New #phishing assets of the #Kimsuky#APT group:
#IOC:
141.164.56[.]44
taxdeliveryservice.kro[.]kr
userauthoritydoc.p-e[.]kr
https://t.co/vzbN0Vvdoe
https://t.co/SogLhnRnRo
https://t.co/eOt7OkgNJi
The #Konni#APT group used #compromised websites for command and control.
#IOC:
yukiicreatives[.]com
rayanlynch[.]com
https://t.co/AoqcY5e1vE
https://t.co/GlxKcoqCd6
The #Kimsuky#APT group conducted #phishing using a Korean domain that means "Ministry of the Interior and Safety notification."
#IOC:
27.102.138.155
행정안전부통지서.홈페이지.한국
블로그신고안내.메인.한국
https://t.co/6rZ925IAfp
https://t.co/f5GQ53L90y
https://t.co/Oo8DiWsaLE
The #Konni#APT group used #compromised websites to deliver information.
#IOC:
bergaeroworks[.]co[.]za
sitisrlweb[.]com
seacura[.]com
https://t.co/e0XqSdQyso
https://t.co/MHznU2kuvD
https://t.co/cgSMKu3BQ9
Last chance to meet us at @GISECGlobal! The @SecAI_AI Booth at P48 is open for one more day.
Find out how AI-powered threat intelligence can give your security team a critical edge.
See you there!
The #Kimsuky#APT group used the #BabyShark trojan to connect to its C2 server via a revoked TLS certificate.
#sha256: 8503a57fa9e3424cc1cb39f8cd15419840eaa73277e9fe383a1bebb518ef9ede(RemoteControl.dll)
#C2: first.pokerstarus.kro[.]kr
https://t.co/We9TamsSQF
Domain resolved to IP 221.162.112.235, re-resovled to over 20 suspicious .kro.kr domains.
https://t.co/TZQCNuBPTp
Day 2 at @GISECGlobal!
Stop by Booth P48 to see why @SecAI_AI Investigator is making waves in Threat Intel.
We're giving away 15-day Pro access codes—grab yours and see the power for yourself.
It’s going to be a packed day at @GISECGlobal with world-class sessions, but don’t miss a visit to @SecAI_AI at Booth P48.
Stop by to see how our proprietary threat intelligence gives you actionable intelligence with near-zero false positives. See you there!
Just 1 more day to @GISECGlobal! Come find @SecAI_AI at Booth P48 to have an hands-on experience of faster, smarter threat investigations powered by AI.
Plus, try your luck at our onsite Lucky Draw! 🎁
See you then!
The #Konni#APT group uses the #compromised site holosformations[.]fr to download files.
C2: 49.12.47[.]155:443
https://t.co/P2n7FE1Vno
https://t.co/UtGAPLmJ43
Hash: 869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47
It is related to #ChatGPT, uses an #AutoIt script for callback, and supports multiple functions such as file display, exfiltration, and downloading.
Recently, the #Konni#APT group has used a large number of #compromised websites to transmit information of infected hosts.
ausbildungsbuddy[.]de https://t.co/LaWBh55sqY…absongkhla[.]com https://t.co/ro6LcoOPtb
beldy[.]ma
https://t.co/savcQGJl9g
go2kgstan[.]com
https://t.co/96C7jfMSxo
holosformations[.]fr
https://t.co/P2n7FE1Vno
michaelagee[.]com
https://t.co/o9voFZ3x9V
🚀 The new version of SecAI is live!
We’ve made major upgrades to help you analyze IPs and domains more effectively:
✅ Clear Verdicts – Malicious, Suspicious, Unknown, or Benign — based on multi-source intelligence
🏷️ Multi-layered Labels – Threat types, malware linkage, attribution, and campaign tags
📊 Historical Attacks – Visualize historical attack activity patterns of IPs
📚 Rich Intelligence contexts – Includes cybermapping data, WHOIS, DNS, certificates, related files, and more
🛠️ Feeds & API (coming soon) – Structured output for platform integration and automation
🔗 Try it now: https://t.co/UUC3aw4YPS
#ThreatIntelligence #CyberSecurity #SecAI
Looking forward to @RSAConference 2025? Stop by booth #Booth N-6570 to meet our team and check out our TI-enriched and AI-driven cybersecurity solutions. You're just one step away from levelling up your security operation.
If you don't have a pass. Don't worry! Here is the Invitation Code: 52ESECAIXP
Registration link: https://t.co/1bS6fc58x7
See you at the RSA Conference 2025! #RSAC
The #Kimsuky#APT group used phishing sites to collect account credentials, but the sites has not been resolved to any IP addresses.
#IOC:
post.blogalarm.kro[.]kr
nid-info.checkmyblog.kro[.]kr
https://t.co/G24Om8KnJg
https://t.co/Oj89uUvlgo