Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
12 IOCs

Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup

ANY.RUN Cybersecurity Blog
ANY.RUN Cybersecurity Blog
Published August 10, 2026Original Report

Malware Families

Excerpt

Editor’s note: This work is a collaboration between Mauro Eldritch from BCA LTD, a company dedicated to threat intelligence and hunting, Heiner García from NorthScan, a threat intelligence initiative uncovering North Korean IT worker infiltration, and ANY.RUN , the leading company in malware analysis and threat intelligence . The article was written by Mauro and Heiner. Key Takeaways Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives ,…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTURE89.187.185.1162.33.223.165199.168.112.175CAPABILITYGh0st RATVICTIMunknown
Adversary
Infrastructure(6)
Capability(1)
Victim

Indicators of Compromise

Open the mindmap →

12 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA1a3d6938f152c47a411263573bb3af324c25a8ebaMediumScore 56/100First seen
IP89.187.185.11HighScore 62/100First seen
IP62.33.223.165HighScore 58/100First seen
IP199.168.112.175HighScore 62/100First seen
IP45.77.71.42HighScore 68/100First seen
IP192.200.115.226HighScore 68/100First seen
SHA18953b9661339a48f4e6408aa1b359cd49f3a6cadMediumScore 56/100First seen
SHA1b26a7c7ea6d75956ebd8c5d294524903b1cf13d0MediumScore 56/100First seen
IP206.217.134.34HighScore 68/100First seen
IP185.152.67.39HighScore 68/100First seen
IP107.150.38.250HighScore 68/100First seen
IP104.250.148.58HighScore 68/100First seen

IOC Relationship Graph

Building graph…