← Remote Workers

147.124.212.125

147.124.212.125 is an IP address that 5 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Red Asgard and Recorded Future. The earliest of those reports is dated 2026-01-12 and the most recent 2026-10-18.

ip address Contagious InterviewLazarus Group MATCHED IN SOURCE

First seen 2026-01-12 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …Stage 2: Dedicated C2 Servers IP Hostname ASN Role 147.124.213.232 WR232 AS396073 (Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router…

  Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure — Red Asgard · under “Stage 2: Dedicated C2 Servers” · published 2026-01-12 · pulled 2026-09-12

• …Primary C2 (env08539) codeviewer-three.vercel.app Domain Vercel C2 (31df390f0305) 11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active socket C2 0xad031E8d8877481337cD53E141C16A2201BB6F4d…

  Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain — Red Asgard · under “Network Indicators” · published 2026-01-23 · pulled 2026-09-12

• …1224 Primary operator C2 Active 95.164.17.24 1224 AnyDesk RAT C2 Active 147.124.213.232 1244 BeaverTail victim C2 Active 147.124.212.125 1244 BeaverTail victim C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail +…

  Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12

• …144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181…

  PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12

• …The same physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178,…

  Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard lists 8 other indicators in this source. 5 are shown, chosen across types.

• 147.124.213.232 IP address
• 216.250.251.87 IP address
• 45.43.11.199 IP address
• https://pastebin.com/u/CrackEden1251_WaitsRenee9809 payload URL
• https://pastebin.com/u/KerrWhale2274_KnowNtsc6785 payload URL

All 9 indicators from this source

Cited by the same report: Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain

Red Asgard lists 7 other indicators in this source. 4 are shown, chosen across types.

• 45.59.163.55 IP address
• 66.235.168.238 IP address
• 0xa80db78ff597c3d34ccaf3bdac39f3e193595561 cryptocurrency wallet address
• 0xad031e8d8877481337cd53e141c16a2201bb6f4d cryptocurrency wallet address

All 8 indicators from this source

Cited by the same report: Hunting Lazarus Part IV: Real Blood on the Wire

Red Asgard lists 7 other indicators in this source. 3 are shown, chosen across types.

• 172.86.105.40 IP address
• 172.86.116.178 IP address
• 86.106.85.234 IP address

All 8 indicators from this source