← All actor clusters

62.113.118.157

62.113.118.157 is an IP address that 6 published sources report in connection with Konni, Kimsuky, APT37 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians, Rewterz, LAC and S2W. The earliest of those reports is dated 2024-07-31 and the most recent 2026-01-20.

ip address KonniKimsukyAPT37DPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2024-07-31 · last seen 2026-01-20

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …및 물가.hwp.lnk 185.231.154.22 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 2 첨부1_소명자료 목록(탈세제보).hwp.lnk 62.113.118.157 [RU] RT3AN7C9QS-7UYE-9K6G-A8F1-HY8IT3CNMEQP 3 첨부1_소명자료 목록(탈세제보).hwp.lnk 93.183.93.185 [RU]…

  AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-07-31 · pulled 2026-09-11

• …#AutoIt3Wrapper_Outfile= Lilith.a3x #AutoIt3Wrapper_AU3Check_Stop_OnWarning=y Global $server_ip = "62.113.118.157" Global $server_port = 80 Global $buffer_size = 1024 Global $mutexname =…

  경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석 — Genians · under “4-1. 사건 관련 목격자의 진술서.pdf.lnk” · published 2025-04-01 · pulled 2026-09-11

• …IP 62.113.118.157 192.109.119.113 185.231.154.22 93.183.93.185 94.103.87.212 MD5…

  North Korea-Linked Konni APT Group - Active IOCs - Rewterz — Rewterz · under “IP” · published 2025-04-03 · pulled 2026-09-12

• …IP 116.202.99.218 192.109.119.113 212.118.52.168 38.180.148.108 62.113.118.157 77.246.101.72 77.246.108.96 89.110.83.245 91.107.208.93 93.183.93.185 94.103.87.212 109.234.36.135…

  국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술 — Genians · under “IP” · published 2025-11-09 · pulled 2026-09-12

• …technology LTD 91.107.208.93 23.254.225.184 194.68.27.204 GSRAT 116.202.99.218 38.180.249.56 Hetzner Online GmbH M247 Europe SRL 62.113.118.157 • The threat actor abuses WordPress-based web sites as staging infrastructure • They also use multiple VPS and hosting services as C2…

  Konni’s New Arsenal: Unmasking GSRAT in North Korea-linked APT Operation — LAC · published 2026-01-20 · pulled 2026-09-12

• Nearby text:

  …p http://sibbss.com/upload.php http://oryzanine.com/index.php http://mq734121.info/index.php 93.183.93.185:57860 185.231.154.22:52720 62.113.118.157:57860 Threat Intelligence Apt North Korea Konni Punk 003 -- --…

  Threat Tracking: Analysis of puNK-003’s Lilith RAT ported to AutoIt Script — S2W · under “Network” · published 2024-08-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석

Genians lists 12 other indicators in this source. 5 are shown, chosen across types.

• no-reply.trustmaster@hometax.go.kr email address
• 61f65bd593ea0e52ac0dfdc6bc9cd73a file hash
• 87dc4c8f67cffc8a9699328face923e2 file hash
• 93.183.93.185 IP address
• 94.103.87.212 IP address

All 13 indicators from this source

Cited by the same report: 경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석

Genians lists 18 other indicators in this source. 4 are shown, chosen across types.

• 3a9c98fb76aaa4f440c059334b585585 file hash
• 6e1ce18cb9065bf0ea91fc5c2817e941 file hash
• 7449b3528dffeb2babfc113308e47bb7 file hash
• 185.231.154.22 IP address

All 19 indicators from this source

Cited by the same report: North Korea-Linked Konni APT Group - Active IOCs - Rewterz

Rewterz lists 13 other indicators in this source. 3 are shown, chosen across types.

• 456987068ff42f8db6ff8e3af8b82e785b010c7f file hash
• d0544a045aae0e316380b57a7319ec54f7f0979a7882f33a15839311c7e29888 file hash
• d5669c046c78f54d2acb353626bb3bcf file hash

All 14 indicators from this source