Winston Chen

🚨 Threat Campaign Alert - North Korea's Kimsuky Unleashes New KLogEXE Keylogger and FPSpy in Targeted Attacks on South Korean🚨 Summary: The North Korean APT group Sparkling Pisces (aka Kimsuky) has been discovered using two new malware strains, KLogEXE and FPSpy, to target South Korea. These sophisticated tools, which include a keylogger and a backdoor, significantly enhance their cyber espionage capabilities and pose a serious threat to global organizations. Threat Actor/Group: Sparkling Pisces (aka Kimsuky)   Malware: KLogEXE, FPSpy Targeted Countries: South Korea Targeted Industries: Not Mentioned Targeted Applications/CVE: Not Mentioned Impact: Espionage, Data exfiltration, keylogging, device compromise IOCs:  SHA-256 Hash 990b7eec4e0d9a22ec0b5c82df535cf1666d9021f2e417b49dc5110a67228e27, a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2, faf666019333f4515f241c1d3fcfc25c67532463245e358b90f9e498fe4f6801, c69cd6a9a09405ae5a60acba2f9770c722afde952bd5a227a72393501b4f5343, 2e768cee1c89ad5fc89be9df5061110d2a4953b336309014e0593eb65c75e715, Domains and Ip Addr mail.apollo-page.r-e[.]kr, nidlogin.apollo.r-e[.]kr, bitjoker2024.000webhostapp[.]com, www.vic.apollo-star7[.]kro.kr 152.32.138[.]167 URL hxxp[:]//mail.apollo-page.r-e[.]kr/wp-content/include.php?_sys_=7, hxxp[:]//mail.apollo-page.r-e[.]kr/plugin/include.php?_sys_=7, hxxps[:]//nidlogin.apollo.r-e[.]kr/cmd/index.php?_idx_=7 MITRE ATT&CK TTP IDs: T1056 (Input Capture),T1071.001 (Application Layer Protocol - Web Protocols),T1105 (Ingress Tool Transfer),T1059.001 (Command and Scripting Interpreter: PowerShell),T1027 (Obfuscated Files or Information) Reference: This writing is based on Research Advisory Report published by ‘Unit42' Team. ------------------------------------------------------------------------------------------ 🚀Join us on our mission to secure the digital world and make cyber defense affordable to everyone! 🌐 Follow "CyberXTron Technologies" for the timely, relevant and actionable cyber threat insights.  #SparklingPisces #Kimsuky #CyberEspionage #Keylogger #FPSpy #APTGroup #NorthKoreaCyberThreat #MalwareAnalysis #CyberThreat #Malware #InfoSec #ThreatIntelligence #cyberXTron #uncovertheunknown🛡️🔒

2

According to recent research, Chinese hacking groups have been targeting a Southeast Asian government agency in a coordinated cyber espionage operation since March 2023. Campaign dubbed "Operation Crimson Palace", involved new malware variants and three activity clusters. Despite Sophos blocking some operations, the attackers have persisted, attempting to resume illicit activities more covertly. Co-founder Francois Driessen weighs in on how this situation reveals the vulnerabilities organizations face when relying purely on reactive security; warranting the need for a true proactive approach. "This is a textbook case of failure of reactive security, no matter how good the technology is," shares Francois. Read the full report here: https://bit.ly/3z3tbMF #ZTconnectivity #CyberEspionage #SophosReport #ThreatGroup

8

🐼Plaguing Panda🐼 A recent advisory issued by multiple international cybersecurity and law enforcement agencies highlights the dangerous activities of the Chinese state-sponsored APT 40 hacking group, which has been exploiting vulnerabilities in public-facing infrastructure and networking devices since 2011. 🕵️ Known by several aliases including Kryptonite Panda and Leviathan, APT 40 has been involved in extensive cyberespionage campaigns against critical targets in countries like the US and Australia, notably using flaws in Log4J, Atlassian Confluence, and Microsoft Exchange to launch attacks. Their tactics involve quickly adapting exploit proof-of-concepts for newly disclosed vulnerabilities and using them to penetrate targeted networks. 🏠 APT 40 is particularly notorious for hijacking end-of-life small-office/home-office (SOHO) routers, turning them into operational infrastructure for launching further attacks and camouflaging their activities by blending in with legitimate traffic. The advisory, featuring case studies from 2022, demonstrates how APT 40 establishes footholds within networks using web shells for persistent access, laterally moves using stolen credentials, and ultimately exfiltrates sensitive data while maintaining a stealthy presence. Recommendations for mitigating such threats include timely application of patches, comprehensive logging, network segmentation, and replacing end-of-life equipment to defend against these sophisticated cyber threats. ❓ State-sponsored attacks from adversarial nations continue to be an ongoing threat. What steps are you taking to mitigate or prevent these incidents from affecting your own network and systems? 🗣️ Let us know your cybersecurity best practices in the comments below! #China #APT40 #KryptonitePanda #Leviathan #Log4J #public-facinginfrastructure #SOHO #hacking #cyberespionage #stolencredentials #sensitivedata #riskmitigation https://buff.ly/3VVibc3

3

We presented our GPT-POWERED MITRE ATT&CK COPILOT session at the Asia-Pacific ATT&CK Community Workshop on 26 Apr 2024 and would like to share the session recording with everyone. Thanks to Center for Threat-Informed Defense and MITRE Engenuity for having us at this workshop, and looking forward to the next community event. This workshop explores the groundbreaking integration of Generative Pre-trained Transformer (GPT) technologies with the ATT&CK framework, highlighting its potential to revolutionize cybersecurity defense mechanisms, threat intelligence analysis, and incident response strategies. As cyber threats become increasingly sophisticated, leveraging advanced technologies like GPT to enhance the MITRE frameworks such as ATT&CK for enterprise, mobile, and ICS can significantly augment an organization’s ability to understand, predict, and mitigate cyber threats. The integration of AI and machine learning offers unprecedented opportunities for automating threat intelligence, enhancing decision-making processes, and developing more resilient cybersecurity postures. Speaker: Steve Ng Co-Founder and CEO, SporeX #MITRE #ATTACK #CoPilot

1

1件のコメント

🌙Moonstone Mayhem🌙 North Korean threat actors, particularly those operating in the newly identified group Moonstone Sleet, continue to exploit the open-source ecosystem, targeting the public npm registry to distribute malicious packages. 📦 These activities, initially linked to the group Jade Sleet, have persisted into 2024 despite increased awareness and defensive efforts. The emergence of Moonstone Sleet demonstrates an ongoing threat to the open-source software supply chain, employing similar tactics to other North Korean groups to achieve financial gains and cyberespionage through malware distributed via npm packages. These malicious activities underscore a persistent cybersecurity threat within the open-source community, challenging both the security infrastructure and the operational integrity of affected systems. 🕵️ The differing techniques between Jade Sleet's dual-package approach and Moonstone Sleet's more streamlined, single-package strategy highlight evolving methods to evade detection and maximize impact. This situation stresses the importance of vigilant security practices among developers and organizations utilizing open-source resources, as well as the necessity for ongoing collaboration within the cybersecurity community to counter these sophisticated threats effectively. 👇 Click the link below to read the full details on the group's activities and tactics, then drop your thoughts in the comments below about this latest threat from North Korea and what it means for the next steps of combatting adversarial state-sponsored groups. #NorthKorea #JadeSleet #MoonstoneSleet #threatactor #statesponsored #cyberespionage #malware #NPM #npmpackages #cybersecurity #nationalsecurity Checkmarx.com https://buff.ly/4cpeqCB

1

Few days to go! Join us on October 23rd to master the MITRE ATT&CK framework and boost your security measures with guidance from Sergey Chubarov. Reserve your spot now: https://lnkd.in/g2zkeEYc #ECCouncil #Cybersecurity #CybersecurityAwareness #EthicalHacking #EthicalHacker #Pentesting #PenetrationTesting #MITRE #ThreatModelling #CyberThreats #CyberAttacks #Webinar #CybersecurityWebinar #CybersecurityExpert

15

Our latest CTI report presents a thorough analysis of recent cyber activities targeting Taiwan by Chinese state-sponsored threat actors. This report offers comprehensive insights into APT tactics, detailed analysis of significant incidents, and actionable recommendations for threat mitigation. Essential for clients and organizations, this report provides the tools needed to anticipate and counteract cyber risks and stay ahead of evolving threats. #CyberExcellence #SecurityInnovation

5

South Korea will implement offensive cyber defense operations to protect critical national infrastructure from hacking and counter disinformation, as announced by the National Security Council (NSC) on September 1. The NSC has developed the National Cybersecurity Basic Plan in collaboration with 14 government agencies. The plan aims to deter cyber threats and establish a foundation for addressing disinformation that affects public opinion and causes social unrest. South Korea intends to collaborate with other countries that share liberal democratic values to enhance cybersecurity cooperation and develop international norms. Measures outlined in the plan include boosting the resilience of critical infrastructure and implementing a multi-layered security system utilizing artificial intelligence and network separation. The initiative comes amid rising concerns over North Korea's alleged cyber activities, including cryptocurrency theft and hacking of defense contractors. #AsiaRisk #CyberAttacksandDataLoss #SouthKorea Follow us for daily updates on risk and operations in Asia! https://lnkd.in/g76b2PCi

1

Red Alert, an offensive research department that is part of a Singapore NSHC group, released "Monthly Threat Actor Group Intelligence Report" for July 2024. There are a few statistics that caught our eye: - The following industries are the most targeted by threat actors: * Commercial Facilities (16% of all attacks) * Finance (10%) * Government (10%) * Manufacturing (10%) * Research (10%) - The most targeted continent is Europe (25% of all attacks) and at the second place you will find South Asia (21%) - The majority of attacks used various phishing methodologies to infect the endpoint devices with malware, usually disguised as a legitimate file. - The most common goal of hacker groups is data theft. You can find more details here: https://lnkd.in/eD4-ghRP

6

🌐 𝐒𝐞𝐜𝐮𝐫𝐢𝐧𝐠 𝐊𝐨𝐫𝐞𝐚'𝐬 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐢𝐧𝐟𝐫𝐚𝐬𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 𝐰𝐢𝐭𝐡 𝐂𝐲𝐛𝐞𝐥𝐥𝐮𝐦. The Korea Internet & Security Agency (KISA) is one of the most important public bodies in Korea, in charge of both public and private sector cybersecurity. Recently, they partnered with Cybellum to manage SBOMs and vulnerabilities for numerous critical infrastructure devices. Read the full case study here: https://lnkd.in/dTaDdXiU #SBOM

11

3件のコメント

North Korea’s ‘Moonstone Sleet’ using fake tank game, custom ransomware in attacks. Why it matters: 1. North Korea's "Moonstone Sleet" hacking group not only poses an escalating financial threat, evidenced by a $6.6m ransom demand, but also entails risks of intellectual property theft. Its targeting of defense and software companies reflects more sophisticated and ambitious criminal objectives. 2. The variety of tactics used, from deploying ransomware and elaborate scams involving fictitious companies and job opportunities, to orchestrating a fraudulent remote work operation, highlights the innovative nature of these cyber threats. Their ability to evolve and tailor their approach signals an increasing threat landscape. 3. The group's active targeting of software developers implies potential for future large-scale supply chain attacks. Microsoft's warning underlines the considerable scale and depth of resources backing North Korean cyber operations, emphasizing the growing urgency of cybersecurity measures globally. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/ekgtFtZ3

1

“A likely China-linked state-sponsored threat actor has been linked to a cyber espionage campaign targeting government, academic, technology, and diplomatic organizations in Taiwan between November 2023 and April 2024.     Recorded Future's Insikt Group is tracking the activity under the name RedJuliett, describing it as a cluster that operates Fuzhou, China, to support Beijing's intelligence collection goals related to the East Asian country. It's also tracked under the names Flax Typhoon and Ethereal Panda.     Among other countries targeted by the adversarial collective include Djibouti, Hong Kong, Kenya, Laos, Malaysia, the Philippines, Rwanda, South Korea, and the U.S.”    RedJuliett, a cyber threat group, has targeted 24 organizations, including government agencies in Taiwan, Laos, Kenya, and Rwanda, and 75 Taiwanese entities for deeper reconnaissance. They exploit internet-facing devices like firewalls and VPNs for initial access and use techniques like SQL injection. RedJuliett, a Chinese cyber threat group, is likely targeting Taiwan to gather intelligence on its economic policies and international relations.    Find out more about the news article and share your findings with us! https://lnkd.in/gEtsHnWz     #cybertronium #cybertroniummalaysia #redjuliett #vpn #firewall #cyberespionage #hacking 

2