AhnLab

Detect, Respond and Evolve
Security Powered by AI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 1st week of June📌

🏭 Qilin listed a South Korean industrial automation equipment company as a new victim
🏥 Black X posted internal data from a South Korean plastic surgery clinic on its leak site
🎓 Nova listed the AI department of a university in Daegu, South Korea, as a new victim

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 4th week of May📌

🏫 Customer data from a Japanese education franchise is being sold on a cybercrime forum
📊 Data from a Japanese government agency handling national civil-service HR is being sold on a cybercrime forum
⚽️ The FBI warned of phishing attacks spoofing official FIFA websites

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

A recent case involving malicious files disguised as security emails from a major Korean credit card company has been confirmed.
The attack flow is similar to a previous Kimsuky LNK malware distribution case.
Read the ASEC blog for the full analysis.
🔗https://t.co/sizthnH6dl

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 3rd week of May📌

💄 Nova named a South Korean cosmetics and chemical firm as a new victim

��� CoinbaseCartel claims a data leak from an open-source visualization platform

👨🏻‍💻 TeamPCP claims to be selling source code leaked from a major developer platform

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 2nd week of May📌

🏥 CoinbaseCartel listed a South Korean medical ultrasound maker as a new victim
💾 Leak Bazaar's DLS, active since March, was identified
👨🏻‍💻 TeamPCP and BreachForums announced a supply chain attack contest

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 1st week of May📌

🏛️ Data from Guatemalan government agencies is being sold on a cybercrime forum
🚗 BlackWater listed a Chinese auto parts manufacturer as a new ransomware victim
💳 A Japanese fintech firm disclosed unauthorized access after GitHub credentials were exposed

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 5th week of April📌

🔐  New ransomware group M3RX emerged
⛪ Data from a South Korean religious organization is being sold on a cybercrime forum
🎬 ShinyHunters claimed it stole data from a U.S. interactive media company

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 4th week of April📌

🏪 ShinyHunters claimed to have leaked data related to a U.S. convenience store chain

💻 ShinyHunters claimed to have leaked data and source code from a U.S. software firm

🔐 The infrastructure of the new data extortion group Prinz Eugen was identified

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 3rd week of April📌

🔐 New ransomware TiMC, BlackWater, and Lamashtu identified

🖧 NoName05716 claimed DDoS attacks on South Korea over support for Ukraine

🏦 A joint campaign by VECT ransomware and TeamPCP is spreading

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

🚨Cyber threat actors are consistently attempting to exploit living off the land binaries built into systems to bypass detection by security products.
Check the ASEC blog to discover the techniques, real world attack cases and counter measures.
https://t.co/rXcU9oVVug

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 2nd week of April📌

🔐 KryBit’s leak and mirror sites were observed

💊 Gunra listed a South Korean pharmaceutical company as a new victim

🧪 DragonForce listed an Egyptian generic drug developer and manufacturer as a new victim

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 1st week of April📌

🏭 NetRunner claimed to have stolen about 960GB of data from the Indian branch of a South Korean auto parts manufacturer
🚗 Everest claimed theft of about 910GB of data from a Japanese automaker
🖧 ShinyHunters claimed a breach of a US network company,

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

⚠️ASEC recently identified a change in the #Kimsuky group’s method of distributing malicious LNK files. Overall attack flow remains the same but structural change was observed in the intermediate execution phase.

Check the full analysis on the ASEC Blog: https://t.co/AFZQ6zcv88

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 4th week of March📌

🚗 Unauthorized external access exploited a warehouse system vulnerability at a Japanese automaker
🏭 INC Ransom claims theft of about 128GB of data from a South Korean steel company
🚔 The operator of cybercrime forum LeakBase was arrested

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

Larva-26002 threat actors have been continuously targeting improperly managed MS-SQL servers. In recent attacks, a scanner malware called ICE Cloud Client, written in Go, has been observed.
Check how Larva-26002 carries out its attack.
https://t.co/ygMLwxfXyK

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 3rd week of March📌

🌐 Emerging threat actor CipherForce claimed an attack on a South Korean job portal
👾 Infrastructure of a new threat actor Loki was exposed
🚔 Cybercrime forum LeakBase was seized and shut down by international law enforcement

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 2nd week of March📌

🔐 Qilin listed a dermatology clinic and the Korean branch of a global advertising company as victims
🏢 KillSec and Everest claimed attacks on a Korean expo management platform and a major elevator manufacturer
🖧 Root access to a South Korean government server is being sold on a cybercrime forum

#Cybersecurity #Ransomware #TI

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report - 1st Week of March 📌

🦹 Ransomware group Morpheus exposes plating company and leaks design drawings and internal credentials
🔒 Ransomware group Ailock resumes activity and re-posts past victim cases
🌐 Pro-Iran/pro-Islamist hacktivists claim DDoS attacks on Israeli defense infrastructure and expand targets to Western nations

#Cybersecurity #TI #ThreatIntel

[AhnLab @AhnLabGlobal]

📌 AhnLab TIP Weekly Report – 4th week of February

🧾 Source code of a South Korean accounting automation firm was found for sale on a cybercrime forum
👾 Beast ransomware listed two South Korean companies as victims
🔐 Atomsilo ransomware resurfaced with five victims posted

#Cybersecurity #Ransomware #TI