144.76.109.61
144.76.109.61 is an IP address
that 3 published sources report
in connection with Kimsuky and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from NTT Security Japan, UN Security Council Panel of Experts (1718 Committee) and S2W.
The earliest of those reports is dated 2023-10-30 and the most recent 2024-11-01.
ip address KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Hetzner Online GmbH |
| Announced by | AS24940 Hetzner Online GmbH |
| Country | Germany |
| Flags | hosting range |
Sources
-
…通信先 159.100.13.216 144.76.109.61 参考文献 [1] JPCERT/CC Eyes, "日本の組織を狙った攻撃グループKimsukyによる攻撃活動", https://blogs.jpcert.or.jp/ja/2024/07/kimsuky.html [2] Genians, "페이스북과…
標的型攻撃グループDarkPlumが使用するAsyncRATの亜種について — NTT Security Japan -
…Additional information on Kimsuky According to a cybersecurity company, the IP address of the Kimsuky server hosting this malware i s 144.76.109.61 and the IP address of another, related server hosting the Kimsuky-controlled domain civilarys.store is 27.255.81.77 .…
access — UN Security Council Panel of Experts (1718 Committee) -
…Acquired APK classification The 144.76.109.61 server operated by the attacker at the time was directory listed, allowing us to see all of the files uploaded to it, which further…
FastViewer Variant Merged with FastSpy and disguised as a Legitimate Mobile Application — S2W
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.