778 reports
Microsoft Threat Intelligence Podcast guests discuss abuse of remote monitoring and management tools alongside North Korean IT worker fraud. The RMM section covers ScreenConnect-style access used by criminal and nation-state actors for malware delivery, A…
NSHC's November 2024 Korean threat-actor intelligence report describes multiple observed intrusion patterns, including malicious LNK files themed around China-North Korea policy, VHDX lures disguised as Chinese embassy invitations, and backdoors that stea…
NuriLab analyzes a new RokRAT malware report associated with APT37, a North Korea-linked threat group also discussed alongside Kimsuky, Moonstone Sleet, and Lazarus in the source context. The report says APT37 impersonates North Korea-related experts and …
This APT group was detected targeting the Russian diplomatic sector in January 2022, employing a spear phishing theme for New Year's Eve festivities as bait. The North Korean hacker group distributes Konni RAT via phishing messages or emails. KONNI has be…
Hangro is presented as possible North Korean VPN or remote-access infrastructure linked to access into or around the DPRK-controlled network environment. The excerpt identifies four historical Hangro IPs in North Korea and Russia that shared a certificate…
The source analyzes a Lazarus-linked browser stealer identified as 11.js and provides hashes for the sample. After deobfuscation, the JavaScript is described as collecting browser logs and user-configuration files, packaging stolen data into ZIP archives,…
The Contagious Interview sample analyzed by dmpdump used fake Willo candidate-screening sites to lure victims into running a copied shell command. The shared VCam_intel.zip artifact contained Windows, macOS and Linux material, with macOS scripts downloadi…
SlowMist's 2024 Blockchain Security and AML report frames North Korean hackers as part of the year's cryptocurrency security and laundering landscape. The excerpt says the report includes statistical analysis of laundering methods and gains by North Korea…
SecAI analyzes a malicious CHM sample linked to Kimsuky activity, showing how the file uses an embedded HTML page and script execution to launch VBS code. The infection chain runs a VBS script from the same directory, executes a second VBS payload stored …
AhnLab describes detection of a Play ransomware intrusion using EDR telemetry and notes that Play, also known as Balloonfly or PlayCrypt, has attacked more than 300 organizations since 2022. The report highlights double-extortion behavior through data the…
Objective-See's 2024 macOS malware review includes several DPRK-linked specimens, including BeaverTail, SpectralBlur, and the BlueNoroff Hidden Risk campaign. The BeaverTail section describes a fake MiroTalk meeting app distributed from mirotalk[.]net tha…
AhnLab describes Play ransomware intrusion tradecraft and notes Palo Alto Unit42 reporting that linked Play activity to Andariel through shared infrastructure after Andariel used Sliver and DTrack for information theft. The excerpt states that Play operat…
A Korean analysis attributes a malicious LNK file disguised as a CRS report PDF to North Korea's Reaper, also known as APT37. The shortcut searches for PowerShell, locates an embedded payload by file size, extracts and opens a decoy PDF, then writes panic…