popup

Cyber Threat Trends

  1. Day Month

conference CrowdStrike 북한

Summary: 2025/04/17 15:48

First reported date: 2010/05/28
Inquiry period : 2025/04/10 15:48 ~ 2025/04/17 15:48 (7 days), 5 search results

전 기간대비 60% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 keylogger 입니다.
악성코드 유형 TONESHELL Trojan GameoverP2P PlugX Lobshot Ransomware SnakeKeylogger 도 새롭게 확인됩니다.
공격기술 Backdoor hijack Campaign Exploit Dropper Phishing MalSpam 도 새롭게 확인됩니다.
기관 및 기업 Zscaler China Government Microsoft Kaspersky Europe Google Türkiye 도 새롭게 확인됩니다.
기타 Malware Windows target Update EDR 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1
    ㆍ 2025/04/14 A week in security (April 7 – April 13)

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1keylogger 5 ▲ 3 (60%)
2Malware 3 ▲ new
3Windows 3 ▲ new
4target 3 ▲ new
5Zscaler 3 ▲ new
6Update 3 ▲ new
7EDR 3 ▲ new
8MUSTANG PANDA 3 ▲ new
9Cobalt Strike 3 ▲ new
10TONESHELL 2 ▲ new
11GitHub 2 ▲ new
12Operation 2 ▲ new
13Advertising 2 ▲ new
14Backdoor 2 ▲ new
15hijack 2 ▲ new
16IoC 2 ▲ new
17Campaign 2 ▲ new
18Trojan 2 ▲ new
19c&c 2 ▲ new
20Victim 2 - 0 (0%)
21China 2 ▲ new
22attack 2 ▲ new
23Government 2 ▲ new
24Exploit 2 ▲ new
25UNIX 1 ▲ new
26driver 1 ▲ new
27SplatCloak 1 ▲ new
28Dropper 1 ▲ new
29GameoverP2P 1 ▲ new
30schtasks 1 ▲ new
31PlugX 1 ▲ new
32C2 1 ▲ new
33Microsoft 1 ▲ new
34Kaspersky 1 ▲ new
35server 1 ▲ new
36Europe 1 ▲ new
37StarProxy 1 ▲ new
38file 1 ▲ new
39exploration 1 ▲ new
40Panda 1 ▲ new
41ThreatProtection 1 ▲ new
42Phishing 1 ▲ new
43Report 1 ▲ new
44Lobshot 1 ▲ new
45Ransomware 1 ▲ new
46WhatsApp 1 ▲ new
47ZeroDay 1 ▲ new
48Google 1 ▲ new
49April 1 ▲ new
50Last 1 ▲ new
51cybercrime 1 ▲ new
52Mustang 1 ▲ new
53Turkeys 1 ▲ new
54employment 1 ▲ new
55agency 1 ▲ new
56İŞKUR 1 ▲ new
57MalSpam 1 ▲ new
58SnakeKeylogger 1 ▲ new
59Türkiye 1 ▲ new
60ThreatLabz 1 ▲ new
61Android 1 ▲ new
62Mustan 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
TONESHELL
2 (22.2%)
Trojan
2 (22.2%)
GameoverP2P
1 (11.1%)
PlugX
1 (11.1%)
Lobshot
1 (11.1%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
Backdoor
2 (18.2%)
hijack
2 (18.2%)
Campaign
2 (18.2%)
Exploit
2 (18.2%)
Dropper
1 (9.1%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
Zscaler
3 (25%)
China
2 (16.7%)
Government
2 (16.7%)
Microsoft
1 (8.3%)
Kaspersky
1 (8.3%)
Threat info
Last 5

SNS

(Total : 2)
  Total keyword

Campaign keylogger MUSTANG PANDA EDR Zscaler target Türkiye SnakeKeylogger MalSpam Cobalt Strike

No Title Date
1Zscaler ThreatLabz @Threatlabz
Zscaler ThreatLabz continues its exploration of Mustang Panda tools by analyzing two new keyloggers that we have named PAKLOG & CorKLOG, and an EDR tampering tool that we have named SplatCloak. Learn how this APT evades detection: https://t.co/xpSVDVTATu https://t.co/FNu1FmqIzd		2025.04.16
2Threat Intelligence @threatintel
#ThreatProtection Turkey’s employment agency (İŞKUR) impersonated in a Snake Keylogger malspam campaign targeting organizations across the country. https://t.co/MobFkRu6Ev #Cybercrime #Cybersecurity		2025.04.15

News

(Total : 3)
  Total keyword

Malware Update keylogger Windows Zscaler IoC c&c Victim EDR TONESHELL Cobalt Strike GitHub Advertising Backdoor hijack Trojan MUSTANG PANDA target Operation China attack Government Exploit C2 Dropper PlugX GameoverP2P Kaspersky schtasks Microsoft Attacker Europe UNIX Android Google ZeroDay WhatsApp Ransomware Lobshot Report Phishing

No Title Date
1Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 - Malware.News2025.04.17
2Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 - Malware.News2025.04.17
3A week in security (April 7 – April 13) - Malware.News2025.04.14

Additional information

Level Description
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Potentially malicious URLs were found in the process memory dump
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
Network SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
No data
No URL CC ASN Co Reporter Date
1https://tinyfilemanagerdemo.alwaysdata.net/user/files/b.exe
alwaysdata exe keylogger 		FR FRAlwaysdata Sarluser12222025.02.23
2http://141.147.43.219:3000/ftp/EmmetPROD.exe
exe keylogger lazy 		SE SERiordz2025.01.31
3http://107.172.148.212/260/cvss.exe
exe keylogger snake 		US USAS-COLOCROSSINGRiordz2025.01.30
4http://caca.vercel.app/file.exe
keylogger 		US USabus3reports2024.12.06
5https://raw.githubusercontent.com/cheetz/nishang/master/Gather/Keylogger.ps1
keylogger 		US USFASTLYabus3reports2024.12.06
View only the last 5
Beta Service, If you select keyword, you can check detailed information.