← Remote Workers

vhdcore/Disk2vhd

vhdcore/Disk2vhd is a malicious repository that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The reports are dated 2026-04-14.

malicious repository EtherHiding / UNC5342DPRK (cluster unattributed) CURATED Taken down checked 2026-10-05

First seen 2026-04-14 · last seen 2026-04-14

Sources

• GitHub facade repository Atos lists as spoofing Disk2vhd to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.

  EtherRAT-appendixes (IoCs/malicious_github_repos.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• GitHub facade repository Atos lists as spoofing Disk2vhd to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.

  EtherRAT distribution: spoofing administrative tools via GitHub facades — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every malicious repository this site holds under Malicious repositories in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/malicious_github_repos.csv)

Atos Threat Research Center lists 96 other indicators in this source. 7 are shown, chosen across types.

• 91.215.85.42 IP address
• 91.221.190.12 IP address
• vmlets/VMware-Tools malicious repository
• 0xa5b51ef13d070026da68618774054eaa1e49aa30 smart contract address
• 0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e smart contract address
• 0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610 cryptocurrency wallet address
• 0xd9afc5c883f45206c916d8e312c2d9f13766344d cryptocurrency wallet address

All 97 indicators from this source

Cited by the same report: EtherRAT distribution: spoofing administrative tools via GitHub facades

Atos Threat Research Center lists 44 other indicators in this source. 5 are shown, chosen across types.

• 135.125.255.55 IP address
• winlabel/BgInfo malicious repository
• xferwiz/Transwiz malicious repository
• 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 smart contract address
• 0x37ef6e88425613564b2cf8adc496acff4b6481a9 cryptocurrency wallet address

All 45 indicators from this source