popup

Cyber Threat Trends

  1. Day Week

conference CrowdStrike 북한

Summary: 2025/04/17 15:53

First reported date: 2010/05/28
Inquiry period : 2025/03/18 15:53 ~ 2025/04/17 15:53 (1 months), 14 search results

전 기간대비 29% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 keylogger Victim ThreatProtection attack Windows 입니다.
악성코드 유형 Trojan TONESHELL GameoverP2P PlugX Amadey Lobshot Lumma 도 새롭게 확인됩니다.
공격기술 MalSpam Stealer Dropper hijack downloader 도 새롭게 확인됩니다.
기관 및 기업 Zscaler Government Kaspersky Europe Microsoft Africa Recorded Future Japan 도 새롭게 확인됩니다.
기타 EDR Cobalt Strike c&c MUSTANG PANDA IoC 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1
    ㆍ 2025/04/14 A week in security (April 7 – April 13)

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1keylogger 14 ▲ 4 (29%)
2Malware 6 ▼ -1 (-17%)
3Victim 5 ▲ 4 (80%)
4ThreatProtection 4 ▲ 3 (75%)
5attack 4 ▲ 3 (75%)
6Windows 4 ▲ 1 (25%)
7Campaign 4 ▲ 3 (75%)
8Backdoor 3 ▲ 2 (67%)
9EDR 3 ▲ new
10SnakeKeylogger 3 ▲ 1 (33%)
11Advertising 3 ▲ 2 (67%)
12Update 3 ▲ 2 (67%)
13Cobalt Strike 3 ▲ new
14c&c 3 ▲ new
15Trojan 3 ▲ new
16MUSTANG PANDA 3 ▲ new
17MalSpam 3 ▲ new
18Zscaler 3 ▲ new
19target 3 - 0 (0%)
20Stealer 3 ▲ new
21IoC 3 ▲ new
22Dropper 2 ▲ new
23Exploit 2 ▼ -1 (-50%)
24TONESHELL 2 ▲ new
25cybercrime 2 ▲ new
26NortonLifeLock 2 ▲ 1 (50%)
27GitHub 2 ▲ new
28China 2 - 0 (0%)
29Maryland 2 ▲ new
30Government 2 ▲ new
31pharmacist 2 ▲ new
32multistage 2 ▲ new
33Operation 2 ▲ new
34Kaspersky 2 ▲ new
35hijack 2 ▲ new
36Phishing 2 ▼ -1 (-50%)
37Email 2 ▼ -1 (-50%)
38Report 2 ▲ new
39Ransomware 2 ▲ 1 (50%)
40Europe 2 ▲ new
41employment 1 ▲ new
42agency 1 ▲ new
43April 1 ▲ new
44Turkeys 1 ▲ new
45Last 1 ▲ new
46SplatCloak 1 ▲ new
47Google 1 - 0 (0%)
48ZeroDay 1 ▲ new
49driver 1 ▲ new
50GameoverP2P 1 ▲ new
51İŞKUR 1 ▲ new
52Türkiye 1 - 0 (0%)
53ThreatLabz 1 ▲ new
54exploration 1 ▲ new
55Mustang 1 ▲ new
56Panda 1 ▲ new
57PlugX 1 ▲ new
58schtasks 1 ▲ new
59Microsoft 1 ▲ new
60server 1 ▲ new
61StarProxy 1 ▲ new
62file 1 ▲ new
63UNIX 1 ▲ new
64C2 1 ▲ new
65WhatsApp 1 ▲ new
66Amadey 1 ▲ new
67Lobshot 1 ▲ new
68malicious 1 ▲ new
69VIPKeyLogger 1 ▲ new
70日本 1 ▲ new
71downloader 1 ▲ new
72JS 1 ▲ new
73Labs 1 ▲ new
74Seqrite 1 - 0 (0%)
75Q4 1 ▲ new
76percentage 1 ▲ new
77sector 1 ▲ new
78ICS 1 ▲ new
79Africa 1 ▲ new
80Software 1 ▼ -4 (-400%)
81Remote Code Execution 1 - 0 (0%)
82Browser 1 - 0 (0%)
83Criminal 1 ▼ -1 (-100%)
84Lumma 1 ▲ new
85corporate 1 ▲ new
86fake 1 ▲ new
87Android 1 ▲ new
88Recorded 1 ▲ new
89recent 1 ▲ new
90home 1 ▲ new
91personal 1 ▲ new
92Man 1 ▲ new
93Magic Kitten 1 ▲ new
94Recorded Future 1 ▲ new
95Future 1 ▲ new
96Record 1 ▲ new
97Japan 1 ▲ new
98decade 1 ▲ new
99variety 1 ▲ new
100notorious 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
SnakeKeylogger
3 (20%)
Trojan
3 (20%)
TONESHELL
2 (13.3%)
Ransomware
2 (13.3%)
GameoverP2P
1 (6.7%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
Campaign
4 (17.4%)
Backdoor
3 (13%)
MalSpam
3 (13%)
Stealer
3 (13%)
Dropper
2 (8.7%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
Zscaler
3 (17.6%)
China
2 (11.8%)
Government
2 (11.8%)
Kaspersky
2 (11.8%)
Europe
2 (11.8%)
Threat info
Last 5

SNS

(Total : 8)
  Total keyword

keylogger Campaign SnakeKeylogger MalSpam Stealer Recorded Future Victim Türkiye target Zscaler EDR MUSTANG PANDA Email downloader Malware Advertising IoC Japan attack iocs Cobalt Strike

No Title Date
1Zscaler ThreatLabz @Threatlabz
Zscaler ThreatLabz continues its exploration of Mustang Panda tools by analyzing two new keyloggers that we have named PAKLOG & CorKLOG, and an EDR tampering tool that we have named SplatCloak. Learn how this APT evades detection: https://t.co/xpSVDVTATu https://t.co/FNu1FmqIzd		2025.04.16
2Threat Intelligence @threatintel
#ThreatProtection Turkey’s employment agency (İŞKUR) impersonated in a Snake Keylogger malspam campaign targeting organizations across the country. https://t.co/MobFkRu6Ev #Cybercrime #Cybersecurity		2025.04.15
3Kimberly @StopMalvertisin
The Record by Recorded Future | Maryland pharmacist used keyloggers to spy on coworkers for a decade, victim alleges https://t.co/5LajQxpHNL		2025.04.05
4ANY.RUN @anyrun_app
???? #MassLogger is a stealer and #keylogger notorious for its variety of infection and evasion techniques. As low-cost #MaaS, it is accessible by a wide audience of malefactors. Learn more & collect #IOCs to strengthen company's security: https://t.co/in4O7tpo27 https://t.co/lXfgoicFvM		2025.03.31
5Threat Intelligence @threatintel
#ThreatProtection #SnakeKeylogger - new multistage info-stealer campaign. Read more about Symantec's protection: https://t.co/6ywCIelzbV		2025.03.31

News

(Total : 6)
  Total keyword

keylogger Malware Victim Windows Trojan Update Backdoor c&c attack Government Dropper IoC target hijack Advertising GitHub EDR Operation MUSTANG PANDA Zscaler Europe TONESHELL China Cobalt Strike Exploit Ransomware Attacker Report Phishing Kaspersky Amadey UNIX C2 Microsoft schtasks PlugX GameoverP2P Google Lumma Criminal Stealer Browser Email Remote Code Execution Software Africa ZeroDay Magic Kitten Android Lobshot WhatsApp

No Title Date
1Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 - Malware.News2025.04.17
2Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 - Malware.News2025.04.17
3A week in security (April 7 – April 13) - Malware.News2025.04.14
4Man accused of using keylogger to spy on colleagues, log in to their personal accounts and watch them at home - Malwarebytes Labs2025.04.09
5Maryland pharmacist used keyloggers to spy on coworkers for a decade, victim alleges - The Record / James Reddick / malpedia2025.04.05

Additional information

Level Description
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Potentially malicious URLs were found in the process memory dump
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
Network SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
No data
No URL CC ASN Co Reporter Date
1https://tinyfilemanagerdemo.alwaysdata.net/user/files/b.exe
alwaysdata exe keylogger 		FR FRAlwaysdata Sarluser12222025.02.23
2http://141.147.43.219:3000/ftp/EmmetPROD.exe
exe keylogger lazy 		SE SERiordz2025.01.31
3http://107.172.148.212/260/cvss.exe
exe keylogger snake 		US USAS-COLOCROSSINGRiordz2025.01.30
4http://caca.vercel.app/file.exe
keylogger 		US USabus3reports2024.12.06
5https://raw.githubusercontent.com/cheetz/nishang/master/Gather/Keylogger.ps1
keylogger 		US USFASTLYabus3reports2024.12.06
View only the last 5
Beta Service, If you select keyword, you can check detailed information.