`203.234.192.200`

203.234.192.200 is an IP address that 4 published sources report in connection with Kimsuky and Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from wezard4u, ENKI and Foresiet. The earliest of those reports is dated 2025-08-15 and the most recent 2025-09-22.

ip address Kimsuky Konni MATCHED IN SOURCE

First seen 2025-08-15 · last seen 2025-09-22

Network

Kind	fixed line
Network	Korea Telecom (Hangyeoresinmunsa(ju))
Announced by	AS4766 Korea Telecom
Country	South Korea

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

…Spawn Chimera: The Hankyoreh 신문의 IP 주소(203.234.192.200)에 접근하기 위한 클라이언트 도구 TLS-Client-Hello 메시지의 ClientRandom 필드에 포트 노킹 방식 세 가지 VPN 서비스 비용을 지불하기 위해 Google Pay를 사용?…
북한 해킹 단체 김수키(Kimsuky) 한국 정부 및 군 기관 해킹 관련 APT Down: The North Korea Files 분석 — wezard4u · under “피싱용 유사 도메인 확보 및 VPS 서버 환경 구성” · published 2025-08-15 · pulled 2026-09-12
…The included readme.txt file contains instructions for using client.py and controller.py to connect to 203.234.192.200 , an IP address belonging to the South Korean news organization Hankyoreh . caption - content of readme.txt client.py uses a SOCKS5…
In-Depth Analysis of the APT Down - The North Korea Files leak — ENKI · under “1.4.2. SPAWN Family Client” · published 2025-09-22 · pulled 2026-09-12
…and The Hankyoreh newspaper The leak revealed a backdoor client named SpawnChimera hidden in a folder tied to IP 203.234.192.200 , which belongs to hani.co.kr — the infrastructure of The Hankyoreh , a liberal South Korean newspaper. This backdoor didn’t use normal…
Kimsuky APT Data Leak: Inside DPRK Cyber Espionage Tools — Foresiet · under “SpawnChimera and The Hankyoreh newspaper” · published 2025-08-28 · pulled 2026-09-12
…readme.txt 파일에는 client.py, controller.py를 사용하여 203.234.192.200 ip에 접속하는 방법이 적혀있으며 해당 ip는 한겨레 신문사의 ip 주소로 확인되었다. caption - readme.txt 파일 내용 client.py는 네트워크 트래픽을 터널링하기 위한 SOCKS5 프록시를 실행하고, client.py의…
APT Down - The North Korea Files 공개 자료 상세 분석 보고서 — ENKI · under “1.4.2. SPAWN Family Client” · published 2025-09-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 북한 해킹 단체 김수키(Kimsuky) 한국 정부 및 군 기관 해킹 관련 APT Down: The North Korea Files 분석

wezard4u lists 7 other indicators in this source. 5 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: In-Depth Analysis of the APT Down - The North Korea Files leak

ENKI lists 6 other indicators in this source. 4 are shown, chosen across types.

All 7 indicators from this source

Cited by the same report: Kimsuky APT Data Leak: Inside DPRK Cyber Espionage Tools

Foresiet lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source