popup

Cyber Threat Trends

  1. Week Month

CrowdStrike 북한 Tofsee

Summary: 2025/04/14 06:16

Inquiry period : 2025/04/13 06:16 ~ 2025/04/14 06:16 (1 days), 96 search results


지난 7일 기간대비 상승한 Top5 연관 키워드는 Alleged securityaffairs abusech sale Low 입니다.
기타 wellknown Synology NAS Cartabellotta Headsets 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/13 ChatGPT: OpenAI-Chef enthüllt Verdopplung der Nutzerbasis in nur wenigen Wochen
    ㆍ 2025/04/13 Perfides LLM-Grooming: So füttert Russland KI-Chatbots mit Fake News – und keiner merkt es
    ㆍ 2025/04/13 IT Sicherheitsnews taegliche Zusammenfassung 2025-04-13 15h : 1 posts

Trend graph by period

Total number of trend targets


Related keyword cloud
Top 100
# Trend Count Comparison
1Alleged 11 ▲ 4 (36%)
2hacking 10 ▼ -1 (-10%)
3securityaffairs 9 ▲ 4 (44%)
4Update 7 ▼ -21 (-300%)
5Malware 7 ▼ -40 (-571%)
6Alert 7 ▼ -10 (-143%)
7target 7 ▼ -17 (-243%)
8Exploit 7 ▼ -10 (-143%)
9Vulnerability 6 ▼ -8 (-133%)
10Software 6 ▼ -10 (-167%)
11abusech 6 ▲ 5 (83%)
12sale 6 ▲ 1 (17%)
13United States 6 ▼ -19 (-317%)
14Victim 5 ▼ -10 (-200%)
15Ransomware 5 ▼ -18 (-360%)
16Education 5 ▼ -6 (-120%)
17access 4 ▼ -1 (-25%)
18RCE 4 ▼ -4 (-100%)
19DDoS 4 ▼ -4 (-100%)
20Dark 4 - 0 (0%)
21last 4 - 0 (0%)
22DarkWeb 4 ▼ -1 (-25%)
23Zusammenfassung 4 - 0 (0%)
24Low 4 ▲ 3 (75%)
25Threat 4 ▼ -5 (-125%)
26taegliche 4 - 0 (0%)
27Sicherheitsnews 4 - 0 (0%)
28China 4 ▼ -5 (-125%)
29c&c 3 ▼ -2 (-67%)
30attack 3 ▼ -18 (-600%)
31C2 3 ▲ 1 (33%)
32Linux 3 - 0 (0%)
33US 3 ▼ -1 (-33%)
34httpstco 3 - 0 (0%)
35Spain 3 ▲ 1 (33%)
36NetWireRC 3 - 0 (0%)
37group 3 ▼ -3 (-100%)
38ChatGPT 3 ▼ -2 (-67%)
39JAMESWTWT 3 ▲ 3 (100%)
40wellknown 3 ▲ new
41Apple 3 - 0 (0%)
42SquiblydooBlog 2 ▲ 2 (100%)
43Fortinet 2 - 0 (0%)
44Synology 2 ▲ new
45NAS 2 ▲ new
46ROUND 2 ▲ 1 (50%)
47privacy 2 ▲ 1 (50%)
48Elon 2 ▲ 2 (100%)
49India 2 ▼ -2 (-100%)
50Mit 2 ▲ 1 (50%)
51Kernel 2 ▲ 1 (50%)
52leak 2 ▼ -1 (-50%)
53Report 2 ▼ -24 (-1200%)
54Data 2 ▼ -4 (-200%)
55MWNEWS 2 ▼ -7 (-350%)
56Advertising 2 ▼ -7 (-350%)
57Cartabellotta 2 ▲ new
58Qilin 2 ▲ 1 (50%)
59NEWSLETTER 2 ▲ 1 (50%)
60RAT 2 ▲ 1 (50%)
61VPN 2 - 0 (0%)
62ZeroDay 2 ▼ -2 (-100%)
63Campaign 2 ▼ -12 (-600%)
64Public 2 ▲ 2 (100%)
65bot 2 ▲ 1 (50%)
66River 2 ▲ 2 (100%)
67Akira 2 ▲ 1 (50%)
68Oracle 2 - 0 (0%)
69hack 2 ▲ 1 (50%)
70obsolete 2 ▲ 2 (100%)
71Cloud 2 - 0 (0%)
72customer 2 ▲ 1 (50%)
73FortiGate 2 ▲ 2 (100%)
74Fall 2 ▲ 2 (100%)
75Video 2 ▲ 2 (100%)
76Java 2 ▲ 1 (50%)
77Storm 2 - 0 (0%)
78malwrhunterteam 2 ▲ 1 (50%)
79Android 2 ▼ -3 (-150%)
80Team 2 - 0 (0%)
81plugin 2 ▼ -1 (-50%)
82QRadar Security Suite 2 ▲ 1 (50%)
83IBM 2 ▲ 1 (50%)
84Manager 1 - 0 (0%)
85Headsets 1 ▲ new
86Dive 1 - 0 (0%)
87Milling 1 ▲ new
88youre 1 ▲ 1 (100%)
89flyback 1 ▲ new
90Ahead 1 ▲ 1 (100%)
91Siemens 1 ▲ 1 (100%)
92Netzwerkgeräte 1 ▲ new
93Comes 1 ▲ new
94Arista 1 ▲ 1 (100%)
95EOS 1 ▲ 1 (100%)
96können 1 ▲ new
97Fintechs 1 ▲ new
98Sentron 1 ▲ new
99PAC 1 ▲ new
100Push 1 ▲ 1 (100%)
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
Ransomware
5 (27.8%)
NetWireRC
3 (16.7%)
RAT
2 (11.1%)
Akira
2 (11.1%)
BlackSuit
1 (5.6%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
hacking
10 (32.3%)
Exploit
7 (22.6%)
RCE
4 (12.9%)
DDoS
4 (12.9%)
Campaign
2 (6.5%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
United States
6 (17.6%)
China
4 (11.8%)
US
3 (8.8%)
Spain
3 (8.8%)
Apple
3 (8.8%)
Malware Type
Top 5

Detailed trend analysis by malware type.

Threat info
Last 5

SNS

(Total : 58)
  Total keyword

hacking target Exploit Ransomware Victim United States DarkWeb Malware DDoS Vulnerability c&c C2 attack Spain RCE Education Akira Update Report Advertising NetWireRC plugin Campaign Oracle NAS US China Android ZeroDay Chrome njRAT hijack Browser Windows VPN DDNS BlackSuit RaaS payment VBS VBScript ...Brazil ValleyRAT United Kingdom UN AsyncRAT Criminal Ucraina CISA Open Directory opendir CVE APT ESET Fortinet Linux DarkComet RAT Trojan Distribution Intelligence ThreatMon Government Attacker WordPress India

1Szabolcs Schmidt @smica83
@malwrhunterteam Uploaded @abuse_ch https://t.co/lw2BvrqOyK		2025.04.13
2Szabolcs Schmidt @smica83
@malwrhunterteam Uploaded @abuse_ch https://t.co/tPdolTzIHW		2025.04.13
3FalconFeeds.io @FalconFeedsio
???? DDoS Alert ???? NoName claims to have targeted multiple websites in Finland. - Perussuomalaiset - The Communist Workers Party -  Arto Lampila - Janne Hakkarainen - Helsinki Regional Transport Authority https://t.co/IJ9mSPTqf8		2025.04.13
4FalconFeeds.io @FalconFeedsio
@smitaprakash @AdityaRajKaul		2025.04.13
5FalconFeeds.io @FalconFeedsio
Hacktivist group “Sylhet Gang” has claimed responsibility for defacing multiple Indian websites in response to the Indian government’s latest Waqf Amendment Act. The group is primarily targeting small-scale businesses and educational institutions. #CyberAttack #Hacktivism #India https://t.co/CcK0bDp		2025.04.13

News

(Total : 37)
  Total keyword

Software Update Apple Malware ChatGPT QRadar Security Suite Java Vulnerability IBM Linux Education China MacOS TikTok Banking Supply chain Phishing 피싱 RCE ...United States Email US Exploit iPhone YouTube hacking India NetWireRC MFA RAT Fortinet VPN 취약점

13D Printed Milling Machine is Solid as a Rock - Hackaday2025.04.14
2Trump Says He Will Look at ‘Whole Electronic Supply Chain’ - Bloomberg Technology2025.04.14
3삼성 피싱(Phishing) 사이트 분석-miamitradingszone(2025.4.11) - Malware.News2025.04.14
4The Spade Hardware Description Language - Hackaday2025.04.14
5Perfides LLM-Grooming: So füttert Russland KI-Chatbots mit Fake News – und keiner merkt es - IT Sicherheitsnews2025.04.13

Additional information

Level Description
danger The processes wscript.exe
watch Creates a suspicious Powershell process
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice File has been identified by 4 AntiVirus engines on VirusTotal as malicious
notice Performs some HTTP requests
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key
Network ET HUNTING TryCloudFlare Domain in TLS SNI
Network ET INFO Observed trycloudflare .com Domain in TLS SNI
Network ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)
Network SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
No Category URL CC ASN Co Date
1malicioushttps://u1.verdictaffidavit.shop/US USCLOUDFLARENET2025.04.13
2malicioushttps://u1.entouragescuff.shop/US US2025.04.11
3malwarehttp://185.7.214.181/nh.exeFR FRQual.it S.a.s.2025.04.11
4c2http://54.169.93.143:10549/SG SGAMAZON-022025.04.11
5c2http://51.79.145.202:10343/CA CAOVH SAS2025.04.11
View only the last 5
No URL CC ASN Co Reporter Date
1http://60.18.51.161:50812/i
32-bit elf mips Mozi 		CN CNCHINA UNICOM China169 Backbonegeenensp2025.04.14
2http://59.89.9.158:47334/bin.sh
32-bit elf mips Mozi 		IN INNational Internet Backbonegeenensp2025.04.14
3http://117.223.4.204:56491/bin.sh
32-bit elf mips Mozi 		IN INNational Internet Backbonegeenensp2025.04.14
4http://222.140.192.123:53509/i
32-bit elf mips Mozi 		CN CNCHINA UNICOM China169 Backbonegeenensp2025.04.14
5http://117.209.86.197:33319/bin.sh
32-bit elf mips Mozi 		IN INNational Internet Backbonegeenensp2025.04.14
View only the last 5
Beta Service, If you select keyword, you can check detailed information.