AhnLab Security Emergency Response Center (ASEC)

#AhnLab #ASEC
AhnLab ASEC

[780th Military Intelligence Brigade (Cyber) @780thC]

Kimsuky Group Using Meterpreter to Attack Web Servers | ASEC has recently discovered the distribution of malware targeting web servers by Kimsuky group; a threat group deemed supported by North Korea. https://t.co/RV7ergaW93 @AhnLab_ASEC

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#Trigona #Ransomware Attacking MS-SQL Servers.

Typical attacks that target MS-SQL servers include brute force attacks and dictionary attacks on systems where account credentials are poorly managed.

https://t.co/9D5khh6q5d

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#Kimsuky Uses Alternate Data Stream (ADS) to Conceal Malware.

https://t.co/uqM5qmoB96

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#AhnLab #MDS detects and blocks malicious #IcedID ms-office word file that uses anti-sandbox techniques.

https://t.co/ucwETzb7Sx

👍AhnLab MDS
https://t.co/e4F2LPHm4l

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#Nevada #Ransomware is being distributed.
b673d92b77489d12779dc1fb5e8f6fdd

".NEVADA" extension
1. Main Features of Nevada Ransomware
2. Nevada Encryption Targets and Exception Conditions

https://t.co/akAMbasTv7

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

ASEC has recently discovered the #ShellBot, also known as #PerlBot, malware being installed on poorly managed Linux SSH servers.

If ShellBot is installed, Linux servers can be used as DDoS Bots for DDoS attacks against specific targets.

https://t.co/zaCcVrKpBS

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

ASEC discovered a malware strain disguised as a password file and being distributed alongside a normal file within a compressed file.

The recently discovered malware was in #CHM and #LNK file formats.

https://t.co/I6Yc5DF0yn

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

📝AhnLab Threat Intelligence Report

A comprehensive report on monitoring the activities of Kimsuky (FlowerPower, AppleSeed) in 2022

https://t.co/Q35K1uzbEe

https://t.co/9D0RnJ1XQ6

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

📝AhnLab Threat Intelligence Report

Unique characteristics of Kimsuky group’s spear phishing emails. Kimsuky used FQDN disguised as a famous Korean web portal.

https://t.co/bb28husMhl

https://t.co/o2MccWMYAc

#AhnLab #Kimsuky #Anlaysis #Thallium

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

📝AhnLab Threat Intelligence Report

Threat Trend Report on Region-Specific Ransomware
- Localized Ransomware Attacks
- Case Study: South Korea, Taiwan, China, Chile

https://t.co/3zAL1BVvfl

https://t.co/6hux6XN8tn

#AhnLab #Ransomware #Anlaysis

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#Mallox #ransomware, which targets vulnerable MS-SQL servers, has been historically distributed at a consistently high rate.

Mallox disguised as a program related to DirectPlay is a file built in .NET file.

📝Analysis:
https://t.co/WeBBCGsUWY

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

AhnLab Security Emergency response Center (ASEC) has recently discovered #CHM malware which is assumed to have been created by #Kimsuky.
It is distributed as an email attachment.

IOC:
726af41024d06df195784ae88f2849e4

C2:
hxxp://mpevalr.ria[.]monster

https://t.co/KjtzBBHgsC

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

❗MS-SQL Attack
The attacker used not only #CobaltStrike but also #Netcat to gain control over the infected system.
It targets poorly managed MS-SQL servers.
Various other malware were also installed like privilege escalator, infostealer, and proxy tools.
https://t.co/fVtMOz7iLu

[780th Military Intelligence Brigade (Cyber) @780thC]

According to ASEC the North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. https://t.co/MNRy8rPSmx @TheHackersNews

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#iswr #ransomware can be decrypted!!!
iswr ransomware is a variant of #STOP ransomware.

#AhnLab #ASEC offers a free script for decrypting files infected by iswr ransomware.

😆https://t.co/zXNhQMDTST

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

CHM Malicious File Disguised as Security Email from a Korean Financial Company
#RedEyes
#Scarcruft

https://t.co/fPoOSJyfzp

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

ASEC has recently discovered the installation of the #PlugX #malware through the Chinese remote control programs #Sunlogin and #Awesun’s remote code execution #vulnerability

https://t.co/UJBbM1bQpm

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#Lazarus exploited a zero-day #vulnerability in Korea’s widely used digital signature authentication software. They attacked Korean defense contractors, satellite companies, IT, and media companies. #0day

This report will be translated into English soon.
https://t.co/lsXnxdN6Oj

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

Anti-Forensic Techniques Used By #Lazarus Group

- Data Hiding: Encryption, Other Forms of Data Hiding
- Artifact Wiping: File Wiping
- Trail Obfuscation: Timestamp Changes

📝Analysis by #AhnLab #ASEC #AFIRST
https://t.co/XhhRoC9BpE

[AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC]

#Magniber #Ransomware’s Relaunch Technique using Windows Registry 🤐
Registering to be relaunched is a preliminary phase of encryption.

https://t.co/r6z7AOtm9T