`23.27.13.135`

23.27.13.135 is an IP address that 8 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview, unclustered DPRK and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), OpenSourceMalware, Mal Beacon, Isotope13, Socket, SlowMist, SafeDep and BlueCyber. The earliest of those reports is dated 2026-08-02 and the most recent 2026-10-18.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x171b0d87171b0d8768656c6c6f6970626f742121`	Etherscan	Wallet, ethereum		NullReceiver	2026-08-22	2026-08-27
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-08-22	2026-08-27

ip address EtherHiding / UNC5342NullReceiverContagious InterviewDPRK (cluster unattributed)PolinRider CURATED

First seen 2026-08-02 · last seen 2026-10-18

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

Command-and-control IP decoded from the NullReceiver destination address the resolver wallet pointed to between 2026-08-22 and 2026-08-27. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolved to during that window, not as a host this site has observed serving anything. Unlike the other two addresses in this rotation it does not sit in 166.88.0.0/16.
Ethereum transaction 0x2f185dbd85a69dcd693524089448a77606c7e5df475fa3a2467b1560835561c4 — Chollima Hunter (on-chain observation) · published 2026-08-22 · pulled 2026-09-03
Command-and-control IP decoded from the NullReceiver destination address the resolver wallet pointed to between 2026-08-22 and 2026-08-27. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolved to during that window, not as a host this site has observed serving anything. Unlike the other two addresses in this rotation it does not sit in 166.88.0.0/16.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-09-03
…access and first stage (27 August) 14:33 A Node.js loader in a malicious pybitjs repo is executed and beacons to the operator C2 at 23.27.13.135.…
Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack — Mal Beacon · under “Timeline of Operation Activity” · published 2026-09-09 · pulled 2026-09-12
…That wallet has been publishing an address every 15 minutes or so since late July, rotating through 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , and 193.247.144.38 .…
BindsNET repository carried a forged merge commit that ran malware on folder open — Isotope13 · under “BindsNET repository carried a forged merge commit that ran malware on folder open” · published 2026-08-29 · pulled 2026-09-12
…# 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 - tailwind.config.js…
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Socket — Socket · under “Resolved C2 IP Addresses #” · published 2026-09-17 · pulled 2026-09-29
…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in full size…
PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager — SlowMist · under “From a Single Line of Configuration to On-Chain Resolution” · published 2026-09-21 · pulled 2026-10-01
…servers, and every server is on AS149440 Evoxt: Active (UTC) C2 2026-07-25 to 2026-08-22 166.88.134.62 2026-08-22 to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The second Ethereum wallet” · published 2026-09-30 · pulled 2026-10-02
…Tài khoản npm: npmuser1101 , npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Ethereum transaction 0x2f185dbd85a69dcd693524089448a77606c7e5df475fa3a2467b1560835561c4

Chollima Hunter (on-chain observation) lists 1 other indicator in this source.

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 6 are shown, chosen across types.

All 16 indicators from this source

Cited by the same report: Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack

Mal Beacon lists 3 other indicators in this source.