← All actor clusters

52.177.14.24

52.177.14.24 is an IP address that 3 published sources report in connection with Kimsuky and Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESTsecurity ALYac and Genians. The earliest of those reports is dated 2020-11-22 and the most recent 2024-06-05.

ip address KimsukyKonni MATCHED IN SOURCE

First seen 2020-11-22 · last seen 2024-06-05

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …rneail.com bitcoin018@hanmail.net Annie Cho securitycounci1report.org servicenidnaver.com un.midsecurity.org N/A (52.177.14.24) app-wallet.com - MS Thallium bitcoin025@hanmail.net Annie Cho bigwnet.com - MS Thallium Yoichi Shimada…

  [스페셜 리포트] 탈륨(김수키)과 코니 APT 그룹의 연관관계 분석 Part3 — ESTsecurity ALYac · under “본문” · published 2020-11-22 · pulled 2026-09-12

• …d.php?na=battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/ d.php?na=battmp 162.0.209.27 [US] 52.177.14.24 [US] [표 5] 보안 업체별 'battmp' 사용 사례 비교 ○ GSC는 분석 당시 C2 서버에 명령어가 등록된 화면을 확인할 수 있었습니다. [그림 10] C2 서버 웹 페이지 화면 ○ 'qwer.gif'…

  외신 인터뷰 의뢰 사칭 김수키 공격 발견 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-06-05 · pulled 2026-09-12

• …joongang.site/pprb/sec/d.php?na= battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/d.php?na= battmp 162.0.209.27 [US] 52.177.14.24 [US] [표 5] 보안 업체별 'battmp' 사용 사례 비교 ○ 센티넬원 분석 보고서에 따르면, 대북 정보분석 전문 미국기업 Korea Risk Group (KRG)의 직원을 표적으로 삼은 공격 사례에 대해 자세히…

  페이스북과 MS관리콘솔을 활용한 Kimsuky APT 공격 발견 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-05-10 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: [스페셜 리포트] 탈륨(김수키)과 코니 APT 그룹의 연관관계 분석 Part3

ESTsecurity ALYac lists 20 other indicators in this source. 5 are shown, chosen across types.

• pigcoin2020@hotmail.com email address
• psh1968216@daum.net email address
• tiger199392@daum.net email address
• 193.148.16.45 IP address
• 91.235.116.144 IP address

All 21 indicators from this source

Cited by the same report: 외신 인터뷰 의뢰 사칭 김수키 공격 발견

Genians lists 9 other indicators in this source. 4 are shown, chosen across types.

• cb82751ae9f84709268fd5e5b135b74e file hash
• d87ba0743c3de99f02b277068b9aea95 file hash
• 162.0.209.27 IP address
• 89.40.173.131 IP address

All 10 indicators from this source

Cited by the same report: 페이스북과 MS관리콘솔을 활용한 Kimsuky APT 공격 발견

Genians lists 12 other indicators in this source. 3 are shown, chosen across types.

• a12757387f178a0ec092fb5360e4f473 file hash
• b5080c0d123ce430f1e28c370a0fa18b file hash
• 69.163.180.70 IP address

All 13 indicators from this source