#ParsedReport
14-12-2022
(*.vhd) Qakbot. QAKBOT is distributed as a virtual disk file (*.vhd)
https://asec.ahnlab.com/ko/44002
Threats:
Qakbot
Motw_bypass_technique
Trojan/win.bankerx-gen.r538785
Industry:
Financial
IOCs:
File: 7
IP: 1
Hash: 5
14-12-2022
(*.vhd) Qakbot. QAKBOT is distributed as a virtual disk file (*.vhd)
https://asec.ahnlab.com/ko/44002
Threats:
Qakbot
Motw_bypass_technique
Trojan/win.bankerx-gen.r538785
Industry:
Financial
IOCs:
File: 7
IP: 1
Hash: 5
ASEC BLOG
가상 디스크 파일 (*.vhd) 로 유포 중인 Qakbot - ASEC BLOG
최근 디스크 이미지 파일을 이용한 악성코드 유포가 증가하고 있다. 그 중 Qakbot 악성코드는 ISO 및 IMG 파일을 통해 유포되어 왔으며, 현재는 VHD 파일로 변경되어 유포 중인 것을 확인하였다. 이와 같이 Qakbot 악성코드가 디스크 이미지 파일(IMG, ISO, VHD) 을 이용하는 것은 MOTW(Mark of the Web) 을 우회하기 위한 것으로 보인다. 디스크 이미지 파일은 내부 파일 추출 또는 마운트 시, 내부 파일에 MOTW 가…
#ParsedReport
14-12-2022
. Famous domestic financial app impersonation attack attack
https://asec.ahnlab.com/ko/44225
Actors/Campaigns:
Kimsuky
Industry:
Financial
Geo:
Japan, Korea, Singapore
IOCs:
IP: 3
Domain: 25
Url: 25
14-12-2022
. Famous domestic financial app impersonation attack attack
https://asec.ahnlab.com/ko/44225
Actors/Campaigns:
Kimsuky
Industry:
Financial
Geo:
Japan, Korea, Singapore
IOCs:
IP: 3
Domain: 25
Url: 25
ASEC
국내 유명 금융 앱 사칭한 피싱공격 - ASEC
국내 유명 금융 앱 사칭한 피싱공격 ASEC
#ParsedReport
14-12-2022
Quick Update on Recent Denonia Samples
https://www.cadosecurity.com/quick-update-on-recent-denonia-samples
Threats:
Denonia
Xmrig_miner
Log4shell_vuln
Geo:
Philippines
IOCs:
Hash: 7
Softs:
unix, macos
Languages:
golang
Platforms:
arm
YARA: Found
Links:
14-12-2022
Quick Update on Recent Denonia Samples
https://www.cadosecurity.com/quick-update-on-recent-denonia-samples
Threats:
Denonia
Xmrig_miner
Log4shell_vuln
Geo:
Philippines
IOCs:
Hash: 7
Softs:
unix, macos
Languages:
golang
Platforms:
arm
YARA: Found
Links:
https://github.com/cado-securityhttps://github.com/likexian/doh-goCado Security | Cloud Investigation
Quick Update on Recent Denonia Samples - Cado Security | Cloud Investigation
Back in April 2022, Cado discovered a suspicious ELF binary that utilized DNS over HTTPS to conduct cryptojacking.
#ParsedReport
14-12-2022
RedGoBotGoDDoS. Redgobot DDOS zombie network written in the new Go language
https://mp.weixin.qq.com/s/4iTA4LBNEnOQ5T5AcvZCCA
Threats:
Redgobot_botnet
Robinbot
Gobot
Bashlite
Tcpsynflood_technique
Tcpackflood_technique
Moobot
IOCs:
Hash: 11
File: 1
IP: 3
Softs:
curl
Functions:
OpenVpn_Send
Languages:
golang
Platforms:
arm, ppc64, amd64, mips
14-12-2022
RedGoBotGoDDoS. Redgobot DDOS zombie network written in the new Go language
https://mp.weixin.qq.com/s/4iTA4LBNEnOQ5T5AcvZCCA
Threats:
Redgobot_botnet
Robinbot
Gobot
Bashlite
Tcpsynflood_technique
Tcpackflood_technique
Moobot
IOCs:
Hash: 11
File: 1
IP: 3
Softs:
curl
Functions:
OpenVpn_Send
Languages:
golang
Platforms:
arm, ppc64, amd64, mips
Weixin Official Accounts Platform
RedGoBot——新型Go语言编写的DDoS僵尸网络
2022年11月底，奇安信威胁情报中心监测到一起未知家族恶意样本利用 Vacron NVR RCE 漏洞传播的事件。参考作者在其资产网站中的输出“@redbot on top\x26quot;，我们把它命名为 RedGoBot。
#ParsedReport
14-12-2022
ASEC (20221205 \~ 20221211). ASEC Weekly Malware Statistics (20221205 \~ 20221211)
https://asec.ahnlab.com/ko/44149
Actors/Campaigns:
Ta505
Threats:
Amadey
Lockbit
Smokeloader
Gandcrab
Clop
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Azorult
Smokerloader
Formbook
Clipboard_grabbing_technique
Industry:
Financial, Transport
Geo:
Korea
IOCs:
File: 12
Url: 21
Email: 5
Domain: 5
Softs:
telegram
Languages:
php
14-12-2022
ASEC (20221205 \~ 20221211). ASEC Weekly Malware Statistics (20221205 \~ 20221211)
https://asec.ahnlab.com/ko/44149
Actors/Campaigns:
Ta505
Threats:
Amadey
Lockbit
Smokeloader
Gandcrab
Clop
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Azorult
Smokerloader
Formbook
Clipboard_grabbing_technique
Industry:
Financial, Transport
Geo:
Korea
IOCs:
File: 12
Url: 21
Email: 5
Domain: 5
Softs:
telegram
Languages:
php
ASEC BLOG
ASEC 주간 악성코드 통계 (20221205 ~ 20221211) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 12월 05일 월요일부터 12월 11일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 다운로더가 44.3%로 1위를 차지하였으며, 그 다음으로는 인포스틸러가 28.2%, 백도어 18.3%, 랜섬웨어 8.5%, 코인마이너가 0.7%로 집계되었다. Top 1 – Amadey Amadey…
#ParsedReport
15-12-2022
STOP Ransomware Being Distributed in Korea
https://asec.ahnlab.com/en/43861
Threats:
Stop_ransomware
Smokeloader
Vidar_stealer
Trojan/win.generic.r533564
Raccoon_stealer
Ransomware/win.extensions.c5314354
Beamwinhttp_loader
Industry:
Financial
Geo:
Korea
IOCs:
Path: 6
Url: 5
Registry: 1
File: 5
Hash: 7
Softs:
task scheduler
Platforms:
intel, x86
15-12-2022
STOP Ransomware Being Distributed in Korea
https://asec.ahnlab.com/en/43861
Threats:
Stop_ransomware
Smokeloader
Vidar_stealer
Trojan/win.generic.r533564
Raccoon_stealer
Ransomware/win.extensions.c5314354
Beamwinhttp_loader
Industry:
Financial
Geo:
Korea
IOCs:
Path: 6
Url: 5
Registry: 1
File: 5
Hash: 7
Softs:
task scheduler
Platforms:
intel, x86
ASEC BLOG
STOP Ransomware Being Distributed in Korea - ASEC BLOG
The ASEC analysis team discovered that the STOP ransomware is being distributed in Korea. This ransomware is being distributed at a very high volume that it is ranked among the Top 3 in the ASEC Weekly Malware Statistics (November 28th, 2022 – December 4th…
#ParsedReport
15-12-2022
Caution! Magniber Ransomware Restarts Its Propagation on December 9th With COVID-19 Related Filenames
https://asec.ahnlab.com/en/44315
Threats:
Magniber
Gandcrab
Revil
Lockbit
Motw_bypass_technique
TTPs:
Tactics: 1
Technics: 0
IOCs:
Path: 1
File: 4
Softs:
internet explorer, chrome
15-12-2022
Caution! Magniber Ransomware Restarts Its Propagation on December 9th With COVID-19 Related Filenames
https://asec.ahnlab.com/en/44315
Threats:
Magniber
Gandcrab
Revil
Lockbit
Motw_bypass_technique
TTPs:
Tactics: 1
Technics: 0
IOCs:
Path: 1
File: 4
Softs:
internet explorer, chrome
ASEC BLOG
Caution! Magniber Ransomware Restarts Its Propagation on December 9th With COVID-19 Related Filenames - ASEC BLOG
On December 9th, 2022, the ASEC analysis team discovered that Magniber Ransomware is being distributed again. During the peak of the COVID-19 outbreak, Magniber was found being distributed with COVID-19 related filenames alongside the previous security update…
#ParsedReport
15-12-2022
ASEC Weekly Malware Statistics (December 5th, 2022 December 11th, 2022)
https://asec.ahnlab.com/en/44354
Threats:
Amadey
Smokeloader
Lockbit
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Formbook
Clipboard_grabbing_technique
Industry:
Financial
Geo:
Korea
IOCs:
Url: 21
Email: 5
File: 6
Domain: 5
Softs:
telegram
Languages:
php
15-12-2022
ASEC Weekly Malware Statistics (December 5th, 2022 December 11th, 2022)
https://asec.ahnlab.com/en/44354
Threats:
Amadey
Smokeloader
Lockbit
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Formbook
Clipboard_grabbing_technique
Industry:
Financial
Geo:
Korea
IOCs:
Url: 21
Email: 5
File: 6
Domain: 5
Softs:
telegram
Languages:
php
ASEC BLOG
ASEC Weekly Malware Statistics (December 5th, 2022 – December 11th, 2022) - ASEC BLOG
The ASEC analysis team uses the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from December 5th, 2022 (Monday) to December 11th, 2022 (Sunday). For the main category, downloader…
#ParsedReport
15-12-2022
MoneyMonger: Predatory Loan Scam Campaigns Move to Flutter
https://www.zimperium.com/blog/moneymonger-predatory-loan-scam-campaigns-move-to-flutter
Actors/Campaigns:
Moneymonger (motivation: information_theft)
Threats:
Bazarbackdoor
Industry:
Financial
Geo:
Peru, Indian, Nederlands
IOCs:
Url: 33
Hash: 39
File: 1
Softs:
flutter, flutters, flutter-java, android, google chrome, mozilla firefox, opera, microsoft edge
Algorithms:
aes, xor
Functions:
collects_privateInfo
Languages:
java, javascript
Platforms:
apple
15-12-2022
MoneyMonger: Predatory Loan Scam Campaigns Move to Flutter
https://www.zimperium.com/blog/moneymonger-predatory-loan-scam-campaigns-move-to-flutter
Actors/Campaigns:
Moneymonger (motivation: information_theft)
Threats:
Bazarbackdoor
Industry:
Financial
Geo:
Peru, Indian, Nederlands
IOCs:
Url: 33
Hash: 39
File: 1
Softs:
flutter, flutters, flutter-java, android, google chrome, mozilla firefox, opera, microsoft edge
Algorithms:
aes, xor
Functions:
collects_privateInfo
Languages:
java, javascript
Platforms:
apple
Zimperium
MoneyMonger: Predatory Loan Scam Campaigns Move to Flutter - Zimperium
The Zimperium zLabs team recently discovered a Flutter application with malicious code. The Flutter-obfuscated malware campaign, MoneyMonger, is solely distributed through third-party app stores and sideloaded onto the victim’s Android device. Read more to…
#ParsedReport
15-12-2022
SpiderLabs Blog. Meta-Phish: Facebook Infrastructure Used in Phishing Attack Chain
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/meta-phish-facebook-infrastructure-used-in-phishing-attack-chain
IOCs:
Url: 5
File: 3
Softs:
instagram, telegram
Languages:
javascript
15-12-2022
SpiderLabs Blog. Meta-Phish: Facebook Infrastructure Used in Phishing Attack Chain
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/meta-phish-facebook-infrastructure-used-in-phishing-attack-chain
IOCs:
Url: 5
File: 3
Softs:
instagram, telegram
Languages:
javascript
Trustwave
Meta-Phish: Facebook Infrastructure Used in Phishing Attack Chain | Trustwave
Meta has two of the largest social media platforms today, Facebook and Instagram. These platforms became the modern gateway for people not just to socialize and eavesdrop on the lives of famous personalities, but more importantly, to stay connected with their…
#ParsedReport
15-12-2022
Supply Chain Attack via New Malicious Python Package, shaderz (Part 2)
https://www.fortinet.com/blog/threat-research/supply-chain-attack-via-new-malicious-python-package-shaderz-part-2
Threats:
W64/agent.7ec7!tr
IOCs:
File: 7
Path: 2
Url: 1
Hash: 1
IP: 1
Softs:
pyinstaller
Languages:
python
15-12-2022
Supply Chain Attack via New Malicious Python Package, shaderz (Part 2)
https://www.fortinet.com/blog/threat-research/supply-chain-attack-via-new-malicious-python-package-shaderz-part-2
Threats:
W64/agent.7ec7!tr
IOCs:
File: 7
Path: 2
Url: 1
Hash: 1
IP: 1
Softs:
pyinstaller
Languages:
python
Fortinet Blog
Supply Chain Attack via New Malicious Python Package, “shaderz” (Part 2) | FortiGuard Labs
FortiGuard Labs recently discovered a 0-day attack in a PyPI package called “shaderz.” Read Part 2 of this blog to learn about the downloaded executables and how to protect against the attack.…
Интересный проект с TTP и инфой по ним (детекты, новости, софты, группировки и т.д.)
https://app.tidalcyber.com/
https://app.tidalcyber.com/
Tidalcyber
Tidal Cyber
Threat-Led Defense
Forwarded from vx-underground
mcbazza was exploring Shodan. He found an exposed camera monitoring a large crop of Tomatoes
Good find!
Good find!
🔥2
#ParsedReport
15-12-2022
MCCrash: Cross-platform DDoS botnet targets private Minecraft servers
https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers
Threats:
Log4shell_vuln
Trojan:win32/mccrash.ma
Industry:
Healthcare, Iot
Geo:
Russia
IOCs:
File: 7
Domain: 2
Hash: 7
Softs:
microsoft defender for iot, (debian, ubuntu, pyinstaller, azure active directory, microsoft 365 defender, windows security, windows defender application control, microsoft defender, microsoft defender for endpoint, have more...
Languages:
java, python
15-12-2022
MCCrash: Cross-platform DDoS botnet targets private Minecraft servers
https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers
Threats:
Log4shell_vuln
Trojan:win32/mccrash.ma
Industry:
Healthcare, Iot
Geo:
Russia
IOCs:
File: 7
Domain: 2
Hash: 7
Softs:
microsoft defender for iot, (debian, ubuntu, pyinstaller, azure active directory, microsoft 365 defender, windows security, windows defender application control, microsoft defender, microsoft defender for endpoint, have more...
Languages:
java, python
Microsoft News
MCCrash: Cross-platform DDoS botnet targets private Minecraft servers
The Microsoft Defender for IoT research team analyzed a cross-platform botnet that infects both Windows and Linux systems from PCs to IoT devices, to launch distributed denial of service (DDoS) attacks against private Minecraft servers.
#ParsedReport
15-12-2022
Tracking Malicious Glupteba Activity Through the Blockchain
https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain
Threats:
Glupteba
Cerber
Industry:
Financial, Iot
IOCs:
Hash: 1
Domain: 41
Coin: 25
File: 1
Algorithms:
aes-gcm, exhibit, xor
15-12-2022
Tracking Malicious Glupteba Activity Through the Blockchain
https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain
Threats:
Glupteba
Cerber
Industry:
Financial, Iot
IOCs:
Hash: 1
Domain: 41
Coin: 25
File: 1
Algorithms:
aes-gcm, exhibit, xor
Nozominetworks
Nozomi Networks Researchers Track Malicious Glupteba Activity Through the Blockchain
This blog presents how Glupteba hides its C&C domains in the bitcoin blockchain, presenting various campaigns over the years.
#ParsedReport
16-12-2022
Dark Web Profile: Black Basta Ransomware
https://socradar.io/dark-web-profile-black-basta-ransomware
Actors/Campaigns:
Carbanak
Threats:
Blackbasta
Lockbit
Conti
Cobalt_strike
Qakbot
Industry:
Retail, Healthcare, Foodtech
Geo:
Deutsche, American
Algorithms:
chacha20
YARA: Found
SIGMA: Found
16-12-2022
Dark Web Profile: Black Basta Ransomware
https://socradar.io/dark-web-profile-black-basta-ransomware
Actors/Campaigns:
Carbanak
Threats:
Blackbasta
Lockbit
Conti
Cobalt_strike
Qakbot
Industry:
Retail, Healthcare, Foodtech
Geo:
Deutsche, American
Algorithms:
chacha20
YARA: Found
SIGMA: Found
SOCRadar® Cyber Intelligence Inc.
Dark Web Profile: Black Basta Ransomware - SOCRadar® Cyber Intelligence Inc.
According to some researchers, Black Basta is a ransomware group that works with the RaaS (ransomware as a service) model.
#ParsedReport
16-12-2022
Sophisticated DarkTortilla Malware Spreading Via Phishing Sites
https://blog.cyble.com/2022/12/16/sophisticated-darktortilla-malware-spreading-via-phishing-sites
Actors/Campaigns:
Tortilla
Threats:
Darktortilla
Agent_tesla
Asyncrat_rat
Nanocore_rat
Process_injection_technique
TTPs:
Tactics: 5
Technics: 6
IOCs:
Hash: 10
Url: 2
Registry: 1
File: 4
Path: 1
Domain: 2
Softs:
task scheduler, net framework, chrome
Algorithms:
rc4, exhibit, zip
Functions:
CreateDecryptor, FindNextFileExW, WriteFileA
Win API:
FindFirstFileExW, CreateFileA, GetObjectA
16-12-2022
Sophisticated DarkTortilla Malware Spreading Via Phishing Sites
https://blog.cyble.com/2022/12/16/sophisticated-darktortilla-malware-spreading-via-phishing-sites
Actors/Campaigns:
Tortilla
Threats:
Darktortilla
Agent_tesla
Asyncrat_rat
Nanocore_rat
Process_injection_technique
TTPs:
Tactics: 5
Technics: 6
IOCs:
Hash: 10
Url: 2
Registry: 1
File: 4
Path: 1
Domain: 2
Softs:
task scheduler, net framework, chrome
Algorithms:
rc4, exhibit, zip
Functions:
CreateDecryptor, FindNextFileExW, WriteFileA
Win API:
FindFirstFileExW, CreateFileA, GetObjectA
Cyble
DarkTortilla Malware Spread Through Phishing Sites
Cyble Research and Intelligence Labs analyzes DarkTortilla, a sophisticated malware spreading via Phishing sites.
#ParsedReport
16-12-2022
. Types of the latest .NET packers and domestic distribution trends
https://asec.ahnlab.com/ko/44066
Threats:
Agent_tesla
Formbook
Postealer
Avemaria_rat
Asyncrat_rat
Darktortilla
Purecrypter
Confuserex_tool
Lokibot_stealer
Remcos_rat
Trojan/win.msilkrypt.r478738
Trojan/win.msilkrypt.r479010
Trojan/win.malwarex-gen.c4922823
Trojan/win.msilkrypt.c5020026
Trojan/win.msil.r503383
Trojan/win.msil.r510208
Trojan/win.msil.r492640
Trojan/win.msilkrypt.r478746
Trojan/win.msil.r491654
Trojan/win.msil.r479032
Trojan/win.msil.r536135
Trojan/win.loader.c5020045
Trojan/win.msilkrypt.r479033
Trojan/win.generic.c5197697
Trojan/win.msilkrypt.r479202
Trojan/win.msil.r5288800
Trojan/win.msil.c5134406
Trojan/win.msil.r498082
Trojan/win.msil.c5198300
Trojan/win.msil.r510204
Industry:
Transport
Geo:
Korea
IOCs:
File: 101
Hash: 33
Url: 27
Softs:
discord
Algorithms:
base64, xor
Functions:
Gameloader, Type
Languages:
csharp
16-12-2022
. Types of the latest .NET packers and domestic distribution trends
https://asec.ahnlab.com/ko/44066
Threats:
Agent_tesla
Formbook
Postealer
Avemaria_rat
Asyncrat_rat
Darktortilla
Purecrypter
Confuserex_tool
Lokibot_stealer
Remcos_rat
Trojan/win.msilkrypt.r478738
Trojan/win.msilkrypt.r479010
Trojan/win.malwarex-gen.c4922823
Trojan/win.msilkrypt.c5020026
Trojan/win.msil.r503383
Trojan/win.msil.r510208
Trojan/win.msil.r492640
Trojan/win.msilkrypt.r478746
Trojan/win.msil.r491654
Trojan/win.msil.r479032
Trojan/win.msil.r536135
Trojan/win.loader.c5020045
Trojan/win.msilkrypt.r479033
Trojan/win.generic.c5197697
Trojan/win.msilkrypt.r479202
Trojan/win.msil.r5288800
Trojan/win.msil.c5134406
Trojan/win.msil.r498082
Trojan/win.msil.c5198300
Trojan/win.msil.r510204
Industry:
Transport
Geo:
Korea
IOCs:
File: 101
Hash: 33
Url: 27
Softs:
discord
Algorithms:
base64, xor
Functions:
Gameloader, Type
Languages:
csharp
ASEC BLOG
최신 닷넷 패커의 종류 및 국내 유포 동향 - ASEC BLOG
[TOC] 0. 개요 본 내용은 TI 보고서 ‘최신 닷넷 패커의 동향 및 분류 보고서‘를 축약한 내용으로 자세한 내용은 가장 하단의 링크를 통해 확인할 수 있다. 최근 닷넷으로 만들어진 패커가 국내와 국외 많은 곳에서 확인되고 있다. 따라서 ASEC 분석팀에서는 국내에 주로 유포되는 다섯 종류의 닷넷(.NET) 패커에 대해 소개하고 국내 유포 동향을 설명할 것이다. 따라서 닷넷 패커로 유포되는 악성 코드의 종류에 대해 간략히 소개하고, 이 문서만의 패커의…
#ParsedReport
16-12-2022
I Solemnly Swear My Driver Is Up to No Good: Hunting for Attestation Signed Malware
https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware
Actors/Campaigns:
Mofang
Contileaks
Threats:
Poortry
Stonestop
Plugx_rat
Trickbot
Fivesys
Vmprotect_tool
Industry:
Entertainment, Education
Geo:
Chinese, Iranian, Russian
IOCs:
Hash: 288
IP: 7
File: 13
Path: 3
Languages:
python
YARA: Found
16-12-2022
I Solemnly Swear My Driver Is Up to No Good: Hunting for Attestation Signed Malware
https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware
Actors/Campaigns:
Mofang
Contileaks
Threats:
Poortry
Stonestop
Plugx_rat
Trickbot
Fivesys
Vmprotect_tool
Industry:
Entertainment, Education
Geo:
Chinese, Iranian, Russian
IOCs:
Hash: 288
IP: 7
File: 13
Path: 3
Languages:
python
YARA: Found
Google Cloud Blog
I Solemnly Swear My Driver Is Up to No Good: Hunting for Attestation Signed Malware | Mandiant | Google Cloud Blog
#ParsedReport
16-12-2022
ASEC (20221204 \~ 20221210). ASEC Weekly phishing email threat trend (20221204 \~ 20221210)
https://asec.ahnlab.com/ko/44397
Threats:
Agent_tesla
Formbook
Smokeloader
Industry:
Financial, Transport
Geo:
Korea, Korean
TTPs:
IOCs:
File: 20
Url: 5
Algorithms:
zip
16-12-2022
ASEC (20221204 \~ 20221210). ASEC Weekly phishing email threat trend (20221204 \~ 20221210)
https://asec.ahnlab.com/ko/44397
Threats:
Agent_tesla
Formbook
Smokeloader
Industry:
Financial, Transport
Geo:
Korea, Korean
TTPs:
IOCs:
File: 20
Url: 5
Algorithms:
zip
ASEC BLOG
ASEC 주간 피싱 이메일 위협 트렌드 (20221204 ~ 20221210) - ASEC BLOG
ASEC 분석팀에서는 샘플 자동 분석 시스템(RAPIT)과 허니팟을 활용하여 피싱 이메일 위협을 모니터링하고 있다. 본 포스팅에서는 2022년 12월 04일부터 12월 10일까지 한 주간 확인된 피싱 이메일 공격의 유포 사례와 이를 유형별로 분류한 통계 정보를 제공한다. 일반적으로 피싱은 공격자가 사회공학 기법을 이용하여 주로 이메일을 통해 기관, 기업, 개인 등으로 위장하거나 사칭함으로써 사용자의 로그인 계정(크리덴셜) 정보를 유출하는 공격을 의미한다.…