Malware Information

January 2023 Threat Trend Report on Kimsuky Group

Posted By ,

Overview The Kimsuky group’s activities in January 2023 were not so different from the past, and there were no prominent issues. However, it had been identified that AppleSeed and a tunnel program called ngrok were being distributed on a normal Korean website. The types of Fully Qualified Domain Name (FQDN) were mainly FlowerPower, AppleSeed, and Random Query.   Attack Statistics Like the 2022 Threat Trend Report on Kimsuky Group published on February 27, the FQDN of the FlowerPower type was…

Shadow Force Group’s Viticdoor and CoinMiner

Posted By ,

The Shadow Force group is a threat group that has been active since 2013, targeting corporations and organizations in South Korea. Trend Micro revealed the first analysis report in September 2015, where it stated that a Korean media-related company had been attacked. In March 2020, AhnLab published an analysis report on Operation Shadow Force. It was introduced as a single campaign as there was the possibility of it being the activities of an existing threat group. However, no relevant threat…

Trigona Ransomware Attacking MS-SQL Servers

Posted By ,

AhnLab Security Emergency response Center (ASEC) has recently discovered the Trigona ransomware being installed on poorly managed MS-SQL servers. Trigona is a relatively recent ransomware that was first discovered in October 2022, and Unit 42 has recently published a report based on the similarity between Trigona and the CryLock ransomware. [1] 1. Poorly Managed MS-SQL Servers Poorly managed MS-SQL servers typically refer to those that are exposed to external connections and have simple account credentials, rendering them vulnerable to brute force…

Additional Activities of the Tick Group That Attacks with a Modified Q-Dir and Their Ties with Operation Triple Tiang

Posted By ,

In March 2023, Eset analyzed malware that was found in an East Asian DLP manufacturer and announced that the Tick group was responsible for it. The Tick group has been active mainly in Korea and Japan since 2014, targeting various sectors such as aerospace, military, defense industries, heavy industries, electronics, telecommunications, government agencies, and diplomacy. AhnLab Security Emergency response Center (ASEC) has confirmed additional activities from this group and will be disclosing them here. * Modified Q-Dir Variants From January…

Qakbot Being Distributed in Korea Through Email Hijacking

Posted By ,

AhnLab Security Emergency response Center (ASEC) has identified circumstances of Qakbot being distributed via malicious PDF files attached to forwarded or replies to existing emails. Qakbot banking malware is one of those that are continuously being distributed through various media. ASEC has covered the distribution trends of Qakbot over the years. As shown below, the distributed email has the form of a hijacked normal email where a reply is sent to the target user with a malicious file attached to it,…