Cyber Threat Trends

Summary: 2025/04/19 11:32

First reported date: 2014/08/08
Inquiry period : 2025/04/12 11:32 ~ 2025/04/19 11:32 (7 days), 17 search results

전 기간대비 76% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Cobalt Strike Malware China c&c Update 입니다.
악성코드 유형 TONESHELL Trojan PlugX ZXShell MgBot Vawtrak XWorm Lumma AsyncRAT 도 새롭게 확인됩니다.
공격자 Anonymous Equation Group Hacking Team Volt Typhoon MuddyWater 도 새롭게 확인됩니다.
공격기술 Backdoor hijack Dropper APT 도 새롭게 확인됩니다.
기관 및 기업 Zscaler Government Chinese Taiwan Canada United Kingdom Police Europe Iran McAfee 도 새롭게 확인됩니다.
기타 MUSTANG PANDA Mustang EDR Panda keylogger 등 신규 키워드도 확인됩니다.

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.  Ref.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/18 Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
    ㆍ 2025/04/17 Unmasking the new XorDDoS controller and infrastructure
    ㆍ 2025/04/17 Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	Cobalt Strike	17	▲ 13 (76%)
2	MUSTANG PANDA	10	▲ new
3	Malware	9	▲ 5 (56%)
4	Mustang	8	▲ new
5	EDR	7	▲ new
6	China	7	▲ 6 (86%)
7	c&c	6	▲ 3 (50%)
8	Update	6	▲ 4 (67%)
9	Backdoor	6	▲ new
10	Zscaler	6	▲ new
11	TONESHELL	6	▲ new
12	Report	6	▲ 3 (50%)
13	Victim	6	▲ 4 (67%)
14	IoC	6	▲ 5 (83%)
15	Campaign	6	▲ 3 (50%)
16	Panda	5	▲ new
17	target	4	▲ 3 (75%)
18	keylogger	4	▲ new
19	GameoverP2P	4	▲ 3 (75%)
20	United States	4	▲ 1 (25%)
21	GitHub	3	▲ new
22	Windows	3	▲ 1 (33%)
23	NetWireRC	3	▲ 1 (33%)
24	Cobalt	3	▲ 2 (67%)
25	attack	3	▲ new
26	ThreatLabz	3	▲ new
27	Phishing	3	▲ 1 (33%)
28	Linux	3	▲ 2 (67%)
29	Criminal	3	▲ new
30	Government	2	▲ new
31	StarProxy	2	▲ new
32	Exploit	2	▲ 1 (50%)
33	intelligence	2	▲ new
34	Chinese	2	▲ new
35	SplatCloak	2	▲ new
36	Operation	2	▲ 1 (50%)
37	Trojan	2	▲ new
38	hijack	2	▲ new
39	UNIX	2	▲ new
40	Taiwan	2	▲ new
41	Advertising	2	▲ 1 (50%)
42	Cisco	2	▲ 1 (50%)
43	Canada	2	▲ new
44	Vulnerability	2	▲ 1 (50%)
45	Anonymous	2	▲ new
46	threat	2	▲ new
47	Sliver	2	▲ new
48	United Kingdom	2	▲ new
49	Microsoft	2	▼ -1 (-50%)
50	C2	1	▲ new
51	series	1	▲ new
52	part	1	▲ new
53	second	1	▲ new
54	Mustan	1	▲ new
55	Dropper	1	▲ new
56	driver	1	▲ new
57	Myanmar	1	▲ new
58	ANYRUN	1	▲ new
59	iocs	1	▲ new
60	ttps	1	▲ new
61	APT41	1	▲ new
62	Explore	1	▲ new
63	APT	1	▲ new
64	The Shadow Brokers	1	▲ new
65	Equation Group	1	▲ new
66	hac	1	▲ new
67	PlugX	1	▲ new
68	server	1	▲ new
69	hacking	1	- 0 (0%)
70	CorKLOG	1	▲ new
71	PAKLOG	1	▲ new
72	Dark	1	▲ new
73	arrest	1	▲ new
74	Hacking Team	1	▲ new
75	Police	1	▲ new
76	Reading	1	▲ new
77	ZXShell	1	▲ new
78	MgBot	1	▲ new
79	Ransomware	1	▼ -1 (-100%)
80	Volt Typhoon	1	▲ new
81	Europe	1	▲ new
82	file	1	▲ new
83	Tick	1	- 0 (0%)
84	schtasks	1	▲ new
85	exploration	1	▲ new
86	Stealer	1	▼ -1 (-100%)
87	Vawtrak	1	▲ new
88	XWorm	1	▲ new
89	Lumma	1	▲ new
90	Iran	1	▲ new
91	powershell	1	▼ -1 (-100%)
92	MuddyWater	1	▲ new
93	AsyncRAT	1	▲ new
94	W	1	▲ new
95	RAT	1	▲ new
96	McAfee	1	▲ new
97	Telegram	1	▲ new
98	Social Engineering	1	- 0 (0%)
99	VirusTotal	1	- 0 (0%)
100	State	1	▲ new

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
TONESHELL		6 (26.1%)
GameoverP2P		4 (17.4%)
NetWireRC		3 (13%)
Trojan		2 (8.7%)
PlugX		1 (4.3%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Anonymous		2 (33.3%)
Equation Group		1 (16.7%)
Hacking Team		1 (16.7%)
Volt Typhoon		1 (16.7%)
MuddyWater		1 (16.7%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Backdoor		6 (25%)
Campaign		6 (25%)
Phishing		3 (12.5%)
Exploit		2 (8.3%)
hijack		2 (8.3%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
China		7 (14.9%)
Zscaler		6 (12.8%)
United States		4 (8.5%)
Government		2 (4.3%)
Chinese		2 (4.3%)

Threat info

Last 5

SNS

(Total : 8)

Total keyword

Cobalt Strike MUSTANG PANDA Zscaler TONESHELL EDR keylogger Campaign Chinese APT Report attack China iocs APT41 Intelligence Backdoor Update Beacon IoC

No	Title	Date
1	Kimberly @StopMalvertisin Dark Reading \| Chinese APT Mustang Panda Debuts 4 New Attack Tools https://t.co/5k6cmxR5ag	2025.04.18
2	ANY.RUN @anyrun_app ???? Explore Threat Intelligence Reports from #ANYRUN. Discover detailed research on active cyber threats and APTs with actionable insights, #IOCs, & #TTPs. Enrich proactive security, report on #APT41 inside ???? https://t.co/ZkhxJ3hf17	2025.04.18
3	Kimberly @StopMalvertisin NVISO Labs \| Crisis Management – Beacon in the Storm https://t.co/38lUEOpj4p	2025.04.17
4	Virus Bulletin @virusbtn Zscaler researchers present the second part of a series on Mustang Panda tools. This time they analyse two new keyloggers, PAKLOG and CorKLOG, as well as an EDR evasion driver (SplatCloak). https://t.co/ni8tV0XVIH https://t.co/841bhFetTp	2025.04.17
5	Cyber_OSINT @Cyber_O51NT Mustang Panda: PAKLOG, CorKLOG, and SplatCloak \| ThreatLabz https://t.co/5zZoo2hTWn	2025.04.17

News

(Total : 9)

Total keyword

Cobalt Strike Malware Victim c&c China Update Attacker IoC EDR Report Backdoor MUSTANG PANDA Campaign United States target TONESHELL GameoverP2P Windows Cobalt Linux GitHub Criminal Zscaler NetWireRC Phishing United Kingdom Vulnerability UNIX Advertising hijack Trojan attack Taiwan keylogger Operation Canada Exploit Cisco Sliver Anonymous Microsoft Government ZXShell schtasks PlugX hacking Dropper Europe C2 Equation Group Hacking Team Chinese The Shadow Brokers arrest Police Volt Typhoon Ransomware MgBot Distribution Kaspersky McAfee Lumma Iran powershell MuddyWater AsyncRAT Telegram Vawtrak Social Engineering VirusTotal XWorm Stealer Australia MFA Israel Türkiye India Italy France Germany Japan ZeroDay South Korea Ucraina ...

No	Title	Date
1	Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates - The Hacker News	2025.04.18
2	Unmasking the new XorDDoS controller and infrastructure - Malware.News	2025.04.17
3	Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools - Malware.News	2025.04.17
4	Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S - Malware.News	2025.04.17
5	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17

Additional information

No	Title	Date
1	Tesla to Delay Production of Cheaper EVs, Reuters Reports - Bloomberg Technology	2025.04.19
2	When Vulnerability Information Flows are Vulnerable Themselves - Malware.News	2025.04.19
3	CISA warns threat hunting staff of end to Google, Censys contracts as agency cuts set in - Malware.News	2025.04.19
4	Radiology practice reportedly working with FBI after ‘data security incident’ - Malware.News	2025.04.19
5	Text scams grow to steal hundreds of millions of dollars - Malware.News	2025.04.19
View only the last 5

No	Title	Date
1	Unmasking the new XorDDoS controller and infrastructure - Malware.News	2025.04.17
2	Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools - Malware.News	2025.04.17
3	Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S - Malware.News	2025.04.17
4	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
5	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	toolspab1.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	74237f2f009020c7bfe80f274a049843	23951	2022.02.25
2	toolspab3.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	9efd29a1bfac21fbd3843dd95acc8582	23949	2022.02.25
3	toolspab2.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	f2336cbcb716869cea7e6d49f5749f1b	23947	2022.02.25
4	Updated_Payments_Statements.li... Darkside Ransomware Cobalt Strike Generic Malware Antivirus Malicious Library UPX AntiDebug AntiVM GIF Format PE File PE32 OS Processor Check	8bdf50e9270b6f6e3c461be75999305d	22459	2022.01.18
5	invoice.exe Darkside Ransomware Cobalt Strike Malicious Library UPX PE File PE32	9fca8332a98b2475b8c5243f70ce5058	22464	2022.01.18
View only the last 5

Level	Description
danger	Executed a process and injected code into it
warning	File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch	Allocates execute permission to another process indicative of possible code injection
watch	Detects Avast Antivirus through the presence of a library
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Foreign language identified in PE resource
notice	One or more potentially interesting buffers were extracted
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	This executable has a PDB path

No data

No	URL	CC	ASN Co	Reporter	Date
1	http://gh-hr.cn/beacon.exe Cobalt strike CobaltStrike exe	CN	...	DonPasci	2025.01.17
2	http://39.107.254.213/beacon.exe Cobalt strike CobaltStrike	CN	...	lontze7	2025.01.16
3	http://106.53.83.169/beacon.exe c2 Cobalt strike	CN	...	lontze7	2025.01.13
4	http://zzz.hnyzh.co/beacon_x86.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
5	http://zzz.hnyzh.co/beacon_x64.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
View only the last 5

Beta Service, If you select keyword, you can check detailed information.