Cyber Threat Trends

Summary: 2025/04/19 11:25

First reported date: 2010/11/26
Inquiry period : 2025/04/12 11:25 ~ 2025/04/19 11:25 (7 days), 27 search results

전 기간대비 48% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Backdoor Malware target Update attack 입니다.
악성코드 유형 TONESHELL Trojan Mirai 도 새롭게 확인됩니다.
공격자 Red Menshen 도 새롭게 확인됩니다.
공격기술 Dropper 도 새롭게 확인됩니다.
기관 및 기업 Egypt Hong Kong Zscaler Fortinet Europe Chinese Trend Micro Russia CISA Cisco Taiwan 도 새롭게 확인됩니다.
기타 Cobalt Strike Linux MUSTANG PANDA IoC BPFDoor 등 신규 키워드도 확인됩니다.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/19 Florida senate panel OKs criticized social media backdoor bill
    ㆍ 2025/04/18 Dark Web Profile: Flax Typhoon
    ㆍ 2025/04/18 Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	Backdoor	27	▲ 13 (48%)
2	Malware	13	▲ 5 (38%)
3	target	12	▲ 9 (75%)
4	Update	10	▲ 7 (70%)
5	attack	10	▲ 7 (70%)
6	Report	8	▲ 2 (25%)
7	China	8	▲ 7 (88%)
8	Cobalt Strike	6	▲ new
9	Windows	6	▲ 2 (33%)
10	EDR	6	▲ 5 (83%)
11	Linux	5	▲ new
12	Exploit	5	▲ 1 (20%)
13	Advertising	5	▲ 3 (60%)
14	Campaign	5	▲ 2 (40%)
15	Operation	5	▲ 4 (80%)
16	Government	5	▲ 4 (80%)
17	c&c	5	▲ 4 (80%)
18	Victim	5	▲ 4 (80%)
19	South Korea	5	▲ 4 (80%)
20	MUSTANG PANDA	5	▲ new
21	United States	5	▲ 1 (20%)
22	TONESHELL	5	▲ new
23	Egypt	4	▲ new
24	Microsoft	4	▲ 2 (50%)
25	IoC	4	▲ new
26	Hong Kong	4	▲ new
27	Vulnerability	4	▲ 1 (25%)
28	Zscaler	4	▲ new
29	BPFDoor	4	▲ new
30	Controller	3	▲ new
31	hijack	3	▲ 1 (33%)
32	RCE	3	▲ 1 (33%)
33	RAT	3	▲ 2 (67%)
34	Kaspersky	3	▲ 2 (67%)
35	NetWireRC	3	▲ 2 (67%)
36	intelligence	3	- 0 (0%)
37	Mustang	3	▲ new
38	MWNEWS	3	▲ new
39	Fortinet	3	▲ new
40	Europe	2	▲ new
41	GameoverP2P	2	- 0 (0%)
42	ZeroDay	2	- 0 (0%)
43	Supply	2	▲ new
44	BRICKSTORM	2	▲ new
45	powershell	2	▲ 1 (50%)
46	Trojan	2	▲ new
47	Chinese	2	▲ new
48	symlink	2	▲ new
49	GitHub	2	▲ 1 (50%)
50	chain	2	▲ new
51	keylogger	2	▲ new
52	file	2	▲ new
53	Supply chain	2	▲ 1 (50%)
54	Trend Micro	2	▲ new
55	access	2	▲ new
56	novel	2	▲ new
57	Russia	2	▲ new
58	stealth	2	▲ new
59	Threat	2	▲ 1 (50%)
60	Panda	2	▲ new
61	Myanmar	1	▲ new
62	VPN	1	▲ new
63	Undocumented	1	▲ new
64	Ruckus	1	▲ new
65	Mirai	1	▲ new
66	state	1	▲ new
67	IoT	1	▼ -1 (-100%)
68	Java	1	- 0 (0%)
69	social	1	▲ new
70	Education	1	- 0 (0%)
71	Florida	1	▲ new
72	Telegram	1	▲ new
73	CISA	1	▲ new
74	Europ	1	▲ new
75	dive	1	▲ new
76	Research	1	▲ new
77	deep	1	▲ new
78	ThreatLabz	1	▲ new
79	Team	1	▲ new
80	MimiKatz	1	▲ new
81	hacking	1	▼ -2 (-200%)
82	UNC5221	1	▲ new
83	SplatCloak	1	▲ new
84	version	1	▲ new
85	MysterySnail	1	▲ new
86	plugin	1	- 0 (0%)
87	internetexposed	1	▲ new
88	Cisco	1	▲ new
89	covert	1	▲ new
90	component	1	▲ new
91	Red Menshen	1	▲ new
92	Mustan	1	▲ new
93	driver	1	▲ new
94	UNIX	1	▲ new
95	cyberespionage	1	▲ new
96	Dropper	1	▲ new
97	C2	1	▲ new
98	StarProxy	1	▲ new
99	server	1	▲ new
100	Taiwan	1	▲ new

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
TONESHELL		5 (25%)
RAT		3 (15%)
NetWireRC		3 (15%)
GameoverP2P		2 (10%)
Trojan		2 (10%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Red Menshen		1 (50%)
Anonymous		1 (50%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Backdoor		27 (57.4%)
Exploit		5 (10.6%)
Campaign		5 (10.6%)
hijack		3 (6.4%)
RCE		3 (6.4%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
China		8 (13.3%)
Government		5 (8.3%)
South Korea		5 (8.3%)
United States		5 (8.3%)
Egypt		4 (6.7%)

Threat info

Last 5

SNS

(Total : 12)

Total keyword

Backdoor Fortinet target China Update attack Supply chain Zscaler TONESHELL MUSTANG PANDA Cobalt Strike Malware Chinese United States Exploit Linux NetWireRC Hong Kong South Korea Egypt Trend Micro RAT US Telegram

No	Title	Date
1	Cyber_OSINT @Cyber_O51NT Socket’s Threat Research Team has revealed a supply chain attack where typosquatted npm packages targeting Telegram bot developers install SSH backdoors, risking unauthorized access and data exfiltration. #CyberSecurity #Malware https://t.co/SjGRvCPzo3	2025.04.18
2	Cyber_OSINT @Cyber_O51NT Over 16,000 internet-exposed Fortinet devices have been compromised with a symlink backdoor, granting read-only access to sensitive files on previously affected systems. #cybersecurity #Fortinet https://t.co/tONViUdbgJ	2025.04.17
3	The Hacker News @TheHackersNews ???? Supply chain cyberattacks are exploding — and hitting where it hurts most: healthcare, retail, energy. ???? One breach = millions exposed. The risk? Vendors are the backdoor. Hackers are walking right in. Learn what’s driving this wave and how to stay ahead: https://t.co/4LGcPEY37W	2025.04.16
4	Zscaler ThreatLabz @Threatlabz Zscaler ThreatLabz has published a deep dive on ????Mustang Panda’s latest arsenal including updates to the ToneShell backdoor and a newly discovered lateral movement tool that we have named StarProxy. Read our full technical analysis here: https://t.co/qTsApYXBTm https://t.co/WJ8bPHRxt7	2025.04.16
5	Kimberly @StopMalvertisin Dark Reading \| China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks https://t.co/mrAffs2sof	2025.04.16

News

(Total : 15)

Total keyword

Backdoor Malware target Update Report attack China Windows EDR Campaign Operation Government Cobalt Strike Victim c&c Advertising Attacker Vulnerability United States Linux Microsoft South Korea MUSTANG PANDA Exploit IoC TONESHELL Zscaler intelligence RCE Kaspersky hijack Hong Kong Egypt powershell Europe ZeroDay RAT GitHub Trojan keylogger NetWireRC GameoverP2P Russia Trend Micro UNIX Chinese hacking plugin Cisco Red Menshen C2 CISA Education Taiwan VPN Java Mirai MimiKatz MFA DarkWeb Australia Dropper Cloudflare DYEPACK Anonymous Stealer Vawtrak Red Hat XWorm Lumma Email Iran Hijacking DNS Software ...

No	Title	Date
1	Florida senate panel OKs criticized social media backdoor bill - Malware.News	2025.04.19
2	Dark Web Profile: Flax Typhoon - Malware.News	2025.04.18
3	Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates - The Hacker News	2025.04.18
4	Novel BPFDoor backdoor component facilitates covert attacks - Malware.News	2025.04.17
5	China-linked BRICKSTORM backdoor involved in Europe-targeted cyberespionage - Malware.News	2025.04.17

Additional information

No	Title	Date
1	Tesla to Delay Production of Cheaper EVs, Reuters Reports - Bloomberg Technology	2025.04.19
2	When Vulnerability Information Flows are Vulnerable Themselves - Malware.News	2025.04.19
3	CISA warns threat hunting staff of end to Google, Censys contracts as agency cuts set in - Malware.News	2025.04.19
4	Radiology practice reportedly working with FBI after ‘data security incident’ - Malware.News	2025.04.19
5	Text scams grow to steal hundreds of millions of dollars - Malware.News	2025.04.19
View only the last 5

No	Title	Date
1	Dark Web Profile: Flax Typhoon - Malware.News	2025.04.18
2	Dark Web Profile: Flax Typhoon - Malware.News	2025.04.18
3	Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools - Malware.News	2025.04.17
4	IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia - Malware.News	2025.04.17
5	IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia - Malware.News	2025.04.17
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	remcos_a.exe Client SW User Data Stealer Backdoor RemcosRAT Browser Login Data Stealer browser info stealer Generic Malware Google Chrome User Data Downloader Malicious Library Malicious Packer UPX Create Service Socket Escalate priviledges PWS Sniff Audio DNS Interne	e3aecc3188eac24edb8e34f5044b3a6a	58998	2025.04.14
2	edocument.exe njRAT backdoor Generic Malware Malicious Library Antivirus UPX PE File CAB MSOffice File PE32 OS Processor Check OS Name Check DLL	445861c5c25defe38d09ae2135230e4b	58925	2025.04.10
3	pdf.ps1 Client SW User Data Stealer Backdoor RemcosRAT browser info stealer Hide_EXE Generic Malware Google Chrome User Data Downloader Malicious Library .NET framework(MSIL) Antivirus Create Service Socket ScreenShot Escalate priviledges PWS Sniff Audio DNS Inte	642647cf863119977d7bd52e848e0cfe	58395	2025.03.31
4	ZoomInstallerFull.exe njRAT backdoor Generic Malware Malicious Library Antivirus UPX PE File MSOffice File CAB PE32 OS Processor Check OS Name Check DLL	92c3cfc9f25013c5d8f2212fcc04c887	58266	2025.03.24
5	Zoom.ClientSetupv-204827038.ex... njRAT backdoor Generic Malware Malicious Library Antivirus UPX PE File MSOffice File CAB PE32 OS Processor Check OS Name Check DLL	4baa06d13429759cd61da9da0738f8aa	58267	2025.03.24
View only the last 5

Level	Description
danger	File has been identified by 66 AntiVirus engines on VirusTotal as malicious
danger	The process wscript.exe wrote an executable file to disk which it then attempted to execute
danger	Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
danger	Executed a process and injected code into it
warning	Disables Windows Security features
watch	Communicates with host for which no DNS query was performed
watch	Installs itself for autorun at Windows startup
watch	One or more non-whitelisted processes were created
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	A process attempted to delay the analysis task.
notice	A process created a hidden window
notice	Checks whether any human activity is being performed by constantly checking whether the foreground window changed
notice	Creates a suspicious process
notice	Creates executable files on the filesystem
notice	Drops a binary and executes it
notice	Drops an executable to the user AppData folder
notice	One or more potentially interesting buffers were extracted
notice	Terminates another process
notice	Uses Windows utilities for basic Windows functionality
notice	Yara rule detected in process memory
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	Command line console output was observed
info	The executable contains unknown PE section names indicative of a packer (could be a false positive)

No data

No	URL	CC	ASN Co	Reporter	Date
1	http://124.123.26.174:8889/sshd backdoor censys elf sshdkit	IN		DaveLikesMalwre	2025.04.19
2	http://78.137.84.190:8080/sshd backdoor censys elf sshdkit	YE	...	DaveLikesMalwre	2025.04.19
3	http://14.227.169.55:8082/sshd backdoor censys elf sshdkit	VN	VNPT Corp	DaveLikesMalwre	2025.04.19
4	http://188.28.75.169:8081/sshd backdoor censys elf sshdkit	GB	Three	DaveLikesMalwre	2025.04.19
5	http://113.169.217.235/sshd backdoor censys elf sshdkit	VN	VNPT Corp	DaveLikesMalwre	2025.04.19
View only the last 5