APT37 aka ScarCruft or RedEyes – Active IOCs

APT37, also known as ScarCruft or RedEyes, is described as a North Korean espionage group that mainly targets South Korea and has also operated against Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and Middle Eastern targets. The advisory …

From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West

North Korean operators behind Contagious Interview and WageMole continued using fake developer hiring activity to steal data and support remote job fraud in Western countries. Zscaler observed updated BeaverTail JavaScript and InvisibleFerret Python paylo…

Recent Keylogger Attributed to North Korean Group Andariel Analyzed Through A Hybrid Analysis Perspective

Andariel, also tracked as APT45, Silent Chollima, and Onyx Sleet, is linked in the source to a recently disclosed keylogger used against U.S. organizations. The malware installs low level keyboard and mouse hooks with SetWindowsHookExW, persists by modify…

북한 APT 리퍼(Reaper)에서 만든 탈북민 사칭 한국해양수산연수원 타겟 인것으로 추측이 되는 악성코드-정보접근권.lnk(2024.11.1)

The sample is attributed in the excerpt to Reaper/APT37 and uses a Windows LNK file with a defector-themed lure connected to the Korea Institute of Maritime and Fisheries Technology. The LNK masquerades with a Microsoft Edge icon, extracts and opens an em…

Monthly Threat Actor Group Intelligence Report, September 2024 (KOR)

NSHC's September 2024 monthly threat actor intelligence report summarizes activity collected from August 21 to September 20, identifying 47 hacking-group activities and reporting SectorA as the largest share at 46 percent. The report says finance-sector a…

Monthly Threat Actor Group Intelligence Report, August 2024 (JPN)

NSHC's August 2024 monthly threat actor intelligence report summarizes activity observed from July 21 to August 20, identifying 29 hacking-group activities overall and a high share attributed to SectorJ, followed by SectorA and SectorE clusters. The repor…

APT37 위협 배후의 사이버 정찰 활동 분석

Genians analyzes APT37 reconnaissance activity against South Korea, including collection of target IP address, location, web browser, and operating-system details before endpoint compromise. The report links the activity to prepared threat infrastructure …

Malicious Github Accounts with gh-fake-analyzer

Ketman's gh-fake-analyzer write-up gives reconnaissance heuristics for separating ordinary GitHub accounts from suspicious profiles used in malware-as-a-service, account farming, or DPRK-style IT worker activity. For DPRK-style profiles, it highlights old…

Ketman's Guide to Identifying a Suspicious Github Account Associated with DPRK

Ketman's guide describes how suspicious GitHub accounts associated with DPRK activity can be mapped through follower and following networks, profile context, repository behavior, and repeated identity patterns. It flags clusters of accounts created around…

APT37 aka ScarCruft or RedEyes – Active IOCs

APT37, also known as ScarCruft or RedEyes, is described as a North Korean espionage group that mainly targets South Korea and has also operated across Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and the Middle East. The advisory links AP…

North Korean APT Kimsuky aka Black Banshee – Active IOCs

Kimsuky, also called Black Banshee in the advisory, is described as a North Korean espionage group active since at least 2012 and targeting organizations and individuals in South Korea, Japan, and the United States. The source lists phishing, malware infe…

Play Ransomware and North Korean APT45 Work Together to Launch Major Cyberattack – Active IOCs

APT45, also known as Andariel or Jumpy Pisces, is described as a North Korean state-sponsored actor tied to financially motivated activity involving the Play ransomware operation between May and September 2024. The excerpt says researchers assessed with m…

North Korea-Linked Konni APT Group – Active IOCs

This APT group was detected targeting the Russian diplomatic sector in January 2022, employing a spear phishing theme for New Year's Eve festivities as bait. The North Korean hacker group distributes Konni RAT via phishing messages or emails. KONNI has be…

MacOS Malware Surges as Corporate Usage Grows

DPRK-aligned APT macOS activity In recent years, the Lazarus Group, a North Korean state-sponsored APT group , has intensified its focus on macOS, marking a significant shift in the macOS threat landscape. They employed advanced phishing campaigns themed …

북한 김수키(Kimsuky) 세종연구소 한반도전략센터장 을 사칭 하는 악성코드-CHEONG ??? Chang Essay FINAL.msc(2024.9.25)

The Wezard4u post analyzes a Kimsuky-linked MSC lure that impersonated the Sejong Institute's Center for Korean Peninsula Strategy director to target people working on North Korea issues. The malicious command sequence used curl to retrieve a decoy DOCX, …