sekurak NewsAug 25, 2025

Hakerzy z Korei Północnej prowadzą nową kampanię cyber szpiegowską. Na celowniku placówki dyplomatyczne

Badacze z Trelix Advanced Research Center wykryli nową kampanię cyber szpiegowską wymierzoną w placówki dyplomatyczne w różnych regionach Korei Południowej. Od marca do lipca bieżącego roku zaobserwowano ponad 19 ataków spear-phishingowych, której celem były ambasady dyplomatyczne zlokalizowane na całym świecie. Za atakiem stoi prawdopodobnie ta sama grupa APT. Treści wiadomości...

#WBiegu #Apt #Apt43 #Awareness #Chiny #Github #Kimsuky #Korea #Szpiegowstwo #Xenorat

https://sekurak.pl/hakerzy-z-korei-polnocnej-prowadza-nowa-kampanie-cyber-szpiegowska-na-celowniku-placowki-dyplomatyczne/

Hakerzy z Korei Północnej prowadzą nową kampanię cyber szpiegowską. Na celowniku placówki dyplomatyczne

Badacze z Trelix Advanced Research Center wykryli nową kampanię cyber szpiegowską wymierzoną w placówki dyplomatyczne w różnych regionach Korei Południowej. Od marca do lipca bieżącego roku zaobserwowano ponad 19 ataków spear-phishingowych, której celem były ambasady dyplomatyczne zlokalizowane na całym świecie. Za atakiem stoi prawdopodobnie ta sama grupa APT. Treści wiadomości...

Sekurak
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲Aug 21, 2025
Detecting #XenoRAT C2 connections using example traffic from known malware sample.
🔥 e0b465d3bd1ec5e95aee016951d55640
🔥 5ab23ac79ede02166d6f5013d89738f9
📡 Huy1612-24727.portmap[.]io:24727
📡 193.161.193.99:24727
📡 147.185.221.30:54661
https://netresec.com/?b=258f641
Define Protocol from Traffic (XenoRAT)

This video shows how to define a protocol in CapLoader just by providing examples of what the protocol looks like. CapLoader can then identify that protocol in other traffic, regardless of IP address and port number, simply by looking for traffic that behaves similar to what it was trained on. We ca[...]

Netresec
The DefendOps DiariesAug 19, 2025

South Korean embassies are under a silent assault. XenoRAT is sneaking past security with phishing emails that use trusted cloud services—what does this mean for the future of cyber defense?

https://thedefendopsdiaries.com/xenorat-malware-a-stealthy-threat-to-south-korean-embassies/

#xenorat
#malware
#cybersecurity
#southkorea
#kimsuky

XenoRAT Malware: A Stealthy Threat to South Korean Embassies

Explore the stealthy XenoRAT malware targeting South Korean embassies with advanced evasion and persistence techniques.

The DefendOps Diaries
lazarusholicJun 19, 2025
"Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석" published by ENKI. #Kimsuky, #XenoRAT, #DPRK, #CTI https://www.enki.co.kr/media-center/blog/dissecting-kimsuky-s-attacks-on-south-korea-in-depth-analysis-of-github-based-malicious-infrastructure
Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석 | 엔키화이트햇

Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례에 대한 분석 글입니다.

lazarusholicJun 19, 2025
"Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure" published by ENKI. #Kimsuky, #XenoRAT, #DPRK, #CTI https://www.enki.co.kr/en/media-center/tech-blog/dissecting-kimsuky-s-attacks-on-south-korea-in-depth-analysis-of-github-based-malicious-infrastructure
Dissecting Kimsuky’s Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure | EnkiWhiteHat

Analysis of Kimsuky's latest domestic attack case exploiting GitHub as an attack infrastructure

The Threat CodexAug 21, 2024
MoonPeak malware from North Korean actors unveils new details on attacker infrastructure
#UAT_5394 #MoonPeak #XenoRAT
https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/
MoonPeak malware from North Korean actors unveils new details on attacker infrastructure

Cisco Talos has uncovered a new remote access trojan (RAT) family we are calling “MoonPeak.” This a XenoRAT-based malware, which is under active development by a North Korean nexus cluster we are calling “UAT-5394.”

Cisco Talos Blog
lazarusholicJun 26, 2024
"Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub" published by Hunt. #XenoRAT, #CTI, #OSINT, #LAZARUS https://hunt.io/blog/good-game-gone-bad-xeno-rat-spread-via-gg-domains-and-github
Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub

Discover how XenoRAT malware is infiltrating the esports community through .gg domains and GitHub.

lazarusholicJun 12, 2024
"APT-C-55（Kimsuky）组织在RandomQuery活动中投递开源RAT的攻击活动分析" published by Qihoo360. #APT-C-55, #XenoRAT, #RandomQuery, #CTI, #OSINT, #LAZARUS https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247498735&idx=1&sn=a0f713dddc2c2c69beca6137980dd27e
lazarusholicJun 11, 2024
"APT Attacks Using Cloud Storage" published by Ahnlab. #LNK, #XenoRAT, #CTI, #OSINT, #LAZARUS https://asec.ahnlab.com/en/66429/
APT Attacks Using Cloud Storage - ASEC BLOG

AhnLab Security Emergency response Center

ASEC BLOG
lazarusholicMay 23, 2024
"Cloud storage를 활용하는 APT 공격" published by Ahnlab. #LNK, #XenoRAT, #CTI, #OSINT, #LAZARUS https://asec.ahnlab.com/ko/65684/
Cloud storage를 활용하는 APT 공격 - ASEC BLOG

AhnLab Security Emergency response Center

ASEC BLOG