Cyber Threat Trends

Summary: 2025/04/17 10:57

First reported date: 2014/08/08
Inquiry period : 2025/04/16 10:57 ~ 2025/04/17 10:57 (1 days), 6 search results

지난 7일 기간대비 100% 높은 트렌드를 보이고 있습니다.
지난 7일 기간대비 상승한 Top5 연관 키워드는 Cobalt Strike c&c Victim Malware IoC 입니다.
악성코드 유형 TONESHELL Trojan PlugX MgBot ZXShell XWorm AsyncRAT Lumma Vawtrak RAT 도 새롭게 확인됩니다.
공격자 Equation Group Hacking Team Volt Typhoon Anonymous MuddyWater 도 새롭게 확인됩니다.
공격기술 Backdoor hijack Exploit Dropper 도 새롭게 확인됩니다.
기관 및 기업 Zscaler China Taiwan Kaspersky Police Iran Government Europe 도 새롭게 확인됩니다.
기타 MUSTANG PANDA EDR Update keylogger GitHub 등 신규 키워드도 확인됩니다.

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.  Ref.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/17 Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	Cobalt Strike	6	▲ 6 (100%)
2	Zscaler	4	▲ new
3	MUSTANG PANDA	4	▲ new
4	c&c	4	▲ 4 (100%)
5	Victim	4	▲ 4 (100%)
6	EDR	4	▲ new
7	Malware	4	▲ 4 (100%)
8	Update	4	▲ new
9	Backdoor	4	▲ new
10	TONESHELL	3	▲ new
11	IoC	3	▲ 3 (100%)
12	Campaign	3	▲ 3 (100%)
13	keylogger	3	▲ new
14	Windows	3	▲ 3 (100%)
15	GameoverP2P	3	▲ 3 (100%)
16	GitHub	2	▲ new
17	China	2	▲ new
18	Advertising	2	▲ 2 (100%)
19	ThreatLabz	2	▲ new
20	hijack	2	▲ new
21	United States	2	▲ 2 (100%)
22	Phishing	2	▲ 2 (100%)
23	Exploit	2	▲ new
24	Trojan	2	▲ new
25	NetWireRC	2	▲ 2 (100%)
26	target	2	▲ new
27	Operation	2	▲ new
28	Mustang	2	▲ new
29	Dropper	1	▲ new
30	attack	1	▲ new
31	SplatCloak	1	▲ new
32	PlugX	1	▲ new
33	driver	1	▲ new
34	schtasks	1	▲ new
35	Mustan	1	▲ new
36	Ransomware	1	▲ 1 (100%)
37	Equation Group	1	▲ new
38	Cobalt	1	▲ 1 (100%)
39	Hacking Team	1	▲ new
40	The Shadow Brokers	1	▲ new
41	Report	1	▲ 1 (100%)
42	Taiwan	1	▲ new
43	Volt Typhoon	1	▲ new
44	Kaspersky	1	▲ new
45	MgBot	1	▲ new
46	Sliver	1	▲ new
47	Anonymous	1	▲ new
48	ZXShell	1	▲ new
49	Police	1	▲ new
50	Criminal	1	▲ new
51	arrest	1	▲ new
52	Microsoft	1	▲ 1 (100%)
53	intelligence	1	▲ new
54	server	1	▲ new
55	XWorm	1	▲ new
56	deep	1	▲ new
57	dive	1	▲ new
58	exploration	1	▲ new
59	Panda	1	▲ new
60	AsyncRAT	1	▲ new
61	MuddyWater	1	▲ new
62	Vulnerability	1	▲ new
63	powershell	1	▲ 1 (100%)
64	Iran	1	▲ new
65	Lumma	1	▲ new
66	Vawtrak	1	▲ new
67	StarProxy	1	▲ new
68	Stealer	1	▲ 1 (100%)
69	Linux	1	▲ 1 (100%)
70	ZeroDay	1	▲ new
71	RAT	1	▲ new
72	Email	1	▲ new
73	UNIX	1	▲ new
74	Government	1	▲ new
75	Europe	1	▲ new
76	C2	1	▲ new
77	file	1	▲ new
78	hac	1	▲ new

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
TONESHELL		3 (15.8%)
GameoverP2P		3 (15.8%)
Trojan		2 (10.5%)
NetWireRC		2 (10.5%)
PlugX		1 (5.3%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Equation Group		1 (20%)
Hacking Team		1 (20%)
Volt Typhoon		1 (20%)
Anonymous		1 (20%)
MuddyWater		1 (20%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Backdoor		4 (26.7%)
Campaign		3 (20%)
hijack		2 (13.3%)
Phishing		2 (13.3%)
Exploit		2 (13.3%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
Zscaler		4 (26.7%)
China		2 (13.3%)
United States		2 (13.3%)
Taiwan		1 (6.7%)
Kaspersky		1 (6.7%)

Threat info

Last 5

SNS

(Total : 2)

Total keyword

Zscaler MUSTANG PANDA Cobalt Strike TONESHELL Backdoor Update Campaign keylogger EDR

No	Title	Date
1	Zscaler ThreatLabz @Threatlabz Zscaler ThreatLabz has published a deep dive on ????Mustang Panda’s latest arsenal including updates to the ToneShell backdoor and a newly discovered lateral movement tool that we have named StarProxy. Read our full technical analysis here: https://t.co/qTsApYXBTm https://t.co/WJ8bPHRxt7	2025.04.16
2	Zscaler ThreatLabz @Threatlabz Zscaler ThreatLabz continues its exploration of Mustang Panda tools by analyzing two new keyloggers that we have named PAKLOG & CorKLOG, and an EDR tampering tool that we have named SplatCloak. Learn how this APT evades detection: https://t.co/xpSVDVTATu https://t.co/FNu1FmqIzd	2025.04.16

News

(Total : 4)

Total keyword

c&c Malware Victim Cobalt Strike EDR Windows Update Attacker IoC GameoverP2P Backdoor Exploit GitHub hijack MUSTANG PANDA Zscaler Trojan target Advertising keylogger TONESHELL Operation United States Campaign Phishing NetWireRC China Equation Group Dropper attack Taiwan Cobalt Hacking Team The Shadow Brokers Report schtasks Volt Typhoon Ransomware MgBot Sliver Anonymous ZXShell Police Criminal arrest PlugX AsyncRAT Microsoft ZeroDay MuddyWater Vulnerability powershell Iran Lumma XWorm Vawtrak Stealer Linux RAT Kaspersky Email intelligence UNIX Government Europe C2

No	Title	Date
1	Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S - Malware.News	2025.04.17
2	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
3	Latest Mustang Panda Arsenal: ToneShell and StarProxy \| P1 - Malware.News	2025.04.17
4	How Indicators of Compromise, Attack, and Behavior Help Spot and Stop Cyber Threats - Malware.News	2025.04.16

Additional information

No	Title	Date
1	엔디비아 'AI 심장부' GPU에 보안 구멍.. '즉시 패치' 비상 - 시큐리티팩트	2025.04.17
2	Hi, robot: Half of all internet traffic now automated - Malware.News	2025.04.17
3	Zoom Sees Outage With 50,000 Users Reporting Availability Issues - Bloomberg Technology	2025.04.17
4	Nude photos and names: KU Health and Kansas hospital sued for data breach - Malware.News	2025.04.17
5	DeepSeek Poses ‘Profound’ Security Threat, US House Panel Claims - Bloomberg Technology	2025.04.17
View only the last 5

No	Title	Date
1	Wars without Gun Smoke: China Plays the Cyber Name-and-Shame Game on Taiwan and the U.S - Malware.News	2025.04.17
2	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
3	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
4	Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak \| P2 - Malware.News	2025.04.17
5	Latest Mustang Panda Arsenal: ToneShell and StarProxy \| P1 - Malware.News	2025.04.17
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	toolspab1.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	74237f2f009020c7bfe80f274a049843	23951	2022.02.25
2	toolspab3.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	9efd29a1bfac21fbd3843dd95acc8582	23949	2022.02.25
3	toolspab2.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	f2336cbcb716869cea7e6d49f5749f1b	23947	2022.02.25
4	Updated_Payments_Statements.li... Darkside Ransomware Cobalt Strike Generic Malware Antivirus Malicious Library UPX AntiDebug AntiVM GIF Format PE File PE32 OS Processor Check	8bdf50e9270b6f6e3c461be75999305d	22459	2022.01.18
5	invoice.exe Darkside Ransomware Cobalt Strike Malicious Library UPX PE File PE32	9fca8332a98b2475b8c5243f70ce5058	22464	2022.01.18
View only the last 5

Level	Description
danger	Executed a process and injected code into it
warning	File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch	Allocates execute permission to another process indicative of possible code injection
watch	Detects Avast Antivirus through the presence of a library
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Foreign language identified in PE resource
notice	One or more potentially interesting buffers were extracted
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	This executable has a PDB path

No data

No	URL	CC	ASN Co	Reporter	Date
1	http://gh-hr.cn/beacon.exe Cobalt strike CobaltStrike exe	CN	...	DonPasci	2025.01.17
2	http://39.107.254.213/beacon.exe Cobalt strike CobaltStrike	CN	...	lontze7	2025.01.16
3	http://106.53.83.169/beacon.exe c2 Cobalt strike	CN	...	lontze7	2025.01.13
4	http://zzz.hnyzh.co/beacon_x86.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
5	http://zzz.hnyzh.co/beacon_x64.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
View only the last 5

Beta Service, If you select keyword, you can check detailed information.