SecAI

Innovative threat intelligence-driven and AI-powered company aiming at cyber threat detection and response.
🏢

[SecAI @SecAI_AI]

New #phishing assets of the #Kimsuky #APT group:
#IOC:
141.164.56[.]44
taxdeliveryservice.kro[.]kr
userauthoritydoc.p-e[.]kr
https://t.co/vzbN0Vvdoe
https://t.co/SogLhnRnRo
https://t.co/eOt7OkgNJi

[SecAI @SecAI_AI]

The #Konni #APT group used #compromised websites for command and control.
#IOC:
yukiicreatives[.]com
rayanlynch[.]com
https://t.co/AoqcY5e1vE
https://t.co/GlxKcoqCd6

[SecAI @SecAI_AI]

The #Kimsuky #APT group conducted #phishing using a Korean domain that means "Ministry of the Interior and Safety notification."
#IOC:
27.102.138.155
행정안전부통지서.홈페이지.한국
블로그신고안내.메인.한국
https://t.co/6rZ925IAfp
https://t.co/f5GQ53L90y
https://t.co/Oo8DiWsaLE

[SecAI @SecAI_AI]

The #Konni #APT group used #compromised websites to deliver information.
#IOC:
bergaeroworks[.]co[.]za
sitisrlweb[.]com
seacura[.]com
https://t.co/e0XqSdQyso
https://t.co/MHznU2kuvD
https://t.co/cgSMKu3BQ9

[SecAI @SecAI_AI]

Last chance to meet us at @GISECGlobal! The @SecAI_AI Booth at P48 is open for one more day.
Find out how AI-powered threat intelligence can give your security team a critical edge.

See you there!

[SecAI @SecAI_AI]

The #Kimsuky #APT group used the #BabyShark trojan to connect to its C2 server via a revoked TLS certificate.
#sha256: 8503a57fa9e3424cc1cb39f8cd15419840eaa73277e9fe383a1bebb518ef9ede(RemoteControl.dll)
#C2: first.pokerstarus.kro[.]kr
https://t.co/We9TamsSQF
Domain resolved to IP 221.162.112.235, re-resovled to over 20 suspicious .kro.kr domains.
https://t.co/TZQCNuBPTp

[SecAI @SecAI_AI]

Day 2 at @GISECGlobal!
Stop by Booth P48 to see why @SecAI_AI Investigator is making waves in Threat Intel.

We're giving away 15-day Pro access codes—grab yours and see the power for yourself.

[SecAI @SecAI_AI]

The #Konni #APT group used the #compromised site to download files.
#IOC: deliberatecollaboration[.]com
https://t.co/nbvORClebc

[SecAI @SecAI_AI]

It’s going to be a packed day at @GISECGlobal with world-class sessions, but don’t miss a visit to @SecAI_AI at Booth P48.

Stop by to see how our proprietary threat intelligence gives you actionable intelligence with near-zero false positives. See you there!

[SecAI @SecAI_AI]

Just 1 more day to @GISECGlobal! Come find @SecAI_AI at Booth P48 to have an hands-on experience of faster, smarter threat investigations powered by AI.

Plus, try your luck at our onsite Lucky Draw! 🎁

See you then!

[SecAI @SecAI_AI]

New #phishing assets of #Kimsuky #APT group:
158.247.247[.]157
https://t.co/oLA6NNsEuH
mexc-signin.kro[.]kr
https://t.co/cJttefbUia
yourinfo.kro[.]kr
https://t.co/Xfk19X5ipf
141.164.53[.]3
https://t.co/O851Wmx4tp
userdoc-sign.kro[.]kr
https://t.co/1nIIdVLmMj
getdocservice.r-e[.]kr
https://t.co/wyTv6i0K0i
mexc-enkr.kro[.]kr
https://t.co/y5GNV2zlLg

[SecAI @SecAI_AI]

The #Konni #APT group uses the #compromised site holosformations[.]fr to download files.
C2: 49.12.47[.]155:443
https://t.co/P2n7FE1Vno
https://t.co/UtGAPLmJ43
Hash: 869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47
It is related to #ChatGPT, uses an #AutoIt script for callback, and supports multiple functions such as file display, exfiltration, and downloading.

[SecAI @SecAI_AI]

New #phishing assets of the #Kimsuky #APT group:
210.114.14.234
https://t.co/Ch52GQ94TU
secinput.n-e[.]kr
https://t.co/vb0rB6ixT4
secuinput.r-e[.]kr
https://t.co/GZiboYthpE
secinput.o-r[.]kr
https://t.co/JB27UsXWwR
158.247.243.223
https://t.co/5lylVAU8BA
updateinfo.r-e[.]kr
https://t.co/VvvRow9jKq
completeinfo.r-e[.]kr
https://t.co/U7EsKdbk8v
preinfo.r-e[.]kr
https://t.co/qCXkezBSgh

[SecAI @SecAI_AI]

Recently, the #Konni #APT group has used a large number of #compromised websites to transmit information of infected hosts.
ausbildungsbuddy[.]de https://t.co/LaWBh55sqY…absongkhla[.]com https://t.co/ro6LcoOPtb
beldy[.]ma
https://t.co/savcQGJl9g
go2kgstan[.]com
https://t.co/96C7jfMSxo
holosformations[.]fr
https://t.co/P2n7FE1Vno
michaelagee[.]com
https://t.co/o9voFZ3x9V

[SecAI @SecAI_AI]

New #phishing assets of the #Kimsuky #APT group: #IOC:
158.247.202[.]109
portiondoc.o-r[.]kr
https://t.co/IekUxZKjQe
https://t.co/eLsvyrs7MO

[SecAI @SecAI_AI]

🚀 The new version of SecAI is live!
We’ve made major upgrades to help you analyze IPs and domains more effectively:
✅ Clear Verdicts – Malicious, Suspicious, Unknown, or Benign — based on multi-source intelligence
🏷️ Multi-layered Labels – Threat types, malware linkage, attribution, and campaign tags
📊 Historical Attacks – Visualize historical attack activity patterns of IPs
📚 Rich Intelligence contexts – Includes cybermapping data, WHOIS, DNS, certificates, related files, and more
🛠️ Feeds & API (coming soon) – Structured output for platform integration and automation

🔗 Try it now: https://t.co/UUC3aw4YPS
#ThreatIntelligence #CyberSecurity #SecAI

[SecAI @SecAI_AI]

Looking forward to @RSAConference 2025? Stop by booth #Booth N-6570 to meet our team and check out our TI-enriched and AI-driven cybersecurity solutions. You're just one step away from levelling up your security operation.
If you don't have a pass. Don't worry! Here is the Invitation Code: 52ESECAIXP
Registration link: https://t.co/1bS6fc58x7
See you at the RSA Conference 2025! #RSAC

[SecAI @SecAI_AI]

@El3phant_TW You can refer to this report for more information on Kimsuky: https://t.co/Z9u7pJmT7J

[SecAI @SecAI_AI]

The #Kimsuky #APT group used phishing sites to collect account credentials, but the sites has not been resolved to any IP addresses.
#IOC:
post.blogalarm.kro[.]kr
nid-info.checkmyblog.kro[.]kr
https://t.co/G24Om8KnJg
https://t.co/Oj89uUvlgo

[SecAI @SecAI_AI]

@Thisism23567356 Our analysts have determined that these domains belong to Kimsuky based on cybermapping and URL characteristics.

[SecAI @SecAI_AI]

New #phishing assets of the #Kimsuky #APT group:
#IOC:
158.247.192[.]105
ips-check.o-r[.]kr
https://t.co/sbjANZjwOj
https://t.co/gcn6rWvbHN