Comments on: From Node.js Malware on GitHub to Exposing Fake North Korean Companies https://blog.gerontakis.eu/2025/07/20/from-node-js-malware-on-github-to-exposing-fake-north-korean-companies/ My personal Blog and more 😎 Wed, 23 Jul 2025 07:20:37 +0000 hourly 1 By: Just another one https://blog.gerontakis.eu/2025/07/20/from-node-js-malware-on-github-to-exposing-fake-north-korean-companies/#comment-4 Wed, 23 Jul 2025 07:20:37 +0000 https://blog.gerontakis.eu/?p=151#comment-4 I guess that this is part of the following
https://unit42.paloaltonetworks.com/north-korean-it-workers

]]> By: Efstratios Lontzetidis https://blog.gerontakis.eu/2025/07/20/from-node-js-malware-on-github-to-exposing-fake-north-korean-companies/#comment-3 Mon, 21 Jul 2025 13:59:37 +0000 https://blog.gerontakis.eu/?p=151#comment-3 Great article! Keep it up!

Based on the file sharing service you encountered on the specific port, here is a good pivot:
https://app.validin.com/detail?find=f3ebe8679a9974c667b65f3348f18b548d8c10cd&type=hash&ref_id=83340cb0058#tab=host_pairs

Further potential indicators:
45[.]59[.]163[.]23
67[.]203[.]7[.]205
147[.]124[.]213[.]19
147[.]124[.]212[.]125
147[.]124[.]213[.]232
66[.]235[.]175[.]109
66[.]235[.]175[.]117
207[.]189[.]164[.]137
45[.]59[.]163[.]56
165[.]140[.]86[.]154
67[.]203[.]7[.]200

]]>