What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-06-21 21:46:00 | Les pirates de scarcruft exploitent un service habilement pour des attaques d'écoute furtive ScarCruft Hackers Exploit Ably Service for Stealthy Wiretapping Attacks (lien direct) |
L'acteur de menace nord-coréen connu sous le nom de Scarcruft a été observé à l'aide d'un malware malveillant de voleur d'informations avec des fonctionnalités de transition électronique sans papiers précédentes ainsi qu'une porte dérobée développée à l'aide de Golang qui exploite le service de messagerie habilement réel.
"L'acteur de menace a envoyé leurs commandes via la porte dérobée de Golang qui utilise le service habilement", le centre d'intervention d'urgence de la sécurité Ahnlab (
The North Korean threat actor known as ScarCruft has been observed using an information-stealing malware with previous undocumented wiretapping features as well as a backdoor developed using Golang that exploits the Ably real-time messaging service. "The threat actor sent their commands through the Golang backdoor that is using the Ably service," the AhnLab Security Emergency response Center ( |
Malware Threat | APT 37 | ★★ |
|
2023-05-02 12:24:00 | Scarcruft de la Corée du Nord déploie des logiciels malveillants Rokrat via des chaînes d'infection des fichiers LNK North Korea\\'s ScarCruft Deploys RokRAT Malware via LNK File Infection Chains (lien direct) |
L'acteur de menace nord-coréenne connue sous le nom de Scarcruft a commencé à expérimenter avec des fichiers LNK surdimensionnés comme voie de livraison pour les logiciels malveillants de Rokrat dès juillet 2022, le même mois, Microsoft a commencé à bloquer les macros entre les documents de bureau par défaut.
"Rokrat n'a pas changé de manière significative au fil des ans, mais ses méthodes de déploiement ont évolué, utilisant désormais des archives contenant des fichiers LNK qui initient
The North Korean threat actor known as ScarCruft began experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default. "RokRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate |
Malware Threat | APT 37 | ★★ |
|
2023-03-22 17:54:00 | Arsenal évolutif de Scarcruft \\: les chercheurs révèlent de nouvelles techniques de distribution de logiciels malveillants [ScarCruft\\'s Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques] (lien direct) | L'acteur de menace persistante avancée nord-coréenne (APT) surnommé Scarcruft utilise des fichiers HTML (CHM) compilés compilés par Microsoft armé pour télécharger des logiciels malveillants supplémentaires.
Selon plusieurs rapports d'Ahnlab Security Emergency Response Center (ASEC), de Sekoia.io et de Zscaler, les résultats illustrent les efforts continus du groupe pour affiner et réorganiser ses tactiques pour contourner la détection.
"
The North Korean advanced persistent threat (APT) actor dubbed ScarCruft is using weaponized Microsoft Compiled HTML Help (CHM) files to download additional malware. According to multiple reports from AhnLab Security Emergency response Center (ASEC), SEKOIA.IO, and Zscaler, the findings are illustrative of the group\'s continuous efforts to refine and retool its tactics to sidestep detection. " |
Malware Threat General Information Cloud | APT 37 | ★★ |
|
2023-02-15 20:29:00 | North Korea\'s APT37 Targeting Southern Counterpart with New M2RAT Malware (lien direct) | The North Korea-linked threat actor tracked as APT37 has been linked to a piece of new malware dubbed M2RAT in attacks targeting its southern counterpart, suggesting continued evolution of the group's features and tactics. APT37, also tracked under the monikers Reaper, RedEyes, Ricochet Chollima, and ScarCruft, is linked to North Korea's Ministry of State Security (MSS) unlike the Lazarus and | Malware Threat Cloud | APT 38 APT 37 | ★★ |
|
2022-06-24 03:40:50 | Google Says ISPs Helped Attackers Infect Targeted Smartphones with Hermit Spyware (lien direct) | A week after it emerged that sophisticated mobile spyware dubbed Hermit was used by the government of Kazakhstan within its borders, Google said it has notified Android users of infected devices. Additionally, necessary changes have been implemented in Google Play Protect - Android's built-in malware defense service - to protect all users, Benoit Sevens and Clement Lecigne of Google Threat | Malware Cloud | APT 37 | |
|
2022-04-26 02:53:07 | North Korean Hackers Target Journalists with GOLDBACKDOOR Malware (lien direct) | A state-backed threat actor with ties to the Democratic People's Republic of Korea (DRPK) has been attributed to a spear-phishing campaign targeting journalists covering the country with the ultimate goal of deploying a backdoor on infected Windows systems. The intrusions, said to be the work of Ricochet Chollima, resulted in the deployment of a novel malware strain called GOLDBACKDOOR, an | Malware Threat Cloud | APT 37 | |
|
2021-12-07 22:33:02 | Warning: Yet Another Bitcoin Mining Malware Targeting QNAP NAS Devices (lien direct) | Network-attached storage (NAS) appliance maker QNAP on Tuesday released a new advisory warning of a cryptocurrency mining malware targeting its devices, urging customers to take preventive steps with immediate effect. "A bitcoin miner has been reported to target QNAP NAS. Once a NAS is infected, CPU usage becomes unusually high where a process named '[oom_reaper]' could occupy around 50% of the | Malware Cloud | APT 37 | |
|
2021-08-18 01:33:33 | NK Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware (lien direct) | A North Korean threat actor has been discovered taking advantage of two exploits in Internet Explorer to infect victims with a custom implant as part of a strategic web compromise (SWC) targeting a South Korean online newspaper.
Cybersecurity firm Volexity attributed the attacks to a threat actor it tracks as InkySquid, and more widely known by the monikers ScarCruft and APT37. Daily NK, the |
Malware Threat Cloud | APT 37 |
1
We have: 8 articles.
We have: 8 articles.
To see everything:
Our RSS (filtrered)
