popup

Cyber Threat Trends

  1. Day Week

conference CrowdStrike 북한

Summary: 2025/04/19 11:33

First reported date: 2016/12/16
Inquiry period : 2025/03/20 11:33 ~ 2025/04/19 11:33 (1 months), 14 search results

전 기간대비 7% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Cryptocurrency Miner Malware Report Cryptocurrency target 입니다.
악성코드 유형 XMRig DYEPACK CoreDN Houdini Mirai 도 새롭게 확인됩니다.
공격자 Anonymous 도 새롭게 확인됩니다.
공격기술 RCE Smishing Hijacking hijack 도 새롭게 확인됩니다.
기관 및 기업 Microsoft Banking Recorded Future United Kingdom Cloudflare Cambodia North Korea Iran 도 새롭게 확인됩니다.
기타 Email Outlaw PostgreSQL Forensics mining 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/15 Kubernetes Threat Hunting using API Server Audit Logs
    ㆍ 2025/04/11 How Huoine Marketplace Is Reshaping Global Fraud
    ㆍ 2025/04/11 Threat actors thrive in chaos


참고로 동일한 그룹의 악성코드 타입은 Cryptocurrency Miner HiddenBee XMRig 등 9개 종이 확인됩니다.

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1Cryptocurrency Miner 14 ▲ 1 (7%)
2Malware 12 ▲ 4 (33%)
3Campaign 8 ▼ -3 (-38%)
4Report 8 ▲ 5 (63%)
5Cryptocurrency 8 ▲ 3 (38%)
6target 6 ▲ 3 (50%)
7Update 6 ▲ 4 (67%)
8Exploit 6 ▼ -1 (-17%)
9attack 6 - 0 (0%)
10Victim 6 ▲ 1 (17%)
11Linux 5 ▲ 3 (60%)
12Vulnerability 5 ▲ 3 (60%)
13Criminal 4 ▲ 1 (25%)
14Phishing 4 ▲ 3 (75%)
15Email 4 ▲ new
16Software 4 - 0 (0%)
17United States 4 ▼ -1 (-25%)
18RSA Conference 3 ▲ 2 (67%)
19Advertising 3 ▲ 2 (67%)
20Outlaw 3 ▲ new
21Cisco 3 ▼ -1 (-33%)
22RCE 3 ▲ new
23Microsoft 3 ▲ new
24VirusTotal 3 ▼ -1 (-33%)
25PostgreSQL 3 ▲ new
26Botnet 3 ▲ 2 (67%)
27Anonymous 2 ▲ new
28hacking 2 ▼ -1 (-50%)
29Forensics 2 ▲ new
30Password 2 ▲ 1 (50%)
31Remote Code Execution 2 ▼ -5 (-250%)
32Banking 2 ▲ new
33Spain 2 ▲ 1 (50%)
34mining 2 ▲ new
35Wiz 2 ▲ new
36Social Engineering 2 ▲ 1 (50%)
37Ransomware 2 - 0 (0%)
38fileless 2 ▲ new
39Windows 2 ▼ -1 (-50%)
40XMRig 2 ▲ new
41China 2 ▼ -2 (-100%)
42IoC 2 ▲ 1 (50%)
43ZeroDay 2 ▲ new
44such 1 ▲ new
45SourceForge 1 ▲ new
46Office 1 ▲ new
47critical 1 ▲ new
48Australia 1 - 0 (0%)
49Recorded Future 1 ▲ new
50MFA 1 ▲ new
51Smishing 1 ▲ new
52Takedown 1 - 0 (0%)
53emerge 1 ▲ new
54CISA 1 ▼ -1 (-100%)
55tar 1 ▲ new
56Distribution 1 ▲ new
57Telegram 1 - 0 (0%)
58United Kingdom 1 ▲ new
59Exploi 1 ▲ new
60arrest 1 ▲ new
61DYEPACK 1 ▲ new
62Kubernetes 1 - 0 (0%)
63DNS 1 ▲ new
64Hijacking 1 ▲ new
65Cloudflare 1 ▲ new
66hijack 1 ▲ new
67Backdoor 1 ▼ -3 (-300%)
68Red Hat 1 ▲ new
69CoreDN 1 ▲ new
70Sandbox 1 ▲ new
71CVSS 1 ▲ new
72fraud 1 ▲ new
73scam 1 ▲ new
74Huione 1 ▲ new
75Cambodia 1 ▲ new
76Operation 1 ▲ new
77Education 1 ▼ -1 (-100%)
78Additional 1 ▲ new
79PHP 1 ▲ new
80ANY 1 ▲ new
81p 1 ▲ new
82powershell 1 - 0 (0%)
83North Korea 1 ▲ new
84group 1 ▲ new
85threat 1 ▲ new
86crypto 1 ▲ new
87Taiwan 1 ▼ -1 (-100%)
88Iran 1 ▲ new
89Elastic 1 ▲ new
90Volt Typhoon 1 - 0 (0%)
91Trojan 1 ▼ -3 (-300%)
92MimiKatz 1 ▲ new
93Google 1 ▲ new
94MalSpam 1 ▲ new
95Chrome 1 ▲ new
96Houdini 1 ▲ new
97exposed 1 ▲ new
98Labs 1 ▲ new
99TI 1 ▲ new
100Mirai 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
Cryptocurrency Miner
14 (51.9%)
Botnet
3 (11.1%)
Ransomware
2 (7.4%)
XMRig
2 (7.4%)
DYEPACK
1 (3.7%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
Anonymous
2 (66.7%)
Volt Typhoon
1 (33.3%)
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
Campaign
8 (25%)
Exploit
6 (18.8%)
Phishing
4 (12.5%)
RCE
3 (9.4%)
hacking
2 (6.3%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
United States
4 (13.3%)
Cisco
3 (10%)
Microsoft
3 (10%)
VirusTotal
3 (10%)
Banking
2 (6.7%)
Malware Family
Top 5

A malware family is a group of applications with similar attack techniques.
In this trend, it is classified into Ransomware, Stealer, RAT or Backdoor, Loader, Botnet, Cryptocurrency Miner.

Threat info
Last 5

SNS

(Total : 3)
  Total keyword

Cryptocurrency Miner PostgreSQL Report Linux Campaign attack Cryptocurrency Exploit Password XMRig Victim Malware hacking CoinMiner

No Title Date
1Virus Bulletin @virusbtn
Elastic Security Labs researchers report on Outlaw, a persistent yet unsophisticated auto-propagating Linux coinminer. Despite lacking stealth and advanced evasion techniques, it remains active and effective by leveraging simple but impactful tactics. https://t.co/kL9gkZn6sv https://t.co/8xPxx5crpA		2025.04.02
2The Hacker News @TheHackersNews
???? 1,500+ PostgreSQL servers hacked for crypto mining. A threat group tracked as JINX-0126 is exploiting publicly exposed PostgreSQL instances with weak passwords. What’s happening: • Malware: PG_MEM (fileless, evasive) • Goal: Deploy XMRig miner • Victims: Over 1,500 https://t.co/q2O22fNevA		2025.04.01
3Cyber_OSINT @Cyber_O51NT
Wiz reports that over 1,500 exposed PostgreSQL servers have been compromised in a fileless cryptocurrency mining campaign linked to a threat actor, marking a variant of an attack first identified by Aqua Security in August 2024. #CyberSecurity #PostgreSQL https://t.co/9h203VL1nK		2025.04.01

News

(Total : 11)
  Total keyword

Cryptocurrency Miner Malware Cryptocurrency Campaign Update Report target Vulnerability Exploit attack Victim Phishing Email Linux Criminal Software United States Botnet RCE Cisco Advertising Microsoft VirusTotal RSA Conference Banking Spain Remote Code Execution Social Engineering Anonymous Ransomware Forensics ZeroDay Windows IoC Attacker China United Kingdom Smishing hijack MFA Cloudflare Education Backdoor Hijacking DNS Kubernetes Australia DYEPACK Takedown Telegram arrest Operation Cambodia Recorded Future Distribution Red Hat CVSS CISA CoreDN PostgreSQL Russia MimiKatz Volt Typhoon Iran Taiwan North Korea powershell ChatGPT Kaspersky Wshrat XMRig Houdini hacking Stealer Password SHODAN intelligence Ubuntu Mirai ...

No Title Date
1Kubernetes Threat Hunting using API Server Audit Logs - Malware.News2025.04.15
2How Huoine Marketplace Is Reshaping Global Fraud - Malware.News2025.04.11
3Threat actors thrive in chaos - Malware.News2025.04.11
4Cryptocurrency Miner and Clipper Malware Spread via SourceForge Cracked Software Listings - The Hacker News2025.04.09
5Additional details on Outlaw Linux cryptomining botnet emerge - Malware.News2025.04.03

Additional information

No Title Date
1Kubernetes Threat Hunting using API Server Audit Logs - Malware.News2025.04.15
2Kubernetes Threat Hunting using API Server Audit Logs - Malware.News2025.04.15
3How Huoine Marketplace Is Reshaping Global Fraud - Malware.News2025.04.11
4How Huoine Marketplace Is Reshaping Global Fraud - Malware.News2025.04.11
5Threat actors thrive in chaos - Malware.News2025.04.11
View only the last 5
Level Description
danger File has been identified by 35 AntiVirus engines on VirusTotal as malicious
watch A process attempted to delay the analysis task.
watch Attempts to create or modify system certificates
watch Communicates with host for which no DNS query was performed
watch Connects to an IRC server
watch Installs itself for autorun at Windows startup
watch Looks for the Windows Idle Time to determine the uptime
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Creates hidden or system file
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Terminates another process
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info Queries for the computername
info The executable uses a known packer
info Uses Windows APIs to generate a cryptographic key
Network ET DROP Spamhaus DROP Listed Traffic Inbound group 23
Network ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
Network ET INFO Executable Download from dotted-quad Host
Network ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Network ET POLICY PE EXE or DLL Windows file download HTTP
Network SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
No data
No data
Beta Service, If you select keyword, you can check detailed information.