← EtherHiding Tracker

23.27.20.143

23.27.20.143 is an IP address that 8 published sources report in connection with EtherHiding / UNC5342, Contagious Interview, Lazarus Group and NullReceiver activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), Google Threat Intelligence Group, Ransom-ISAC and Trend Micro. The earliest of those reports is dated 2025-10-16 and the most recent 2026-09-25.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address EtherHiding / UNC5342Contagious InterviewLazarus GroupNullReceiver CURATED

First seen 2025-10-16 · last seen 2026-09-25

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 12 March 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in ".." delimiters and encoded as reversed base64; reversing and decoding gives http://23.27.20.143:27017, http://23.27.20.143:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. It sits in 23.27.0.0/16, the same range as 23.27.13.135, which this site read from the NullReceiver resolver wallet in August 2026, and as 23.27.202.27, which Panther reports for Contagious Interview. Three addresses in one range from three independent readings is a hosting pattern worth noting, not evidence that any two of them are the same host.

  BNB Smart Chain transaction 0xe7ae4118e4bb36251b71a0e840f47744ec4a1f4f2ff67780b8596cd9fe6c3e2a — Chollima Hunter (on-chain observation) · pulled 2026-09-03

• Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 12 March 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in ".." delimiters and encoded as reversed base64; reversing and decoding gives http://23.27.20.143:27017, http://23.27.20.143:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. It sits in 23.27.0.0/16, the same range as 23.27.13.135, which this site read from the NullReceiver resolver wallet in August 2026, and as 23.27.202.27, which Panther reports for Contagious Interview. Three addresses in one range from three independent readings is a hosting pattern worth noting, not evidence that any two of them are the same host.

  BNB Smart Chain transaction 0x8bcd16155c0947d507659a884ddb4c618cbf3ac9fd8b4b334d3d2ca9403b75ba — Chollima Hunter (on-chain observation) · pulled 2026-09-03

• Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 12 March 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in ".." delimiters and encoded as reversed base64; reversing and decoding gives http://23.27.20.143:27017, http://23.27.20.143:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. It sits in 23.27.0.0/16, the same range as 23.27.13.135, which this site read from the NullReceiver resolver wallet in August 2026, and as 23.27.202.27, which Panther reports for Contagious Interview. Three addresses in one range from three independent readings is a hosting pattern worth noting, not evidence that any two of them are the same host.

  DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-09-03

• …of Remote Code Execution (RCE), appearing to be a variant of the DEV#POPPER campaign. One obfuscated payload fetches data via http://23.27.20.143:27017/$/boot using custom headers to download telemetry capture and malware stager code—another ~2,500-line obfuscated script.…

  Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2) — Ransom-ISAC · under “Full Attack Chain” · published 2025-10-27 · pulled 2026-09-12

• …event the primary channel is not able to establish connection with patient zero. C2 IP Addresses C2 Port C2 Channel Type Malware 23.27.20.143 27017 HTTP API Python Dropper 136.0.9.8 27017, 443 HTTP API, socket.io Loader/RAT 166.88.4.2 27017, 443 HTTP API, socket.io…

  Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Intrusion C2 Channels” · published 2025-11-13 · pulled 2026-09-12

• …to Potential Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat…

  Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trend Micro · under “Conclusion” · published 2026-04-21 · pulled 2026-09-12

• …The following changes were observed in the September 2026 samples: Aspect October 2025 September 2026 C2 IP 23.27.20.143 181.214.149.148 C2 Port 27017 (MongoDB, easily flagged) 443 (blends with HTTPS traffic) C2 Resolution Channels 2 parallel (Hardcoded…

  XCTDH Adopts Hash Hiding — Ransom-ISAC · under “Evolution from October 2025” · published 2026-09-25 · pulled 2026-10-01

• …an omni-OS NodeJS-based Remote Access Trojan capable of Remote Code Execution (RCE). One obfuscated code code fetches data via http://23.27.20.143:27017/$/boot using custom headers to download a telemetry capture and malware stager malware that is also a ~2500-line obfuscated script.…

  Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3) — Ransom-ISAC · under “Full Attack Chain” · published 2025-10-20 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

• 01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7 file hash
• 970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 file hash
• 154.91.0.103 IP address
• 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c smart contract address
• 0x9bc1355344b54dedf3e44296916ed15653844509 smart contract address
• 0x24622144ea31a93e38ae727792da8a016377f1c3d55fe5d6d51dcefd1aaee29b transaction hash
• 0x5c77567fcf00c317b8156df8e00838105f16fdd4fbbc6cd83d624225397d8856 transaction hash
• 0x86d1a21fd151e344ccc0778fd018c281db9d40b6ccd4bdd3588cb40fade1a33a transaction hash
• 0x8d31cc22ceb128ea1b70704f9cfdf2f87a60dac547101623e02c22ff014241a9 transaction hash
• 0xc2da361c40279a4f2f84448791377652f2bf41f06d18f19941a96c720228cd0f transaction hash
• 0xe2a54e1d101946e92b04a19fb14ca63a7a5a7af9841cee7f00e68995a2621a98 transaction hash
• 0xf93c0b6873f55eedccd12bc79781fc6d8b14f6c8e2b0e9d8f24f39b5294b6b6b transaction hash

All 17 indicators from this source