`185.153.182.241`

185.153.182.241 is an IP address that 7 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Henrique Marcomini (Medium), Logpresso, Socket, NVISO, Security Scorecard, IGLOO Security and JPCERT/CC. The earliest of those reports is dated 2024-12-26 and the most recent 2026-11-09.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2024-12-26 · last seen 2026-11-09

Network

Kind	proxy or VPN
Network	WorkTitans B.V. (WorkTitans B.V)
Announced by	AS209847 WorkTitans B.V.
Country	Turkey
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

Transcribed by hand on 27 September 2026 from a post the scraper cannot read because Medium answers it with a bot check. A user offered a job through LinkedIn was given the Bitbucket repository voting-dapp, under an account named coinbase2024, as the hiring challenge. The post deobfuscates the BeaverTail loader and InvisibleFerret payloads it carried and gives their command-and-control address, 185.153.182.241 on port 1224, which other reporting this site holds already ties to the same activity. The post itself attributes only through the malware families, which it notes are commonly attributed to DPRK groups and tracked as Contagious Interview. The author's own analysis repository, team-bytesized/article_dprk_12_2024, is research and is not carried.
medium.com/@henrique4win/analyzing-north-korean-malware-95dc3325d943 — Henrique Marcomini (Medium) · under “coinbase2024 voting-dapp interview repository (Henrique Marcomini)” · published 2024-12-26 · pulled 2026-09-27
…1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…
[위협 분석] 북한 라자루스(Lazarus) 그룹이 배포한 악성 npm 패키지 감염 사례 | 로그프레소 — Logpresso · under “IP” · published 2025-03-17 · pulled 2026-09-12
…One of the packages published by wishorn , a newly created npm account, uses the same obfuscated C2 IP address — 185.153.182.241 on port 1224 — within the dev-debugger-vite package.…
Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads | Socket — Socket · under “Malicious Campaign Proliferation #” · published 2025-04-04 · pulled 2026-09-12
…147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242…
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12
…185.153.182.241 Dec 2024 December Campaigns 86.104.74.51 November 2024 Spoofed domain: sageskills-uk.com.…
Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign — Security Scorecard · under “Infrastructure and Operation” · published 2025-01-29 · pulled 2026-09-12
…패키지 14종 내 BeaverTail 악성코드 난독화 해제 후 요청하는 C2를 확인한 결과 같은 C2 주소 사용, 1224 Port와 /client 이후 유사한 형식의 URI를 사용하는 것으로 확인 ○ dev-debugger-vite의 C2인 185.153.182.241의 경우 2024년 12월부터 Lazarus가 진행중인 정보탈취 목적의 ‘Phantom Circuit’에서 사용된 이력을 확인 ○ C2 주소에 URL을 사용하는 경우 새로운 유포 방식을 테스트하기 위한 목적으로 보여 Lazarus가 테스트 및…
북한 위협 행위자 Contagious Interview 캠페인 분석(2보) — IGLOO Security · under “3.3 BeaverTail 악성코드 분석” · published 2025-05-13 · pulled 2026-09-12
…2.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: medium.com/@henrique4win/analyzing-north-korean-malware-95dc3325d943

Henrique Marcomini (Medium) lists 1 other indicator in this source.

Cited by the same report: [위협 분석] 북한 라자루스(Lazarus) 그룹이 배포한 악성 npm 패키지 감염 사례 | 로그프레소

Logpresso lists 10 other indicators in this source. 6 are shown, chosen across types.

All 11 indicators from this source

Cited by the same report: Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads | Socket

Socket lists 16 other indicators in this source. 5 are shown, chosen across types.

All 17 indicators from this source