OSINT - HIDDEN COBRA – North Korean Trojan: Volgmer
This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a Trojan malware variant used by the North Korean government—commonly known as Volgmer. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra. FBI has high confidence that HIDDEN COBRA actors are using the IP addresses—listed in this report’s IOC files—to maintain a presence on victims’ networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to North Korean government malicious cyber activity.
AI Analysis
Technical Summary
The Volgmer Trojan is a malware variant attributed to the North Korean state-sponsored threat actor group commonly known as HIDDEN COBRA or Lazarus Group. This malware is used to maintain persistent access within victim networks, enabling further exploitation and intelligence gathering. The U.S. Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) have identified specific IP addresses and indicators of compromise (IOCs) associated with Volgmer, which are used by the threat actors to establish and sustain their presence on targeted systems. Volgmer operates as a backdoor Trojan, allowing remote attackers to execute arbitrary commands, exfiltrate data, and potentially deploy additional malicious payloads. The malware's use by a nation-state actor indicates a high level of sophistication and targeted intent, often focusing on strategic or sensitive sectors. Although the technical alert does not specify affected software versions or detailed infection vectors, the malware's persistence and network exploitation capabilities make it a significant threat for organizations that may be targeted for espionage or disruption. The alert emphasizes the importance of monitoring the identified IP addresses to detect and mitigate ongoing or attempted intrusions by HIDDEN COBRA actors.
Potential Impact
For European organizations, the presence of Volgmer represents a risk primarily to confidentiality and integrity of sensitive information. Given the malware's backdoor capabilities, attackers can exfiltrate intellectual property, government secrets, or critical business data. The threat is particularly relevant to sectors such as government agencies, defense contractors, critical infrastructure, and high-tech industries, which are often targets of North Korean cyber espionage. The malware's ability to maintain persistence and facilitate further exploitation could lead to prolonged undetected access, increasing the risk of data breaches and operational disruptions. Although the alert categorizes the severity as low, the strategic nature of the threat actor and potential for targeted attacks means that impact could be significant if successful intrusions occur. European organizations with limited cybersecurity monitoring or those lacking threat intelligence integration may be more vulnerable to such threats.
Mitigation Recommendations
1. Implement proactive network monitoring to detect and block communications with the known IP addresses associated with Volgmer, leveraging threat intelligence feeds from DHS, FBI, and trusted cybersecurity partners. 2. Employ advanced endpoint detection and response (EDR) solutions capable of identifying unusual process behaviors indicative of backdoor activity. 3. Conduct regular threat hunting exercises focused on detecting persistence mechanisms and lateral movement within networks. 4. Harden network segmentation to limit the spread of malware and restrict access to sensitive systems. 5. Ensure timely application of security patches and updates to all software and firmware, even though no specific vulnerable versions are identified, to reduce attack surface. 6. Train security teams to recognize indicators of compromise related to HIDDEN COBRA activity and establish incident response plans tailored to nation-state threats. 7. Collaborate with national cybersecurity centers and share intelligence on observed activity to enhance collective defense. 8. Restrict administrative privileges and enforce multi-factor authentication to reduce the risk of credential compromise facilitating malware deployment.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Belgium, Poland, Sweden, Finland
Indicators of Compromise
- file: MAR-10135536-D_WHITE_S508C.PDF
- hash: 143cb4f16dcfc16a02812718acd32c8f
- hash: 1ecd83ee7e4cfc8fed7ceb998e75b996
- hash: 35f9cfe5110471a82e330d904c97466a
- hash: 5dd1ccc8fb2a5615bf5656721339efed
- hash: 81180bf9c7b282c6b8411f8f315bc422
- hash: e3d03829cbec1a8cca56c6ae730ba9a8
- ip: 103.16.223.35
- ip: 113.28.244.194
- ip: 116.48.145.179
- ip: 186.116.9.20
- ip: 186.149.198.172
- ip: 195.28.91.232
- ip: 195.97.97.148
- ip: 199.15.234.120
- ip: 200.42.69.133
- ip: 203.131.222.99
- ip: 210.187.87.181
- ip: 83.231.204.157
- ip: 84.232.224.218
- ip: 89.190.188.42
- hash: b6214e428fa300398d713f342dd73720
- hash: ccee43451bf78c75c2a487a75245aed2
- hash: 921b3440b4b8a40600f0d733db4fdca8
- hash: 2211eee046bd996c987599e0cbe6e1cc
- hash: e12b92a1aeeb53d25ac14b4be573e860
- hash: 8f4d22d26031119928449f856466da0a
- hash: 74a2bd172adaf6d5964d238371ba9f4e
- hash: 9f849d9f0bb48924b8f04e47a36b59c4
- hash: 07768f7af89f774cbeaa36bf80d68dd9
- hash: 68fe7330ba22a7f4f9a4b7c2582a803a
- hash: 74c867b7fa902e50761d82dfe59ee255
- hash: e1d6628e550c3c99207d85828a6cd932
- hash: eb005743ac215eb0f146227f3480e6e9
- hash: a92c0e7aeced10cc835d04f072c44c5d
- hash: c83f6ab61a65902e9b94f8fa0c93fa07
- hash: 6e50576388df1a686f37bd49ea0542e4
- hash: 686c6badf362b2716ea522a2357991fd
- hash: e1b62318f465d0a1e7b5e98574456f62
- hash: 12c4003f6526b045c92e9fa4cf3da2f9
- hash: 6a0443b1df33fdb22fe2068751f9f007
- hash: 819f69a104b87fb32f61b9853df8a9be
- hash: 9a6eb9c39222d2a6358f6c2adeabcf87
- hash: 0c73039cd8388fd8c45b8367398f2ce6
- hash: a8b3c39fdf381c29d7e2a9f1a46ddfdd
- hash: a7cf4e7d72c146b5abc2bfb31ad7ccfc
- hash: 762fc1698ef3b6b4577f8dc8872dcac5
- hash: 4911328ef1c6ec0210fa3b92fe556efe
- ip: 199.68.196.125
- ip: 109.68.120.179
- ip: 85.132.123.50
- ip: 80.95.219.72
- ip: 88.201.64.185
- ip: 103.10.55.35
- ip: 45.124.169.36
- ip: 222.44.80.138
- ip: 61.153.146.207
- ip: 41.131.164.156
- ip: 82.129.240.148
- ip: 82.201.131.124
- ip: 31.146.82.22
- ip: 103.27.164.10
- ip: 103.27.164.42
- ip: 112.133.214.38
- ip: 114.79.141.59
- ip: 115.115.174.67
- ip: 115.178.96.66
- ip: 115.249.29.78
- ip: 117.211.164.245
- ip: 117.218.84.197
- ip: 117.239.102.132
- ip: 117.239.144.203
- ip: 117.240.190.226
- ip: 117.247.63.127
- ip: 117.247.8.239
- ip: 118.67.237.124
- ip: 125.17.79.35
- ip: 125.18.9.228
- ip: 14.102.46.3
- ip: 14.139.125.214
- ip: 14.141.129.116
- ip: 180.211.97.186
- ip: 182.156.76.122
- ip: 182.72.113.90
- ip: 182.73.165.58
- ip: 182.73.245.46
- ip: 182.74.42.194
- ip: 182.77.61.231
- ip: 183.82.199.174
- ip: 183.82.33.102
- ip: 203.110.91.252
- ip: 203.196.136.60
- ip: 203.88.138.79
- ip: 43.249.216.6
- ip: 45.118.34.215
- ip: 139.255.62.10
- ip: 128.65.184.131
- ip: 128.65.187.94
- ip: 178.248.41.117
- ip: 185.113.149.239
- ip: 185.115.164.86
- ip: 185.46.218.77
- ip: 213.207.209.36
- ip: 217.218.90.124
- ip: 217.219.193.158
- ip: 217.219.202.199
- ip: 37.235.21.166
- ip: 37.98.114.90
- ip: 78.38.114.15
- ip: 78.38.182.242
- ip: 78.39.125.67
- ip: 80.191.171.32
- ip: 85.185.30.195
- ip: 85.9.74.159
- ip: 89.165.119.105
- ip: 91.106.77.7
- ip: 91.98.112.196
- ip: 91.98.126.92
- ip: 91.98.36.66
- ip: 94.183.177.90
- ip: 95.38.16.188
- ip: 27.114.187.37
- ip: 116.90.226.67
- ip: 113.203.238.98
- ip: 115.186.133.195
- ip: 182.176.121.244
- ip: 182.187.139.132
- ip: 37.216.67.155
- ip: 84.235.85.86
- ip: 103.241.106.15
- ip: 203.118.42.155
- ip: 58.185.197.210
- ip: 123.231.112.147
- ip: 222.165.146.86
- ip: 122.146.157.141
- ip: 140.136.205.209
- ip: 110.77.137.38
- ip: 118.175.22.10
- ip: 125.25.206.15
- ip: 203.147.10.65
- ip: 58.82.155.98
- ip: 61.91.47.142
- ip: 185.134.98.141
- link: https://www.us-cert.gov/ncas/alerts/TA17-318B
- comment: This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a Trojan malware variant used by the North Korean government—commonly known as Volgmer. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra. FBI has high confidence that HIDDEN COBRA actors are using the IP addresses—listed in this report’s IOC files—to maintain a presence on victims’ networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to North Korean government malicious cyber activity.
- hash: e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2
- link: https://www.virustotal.com/file/e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2/analysis/1510736372/
- hash: 1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d
- link: https://www.virustotal.com/file/1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d/analysis/1510736339/
- hash: 6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1
- link: https://www.virustotal.com/file/6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1/analysis/1510794755/
- hash: eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5
- link: https://www.virustotal.com/file/eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5/analysis/1510776348/
- hash: ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd
- link: https://www.virustotal.com/file/ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd/analysis/1510776360/
- hash: 9a5fa5c5f3915b2297a1c379be9979f0
- hash: 2d2b88ae9f7e5b49b728ad7a1d220e84
- hash: ba8c717088a00999f08984408d0c5288
- hash: 1b8ad5872662a03f4ec08f6750c89abc
- hash: e034ba76beb43b04d2ca6785aa76f007
- hash: eb9db98914207815d763e2e5cfbe96b9
- hash: 1ecd83ee7e4cfc8fed7ceb998e75b996
- float: 7.00782518905
- file: 1ecd83ee7e4cfc8fed7ceb998e75b996
- hash: eddb7228e2f8b7a99c4c32a743504ed3c16b5ef3
- ssdeep: 3072:Kn13mR+uvEuCBlMclG4te7DFQstzN29ZfyXZM5QVj+XZ4dC:KneZvrRclG4mF5qZfyO2AJWC
- size-in-bytes: 131072
- hash: 81180bf9c7b282c6b8411f8f315bc422
- float: 1.69870551288
- hash: c9b703cbc692977dfa0fe7b82768974f17dbf309
- ssdeep: 3:3l/l/0P5BQCfqgFwylTDRv9tWpdYYg11MBMs5v Y6Pw/l/lN:3tlMP5BQCigFwyFDlWzYn1FF6PQ/
- size-in-bytes: 546
- hash: 5dd1ccc8fb2a5615bf5656721339efed
- float: 6.09092146887
- file: 5dd1ccc8fb2a5615bf5656721339efed
- hash: 1b247442e28d9d72cb0c1a6e7dfbcd092829ee6d
- ssdeep: 1536:VWzaaYA98ReypyDfOyzrj5b6T9LN52GoDCK RRpyJutZTgMJ:gaS98ppkj5b0DBSCscJuthg
- size-in-bytes: 110592
- hash: 143cb4f16dcfc16a02812718acd32c8f
- float: 5.74626869405
- file: 143cb4f16dcfc16a02812718acd32c8f
- hash: f8397d940a204a2261dba2babd6e0718dd87574c
- ssdeep: 1536:GvSjInlBLrYOyzlgZdQ0OTigNDFxu/7zS5o3tRShIYQtl5ye:Gv SjIPrmgZdQ00NHoKUShctl5ye
- size-in-bytes: 107008
- hash: e3d03829cbec1a8cca56c6ae730ba9a8
- float: 6.27885773112
- file: e3d03829cbec1a8cca56c6ae730ba9a8
- hash: ae65ffcd83dab3fdafea3ff6915fce34e1307bce
- ssdeep: 3072:+4V0+H9kt2K5aiV6CDDP+LQWOfsJEta8Ql:+35p6wP+X8Q
- size-in-bytes: 139264
- port: 8080
- ip: 103.16.223.35
- port: 8080
- ip: 113.28.244.194
- port: 8080
- ip: 116.48.145.179
- port: 8000
- ip: 186.116.9.20
- port: 8080
- ip: 186.149.198.172
- port: 8088
- ip: 195.28.91.232
- port: 8080
- ip: 195.97.97.148
- port: 8080
- ip: 199.15.234.120
- port: 8080
- ip: 200.42.69.133
- port: 8080
- ip: 203.131.222.99
- port: 8080
- ip: 210.187.87.181
- port: 8088
- ip: 83.231.204.157
- port: 8088
- ip: 84.232.224.218
- port: 8080
- ip: 84.232.224.218
OSINT - HIDDEN COBRA – North Korean Trojan: Volgmer
Description
This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a Trojan malware variant used by the North Korean government—commonly known as Volgmer. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra. FBI has high confidence that HIDDEN COBRA actors are using the IP addresses—listed in this report’s IOC files—to maintain a presence on victims’ networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to North Korean government malicious cyber activity.
AI-Powered Analysis
Technical Analysis
The Volgmer Trojan is a malware variant attributed to the North Korean state-sponsored threat actor group commonly known as HIDDEN COBRA or Lazarus Group. This malware is used to maintain persistent access within victim networks, enabling further exploitation and intelligence gathering. The U.S. Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) have identified specific IP addresses and indicators of compromise (IOCs) associated with Volgmer, which are used by the threat actors to establish and sustain their presence on targeted systems. Volgmer operates as a backdoor Trojan, allowing remote attackers to execute arbitrary commands, exfiltrate data, and potentially deploy additional malicious payloads. The malware's use by a nation-state actor indicates a high level of sophistication and targeted intent, often focusing on strategic or sensitive sectors. Although the technical alert does not specify affected software versions or detailed infection vectors, the malware's persistence and network exploitation capabilities make it a significant threat for organizations that may be targeted for espionage or disruption. The alert emphasizes the importance of monitoring the identified IP addresses to detect and mitigate ongoing or attempted intrusions by HIDDEN COBRA actors.
Potential Impact
For European organizations, the presence of Volgmer represents a risk primarily to confidentiality and integrity of sensitive information. Given the malware's backdoor capabilities, attackers can exfiltrate intellectual property, government secrets, or critical business data. The threat is particularly relevant to sectors such as government agencies, defense contractors, critical infrastructure, and high-tech industries, which are often targets of North Korean cyber espionage. The malware's ability to maintain persistence and facilitate further exploitation could lead to prolonged undetected access, increasing the risk of data breaches and operational disruptions. Although the alert categorizes the severity as low, the strategic nature of the threat actor and potential for targeted attacks means that impact could be significant if successful intrusions occur. European organizations with limited cybersecurity monitoring or those lacking threat intelligence integration may be more vulnerable to such threats.
Mitigation Recommendations
1. Implement proactive network monitoring to detect and block communications with the known IP addresses associated with Volgmer, leveraging threat intelligence feeds from DHS, FBI, and trusted cybersecurity partners. 2. Employ advanced endpoint detection and response (EDR) solutions capable of identifying unusual process behaviors indicative of backdoor activity. 3. Conduct regular threat hunting exercises focused on detecting persistence mechanisms and lateral movement within networks. 4. Harden network segmentation to limit the spread of malware and restrict access to sensitive systems. 5. Ensure timely application of security patches and updates to all software and firmware, even though no specific vulnerable versions are identified, to reduce attack surface. 6. Train security teams to recognize indicators of compromise related to HIDDEN COBRA activity and establish incident response plans tailored to nation-state threats. 7. Collaborate with national cybersecurity centers and share intelligence on observed activity to enhance collective defense. 8. Restrict administrative privileges and enforce multi-factor authentication to reduce the risk of credential compromise facilitating malware deployment.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 3
- Analysis
- 2
- Uuid
- 5a0eb192-bf90-4995-9082-fb44950d210f
- Original Timestamp
- 1511183700
Indicators of Compromise
File
| Value | Description | Copy |
|---|---|---|
fileMAR-10135536-D_WHITE_S508C.PDF | — | |
file1ecd83ee7e4cfc8fed7ceb998e75b996 | — | |
file5dd1ccc8fb2a5615bf5656721339efed | — | |
file143cb4f16dcfc16a02812718acd32c8f | — | |
filee3d03829cbec1a8cca56c6ae730ba9a8 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash143cb4f16dcfc16a02812718acd32c8f | — | |
hash1ecd83ee7e4cfc8fed7ceb998e75b996 | — | |
hash35f9cfe5110471a82e330d904c97466a | — | |
hash5dd1ccc8fb2a5615bf5656721339efed | — | |
hash81180bf9c7b282c6b8411f8f315bc422 | — | |
hashe3d03829cbec1a8cca56c6ae730ba9a8 | — | |
hashb6214e428fa300398d713f342dd73720 | (header) | |
hashccee43451bf78c75c2a487a75245aed2 | .text | |
hash921b3440b4b8a40600f0d733db4fdca8 | .rdata | |
hash2211eee046bd996c987599e0cbe6e1cc | .data | |
hashe12b92a1aeeb53d25ac14b4be573e860 | .rsrc | |
hash8f4d22d26031119928449f856466da0a | (header) | |
hash74a2bd172adaf6d5964d238371ba9f4e | .text | |
hash9f849d9f0bb48924b8f04e47a36b59c4 | .rdata | |
hash07768f7af89f774cbeaa36bf80d68dd9 | .data | |
hash68fe7330ba22a7f4f9a4b7c2582a803a | .rsrc | |
hash74c867b7fa902e50761d82dfe59ee255 | .reloc | |
hashe1d6628e550c3c99207d85828a6cd932 | (header) | |
hasheb005743ac215eb0f146227f3480e6e9 | .text | |
hasha92c0e7aeced10cc835d04f072c44c5d | .rdata | |
hashc83f6ab61a65902e9b94f8fa0c93fa07 | .data | |
hash6e50576388df1a686f37bd49ea0542e4 | .rsrc | |
hash686c6badf362b2716ea522a2357991fd | .reloc | |
hashe1b62318f465d0a1e7b5e98574456f62 | (header) | |
hash12c4003f6526b045c92e9fa4cf3da2f9 | .text | |
hash6a0443b1df33fdb22fe2068751f9f007 | .rdata | |
hash819f69a104b87fb32f61b9853df8a9be | .data | |
hash9a6eb9c39222d2a6358f6c2adeabcf87 | .reloc | |
hash0c73039cd8388fd8c45b8367398f2ce6 | (header) | |
hasha8b3c39fdf381c29d7e2a9f1a46ddfdd | .text | |
hasha7cf4e7d72c146b5abc2bfb31ad7ccfc | .rdata | |
hash762fc1698ef3b6b4577f8dc8872dcac5 | .data | |
hash4911328ef1c6ec0210fa3b92fe556efe | .reloc | |
hashe79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2 | - Xchecked via VT: e3d03829cbec1a8cca56c6ae730ba9a8 | |
hash1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d | - Xchecked via VT: 5dd1ccc8fb2a5615bf5656721339efed | |
hash6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1 | - Xchecked via VT: 35f9cfe5110471a82e330d904c97466a | |
hasheff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5 | - Xchecked via VT: 1ecd83ee7e4cfc8fed7ceb998e75b996 | |
hashff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd | - Xchecked via VT: 143cb4f16dcfc16a02812718acd32c8f | |
hash9a5fa5c5f3915b2297a1c379be9979f0 | — | |
hash2d2b88ae9f7e5b49b728ad7a1d220e84 | — | |
hashba8c717088a00999f08984408d0c5288 | — | |
hash1b8ad5872662a03f4ec08f6750c89abc | — | |
hashe034ba76beb43b04d2ca6785aa76f007 | — | |
hasheb9db98914207815d763e2e5cfbe96b9 | — | |
hash1ecd83ee7e4cfc8fed7ceb998e75b996 | — | |
hasheddb7228e2f8b7a99c4c32a743504ed3c16b5ef3 | — | |
hash81180bf9c7b282c6b8411f8f315bc422 | — | |
hashc9b703cbc692977dfa0fe7b82768974f17dbf309 | — | |
hash5dd1ccc8fb2a5615bf5656721339efed | — | |
hash1b247442e28d9d72cb0c1a6e7dfbcd092829ee6d | — | |
hash143cb4f16dcfc16a02812718acd32c8f | — | |
hashf8397d940a204a2261dba2babd6e0718dd87574c | — | |
hashe3d03829cbec1a8cca56c6ae730ba9a8 | — | |
hashae65ffcd83dab3fdafea3ff6915fce34e1307bce | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip103.16.223.35 | — | |
ip113.28.244.194 | — | |
ip116.48.145.179 | — | |
ip186.116.9.20 | — | |
ip186.149.198.172 | — | |
ip195.28.91.232 | — | |
ip195.97.97.148 | — | |
ip199.15.234.120 | — | |
ip200.42.69.133 | — | |
ip203.131.222.99 | — | |
ip210.187.87.181 | — | |
ip83.231.204.157 | — | |
ip84.232.224.218 | — | |
ip89.190.188.42 | — | |
ip199.68.196.125 | According to a trusted third party, between November 24, and November 30, 2016, Volgmer malware was observed communicating from this IP address over Port 8002. | |
ip109.68.120.179 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip85.132.123.50 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip80.95.219.72 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip88.201.64.185 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip103.10.55.35 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip45.124.169.36 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip222.44.80.138 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip61.153.146.207 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip41.131.164.156 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip82.129.240.148 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip82.201.131.124 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip31.146.82.22 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip103.27.164.10 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip103.27.164.42 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip112.133.214.38 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip114.79.141.59 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip115.115.174.67 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip115.178.96.66 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip115.249.29.78 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.211.164.245 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.218.84.197 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.239.102.132 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.239.144.203 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.240.190.226 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.247.63.127 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip117.247.8.239 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip118.67.237.124 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip125.17.79.35 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip125.18.9.228 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip14.102.46.3 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip14.139.125.214 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip14.141.129.116 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip180.211.97.186 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.156.76.122 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.72.113.90 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.73.165.58 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.73.245.46 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.74.42.194 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.77.61.231 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip183.82.199.174 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip183.82.33.102 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip203.110.91.252 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip203.196.136.60 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip203.88.138.79 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip43.249.216.6 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip45.118.34.215 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip139.255.62.10 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip128.65.184.131 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip128.65.187.94 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip178.248.41.117 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip185.113.149.239 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip185.115.164.86 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip185.46.218.77 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip213.207.209.36 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip217.218.90.124 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip217.219.193.158 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip217.219.202.199 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip37.235.21.166 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip37.98.114.90 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip78.38.114.15 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip78.38.182.242 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip78.39.125.67 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip80.191.171.32 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip85.185.30.195 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip85.9.74.159 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip89.165.119.105 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip91.106.77.7 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip91.98.112.196 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip91.98.126.92 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip91.98.36.66 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip94.183.177.90 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip95.38.16.188 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip27.114.187.37 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip116.90.226.67 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip113.203.238.98 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip115.186.133.195 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.176.121.244 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip182.187.139.132 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip37.216.67.155 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip84.235.85.86 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip103.241.106.15 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip203.118.42.155 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip58.185.197.210 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip123.231.112.147 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip222.165.146.86 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip122.146.157.141 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip140.136.205.209 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip110.77.137.38 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip118.175.22.10 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip125.25.206.15 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip203.147.10.65 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip58.82.155.98 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip61.91.47.142 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip185.134.98.141 | USG analysis identified this IP address as HIDDEN COBRA infrastructure, which is a likely compromised host. | |
ip103.16.223.35 | — | |
ip113.28.244.194 | — | |
ip116.48.145.179 | — | |
ip186.116.9.20 | — | |
ip186.149.198.172 | — | |
ip195.28.91.232 | — | |
ip195.97.97.148 | — | |
ip199.15.234.120 | — | |
ip200.42.69.133 | — | |
ip203.131.222.99 | — | |
ip210.187.87.181 | — | |
ip83.231.204.157 | — | |
ip84.232.224.218 | — | |
ip84.232.224.218 | — |
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://www.us-cert.gov/ncas/alerts/TA17-318B | — | |
linkhttps://www.virustotal.com/file/e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2/analysis/1510736372/ | - Xchecked via VT: e3d03829cbec1a8cca56c6ae730ba9a8 | |
linkhttps://www.virustotal.com/file/1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d/analysis/1510736339/ | - Xchecked via VT: 5dd1ccc8fb2a5615bf5656721339efed | |
linkhttps://www.virustotal.com/file/6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1/analysis/1510794755/ | - Xchecked via VT: 35f9cfe5110471a82e330d904c97466a | |
linkhttps://www.virustotal.com/file/eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5/analysis/1510776348/ | - Xchecked via VT: 1ecd83ee7e4cfc8fed7ceb998e75b996 | |
linkhttps://www.virustotal.com/file/ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd/analysis/1510776360/ | - Xchecked via VT: 143cb4f16dcfc16a02812718acd32c8f |
Comment
| Value | Description | Copy |
|---|---|---|
commentThis joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a Trojan malware variant used by the North Korean government—commonly known as Volgmer. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra.
FBI has high confidence that HIDDEN COBRA actors are using the IP addresses—listed in this report’s IOC files—to maintain a presence on victims’ networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to North Korean government malicious cyber activity. | — |
Float
| Value | Description | Copy |
|---|---|---|
float7.00782518905 | — | |
float1.69870551288 | — | |
float6.09092146887 | — | |
float5.74626869405 | — | |
float6.27885773112 | — |
Ssdeep
| Value | Description | Copy |
|---|---|---|
ssdeep3072:Kn13mR+uvEuCBlMclG4te7DFQstzN29ZfyXZM5QVj+XZ4dC:KneZvrRclG4mF5qZfyO2AJWC | — | |
ssdeep3:3l/l/0P5BQCfqgFwylTDRv9tWpdYYg11MBMs5v
Y6Pw/l/lN:3tlMP5BQCigFwyFDlWzYn1FF6PQ/ | — | |
ssdeep1536:VWzaaYA98ReypyDfOyzrj5b6T9LN52GoDCK
RRpyJutZTgMJ:gaS98ppkj5b0DBSCscJuthg | — | |
ssdeep1536:GvSjInlBLrYOyzlgZdQ0OTigNDFxu/7zS5o3tRShIYQtl5ye:Gv
SjIPrmgZdQ00NHoKUShctl5ye | — | |
ssdeep3072:+4V0+H9kt2K5aiV6CDDP+LQWOfsJEta8Ql:+35p6wP+X8Q | — |
Size in-bytes
| Value | Description | Copy |
|---|---|---|
size-in-bytes131072 | — | |
size-in-bytes546 | — | |
size-in-bytes110592 | — | |
size-in-bytes107008 | — | |
size-in-bytes139264 | — |
Port
| Value | Description | Copy |
|---|---|---|
port8080 | — | |
port8080 | — | |
port8080 | — | |
port8000 | — | |
port8080 | — | |
port8088 | — | |
port8080 | — | |
port8080 | — | |
port8080 | — | |
port8080 | — | |
port8080 | — | |
port8088 | — | |
port8088 | — | |
port8080 | — |
Threat ID: 682b81098ee1a77b717bddcb
Added to database: 5/19/2025, 7:05:45 PM
Last enriched: 6/18/2025, 7:33:34 PM
Last updated: 8/14/2025, 5:24:54 AM
Views: 14
Related Threats
Actions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.