192.119.64.43
192.119.64.43 is an IP address
that 3 published sources report
in connection with APT38, unclustered DPRK and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from SentinelOne, Elastic Security Labs and Elastic Security Labs (GitHub indicator release).
The earliest of those reports is dated 2023-11-01 and the most recent 2026-10-18.
ip address APT38DPRK (cluster unattributed)Lazarus Group MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | HostPapa |
| Announced by | AS54290 HostPapa |
| Country | United States |
| Flags | hosting range |
Sources
-
…/tp-globa.xyz/OdhLca1mLUp/lZ5rZPxWsh/7yZKYQI43S/fP7savDX6c/bfC http://swissborg.blog/zxcv/bnm 23.254.226.90 104.168.214.151 142.11.209.144 192.119.64.43 File paths…
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads | SentinelOne — SentinelOne -
…in an attempt to appear more legitimate to the victims of the intrusion. tp-globa.xyz , as of this writing, resolves to an IP address ( 192.119.64.43 ) that has been observed distributing malware attributed to the DPRK’s Lazarus Group ( 1 , 2 , 3 ). 23.254.226.90 23.254.226.90 is the…
Elastic catches DPRK passing out KANDYKORN — Elastic Security Labs -
…"type": "domain-name"}}} {"threat": {"indicator": {"description": "Simple indicator of observable {192.119.64.43}", "ip": ["192.119.64.43"], "marking": {"tlp": "clear"}, "reference":…
KANDYKORN, SUGARLOADER and HLOADER indicators — Elastic Security Labs (GitHub indicator release)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.