CHA Minseok(Jacky)

CHA is my family name. Threat Intelligence Researcher at AhnLab / Keybase : mstoned7 , Signal : mstoned7.21 / Tweets are my own.

[CHA Minseok(Jacky) @mstoned7]

When I woke up, I found a reply saying that my request had been approved. However, I still couldn't continue the chat. I started a new conversation instead, and fortunately it retained the context of my previous conversation with Claude. I'm currently continuing the new conversation using a different model.

[CHA Minseok(Jacky) @mstoned7]

Using AI for cybersecurity work is tough. Claude paused my conversation for review while I was tracking a threat actor. I've submitted a 'request an exemption' and I'm curious how long the wait will be.

[CHA Minseok(Jacky) @mstoned7]

China's MPS announced 5 crackdowns (June 16, 2026) tied to Silver Fox malware (likely ValleyRAT/Winos4.0) development, sale, and distribution. Unclear if the 5 cases are linked or separate.

Since the Silver Fox source code/builder leaked in 2023, this looks like Chinese nationals who built variants from the leaked builder or sold/used it got arrested — not necessarily the original threat actor we've been tracking.

Similar to ransomware ecosystems: resellers/affiliates tend to get caught before the core developers do.
https://t.co/tiyDNf68DD (Chinese) #SilverFox

[Balkan Insight @BalkanInsight]

North Korean hackers are stealing identities to land freelance work with Western companies, and some of the victims are in the Balkans.

Read more: https://t.co/dHkpMD8RNt

[CHA Minseok(Jacky) @mstoned7]

It seems that the attacks on Japan using AtlasRAT are ongoing.

[サイバーディフェンス研究所｜脆弱性診断・ペネトレーションテスト・フォレンジック・脅威インテリジェンス @cyberdefense_jp]

🚨【ブログ公開】『日本を標的としたAtlas RAT配布事例を追う』

2026年に入り、日本語の業務文書に偽装したファイル名でAtlas RATへ誘導する検体を複数確認、本記事では2つの実行フローを軸に、配布からRAT本体起動までの流れと判明点を整理しました。亜種の実装差分にも触れています🔍

https://t.co/bdM2glnF6e

#サイバーセキュリティ #マルウェア #ThreatIntel #AtlasRAT #CDI

[CHA Minseok(Jacky) @mstoned7]

Massive data breach feared at Kyushu Power as SSD missing https://t.co/pCgVMrIkqv - It is reported that the data was not encrypted.

[CHA Minseok(Jacky) @mstoned7]

North Korea uses MetaMask as a cryptocurrency wallet. According to South Korean media reports, North Korea is researching the implementation of Ethereum smart contracts on its isolated internal network. https://t.co/WnqDiZyty5 (Korean)

[CHA Minseok(Jacky) @mstoned7]

@Sec_S_Owl This blog post includes several clusters that I am currently tracking. Unfortunately, the analysis does not explain how the attribution was made, so until it can be verified, I am treating it as a reference only and continue to distinguish those clusters separately.

[CHA Minseok(Jacky) @mstoned7]

The group we suspect to be Silver Fox attacked Korean organizations via SEO poisoning, and it appears they implemented IP filtering. While some of the targets were identified, we were unable to determine what actions were taken post-infection. The activity targeting Japan differs somewhat from the traditional Silver Fox we have been tracking, which leads us to assess it as either an affiliated group or an entirely separate threat actor.

[CHA Minseok(Jacky) @mstoned7]

Attribution of Silver Fox remains challenging. I consider it a misguided approach when some security vendors classify any ValleyRAT usage as Silver Fox activity. While Silver Fox is more aligned with cybercrime operations, their behavior outside of China tends to resemble that of an APT actor. (Though it's also possible this represents a distinct group operating in a similar manner.)

[CHA Minseok(Jacky) @mstoned7]

According to the Tving data breach report, the attacker directly accessed the database server where personal information was stored. https://t.co/hndshFOzXe (Korean)

[CHA Minseok(Jacky) @mstoned7]

User data from the Korean OTT service Tving has been leaked, including member IDs, names, dates of birth, gender, phone numbers, and email addresses. https://t.co/MuoiJAPECz , https://t.co/qRucOtatZv (Korean)

[CHA Minseok(Jacky) @mstoned7]

BGF Networks, the operator of CU convenience store parcel delivery, announced that a personal data breach was confirmed on June 4 at 3:30 PM.

The leaked data items include:
User ID & Password
Name, Date of Birth, & Gender
Address, Email, & Phone number
Connecting Information (CI)
https://t.co/ZBnODiGOEq (Korean)

[CHA Minseok(Jacky) @mstoned7]

LG says rumours of a potential sale of its TV business are “baseless”
https://t.co/1IJn4HTDdG

[CHA Minseok(Jacky) @mstoned7]

Ah... I used to be a big fan of LG TVs.

[Jukan @jukan05]

As a Korean, this is very sad.

According to a local Korean media report released today, LG Electronics has reportedly explored the possibility of selling its TV business to China’s Hisense.

The Korean TV industry has collapsed.

[CHA Minseok(Jacky) @mstoned7]

The President of LG Electronics' TV (MS) Business Division met with representatives from rival TV manufacturer Hisense and retailer https://t.co/YTdE9VTOXC in Beijing late last month. https://t.co/OM390ntIEl (Korean) While one Korean media outlet reported that LG Electronics might abandon its TV business, the accuracy of this claim remains unverified. https://t.co/1C6Wjgq2Vg (Korean) ,

[Sekoia.io @sekoia_io]

Russia's #FSB-linked #Gamaredon has been hammering Ukraine's government, military & critical infrastructure for over a decade. We went behind the scenes.

Tracked their infrastructure. Recovered artefacts from compromised machines. Here's what we found 🧵 https://t.co/o4KN9OAiip

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[ReversingLabs @ReversingLabs]

🚨 Supply Chain Attack Alert! 🚨
31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds!

ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope. 🧵

[CHA Minseok(Jacky) @mstoned7]

Similar variants have been emerging since April 2026, with 15 instances identified so far. The DLL includes the PDB path: C:\Users\Administrator\Desktop\084049\crashreport_new\Release\crashreport_new.pdb. Additionally, infection cases have been reported within our systems in Germany.

[Askar Dyussekeyev @askardyuss]

💥 Fresh APT-Q-27 (GoldenEyeDog) artifacts spotted! Both samples show revoked EV certs.

1️⃣ image2026052689685.exe (A9012A3DB01AE1336CD5B637A8668A5C)
Signed by: Xiamen Baoding Software Tech
Status: REVOKED by Sectigo (Issued Mar 23, 2026) 🛑

2️⃣ Side-loading payload: crashreport.dll (639b0dd0fe4da3f4743de6347d7d58b7)
Signed by: LENOVO (UNITED STATES) INC. (Digital Trust Lab)
Status: REVOKED by DigiCert (Issued Apr 10, 2026) ⚠️

Payload and auxiliary tools are hosted on storage.googleapis[.]com.

Stay vigilant! 🛡️

#ThreatIntel #MalwareAnalysis #APT