Tag: phishing infrastructure

1 Attack Reports | 0 Vulnerabilities

Attack reports

A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail

This analysis documents a third Vultr Seoul VPS (158.247.210.58) associated with Kimsuky operations, featuring over 60 domains across an 18-month period of systematic credential harvesting infrastructure. The actor demonstrates deliberate rotation through seven DDNS providers to evade blocklisting …
apt43
credential harvesting
dprk
naver
2026-04-28
ddns rotation
korean nts
phishing infrastructure
vultr seoul
Published: April 28, 2026
Downloadable IOCs: 0
Click here to see more Attack Reports