Case of Ransomware Infection in a Company Using Local Administrator Accounts Set with Same Password
After analyzing the infected systems of the company that suffered damage from the recent Lockis ransomware infection, the ASEC analysis team discovered that the attacker executed the ransomware after RDP accessing the infected systems with local Administrator accounts. An investigation of local Administrator information of the infected systems showed that
Redline Stealer Targeting Accounts Saved to Web Browser with Automatic Login Feature Included
While investigating a recent breach case of the internal network of a certain company, AhnLab ASEC analysis team has confirmed that the VPN account used to access the company network was leaked from the PC of a certain employee who was working from home. The company where the damage occurred
![[Alert] Apache Log4j 2 Vulnerability, Update Recommended](https://asec.ahnlab.com/wp-content/uploads/2021/12/01_security-problem_03-1.png)
[Alert] Apache Log4j 2 Vulnerability, Update Recommended
The Apache Log4j 2 vulnerability (CVE-2021-44228) was revealed on Twitter and Github alongside POC on December 10th, 2021. It is the remote code execution (RCE) vulnerability of the Log4j software, which can include the remote Java object address in the log message and run it in the vulnerable server. Alibaba’s cloud
Word File Disguised as a Design Modification Request for Information Theft
The ASEC analysis team has discovered the distribution of malicious Word file targeting Korean users. The filename is Design Modification Request.doc, and it includes an image that prompts the user to run the macro. Figure 1. Image in the Word file Figure 2. File information of Design Modification Request.doc
Lokibot Malware Disguised as National Tax Service Email Being Distributed
The ASEC analysis team has recently discovered that malicious emails disguised as Hometax are consistently being distributed. The sender address used in the email is hometaxadmin@hometax.go[.]kr or hometaxadmin@hometax[.]kr, identical to the case found last year, and the email contains electronic tax invoice related materials. Figure 1. Email that is being
AgentTesla Being Distributed via More Sophisticated Malicious PowerPoint Files
The ASEC analysis team has introduced malicious PowerPoint files that have been continuously distributed since last year. Recently, the team has discovered that various malicious features were added to the script that is run in the malicious PowerPoint file. The method the malicious file is run remains the same as
Distribution of Phishing Emails Targeting Korean Research Institutes and Companies
The ASEC analysis team has discovered the distribution of phishing emails targeting Korean research institutes and companies to steal passwords. The phishing email impersonated an international transport company, requesting the user to submit custom information, and open the attachment file to prompt the user to click the URL. Upon clicking
Distribution of Malicious Excel Files Targeting Companies Amid Black Friday Season
Malicious Excel files are being distributed to companies amid the Black Friday season. The email confirmed today (Nov 25th) is an email reported by the attacked company in Korea. Attached to the email is an Excel file that contains an Excel 4.0 Macro (XLM) macro sheet in the form of
Emails Disguised as ‘Emirates Post’ Being Distributed During the Overseas Direct Purchase Season
The ASEC analysis team has introduced numerous phishing websites disguised as various companies. The team has recently discovered a malicious email disguised as Emirates Post, a transport company, during the overseas direct purchase season. As shown in the figure below, the malicious email states that there is a problem with
North Korea-related Malicious Document Files Using CVE-2021-40444 Vulnerability
The ASEC analysis team has recently discovered the distribution of malicious files that include a new vulnerability CVE-2021-40444 which was revealed by Microsoft in September. It is noteworthy that the confirmed document files are all North Korea-related materials. North Korea-related malicious files have been evolving in new ways since the past. Seeing
