动的幕后黑手为Kimsuky。 此前Kimsuky组织使用的C&C地址所对应的IP地址与此次木马使用的IP地址相同，同为216.189.149.78。 总结 目前，基于奇安信威胁情报中心的威胁情报数据的全线产品，包括威胁情报平台（TIP）、天眼高级威胁检测系统、NGSOC、奇安信态势感知等，都已经支持对此APT攻击团伙攻击活动的精准检测。 IOCs MD5…
Kimsuky武器库更新：利用新冠疫情为诱饵针对韩国地区的攻击活动分析 — QiAnXin Threat Intelligence
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.