← All actor clusters

45.11.59.140

45.11.59.140 is an IP address that 2 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from SentinelOne and MichaelKoczwara. The earliest of those reports is dated 2026-09-18 and the most recent 2026-11-07.

ip address Lazarus GroupAPT38 MATCHED IN SOURCE

First seen 2026-09-18 · last seen 2026-11-07

Network

Looked up 2026-09-29 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …and nohup …/iSync –type=renderer 2026-03-29 05:00:55 C2 connection SystemUpdate => technicais (176.97.114.232), iSync => hubpage (45.11.59.140), Telegram at 05:00:58 2026-03-29 05:00:58 Implant re-arm xattr -rd com.apple.quarantine + chmod +x on iSync (GatekeeperBypass)…

  Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne — SentinelOne · under “Infection Timeline” · published 2026-09-18 · pulled 2026-09-29

• …and support my work. Subscribe SentinelOne lists two IP/domain pairs as ROOFDECK C2s: 85.137.56.245 — grenight.com 45.11.59.140 — storage.hubpage.cloud Searching for the same certificate issuer found 213.111.148.242 .…

  Tracking Lazarus Group TraderTraitor Infrastructure Through Certificates and Historical Records — MichaelKoczwara · under “TL;DR” · published 2026-11-07 · pulled 2026-11-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

SentinelOne lists 12 other indicators in this source. 7 are shown, chosen across types.

• 1cd6d13ff15adbf7a42025d10ec99b4a file hash
• 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa file hash
• 5728b11d30586bbfc1d8bd12df1c722a06e767a2 file hash
• https://github.com/chainstacker GitHub account
• https://github.com/exubient0 GitHub account
• 85.137.56.10 IP address
• 85.137.56.245 IP address

All 13 indicators from this source

Cited by the same report: Tracking Lazarus Group TraderTraitor Infrastructure Through Certificates and Historical Records

MichaelKoczwara lists 18 other indicators in this source. 5 are shown, chosen across types.

• 37ec4665a8102d115ffd1ac20dae94c98b4dac64b0c1a68228aa2a531caeb35d file hash
• 3b87a8b5867c89d2943eeb518436a11c335972ed3f962506025ef4e20bdbfad6 file hash
• 7350cb4703a96ea7c140bd30da9a6d1bcff36eb2 file hash
• 45.11.59.184 IP address
• 45.11.59.99 IP address

All 19 indicators from this source