87.236.177.9
87.236.177.9 is an IP address
that 3 published sources report
in connection with Contagious Interview and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from NTT Security Japan and Red Asgard.
The earliest of those reports is dated 2026-01-23 and the most recent 2026-03-17.
ip address Contagious InterviewLazarus Group CURATED
Network
| Kind | data centre |
|---|---|
| Network | EUROHOSTER Ltd. |
| Announced by | AS207728 Virterion LLC |
| Country | The Netherlands |
| Flags | hosting range |
Sources
-
StoatWaffle command-and-control server reported by NTT Security Japan, reached by the modular Node.js loader that blockchain-themed Visual Studio Code lure projects installed. NTT attributes StoatWaffle to WaterPlum, its name for the Contagious Interview operators.
StoatWaffle, malware used by WaterPlum — NTT Security Japan -
…think it necessary to pay close attention to their activities. IoC 185.163.125.196 147.124.202.208 163.245.194.216 66.235.168.136 87.236.177.9 記事をシェアする 前の記事 WaterPlumが使用するマルウェアStoatWaffleについて CARO Workshop 2026 登壇レポート 次の記事 セキュリティナレッジ一覧へ戻る 関連記事 / おすすめ記事…
StoatWaffle, malware used by WaterPlum — NTT Security Japan -
…, ~/.aws/ , ~/.gnupg/ Kill Switch: If C2 returns responseCode == '-1' , all processes terminate. Exfiltration target: http://87.236.177.9:3000/api/errorMessage The Authentication Backdoor Line 39 of server/controllers/auth.js contains a subtle but critical backdoor:…
Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain — Red Asgard -
…OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active 87.236.177.9 3000 BeaverTail C2 (env08539) Active Domains Domain Role Status elvengold.com Lure domain Active email.tokenloopz.com Lure…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.