Attack traffic from North Korea

Honeypot telemetry for sources geolocated to North Korea

Observed by OffSeq honeypot sensors · last 30 days · last seen 7 hours ago · first observed 2026-09-25 (29 days ago)

337

Attacks

Distinct source IPs

Attack traffic is led by TECHOFF SRV LIMITED.

OffSeq honeypot sensors recorded 337 attacks from 3 distinct hosts geolocated to North Koreain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1046 Network Service Discovery222
T1110 Brute Force59
T1190 Exploit Public-Facing Application6
T1059 Command and Scripting Interpreter4
T1552.001 Credentials In Files1

Top networks (ASNs)

TECHOFF SRV LIMITED337

Open the live view → Get this in real time →