popup

Cyber Threat Trends

  1. Week Month

conference CrowdStrike 북한

Summary: 2025/04/17 12:53

First reported date: 2010/11/26
Inquiry period : 2025/04/16 12:53 ~ 2025/04/17 12:53 (1 days), 8 search results

지난 7일 기간대비 75% 높은 트렌드를 보이고 있습니다.
지난 7일 기간대비 상승한 Top5 연관 키워드는 Backdoor Update target Malware attack 입니다.
악성코드 유형 TONESHELL Trojan RAT PlugX XWorm Lumma NetWireRC AsyncRAT 도 새롭게 확인됩니다.
공격자 MuddyWater 도 새롭게 확인됩니다.
공격기술 Stealer Dropper Campaign 도 새롭게 확인됩니다.
기관 및 기업 Zscaler Europe Iran 도 새롭게 확인됩니다.
기타 Cobalt Strike c&c MUSTANG PANDA IoC Victim 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1
    ㆍ 2025/04/16 How Indicators of Compromise, Attack, and Behavior Help Spot and Stop Cyber Threats

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1Backdoor 8 ▲ 6 (75%)
2Cobalt Strike 4 ▲ new
3Update 4 ▲ 3 (75%)
4target 3 ▲ 2 (67%)
5c&c 3 ▲ new
6MUSTANG PANDA 3 ▲ new
7TONESHELL 3 ▲ new
8Malware 3 ▲ 2 (67%)
9IoC 3 ▲ new
10Zscaler 3 ▲ new
11attack 3 ▲ 2 (67%)
12Victim 3 ▲ new
13EDR 3 ▲ 3 (100%)
14Windows 3 ▲ 3 (100%)
15Trojan 2 ▲ new
16China 2 ▲ 2 (100%)
17Exploit 2 ▲ 1 (50%)
18GitHub 2 ▲ new
19Advertising 2 ▲ 2 (100%)
20hijack 2 ▲ 2 (100%)
21keylogger 2 ▲ new
22Linux 2 ▲ new
23GameoverP2P 2 ▲ 2 (100%)
24Operation 2 ▲ 2 (100%)
25Stealer 1 ▲ new
26intelligence 1 ▲ 1 (100%)
27StarProxy 1 ▲ new
28file 1 ▲ new
29ZeroDay 1 ▲ 1 (100%)
30C2 1 ▲ new
31RAT 1 ▲ new
32Email 1 ▲ 1 (100%)
33Europe 1 ▲ new
34Government 1 ▲ 1 (100%)
35UNIX 1 ▲ new
36Reading 1 ▲ new
37Dark 1 ▲ new
38Dropper 1 ▲ new
39ChinaLinked 1 ▲ new
40Hackers 1 ▲ new
41Lay 1 ▲ new
42driver 1 ▲ new
43Kaspersky 1 ▲ 1 (100%)
44Microsoft 1 ▲ 1 (100%)
45schtasks 1 ▲ new
46PlugX 1 ▲ new
47SplatCloak 1 ▲ new
48Mustan 1 ▲ new
49Supply 1 ▲ new
50Vawtrak 1 ▲ 1 (100%)
51controller 1 ▲ 1 (100%)
52healthcare 1 ▲ new
53retail 1 ▲ new
54energy 1 ▲ new
55Supply chain 1 ▲ new
56ThreatLabz 1 ▲ new
57deep 1 ▲ new
58dive 1 ▲ new
59Mustang 1 ▲ new
60Report 1 - 0 (0%)
61South Korea 1 ▲ 1 (100%)
62Trend Micro 1 ▲ 1 (100%)
63Egypt 1 ▲ 1 (100%)
64Hong Kong 1 ▲ 1 (100%)
65BPFDoor 1 ▲ 1 (100%)
66Enables 1 ▲ new
67XWorm 1 ▲ new
68Phishing 1 ▲ 1 (100%)
69Lumma 1 ▲ new
70Iran 1 ▲ new
71powershell 1 ▲ 1 (100%)
72chain 1 ▲ new
73United States 1 - 0 (0%)
74Campaign 1 ▲ new
75Vulnerability 1 ▲ 1 (100%)
76Fortinet 1 ▲ 1 (100%)
77MuddyWater 1 ▲ new
78NetWireRC 1 ▲ new
79AsyncRAT 1 ▲ new
80httpstcoVn 1 ▲ new
81LawrenceAbrams 1 ▲ new
82symlink 1 ▲ new
83server 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
TONESHELL
3 (21.4%)
Trojan
2 (14.3%)
GameoverP2P
2 (14.3%)
RAT
1 (7.1%)
PlugX
1 (7.1%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
MuddyWater
1 (100%)
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
Backdoor
8 (50%)
Exploit
2 (12.5%)
hijack
2 (12.5%)
Stealer
1 (6.3%)
Dropper
1 (6.3%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
Zscaler
3 (18.8%)
China
2 (12.5%)
Europe
1 (6.3%)
Government
1 (6.3%)
Kaspersky
1 (6.3%)
Threat info
Last 5

SNS

(Total : 4)
  Total keyword

Backdoor MUSTANG PANDA Fortinet Cobalt Strike TONESHELL Update Zscaler attack Supply chain China

No Title Date
1The Hacker News @TheHackersNews
???? Supply chain cyberattacks are exploding — and hitting where it hurts most: healthcare, retail, energy. ???? One breach = millions exposed. The risk? Vendors are the backdoor. Hackers are walking right in. Learn what’s driving this wave and how to stay ahead: https://t.co/4LGcPEY37W		2025.04.16
2Zscaler ThreatLabz @Threatlabz
Zscaler ThreatLabz has published a deep dive on ????Mustang Panda’s latest arsenal including updates to the ToneShell backdoor and a newly discovered lateral movement tool that we have named StarProxy. Read our full technical analysis here: https://t.co/qTsApYXBTm https://t.co/WJ8bPHRxt7		2025.04.16
3Kimberly @StopMalvertisin
Dark Reading | China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks https://t.co/mrAffs2sof		2025.04.16
4BleepingComputer @BleepinComputer
Over 16,000 Fortinet devices compromised with symlink backdoor - @LawrenceAbrams https://t.co/Vn6TkIFVk0 https://t.co/Vn6TkIFVk0		2025.04.16

News

(Total : 4)
  Total keyword

Backdoor Cobalt Strike Victim c&c target IoC Update Windows EDR Malware GitHub Trojan Attacker MUSTANG PANDA Operation keylogger GameoverP2P TONESHELL Advertising attack Exploit Linux Zscaler hijack PlugX schtasks Microsoft Report Dropper China UNIX Government Europe C2 Kaspersky Stealer intelligence Vulnerability Trend Micro Egypt Hong Kong AsyncRAT NetWireRC MuddyWater Phishing Email Campaign United States powershell Iran Lumma XWorm Vawtrak South Korea ZeroDay RAT

No Title Date
1Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 - Malware.News2025.04.17
2Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 - Malware.News2025.04.17
3How Indicators of Compromise, Attack, and Behavior Help Spot and Stop Cyber Threats - Malware.News2025.04.16
4New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks - The Hacker News2025.04.16

Additional information

Level Description
danger File has been identified by 66 AntiVirus engines on VirusTotal as malicious
danger The process wscript.exe wrote an executable file to disk which it then attempted to execute
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
danger Executed a process and injected code into it
warning Disables Windows Security features
watch Communicates with host for which no DNS query was performed
watch Installs itself for autorun at Windows startup
watch One or more non-whitelisted processes were created
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice A process attempted to delay the analysis task.
notice A process created a hidden window
notice Checks whether any human activity is being performed by constantly checking whether the foreground window changed
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice One or more potentially interesting buffers were extracted
notice Terminates another process
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
No data
No URL CC ASN Co Reporter Date
1http://83.224.128.207/sshd
backdoor censys elf sshdkit 		IT ITVodafone Italia S.p.A.DaveLikesMalwre2025.04.17
2http://188.28.76.180:8082/sshd
backdoor censys elf sshdkit 		GB GBThreeDaveLikesMalwre2025.04.17
3http://117.206.137.98:2000/sshd
backdoor censys elf sshdkit 		IN INNational Internet BackboneDaveLikesMalwre2025.04.17
4http://31.216.198.57:8081/sshd
backdoor censys elf sshdkit 		HR HRHrvatski Telekom d.d.DaveLikesMalwre2025.04.17
5http://31.216.198.57:8082/sshd
backdoor censys elf sshdkit 		HR HRHrvatski Telekom d.d.DaveLikesMalwre2025.04.17
View only the last 5
Beta Service, If you select keyword, you can check detailed information.