Inhee Han

Threat Intelligence Researcher GTIG@Google (@Mandiant). Opinions are my own.

[RooCon @RooCon_AU]

🚨 SET YOUR ALARMS: #RooCon26 guest registrations open TOMORROW (1 Sep) @ 9:00 am AEST! ⏰

Join us 18–19 Nov at Google Sydney for deep technical threat intel, attribution, & adversary tradecraft.

🔗 Register Here Tomorrow:
https://t.co/5DnEy6o9bJ

[Aragorn Tseng @Aragorntseng]

Excited to share our latest research from Google Threat Intelligence Group on React2Shell (CVE-2025-55182).

https://t.co/qYJ3GwoDej

[RooCon @RooCon_AU]

Have you tracked an adversary, uncovered a novel TTP, or perfected an analytic technique? 🕵️‍♂️

The Call for Papers for RooCon25 is open, and while the initial submissions are excellent, we are actively seeking more voices. We are looking for 👉 your voice.

[Seongsu Park @unpacker]

Thrilled to speak at the upcoming Quarterly Cyber Threat Report (QCTR) hosted by the Centre for Cybersecurity Belgium (CCB) on July 10.

I’ll be presenting a technical deep dive into the latest campaigns by DPRK cyber threat actors, categorized into three main objectives: Surveillance, Cyber Espionage, and Financially Motivated Attacks. Join us to explore their evolving tactics!

https://t.co/bm2X06EQEr

[Dan Perez @MrDanPerez]

🚨Hiring Alert🚨

Our Cyber Espionage Intelligence Production team is hiring for a role dedicated to producing Intelligence on 🇨🇳 cyber threats!!!! This is an awesome opportunity to work with a team of dedicated analysts supporting the 🇨🇳Mission Team!

Lots of exciting data, great leadership and lots of Googleyness! Come work with me!

https://t.co/6qKH34B7Le

#cyberjobs #threatintel #china #chinacyber

[hypen @hypen1117]

My first #Lazarus report at #Kaspersky is out ! The newly discovered #CookiePlus is a plugin-based malware that has the ability to download both DLL and shellcode.

It was a great experience working with great coworkers and learning a lot.

https://t.co/Nbn1bWu3DB

[Seongsu Park @unpacker]

Just dropped findings on DPRK's campaigns: Contagious Interview & WageMole.

Key takeaways:
1️⃣ Threat actors are rapidly evolving tools in Contagious Interview.
2️⃣ Successful infection across platforms in record time.
3️⃣ WageMole shows in-depth interview prep & precise target selection.
4️⃣ They're enhancing interview prep with data stolen from Contagious Interview & Generative AI tech.
https://t.co/sgeS83yg3G

[POC_Crew @POC_Crew]

[POC2024] SPEAKER UPDATE 1⃣5⃣

👥 @binerdd & @kaanezder - "Fake it till you make it: Bypassing V8 Sandbox by constructing a fake Isolate"

#POC2024

[Seongsu Park @unpacker]

According to German media, North Korean-linked #Kimsuky hackers targeted Diehl Defense, a German arms company, to steal sensitive military data through fake job offers and a spoof website, tricking individuals into downloading malware.
Article: https://t.co/Xq2EHOw3rR

This relates to my HITCON presentation this year—hope the recording is available soon!

[Seongsu Park @unpacker]

Thrilled to announce that I'll be speaking at #HITCON CMT 2024 this August about the latest activities of the Kimsuky group. Looking forward to reconnecting with old friends and meeting amazing researchers!
https://t.co/23o1E5WCbX

[RooCon @RooCon_AU]

CFP for RooCon24 closes in 10 days. We’re looking forward for your submissions! 👇

https://t.co/tfUzsfAEwc

[Seongsu Park @unpacker]

Thrilled to shared #Kimsuky's latest activity using TRANSLATEXT to focus on the South Korean education sector in an intelligence gathering effort. 🕵️‍♂️
https://t.co/PeYK1QDnzc

What caught our attention:
▶️ Found a Chrome extension on a attacker-controlled GitHub.
▶️ It snags cookies, screenshots, and even email passwords.
▶️ Can bypass security measures from email providers.
▶️ Uses a dead drop resolver to receive extra commands via a legitimate blog service.
▶️ Target confirmed: South Korean education sector linked to North Korea research.

[Mathew @mittypk]

🦘🚨 CFP is live! Attendee registration coming in the near future, stay tuned.

[Mathew @mittypk]

🚨RooCon24 - 5 Nov 2024! 🚨
More coming soon, stay tuned!
🦘🦘🦘

[hypen @hypen1117]

We recently identified #TrollStealer, which we believe is behind the #Kimsuky group. Written in Go, the stealer was signed with a legitimate certificate and steals the GPKI certificate used by the South Korean government.

Please see the report below ⬇️
https://t.co/hil8trocNS

[Seongsu Park @unpacker]

This is a typical methodology recently employed by the #BlueNoroff group. They initiate contact with individuals involved in cryptocurrency and propose an online meeting, during which they prompt the execution of a Javascript or Applescript to ostensibly configure internal meeting settings. However, in reality, this script is designed to fetch the next stage payload. Please beware of the latest tactic from this notorious group! 🚨

[Seongsu Park @unpacker]

Just uncovered another cyber attack by the Lazarus group! This time, they targeted a software vendor, exploiting vulnerabilities in widely-used software in South Korea. Also, uncovered links to previous campaigns attributed to this group. Check this out:
https://t.co/MbaejLKPsB

[Mathew @mittypk]

🦘🚨RooCon Call for Papers is still open for another week! This is your last chance to be a presenter! 🎙️
https://t.co/NWWt4KL9bk

[Yongdae Kim ([email protected]) @yongdaek]

* LTESniffer 2.0.0: Supporting Uplink Sniffing with Two B210s*

Done by Tuan Dinh Hoang
@hdtuanss, who keeps upgrading it even after paper acceptance.

Previously, it requires to use the expensive X310.

https://t.co/1zGhTlfIAr

[Mathew @mittypk]

🚨🦘We couldn't find a cyber threat intel and attribution focused conference in the region so we thought we would build it! Come join us at the first ever RooCon later this year at Google's offices in Sydney. It will be a free event but spaces are limited

https://t.co/ZTwRoODJPh