Malicious PowerPoint Files Constantly Being Distributed
On April 2021, the ASEC analysis team introduced the malware delivered via PowerPoint files attached to email in the ASEC blog. The team has found continuous malicious activities that use PPAM files in the form of PowerPoint and thus is sharing them. When a macro included in the PowerPoint is
NanoCore RAT Disguised as Notification of Foreign Currency Remittance Being Spread!
The ASEC analysis team recently discovered that the NanoCore remote access Trojan (RAT) disguised as notification of foreign currency remittance was distributed. Because the malware is usually spread through phishing mails, users need to take extra caution. The mail impersonates a capital company and is distributed with the title “[**
JavaScript-based BlueCrab Ransomware Has Stopped?
The distribution of BlueCrab (Sodinokibi and REvil) ransomware exploiting JavaScript has stopped since July 13th, 2021. There have been many cases of the distribution being stopped and then resumed after going through changes, but this is the first time to have it stopped for such a long period. BlueCrab ransomware
Various Types of Threats Disguised as Software Download Being Distributed
Through multiple posts, the ASEC analysis team has mentioned CryptBot that is searched through keywords such as cracks and serials of commercial software, urging users to take caution. CryptBot Info-stealing Malware Distributed Through Phishing Sites CryptBot Infostealer Constantly Changing and Being Distributed CryptBot malware is the one that is usually
Word Document Titled ‘BIO Form’ Being Distributed
Since last month, the ASEC analysis team has been continuously uploading posts about APT attacks using word documents. Recently, it found that the malware of the same type is being constantly distributed in the name of ‘BIO form.’ By looking at the distribution history of previous word documents, we can
CryptBot Infostealer Constantly Changing and Being Distributed
CryptBot is an Infostealer that is being distributed through malicious websites disguised as software download pages. Because there are multiple malicious websites created and many of them appear on the top page when keywords such as cracks and serials of popular commercial software are entered in search engines, many users
Malware Disguised as Job Offer Letter
The ASEC analysis team has recently discovered that KPOT Infostealer is being distributed via spam mails containing word files. There has been a number of cases ultimately downloading Infostealer programs when the macro was enabled, but this case is noticeable in that it used a word file with a particular
Fileless Remcos RAT Malware Delivery
The ASEC analysis team identified that Remcos RAT malware is being distributed through malicious macros in Excel files. As for the malware, the team introduced it in detail in the post linked below this text. While the method of coming into the system through spam mails is the same as
Excel Files Becoming More Sophisticated (Distribution of Dridex and Cobalt Strike)
The distribution method of Dridex through Excel files has been steadily discovered since last year and was introduced on this blog. Recently, the ASEC analysis team found that the Cobalt Strike tool along with Dridex is being distributed with a similar method as before. Yet unlike previous cases, recent Excel
Excel 4.0 Macro with Various Images being Distributed
The ASEC analysis team found that malicious Excel files using the Excel 4.0 macro (formula macro) have been continually distributed. The malware has been distributed indiscriminately through e-mails since May, and as it is still being discovered today, users need to take caution. The malicious Excel files include images that
