{ "Event": { "analysis": "1", "date": "2026-04-21", "extends_uuid": "", "info": "[Threat Intel] A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail", "protected": false, "publish_timestamp": "1779545719", "published": true, "threat_level_id": "2", "timestamp": "1779545719", "uuid": "4b32f82e-29f8-42e1-b1bd-24563759c0c4", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Kimsuky\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"South Korea\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777431612", "to_ids": false, "type": "link", "uuid": "83ba64b2-4e6a-40e6-8d81-89f8106a3741", "value": "https://intel.breakglass.tech/post/kimsuky-third-vultr-seoul-60-domains-ddns-rotation-naver-nts" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1777431612", "to_ids": false, "type": "text", "uuid": "558d9a40-c9b8-4fb0-9f3f-5354c87b1309", "value": "This analysis documents a third Vultr Seoul VPS (158.247.210.58) associated with Kimsuky operations, featuring over 60 domains across an 18-month period of systematic credential harvesting infrastructure. The actor demonstrates deliberate rotation through seven DDNS providers to evade blocklisting while maintaining the same backend VPS since at least September 2020. The domains systematically impersonate Naver, Korean National Tax Service (HomeTax), and government portals using prefixes like nid-user, n-store, nts-auth, and htax-login. Currently, 31 domains actively resolve while web ports remain closed, indicating a parked and ready operational posture. The infrastructure sits in AS20473 alongside two previously documented Vultr Seoul boxes, demonstrating the actor's clear preference for this provider and geographic proximity to South Korean targets." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1777431612", "to_ids": false, "type": "text", "uuid": "d332ca0d-a0ee-4541-9657-c48b14556288", "value": "Name: A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail\nAuthor: AlienVault\nAdversary: Kimsuky\nTags: [\"vultr seoul\", \"ddns rotation\", \"apt43\", \"korean nts\", \"phishing infrastructure\", \"naver\", \"dprk\", \"credential harvesting\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Government\", \"Finance\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1777431612", "to_ids": false, "type": "threat-actor", "uuid": "000ea33c-1508-498a-9742-365602d89af5", "value": "Kimsuky" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678428", "to_ids": true, "type": "hostname", "uuid": "7f2f430b-e07b-4b31-984f-dc34fce0e7e8", "value": "ips-govkr.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678449", "to_ids": true, "type": "hostname", "uuid": "204cfe2f-db5b-467e-8978-9c923ba21293", "value": "n-cloud.htax-store.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678470", "to_ids": true, "type": "hostname", "uuid": "3119e91b-e83d-4120-9fa0-0137529c24ad", "value": "nid-user.nts-auth.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678492", "to_ids": true, "type": "hostname", "uuid": "72178dfa-e497-48b0-9283-ce0dcccee818", "value": "mdlog.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678513", "to_ids": true, "type": "domain", "uuid": "8a29901f-8aec-4084-b6ce-7fb9ea733860", "value": "johnnytogdstudio.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678534", "to_ids": true, "type": "hostname", "uuid": "9aba77c7-bd97-4b74-a493-bc83b1599c26", "value": "govkr-auth.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678555", "to_ids": true, "type": "hostname", "uuid": "df5ea870-418a-423c-9d53-203269f364f8", "value": "govkr-nid.tax-auth.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678576", "to_ids": true, "type": "hostname", "uuid": "b5506006-f39d-4dac-a939-6306d251eb23", "value": "govkr-tax.nid-auth.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678597", "to_ids": true, "type": "hostname", "uuid": "8140d447-5eff-4cb5-b2c1-e07f9c058321", "value": "htax-login.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678618", "to_ids": true, "type": "hostname", "uuid": "934c15b5-ab61-45e9-83d2-700137311664", "value": "htax-login.n-cloud.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678639", "to_ids": true, "type": "hostname", "uuid": "6f37e14c-ebf7-4701-8e98-e3003d58ca24", "value": "htax-login.nts-kr.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678661", "to_ids": true, "type": "hostname", "uuid": "0b27eebe-9158-4540-a1d3-1ef877e89586", "value": "htax-nid.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678682", "to_ids": true, "type": "hostname", "uuid": "ef1e9d7c-9cd3-41ed-b058-b56dbb821021", "value": "htax-nid.n-user.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678703", "to_ids": true, "type": "hostname", "uuid": "7c04afe0-9225-4175-9832-0d220ce324b1", "value": "htax-user.govkr.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678724", "to_ids": true, "type": "hostname", "uuid": "a1bde7af-0e91-43ec-8540-fc3a3ea3fe26", "value": "n-auth.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678745", "to_ids": true, "type": "hostname", "uuid": "6a655ab2-8372-4b77-ada0-0a4e59f15753", "value": "n-auth.nts-login.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678766", "to_ids": true, "type": "hostname", "uuid": "ac325315-d09b-465f-b9ae-bea0e620e031", "value": "n-cloud.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678788", "to_ids": true, "type": "hostname", "uuid": "4ca09918-9b0d-4484-beee-2a40cf83a68d", "value": "n-cloud.nid-tax.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678809", "to_ids": true, "type": "hostname", "uuid": "9cb0f447-2ca5-4f5d-a447-319afd35ff5e", "value": "n-corp.htax-auth.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678830", "to_ids": true, "type": "hostname", "uuid": "cf98b78a-1d13-440c-8ecc-e4fc7b054277", "value": "n-corp.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678851", "to_ids": true, "type": "hostname", "uuid": "af2ca1f5-b437-48cd-8e10-5431795c8ea5", "value": "n-login.htax-nid.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678872", "to_ids": true, "type": "hostname", "uuid": "9a42e428-dbb5-4761-9d4f-46b15a45cf97", "value": "n-store.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678893", "to_ids": true, "type": "hostname", "uuid": "27b37c3e-6f1b-4097-bddf-3e56d2927fbc", "value": "n-store.nts-user.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678914", "to_ids": true, "type": "hostname", "uuid": "e7f66520-3e96-49a2-9724-d299fd286ff8", "value": "n-store.tax-nid.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678935", "to_ids": true, "type": "hostname", "uuid": "b468898b-aa6b-4b1e-8bc1-9a5561fab5a7", "value": "n-user.htax-auth.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678956", "to_ids": true, "type": "hostname", "uuid": "6910db04-837f-404b-9c97-e736e4380922", "value": "n-user.ips-gov.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678977", "to_ids": true, "type": "hostname", "uuid": "395d9da3-d1bd-46d1-88fe-42a0731839e3", "value": "nid-auth.n-cloud.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777678998", "to_ids": true, "type": "hostname", "uuid": "aff2946e-c30c-4a8a-b0fa-5a6161c2623c", "value": "nid-gov.tax-store.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679020", "to_ids": true, "type": "hostname", "uuid": "a25634ac-3f10-4a3c-baf6-894f6e839227", "value": "nid-login.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679041", "to_ids": true, "type": "hostname", "uuid": "45b0dea7-c2b7-4159-9312-155666726142", "value": "nid-login.nts-gov.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679062", "to_ids": true, "type": "hostname", "uuid": "8b1b4053-64aa-4a41-80c9-d8e85cd7dbf3", "value": "nid-nts.n-store.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679083", "to_ids": true, "type": "hostname", "uuid": "e0504a8b-df9d-4cab-a2bd-aa3199585d1b", "value": "nid-store.govkr.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679104", "to_ids": true, "type": "hostname", "uuid": "8db2e899-f767-41c2-a85b-e26b2844d604", "value": "nid-store.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679126", "to_ids": true, "type": "hostname", "uuid": "ac06608b-0b73-4e00-a3ba-26796989af4e", "value": "nid-user.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679147", "to_ids": true, "type": "hostname", "uuid": "962a2272-02ec-4da5-8cc4-2697eaf65603", "value": "nts-auth.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679168", "to_ids": true, "type": "hostname", "uuid": "be11c230-9482-45e6-b3c7-79f1ebd18b6d", "value": "nts-login.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679189", "to_ids": true, "type": "hostname", "uuid": "d44451a8-6258-4c5e-8a0d-b977f8de19fb", "value": "nts-login.n-auth.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679210", "to_ids": true, "type": "hostname", "uuid": "b3c7b221-d1ba-4dd8-b28f-76720094da6e", "value": "nts-nid.n-login.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679232", "to_ids": true, "type": "hostname", "uuid": "79ac64da-5434-414a-b836-871f0b40fcf8", "value": "nts-store.n-login.dns.navy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679253", "to_ids": true, "type": "hostname", "uuid": "7d0ad1cf-80a6-4838-84c9-4a1f1d78fedb", "value": "nuser-login.govkr.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679275", "to_ids": true, "type": "hostname", "uuid": "bbbd53c1-77f2-47ec-9104-65b5df17279f", "value": "nuser-login.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679296", "to_ids": true, "type": "hostname", "uuid": "287cb3d8-f619-4232-9e28-26a5581a77d4", "value": "tax-login.mydns.vc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679318", "to_ids": true, "type": "hostname", "uuid": "3d0b0724-f400-4f1d-a0a2-e09ca3b7ec97", "value": "tax-login.n-corp.kro.kr", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679340", "to_ids": true, "type": "hostname", "uuid": "3e140598-7e9b-4a36-9ec8-93e00a28fd17", "value": "tax-nid.mydns.bz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679362", "to_ids": true, "type": "hostname", "uuid": "91ad14ee-577d-45f3-82ff-8e3523b762df", "value": "tax-user.nid-gov.dns.army", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679383", "to_ids": true, "type": "ip-dst", "uuid": "fc05eda9-9f3b-4d97-9be3-d67d71d55c83", "value": "158.247.210.58", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777674005", "to_ids": false, "type": "AS", "uuid": "b6942d4d-d703-46e8-8edb-de774ad35530", "value": "20473" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679404", "to_ids": true, "type": "hostname", "uuid": "85deb2f5-2060-4801-9d03-6591e9660066", "value": "ntdersg.mydns.jp", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679425", "to_ids": true, "type": "hostname", "uuid": "fb2f1b0e-2474-4e1c-913b-09c173c24202", "value": "nversg.mydns.jp", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679446", "to_ids": true, "type": "hostname", "uuid": "dcf9a7a5-0972-4099-b7cd-6603dbe8dba1", "value": "n-store.nskrm.dynv6.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679468", "to_ids": true, "type": "ip-dst", "uuid": "0b94c5fc-217c-4dae-9080-5963bb2574ed", "value": "158.247.219.150", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1777679489", "to_ids": true, "type": "ip-dst", "uuid": "cdc4c5ab-2293-4db5-bf5d-1ceeb2a3bc27", "value": "158.247.250.37", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }