APT Attack Disguised as a Research Paper on Russia-North Korea Partnership (Kimsuky)
AhnLab SEcurity intelligence Center (ASEC) has recently discovered an APT attack targeting Korean users. During the attack, the threat actor used a GitHub repository, which was uploaded with various malicious scripts and normal decoy files used for the attack. Figure 1. Threat actor’s GitHub repository Malicious behaviors are performed
Malware Disguised as Browser Update
Recently, AhnLab SEcurity intelligence Center (ASEC) identified the distribution of malware disguised as a browser update targeting a wide range of users. This malware is distributed through infected websites, and when users visit these sites, malicious scripts are loaded. The scripts create fake update windows for browsers like Chrome or
GitHub Enterprise Server (GHES) Product Security Update Advisory (CVE-2024-6800)
Overview An update has been released to address vulnerabilities in the GitHub Enterprise Server(GHES)...
GitHub Repository Used by Kimsuky Threat Group
Overview While analyzing the Kimsuky group’s malware, AhnLab SEcurity intelligence Center (ASEC) discovered a certain GitHub repository. An inspection revealed that a strain of the FlowerPower malware that has been distributed since 2020 was uploaded. It also contained user information exfiltrated to GitHub and was confirmed to be the
Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub)
AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of a malicious Word file disguised as a profile template from emails impersonating a certain professor. ‘[Attachment] Profile Template.doc’ is the filename of the password-protected Word file that was discovered, with the password itself being included in the body of
