Cyber Threat Trends

Summary: 2025/04/19 11:32

First reported date: 2014/08/08
Inquiry period : 2025/03/20 11:32 ~ 2025/04/19 11:32 (1 months), 37 search results

전 기간대비 16% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Cobalt Strike Campaign Backdoor China United States 입니다.
악성코드 유형 TONESHELL RATel SectopRAT BlackSuit AsyncRAT 도 새롭게 확인됩니다.
공격자 Tick Anonymous 도 새롭게 확인됩니다.
공격기술 Dropper 도 새롭게 확인됩니다.
기관 및 기업 Zscaler Türkiye 도 새롭게 확인됩니다.
기타 Anubis keylogger ThreatLabz Password StarProxy 등 신규 키워드도 확인됩니다.

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.  Ref.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/18 Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
    ㆍ 2025/04/17 Unmasking the new XorDDoS controller and infrastructure
    ㆍ 2025/04/17 Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	Cobalt Strike	37	▲ 6 (16%)
2	Malware	25	- 0 (0%)
3	Campaign	16	▲ 4 (25%)
4	Backdoor	15	▲ 12 (80%)
5	Report	13	▼ -2 (-15%)
6	China	13	▲ 5 (38%)
7	c&c	12	- 0 (0%)
8	Windows	12	- 0 (0%)
9	Victim	11	▼ -1 (-9%)
10	United States	11	▲ 2 (18%)
11	IoC	10	▼ -1 (-10%)
12	MUSTANG PANDA	10	▲ 6 (60%)
13	target	10	▲ 3 (30%)
14	Update	10	▼ -1 (-10%)
15	Cobalt	9	▼ -8 (-89%)
16	Mustang	8	▲ 7 (88%)
17	Operation	8	▲ 6 (75%)
18	Microsoft	8	- 0 (0%)
19	Phishing	8	▼ -1 (-13%)
20	EDR	7	▲ 2 (29%)
21	FIN7	7	▲ 4 (57%)
22	Kaspersky	7	▲ 5 (71%)
23	FIN	7	▲ 6 (86%)
24	hacking	6	▲ 2 (33%)
25	Zscaler	6	▲ new
26	Anubis	6	▲ new
27	Russia	6	▲ 3 (50%)
28	TONESHELL	6	▲ new
29	GameoverP2P	6	▲ 4 (67%)
30	Panda	6	▲ 5 (83%)
31	NetWireRC	6	▲ 3 (50%)
32	Advertising	6	▲ 1 (17%)
33	Government	6	▲ 4 (67%)
34	attack	6	- 0 (0%)
35	Trojan	5	▲ 3 (60%)
36	Taiwan	4	▼ -1 (-25%)
37	Linux	4	▼ -1 (-25%)
38	keylogger	4	▲ new
39	Criminal	4	▲ 1 (25%)
40	Stealer	4	▲ 2 (50%)
41	Ransomware	4	▼ -4 (-100%)
42	Email	4	▲ 3 (75%)
43	Education	3	▲ 1 (33%)
44	intelligence	3	▼ -3 (-100%)
45	threat	3	▼ -1 (-33%)
46	Türkiye	3	▲ new
47	Remote Code Execution	3	▼ -2 (-67%)
48	ThreatLabz	3	▲ new
49	RATel	3	▲ new
50	Android	3	▼ -3 (-100%)
51	hijack	3	▲ 1 (33%)
52	GitHub	3	▼ -3 (-100%)
53	Vulnerability	3	▼ -6 (-200%)
54	group	3	▲ 2 (67%)
55	Cisco	3	▼ -2 (-67%)
56	Germany	3	▲ 1 (33%)
57	powershell	3	▼ -3 (-100%)
58	MFA	3	▼ -2 (-67%)
59	Exploit	3	▼ -8 (-267%)
60	Password	3	▲ new
61	Chinese	2	- 0 (0%)
62	StarProxy	2	▲ new
63	SectopRAT	2	▲ new
64	SplatCloak	2	▲ new
65	Chinalinked	2	▲ new
66	United Kingdom	2	- 0 (0%)
67	Earth	2	▲ new
68	Alux	2	▲ new
69	securityaffairs	2	▲ new
70	full	2	▲ new
71	UNIX	2	▲ new
72	Canada	2	▲ 1 (50%)
73	APT41	2	▼ -2 (-100%)
74	ZeroDay	2	▲ 1 (50%)
75	Tick	2	▲ new
76	Anonymous	2	▲ new
77	Sliver	2	▲ new
78	VirusTotal	2	- 0 (0%)
79	Social Engineering	2	- 0 (0%)
80	BlackSuit	2	▲ new
81	India	2	- 0 (0%)
82	Browser	2	- 0 (0%)
83	Russian	2	▲ new
84	France	2	- 0 (0%)
85	APT	2	▲ 1 (50%)
86	Software	2	▼ -3 (-150%)
87	Cryptocurrency	2	- 0 (0%)
88	Australia	2	▼ -1 (-50%)
89	MWNEWS	2	▲ 1 (50%)
90	Telegram	2	▼ -2 (-100%)
91	Distribution	2	- 0 (0%)
92	Dropper	2	▲ new
93	Malware download	2	▲ 1 (50%)
94	AsyncRAT	2	▲ new
95	Chrome	2	- 0 (0%)
96	W	1	▲ new
97	C2	1	▲ new
98	RAT	1	- 0 (0%)
99	Opera	1	- 0 (0%)
100	njRAT	1	▲ new

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
TONESHELL		6 (14.6%)
GameoverP2P		6 (14.6%)
NetWireRC		6 (14.6%)
Trojan		5 (12.2%)
Ransomware		4 (9.8%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Tick		2 (40%)
Anonymous		2 (40%)
MuddyWater		1 (20%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Campaign		16 (25%)
Backdoor		15 (23.4%)
Phishing		8 (12.5%)
hacking		6 (9.4%)
Stealer		4 (6.3%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
China		13 (14.3%)
United States		11 (12.1%)
Microsoft		8 (8.8%)
Kaspersky		7 (7.7%)
Zscaler		6 (6.6%)

Threat info

Last 5

SNS

(Total : 15)

Total keyword

Cobalt Strike MUSTANG PANDA Backdoor Malware Windows FIN7 hacking Zscaler Report Campaign Cobalt Russia keylogger Kaspersky attack China TONESHELL EDR iocs Intelligence APT41 Beacon Chinese APT RATel DoTNet Dropper Ransomware BlackSuit IDATLoader SectopRAT Update Spain Phishing Operation Password IoC

No	Title	Date
1	Kimberly @StopMalvertisin Dark Reading \| Chinese APT Mustang Panda Debuts 4 New Attack Tools https://t.co/5k6cmxR5ag	2025.04.18
2	ANY.RUN @anyrun_app ???? Explore Threat Intelligence Reports from #ANYRUN. Discover detailed research on active cyber threats and APTs with actionable insights, #IOCs, & #TTPs. Enrich proactive security, report on #APT41 inside ???? https://t.co/ZkhxJ3hf17	2025.04.18
3	Kimberly @StopMalvertisin NVISO Labs \| Crisis Management – Beacon in the Storm https://t.co/38lUEOpj4p	2025.04.17
4	Virus Bulletin @virusbtn Zscaler researchers present the second part of a series on Mustang Panda tools. This time they analyse two new keyloggers, PAKLOG and CorKLOG, as well as an EDR evasion driver (SplatCloak). https://t.co/ni8tV0XVIH https://t.co/841bhFetTp	2025.04.17
5	Cyber_OSINT @Cyber_O51NT Mustang Panda: PAKLOG, CorKLOG, and SplatCloak \| ThreatLabz https://t.co/5zZoo2hTWn	2025.04.17

News

(Total : 22)

Total keyword

Cobalt Strike Malware Campaign Attacker c&c United States Victim China Report target Update IoC Backdoor Microsoft Windows Phishing Operation Government GameoverP2P NetWireRC Advertising Cobalt Kaspersky Trojan EDR Email Stealer attack Russia TONESHELL Linux Taiwan MUSTANG PANDA Criminal Android Zscaler hijack Education Germany Remote Code Execution Vulnerability FIN7 Cisco GitHub powershell MFA Exploit hacking Ransomware Türkiye Cryptocurrency intelligence Social Engineering keylogger UNIX India VirusTotal Chrome RATel ZeroDay Tick France Anonymous Sliver Canada United Kingdom Telegram Password Distribution Browser Australia Software AsyncRAT Chinese McAfee Dropper Police MuddyWater ZXShell Iran arrest Lumma NirCmd Akamai Okta Accenture KrakenKeylogger ...

No	Title	Date
1	Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates - The Hacker News	2025.04.18
2	Unmasking the new XorDDoS controller and infrastructure - Malware.News	2025.04.17
3	Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools - Malware.News	2025.04.17
4	Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S - Malware.News	2025.04.17
5	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17

Additional information

No	Title	Date
1	Tesla to Delay Production of Cheaper EVs, Reuters Reports - Bloomberg Technology	2025.04.19
2	When Vulnerability Information Flows are Vulnerable Themselves - Malware.News	2025.04.19
3	CISA warns threat hunting staff of end to Google, Censys contracts as agency cuts set in - Malware.News	2025.04.19
4	Radiology practice reportedly working with FBI after ‘data security incident’ - Malware.News	2025.04.19
5	Text scams grow to steal hundreds of millions of dollars - Malware.News	2025.04.19
View only the last 5

No	Title	Date
1	Unmasking the new XorDDoS controller and infrastructure - Malware.News	2025.04.17
2	Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools - Malware.News	2025.04.17
3	Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S - Malware.News	2025.04.17
4	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
5	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	toolspab1.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	74237f2f009020c7bfe80f274a049843	23951	2022.02.25
2	toolspab3.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	9efd29a1bfac21fbd3843dd95acc8582	23949	2022.02.25
3	toolspab2.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	f2336cbcb716869cea7e6d49f5749f1b	23947	2022.02.25
4	Updated_Payments_Statements.li... Darkside Ransomware Cobalt Strike Generic Malware Antivirus Malicious Library UPX AntiDebug AntiVM GIF Format PE File PE32 OS Processor Check	8bdf50e9270b6f6e3c461be75999305d	22459	2022.01.18
5	invoice.exe Darkside Ransomware Cobalt Strike Malicious Library UPX PE File PE32	9fca8332a98b2475b8c5243f70ce5058	22464	2022.01.18
View only the last 5

Level	Description
danger	Executed a process and injected code into it
warning	File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch	Allocates execute permission to another process indicative of possible code injection
watch	Detects Avast Antivirus through the presence of a library
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Foreign language identified in PE resource
notice	One or more potentially interesting buffers were extracted
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	This executable has a PDB path

No data

No	URL	CC	ASN Co	Reporter	Date
1	http://gh-hr.cn/beacon.exe Cobalt strike CobaltStrike exe	CN	...	DonPasci	2025.01.17
2	http://39.107.254.213/beacon.exe Cobalt strike CobaltStrike	CN	...	lontze7	2025.01.16
3	http://106.53.83.169/beacon.exe c2 Cobalt strike	CN	...	lontze7	2025.01.13
4	http://zzz.hnyzh.co/beacon_x86.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
5	http://zzz.hnyzh.co/beacon_x64.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
View only the last 5

Beta Service, If you select keyword, you can check detailed information.