← All actor clusters

185.231.154.22

185.231.154.22 is an IP address that 5 published sources report in connection with Konni and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians, Rewterz, LAC and S2W. The earliest of those reports is dated 2024-07-31 and the most recent 2026-01-20.

ip address KonniDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2024-07-31 · last seen 2026-01-20

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …자동 제작 도구까지 개발해 공격에 활용하고 있습니다. No File Name AutoIt Script C2 Mutex 1 시장통제 관련 내부 동향 및 물가.hwp.lnk 185.231.154.22 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 2 첨부1_소명자료 목록(탈세제보).hwp.lnk 62.113.118.157 [RU]…

  AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-07-31 · pulled 2026-09-11

• …○ 참고로 ' 62.113.118.157 ', ' 185.231.154.22 ', ' 93.183.93.185 ', ' 94.103.87.212 ' C2는 2024년부터 AutoIt 악성 스크립트를 이용한 통신 주소로 계속 관찰되고 있는 상황입니다.…

  경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석 — Genians · under “4-1. 사건 관련 목격자의 진술서.pdf.lnk” · published 2025-04-01 · pulled 2026-09-11

• …IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5…

  North Korea-Linked Konni APT Group - Active IOCs - Rewterz — Rewterz · under “IP” · published 2025-04-03 · pulled 2026-09-12

• …Lilith RAT 94.103.87.212 C2 Custom Lilith RAT 93.183.93.185 C2 Custom Lilith RAT 185.231.154.22 C2 Custom Lilith RAT 91.107.208.93 C2 Custom Lilith RAT accuses.org C2 AutoIt Amadey kpcserver.com C2 AutoIt Amadey 47 © 2026 LAC Co.,…

  Konni’s New Arsenal: Unmasking GSRAT in North Korea-linked APT Operation — LAC · published 2026-01-20 · pulled 2026-09-12

• Nearby text:

  …/storkse.com/upload.php http://sibbss.com/upload.php http://oryzanine.com/index.php http://mq734121.info/index.php 93.183.93.185:57860 185.231.154.22:52720 62.113.118.157:57860 Threat Intelligence Apt North Korea Konni Punk 003 --…

  Threat Tracking: Analysis of puNK-003’s Lilith RAT ported to AutoIt Script — S2W · under “Network” · published 2024-08-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석

Genians lists 12 other indicators in this source. 5 are shown, chosen across types.

• no-reply.trustmaster@hometax.go.kr email address
• 16eb2cceb920319eaddd5d7b85483cc4 file hash
• 61f65bd593ea0e52ac0dfdc6bc9cd73a file hash
• 5.161.182.109 IP address
• 5.75.181.118 IP address

All 13 indicators from this source

Cited by the same report: 경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석

Genians lists 18 other indicators in this source. 4 are shown, chosen across types.

• 1827287811ef97153d0ea850673ecec1 file hash
• 29b0a6b9608540b9446c0fb14a36f0b0 file hash
• 192.109.119.113 IP address
• 62.113.118.157 IP address

All 19 indicators from this source

Cited by the same report: North Korea-Linked Konni APT Group - Active IOCs - Rewterz

Rewterz lists 13 other indicators in this source. 3 are shown, chosen across types.

• 3872ff7378ab6b155c9af26285f1a9ff9d496f76 file hash
• 456987068ff42f8db6ff8e3af8b82e785b010c7f file hash
• 93.183.93.185 IP address

All 14 indicators from this source