`185.208.158.208`

185.208.158.208 is an IP address that 2 published sources report in connection with Andariel and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist and Threatray. The earliest of those reports is dated 2021-06-15 and the most recent 2021-12-22.

ip address Andariel Lazarus Group MATCHED IN SOURCE

First seen 2021-06-15 · last seen 2021-12-22

Network

Kind	data centre
Network	Global-Data System IT Corporation
Country	Switzerland
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Third stage C2 servers 198.55.119.112:443 45.58.112.77:443 23.229.111.197:8443 23.229.111.197:443 185.208.158.208:443 MITRE ATT&CK Mapping Tactic Technique Technique Name Resource Development T1584.006 T1583.003 Compromise…
Andariel evolves to target South Korea with ransomware | Securelist — Kaspersky Securelist · under “Indicators of compromise” · published 2021-06-15 · pulled 2026-09-12
…52.202.193.124 ed11e94fd9aa3c7d4dd0b4345c106631fe52929c6e26a0daec2ed7d22e47ada0 x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 185.208.158.208 fec82f2542d7f82e9fce3e16bfa4024f253adee7121973bd9d67a3c79441b83c x64 RAT (3rd stage) RAT-KrCERT-x64 (TigerRAT) 185.208.158.208…
Establishing the TigerRAT and TigerDownloader malware families — Threatray · under “Extracted C2s” · published 2021-12-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Andariel evolves to target South Korea with ransomware | Securelist

Kaspersky Securelist lists 6 other indicators in this source.

Cited by the same report: Establishing the TigerRAT and TigerDownloader malware families

Threatray lists 5 other indicators in this source. 3 are shown, chosen across types.

All 6 indicators from this source