A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail
Essential information
- Published
- 28/04/2026 10:06
- Modified
- 28/04/2026 14:35
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- apt43 credential harvesting ddns rotation dprk korean nts naver phishing infrastructure vultr seoul
- Tags
- 2026-04-28 apt43 credential harvesting ddns rotation dprk korean nts naver phishing infrastructure vultr seoul
- Related entities
- 45 indicators, 45 observables, 1 intrusion sets (apt), 47 others
Description
This analysis documents a third Vultr Seoul VPS (158.247.210.58) associated with Kimsuky operations, featuring over 60 domains across an 18-month period of systematic credential harvesting infrastructure. The actor demonstrates deliberate rotation through seven DDNS providers to evade blocklisting while maintaining the same backend VPS since at least September 2020. The domains systematically impersonate Naver, Korean National Tax Service (HomeTax), and government portals using prefixes like nid-user, n-store, nts-auth, and htax-login. Currently, 31 domains actively resolve while web ports remain closed, indicating a parked and ready operational posture. The infrastructure sits in AS20473 alongside two previously documented Vultr Seoul boxes, demonstrating the actor's clear preference for this provider and geographic proximity to South Korean targets.