Time

·         2025

Targets

·         European public · legal sector institutions

·         Korean ERP software vendors and their ERP using clients

Initial Access

·         In the case of Korea, supply chain attacks through ERP software companies

Exploited Vulnerabilities

·         unknown

Malware and Tools

·         TigerRAT : Custom RAT for initial foothold and command execution

·         JelusRAT : In-memory loading·plugin-based extended functionality 2stage RAT

·         StarshellRAT : Command execution·file exfiltration·screenshot functionality .NET RAT

·         GopherRAT : File/folder exfiltration·SOCKS tunneling·system enumeration functionality Golang RAT

·         ASPXSHELL/TigerShell : Web shell for web server control and command execution

·         Custom Port Scanner(ps.exe) : Internal network port scanning

·         PetitPotato(Custom) : MS-EFSR privilege escalation

·         BYOVD(Process Explorer driver exploitation) : EDR/security process termination

·         Procdump/PassView/Plink/Socks5Server : Credential theft and tunneling auxiliary tools

Techniques

·         Securing persistence and re-execution based on Scheduled Task

·         Collection of domain and user credentials through LSASS/NTDS/registry dump

·         Internal asset and network reconnaissance based on PowerShell · WMIC · Netstat

·         Lateral movement using RDP and Impacket

·         Evasion of detection through disabling Windows Defender and setting exceptions

·         File / tool /Forensic disruption through artifact deletion

·         Supply chain infection through trojanization of ERP update paths

·         Covert communication through in-memory execution and web shell utilization

Impact

·         Domain and user credential theft

·         Potential leakage of internal systems and AD information

·         Access to and information gathering of sensitive documents related to money laundering

·         Secondary infection risk occurring for multiple ERP customers

Description

·         Andariel conducts two independent infiltrations in different regions and methods

·         One is a direct infiltration-type RAT operation, the other is a supply chain attack exploiting software update chains

Source

·         To the past and beyond: Andariel’s latest arsenal and cyberattacks[1]

Time

·         May 2025

Targets

·         South Korean North Korean field activists

Initial Access

·         Spear phishing email dispatch

·         Inducing clicks on MEGA cloud links in emails

·         Inducing execution of internal LNK ( shortcuts ) after downloading ZIP

·         Executing PowerShell scripts upon LNK execution → downloading and executing additional malicious files ·

Exploited Vulnerabilities

·         None

Malware and Tools

·         LNK(Shortcut): Internal Offset/Payload based on ExtraData included, Triggers the creation of multiple malicious files upon execution

·         PowerShell: Downloads additional malicious files·Executes, Collects system information·Uploads

·         ms.exe: Normal signature(Adersoft certificate)Used in launcher form, Same path .Includes manifest auto-load verification logic

·         ms.exe.manifest: Base64 Includes encoded data, Executes VBS after decoding

·         1.vbs: pc366.ps1 Execution trigger

·         pc366.ps1: Exfiltrates system information and uploads to Dropbox, Receives additional files from Dropbox·Executes

·         tmp.ini / park_yyy_MM-dd__HH_mm_info.ini: Filename for storing and uploading collected information

·         1.bat: Downloads and executes additional files from the attacker’s server

·        default_an.vbs: PowerShell Execute(Console Hide) and default_an.ps1Execute

·        default_an.ps1:AnyDesk related window/Hide tray traces·Remove, default_an.exeExecute

– default_an.exe: AnyDesk executable file (described as version 5.5.3.0)

·        service.conf/system.conf:described as AnyDesk configuration file

·        default5(XML): 5every default_an.vbsconfiguration file for registering Scheduled Task to execute

·        curl:used for additional file download

Techniques

·        Hiding multiple payloads in LNK ExtraData,XOR(0xAD)After decoding, create files step by step

·        Deceiving users with bait documents(Display normal document screen)

– Scheduled Task registration for periodic execution (ms.exe executed every 18 minutes, default_an.vbs executed every 5 minutes)

·         Normal cloud service(Dropbox)exploitation C2communication and data upload

·         system information collection(process/OS version/public IP/antivirus products, etc.)

·         remote control tool(AnyDesk)UI trace concealment(window/tray icon hiding·deletion)

·         parameter-based download infrastructure(d.php +newpa parameter)for flexible delivery of multiple files

Impact

·         Theft of victim’s system information and upload to Dropbox

·         Receiving additional files for executing attacker commands·performing execution functions

Description

·         Distributing malicious ZIP files based on MEGA links targeting North Korean activists through spear phishing,when LNK is executed, PowerShell downloads and executes additional payloads

·         Using Dropbox as a C2channel for uploading collected information and receiving files for executing additional commands

·         ms.exe(normal signature launcher) + .manifest(Base64 VBS) loading method and pprb/d.php?newpa= form download infrastructure suggests the attack entity is Kimsuky(APT43)

Source

·         [Monthly threat analysis] Latest information theft cases by the attack group using Kimsuky Dropbox[2]