Makop Ransomware Distributed As Copyright Violation Related Materials
Malware

Makop Ransomware Distributed As Copyright Violation Related Materials

The ASEC analysis team has recently shared information about the distribution of Makop ransomware disguised as job applications. This week, the team confirmed that the ransomware is being distributed via e-mails that contain materials related to copyright violation. Unlike the last time, the compressed file is attached with the .dat

  • Apr 27 2021
[Caution] Makop Ransomware Disguised as Job Application E-mail Being Distributed!
Malware

[Caution] Makop Ransomware Disguised as Job Application E-mail Being Distributed!

ASEC analysis team has recently discovered ransomware disguised as job application being distributed via e-mail. It appears that the attacker is targeting recruitment managers of various companies amidst the recruitment season of the first half of the year. Hence, recruiters must pay particular attention when managing their e-mail accounts. The

  • Apr 16 2021
Caution! Magniber Ransomware Being Distributed in Korea Using CVE-2021-26411 Vulnerability
Malware Vulnerabilities

Caution! Magniber Ransomware Being Distributed in Korea Using CVE-2021-26411 Vulnerability

The distributor of Magniber ransomware has continued to evolve to avoid V3’s detection. It goes without saying that subscribers of ASEC Blog are well aware of the fact that AhnLab has been fighting the developers of Magniber ransomware for a long time, and that the history almost resembles a cat-and-mouse

  • Mar 16 2021
Distribution of Malware via Resume/Copyright-Related Emails (Ransomware, Infostealer)
Malware

Distribution of Malware via Resume/Copyright-Related Emails (Ransomware, Infostealer)

ASEC analysis team has confirmed the malware under the disguise of a resume is still being distributed. This time, it disguised as resume and copyright-related files. The file that is being recently distributed also takes the form of NSIS (Nullsoft Scriptable Install System) and is being distributed under various filenames

  • Feb 24 2021
BlueCrab Ransomware Installing Hacking Tool CobaltStrike in Corporate Environments
Malware

BlueCrab Ransomware Installing Hacking Tool CobaltStrike in Corporate Environments

The ASEC analysis team confirmed that during the BlueCrab ransomware (=Sodinokibi, REvil) infection process, which is distributed in JS form, the CobaltStrike hacking tool was distributed under certain conditions. CobaltStrike hacking tool is a limited tool used for mock hacking test purposes under legitimate purposes; however, it has been actively

  • Feb 01 2021
BlueCrab Ransomware’s Continuous Attempts to Bypass Detection
EndPoint Malware

BlueCrab Ransomware’s Continuous Attempts to Bypass Detection

BlueCrab Ransomware (=Sodinokibi Ransomware) is a ransomware that is being vigorously distributed to Korean users. It distributes through a fake forum web page created using various search keywords. The infection process begins at the moment when a user runs the JS file downloaded from the distribution page. The distribution page

  • Jan 28 2021
[Threat Analysis] CLOP Ransomware that Attacked Korean Distribution Giant
Malware

[Threat Analysis] CLOP Ransomware that Attacked Korean Distribution Giant

In November last year, there was a case that shocked not only the security industry, but also all of the Korean industries. The system of E-Land Group, the distribution giant, was infected by the ‘CLOP Ransomware.’ According to the press report that quoted an associate of the company, over half

  • Jan 05 2021