Cyber Threat Trends

First reported date: 2023/10/27
Inquiry period : 2025/04/24 00:25 ~ 2025/04/25 00:25 (1 days), 2 search results

지난 7일 기간대비 신규 트렌드를 보이고 있습니다.
악성코드 유형 LPEClient Volgmer Bankshot RATel Maze 도 새롭게 확인됩니다.
공격자 Lazarus 도 새롭게 확인됩니다.
공격기술 Campaign APT 도 새롭게 확인됩니다.
기관 및 기업 Kaspersky Microsoft South Korea United Kingdom United States dprk North Korea 도 새롭게 확인됩니다.
기타 Update innorix Malicious Traffic Cryptocurrency Victim 등 신규 키워드도 확인됩니다.

LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to store the downloaded payload.

It sends detailed information about the victim's environment, like computer name, type and number of processors, computer manufacturer, product name, major and minor Windows versions, architecture, memory information, installed security software and the version of the ntoskrnl.exe from its version-information resource.

LPEClient uses specific 32-bit values to represent its execution state (0x59863F09 when connecting via the WinHTTP interface, 0xA9348B57 via WinINet), or the nature of HTTP requests to the C&C servers (0xF07D6B34 when sending system information, 0xEF8C0D51 when requesting a DLL payload, 0xCB790A25 when reporting the successful loading of the DLL, 0xD7B20A96 when reporting the state of the the DLL execution). As the final step, malware looks for the export CloseEnv and executes it.  Ref.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/24 Operation SyncHole: Lazarus APT goes back to the well


참고로 동일한 그룹의 악성코드 타입은 SmokeLoader GuLoader Zloader 등 47개 종이 확인됩니다.