popup

Cyber Threat Trends

  1. Day Month

conference CrowdStrike 북한

Summary: 2025/04/18 11:18

First reported date: 2011/08/10
Inquiry period : 2025/04/11 11:17 ~ 2025/04/18 11:17 (7 days), 6 search results

전 기간대비 -83% 낮은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Exploit Report RCE attack Vulnerability 입니다.
악성코드 유형 DYEPACK IcedID Cryptocurrency Miner CoreDN 도 새롭게 확인됩니다.
공격자 Anonymous 도 새롭게 확인됩니다.
공격기술 XSS Backdoor hijack Hijacking 도 새롭게 확인됩니다.
기관 및 기업 United Kingdom Government 도 새롭게 확인됩니다.
기타 IPv Discord tunneling scans python 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/18 Microsoft’s Secure by Design journey: One year of success
    ㆍ 2025/04/15 Kubernetes Threat Hunting using API Server Audit Logs
    ㆍ 2025/04/12 Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1DNS 6 ▼ -5 (-83%)
2Malware 4 ▼ -3 (-75%)
3Exploit 4 ▲ 3 (75%)
4Report 3 ▲ 1 (33%)
5Update 3 - 0 (0%)
6RCE 3 ▲ 2 (67%)
7attack 3 ▲ 1 (33%)
8Vulnerability 2 ▲ 1 (50%)
9Software 2 - 0 (0%)
10United States 2 ▼ -2 (-100%)
11Campaign 2 ▲ 1 (50%)
12IPv 2 ▲ new
13Microsoft 2 ▲ 1 (50%)
14DYEPACK 2 ▲ new
15intelligence 2 ▲ 1 (50%)
16c&c 2 ▼ -3 (-150%)
17Phishing 2 ▼ -2 (-100%)
18Discord 1 ▲ new
19tunneling 1 ▲ new
20scans 1 ▲ new
21python 1 ▲ new
22Multiple 1 ▲ new
23Internet 1 ▲ new
24public 1 ▲ new
25Australia 1 ▼ -1 (-100%)
26Telegram 1 - 0 (0%)
27IcedID 1 ▲ new
28United Kingdom 1 ▲ new
29Zero Trust 1 ▲ new
30Ransomware 1 ▼ -1 (-100%)
31Windows 1 ▼ -1 (-100%)
32little 1 ▲ new
33GitHub 1 ▲ new
34LinkedIn 1 ▲ new
35CISA 1 ▼ -4 (-400%)
36Government 1 ▲ new
37Data Center 1 - 0 (0%)
38XSS 1 ▲ new
39Firmware 1 ▲ new
40bit 1 ▲ new
41Backdoor 1 ▲ new
42threatactor 1 ▲ new
43Forensics 1 ▲ new
44Google 1 - 0 (0%)
45AdditionalFields 1 ▲ new
46parsejson 1 ▲ new
47TTLs 1 ▲ new
48Hackers 1 ▲ new
49Subdomain 1 ▲ new
50Allows 1 ▲ new
51Cryptocurrency Miner 1 ▲ new
52CVSS 1 ▲ new
53CoreDN 1 ▲ new
54gt 1 ▲ new
55Anonymous 1 ▲ new
56Linux 1 ▲ new
57Red Hat 1 ▲ new
58Advertising 1 ▼ -1 (-100%)
59hijack 1 ▲ new
60Cloudflare 1 - 0 (0%)
61Hijacking 1 ▲ new
62target 1 ▼ -1 (-100%)
63Kubernetes 1 ▲ new
64Ope 1 ▲ new
65ta 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
DYEPACK
2 (33.3%)
IcedID
1 (16.7%)
Ransomware
1 (16.7%)
Cryptocurrency Miner
1 (16.7%)
CoreDN
1 (16.7%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
Anonymous
1 (100%)
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
Exploit
4 (26.7%)
RCE
3 (20%)
Campaign
2 (13.3%)
Phishing
2 (13.3%)
XSS
1 (6.7%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
United States
2 (20%)
Microsoft
2 (20%)
Australia
1 (10%)
United Kingdom
1 (10%)
CISA
1 (10%)
Threat info
Last 5

SNS

(Total : 2)
  Total keyword

DNS Telegram Discord

No Title Date
1Unit 42 @Unit42_Intel
Multiple domains leveraging #DNS #tunneling have been probing the Internet for public IPv4/IPv6 resolvers. Lacking TXT/PTR records, the associated DNS traffic is highly suspicious. These #scans began in Jan 2025 and peaked earlier this week. More info at https://t.co/Zve4RHnSt9 https://t.co/L2LKHJ0D		2025.04.17
2Dark Web Informer - Cyber Threat Intelligence @DarkWebInformer
With a little bit of python, I'm running a threat_actor lookup command with my own data on Discord and sending it back to Telegram all in 2 seconds. /dns_lookup -> DNS details /ip -> IP details /threat_actor -> Provides the last 3 claims (screenshots) /whois -> Whois details https://t.c		2025.04.17

News

(Total : 4)
  Total keyword

DNS Exploit Malware attack Report Attacker Update RCE Vulnerability United States Microsoft DYEPACK Software c&c intelligence Phishing Campaign Kubernetes Australia United Kingdom target IcedID Zero Trust Ransomware Windows GitHub Hijacking CISA Government Data Center XSS Firmware LinkedIn CoreDN Cloudflare Google Cryptocurrency Miner hijack CVSS Forensics Anonymous Linux Red Hat Advertising Backdoor

No Title Date
1Microsoft’s Secure by Design journey: One year of success - Malware.News2025.04.18
2Kubernetes Threat Hunting using API Server Audit Logs - Malware.News2025.04.15
3Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain - Malware.News2025.04.12
4DNS Response analysis with KQL: queries, answers, TTL, RTT & more - Malware.News2025.04.11

Additional information

No Request Hash(md5) Report No Date
1http://www.cipd.org/globalasse...
Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File PNG Format JPEG Format 		4e58a191b515eed2a9894dc8698bc5c0590782025.04.18
2 1 Podgląd wpisu po zmianie _ C...
Client SW User Data Stealer browser info stealer Generic Malware Google Chrome User Data Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection BitCoin Internet API persistenc 		0b0afec69e7d62568ab3bfdadc92c631591772025.04.18
3 1 Podgląd wpisu po zmianie _ C...
Client SW User Data Stealer browser info stealer Generic Malware Google Chrome User Data Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection BitCoin Internet API persistenc 		0b0afec69e7d62568ab3bfdadc92c631591742025.04.18
4 layout.bin
Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File 		72c582ab7db10af86a90608f98e5e614590582025.04.17
5 os.dat
Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File 		af1d8d9435cb10fe2f4b4215eaf6bec4590592025.04.17
View only the last 5
Level Description
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
Network ET INFO TLS Handshake Failure
Network SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
No data
No data
Beta Service, If you select keyword, you can check detailed information.