Cyber Threat Trends

Summary: 2025/04/18 11:20

First reported date: 2011/08/10
Inquiry period : 2025/03/19 11:20 ~ 2025/04/18 11:20 (1 months), 37 search results

전 기간대비 38% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 DNS Malware Phishing attack Report 입니다.
악성코드 유형 Anchor 도 새롭게 확인됩니다.
공격자 Anonymous 도 새롭게 확인됩니다.
기관 및 기업 NSA Australia FBI Government VirusTotal Canada Ucraina Germany Banking SentinelOne 도 새롭게 확인됩니다.
기타 Fast Flux Meerkat Morphing Infoblox 등 신규 키워드도 확인됩니다.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/18 Microsoft’s Secure by Design journey: One year of success
    ㆍ 2025/04/15 Kubernetes Threat Hunting using API Server Audit Logs
    ㆍ 2025/04/12 Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	DNS	37	▲ 14 (38%)
2	Malware	22	▲ 5 (23%)
3	Phishing	17	▲ 15 (88%)
4	attack	14	▲ 7 (50%)
5	Report	14	▲ 7 (50%)
6	Exploit	13	▲ 5 (38%)
7	United States	12	▲ 3 (25%)
8	Update	11	▲ 2 (18%)
9	target	10	▲ 2 (20%)
10	intelligence	10	▲ 5 (50%)
11	Remote Code Execution	9	▼ -1 (-11%)
12	Campaign	8	▲ 2 (25%)
13	c&c	8	▲ 7 (88%)
14	Advertising	8	- 0 (0%)
15	Email	7	▲ 6 (86%)
16	Victim	7	▲ 3 (43%)
17	CISA	6	▲ 5 (83%)
18	Fast	6	▲ new
19	Software	6	▲ 2 (33%)
20	Windows	6	▲ 1 (17%)
21	GitHub	6	▲ 2 (33%)
22	RCE	6	▲ 5 (83%)
23	Flux	6	▲ new
24	Vulnerability	6	▲ 1 (17%)
25	Telegram	5	▲ 4 (80%)
26	Microsoft	5	▼ -1 (-20%)
27	IoC	5	▲ 3 (60%)
28	Google	4	▲ 3 (75%)
29	Meerkat	4	▲ new
30	Morphing	4	▲ new
31	Operation	4	▼ -1 (-25%)
32	NSA	4	▲ new
33	hacking	4	▲ 3 (75%)
34	GameoverP2P	3	▲ 1 (33%)
35	Infoblox	3	▲ new
36	DYEPACK	3	▲ 2 (67%)
37	Distribution	3	- 0 (0%)
38	Backdoor	3	▲ 2 (67%)
39	powershell	3	▲ 1 (33%)
40	LinkedIn	3	- 0 (0%)
41	Threat	3	▲ new
42	MX	3	▲ new
43	Australia	3	▲ new
44	Ransomware	3	- 0 (0%)
45	Linux	3	▼ -3 (-100%)
46	Ubuntu	3	▲ 2 (67%)
47	Cloudflare	3	▲ 1 (33%)
48	Zero Trust	3	▲ 2 (67%)
49	Education	3	▲ 1 (33%)
50	FBI	3	▲ new
51	Government	2	▲ new
52	Twitter	2	▼ -1 (-50%)
53	DDoS	2	▼ -1 (-50%)
54	Honeynet	2	▲ new
55	VirusTotal	2	▲ new
56	IPv	2	▲ new
57	Data Center	2	▲ 1 (50%)
58	ChatGPT	2	▲ new
59	Public	2	▲ new
60	플럭스	2	▲ new
61	Canada	2	▲ new
62	securityaffairs	2	▲ new
63	subdomain	2	▲ new
64	Red Team	2	▲ new
65	Password	2	▲ 1 (50%)
66	Firmware	2	▲ new
67	Red Hat	2	▲ 1 (50%)
68	Chrome	2	▲ new
69	Anonymous	2	▲ new
70	WMI	2	▲ new
71	YouTube	2	▲ 1 (50%)
72	Ucraina	2	▲ new
73	Docker	2	▲ 1 (50%)
74	Kaspersky	2	▲ 1 (50%)
75	Cisco	2	▲ 1 (50%)
76	MFA	2	▲ new
77	Germany	2	▲ new
78	Russia	2	▲ 1 (50%)
79	PhaaS	2	▲ new
80	Kubernetes	2	▲ 1 (50%)
81	Banking	1	▲ new
82	attac	1	- 0 (0%)
83	엔비디아	1	▲ new
84	name	1	▲ new
85	Supply chain	1	▲ new
86	Falco	1	▲ new
87	블루	1	▲ new
88	Actions	1	▲ new
89	memory	1	▲ new
90	workflow	1	▲ new
91	xabyss	1	▲ new
92	Trojan	1	- 0 (0%)
93	Malvertising	1	▼ -1 (-100%)
94	필드	1	▲ new
95	Browser	1	▼ -1 (-100%)
96	Java	1	- 0 (0%)
97	Smishing	1	▲ new
98	Criminal	1	▼ -2 (-200%)
99	Anchor	1	▲ new
100	SentinelOne	1	▲ new

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
GameoverP2P		3 (23.1%)
DYEPACK		3 (23.1%)
Ransomware		3 (23.1%)
Trojan		1 (7.7%)
Anchor		1 (7.7%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Anonymous		2 (100%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Phishing		17 (26.6%)
Exploit		13 (20.3%)
Remote Code Execution		9 (14.1%)
Campaign		8 (12.5%)
RCE		6 (9.4%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
United States		12 (20%)
CISA		6 (10%)
Microsoft		5 (8.3%)
Google		4 (6.7%)
NSA		4 (6.7%)

Threat info

Last 5

SNS

(Total : 12)

Total keyword

DNS Phishing Exploit CISA Telegram Report hacking Email FBI WordPress Gmail Victim Yahoo NSA Ransomware Discord

No	Title	Date
1	Unit 42 @Unit42_Intel Multiple domains leveraging #DNS #tunneling have been probing the Internet for public IPv4/IPv6 resolvers. Lacking TXT/PTR records, the associated DNS traffic is highly suspicious. These #scans began in Jan 2025 and peaked earlier this week. More info at https://t.co/Zve4RHnSt9 https://t.co/L2LKHJ0D	2025.04.17
2	Dark Web Informer - Cyber Threat Intelligence @DarkWebInformer With a little bit of python, I'm running a threat_actor lookup command with my own data on Discord and sending it back to Telegram all in 2 seconds. /dns_lookup -> DNS details /ip -> IP details /threat_actor -> Provides the last 3 claims (screenshots) /whois -> Whois details https://t.c	2025.04.17
3	Dark Web Informer - Cyber Threat Intelligence @DarkWebInformer ????Public DNS Comparison https://t.co/H1rFYhAszT	2025.04.10
4	Kimberly @StopMalvertisin The Register \| Flux off: CISA, annexable allies warn of hot DNS threat https://t.co/6WqEgdiUvj	2025.04.04
5	Cyber_OSINT @Cyber_O51NT CISA, the FBI, and NSA are urging organizations and DNS providers to combat the "Fast Flux" evasion technique exploited by state-sponsored actors and ransomware gangs. #cybersecurity #CISA https://t.co/7Jzaa9H5Vt	2025.04.04

News

(Total : 25)

Total keyword

DNS Malware attack Attacker Phishing Report United States Update Exploit target intelligence Remote Code Execution Campaign Advertising c&c Windows Email Victim Vulnerability Software GitHub RCE Microsoft IoC Google Operation GameoverP2P Zero Trust Distribution Backdoor LinkedIn Cloudflare Telegram Education CISA Ubuntu Australia powershell NSA DYEPACK Linux Data Center Ransomware ChatGPT Twitter FBI Anonymous Password Government WMI Canada Honeynet VirusTotal Chrome Firmware Red Team DDoS Red Hat YouTube Russia Docker Kubernetes hacking Ucraina Kaspersky Germany MFA Cisco Supply chain Banking Trojan Java Browser Malvertising Criminal Anchor SentinelOne Akira Black Basta China XSS ...

No	Title	Date
1	Microsoft’s Secure by Design journey: One year of success - Malware.News	2025.04.18
2	Kubernetes Threat Hunting using API Server Audit Logs - Malware.News	2025.04.15
3	Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain - Malware.News	2025.04.12
4	DNS Response analysis with KQL: queries, answers, TTL, RTT & more - Malware.News	2025.04.11
5	Unraveling the U.S. toll road smishing scams - Malware.News	2025.04.11

Additional information

No	Title	Date
1	Japan FSA Says Hacked Online Trading Reaches About $700 Million - Bloomberg Technology	2025.04.18
2	Secure legacy Oracle cloud credentials amid leak reports, CISA warns - Malware.News	2025.04.18
3	가짜 돈·위조품 '꼼짝마!'.. 보안 잉크 아세요? - 시큐리티팩트	2025.04.18
4	Care what you share - Malware.News	2025.04.18
5	Inside Black Basta: Ransomware Resilience and Evolution After the Leak - Malware.News	2025.04.18
View only the last 5

No	Title	Date
1	Microsoft’s Secure by Design journey: One year of success - Malware.News	2025.04.18
2	Microsoft’s Secure by Design journey: One year of success - Malware.News	2025.04.18
3	Kubernetes Threat Hunting using API Server Audit Logs - Malware.News	2025.04.15
4	Kubernetes Threat Hunting using API Server Audit Logs - Malware.News	2025.04.15
5	DNS Response analysis with KQL: queries, answers, TTL, RTT & more - Malware.News	2025.04.11
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	http://www.cipd.org/globalasse... Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File PNG Format JPEG Format	4e58a191b515eed2a9894dc8698bc5c0	59078	2025.04.18
2	1 Podgląd wpisu po zmianie _ C... Client SW User Data Stealer browser info stealer Generic Malware Google Chrome User Data Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection BitCoin Internet API persistenc	0b0afec69e7d62568ab3bfdadc92c631	59177	2025.04.18
3	1 Podgląd wpisu po zmianie _ C... Client SW User Data Stealer browser info stealer Generic Malware Google Chrome User Data Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection BitCoin Internet API persistenc	0b0afec69e7d62568ab3bfdadc92c631	59174	2025.04.18
4	layout.bin Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File	72c582ab7db10af86a90608f98e5e614	59058	2025.04.17
5	os.dat Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File	af1d8d9435cb10fe2f4b4215eaf6bec4	59059	2025.04.17
View only the last 5

Level	Description
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Performs some HTTP requests
notice	Potentially malicious URLs were found in the process memory dump
notice	Uses Windows utilities for basic Windows functionality
notice	Yara rule detected in process memory
Network	ET INFO TLS Handshake Failure
Network	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

No data

Beta Service, If you select keyword, you can check detailed information.