Beware of phishing emails disguised as quote requests (SnakeKeylogger)
The AhnLab SEcurity intelligence Center (ASEC) recently confirmed that phishing emails disguised as requests for quotes are being circulated. The email body is disguised as a request from a representative of the Materials Management Division in the Purchasing Department asking the recipient to review a quote, and it prompts the
Beware of phishing emails disguised as purchase order confirmation requests (Xloader)
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as requests to confirm purchase orders. The email body prompts recipients to open a malicious DOCX file disguised as a purchase order to verify the order. [Figure 1] Phishing email body When
Node2Shell: Taking Over a Server with a Single Compressed Data File (CVE-2026-111497)
Overview CVE-2026-111497, disclosed in October 2026, is an out-of-bounds write vulnerability in the Brotli decoder included in Node.js. Brotli is a compression algorithm developed by Google, primarily used to compress web transmission data or to decompress transmitted compressed data. When a web application receives data compressed with Brotli, the Brotli
September 2026 Infostealer Trend Report
Content This Infostealer Trend Report summarizes the distribution channels, number of malware samples, number of detections, and information on companies targeted by new Infostealers (malware designed to steal information) collected during the month of September 2026. The data was compiled based on detection logs from AhnLab SEcurity intelligence Center (ASEC)
The Weak Link Identified by AI: October 2026, When the Outer Contact Point Collapsed
Security Blind Spots Identified by AI The large-scale data breaches disclosed in quick succession in South Korea and Japan in October 2026 mostly originated not from internal core systems, but from peripheral entry points such as externally exposed web services, app backend APIs, and outsourced SaaS (services provided by third-party
Analysis of the GitHub “php2shell” Repository: Public PoCs and Defense Tools That Spread Immediately After the Disclosure of the PHP Vulnerability
Overview Immediately after the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, a large number of repositories named “php2shell” were created in a short period of time on GitHub, a code repository platform. Of the top 100 repositories (excluding forks) found by searching for “php2shell,” 99 addressed
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat
Key Summary Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX. Key Observations
The Threat of AI-Driven Autonomous Penetration Testing, as Examined by ARTEX
Overview AI is being used for various tasks that were previously performed manually, such as research, document writing, and code analysis. A 2026 corporate survey also showed that the scope of AI adoption among organizations had expanded compared to the previous year. Recently, there has been a trend toward automating
An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies
Overview. This report summarizes cases in which Suo5 (an HTTP/HTTPS-based tunneling tool) was exploited for pivoting—a technique used to expand the scope of an attack to other systems or networks by passing through a system that has already been compromised—by using compromised web servers as relay points to access internal
