In August 2025, APT attacks in South Korea primarily utilized spear phishing techniques, with LNK files being the most prevalent method. Two main types of attacks were observed: Type A, which used compressed CAB files containing malicious scripts for information exfiltration and additional malware downloads, and Type B, which executed RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks targeted various sectors, employing sophisticated social engineering tactics and decoy documents to increase credibility. The malware performed actions such as keylogging, taking screenshots, and executing commands based on the threat actor's instructions. The report highlights the continuous evolution of APT tactics and the importance of vigilance against targeted phishing campaigns.
The Kimsuky APT group has launched a sophisticated spear-phishing campaign using AI-generated deepfake military ID cards to target South Korean defense institutions. The attack impersonates military employee ID issuance processes and exploits ChatGPT to create convincing fake ID images. The malware employs obfuscated batch files and AutoIt scripts to evade detection, connecting to command and control servers for further payload deployment. The campaign demonstrates the evolving tactics of state-sponsored threat actors in leveraging AI technologies for cyber espionage. Analysis reveals connections to previous Kimsuky operations targeting unification researchers and government agencies, highlighting the persistent nature of the threat.
*Today, we have intuitively adapted to Quick Response (QR) codes in the tapestry of our day-to-day life.*
Whether we are scanning the menu at a restaurant or checking in to our flight, they have seamlessly integrated into the consumption of products and information.
Yet, with its widespread adoption, it has also acquired an accompanying security challenge. Bad actors have capitalized on QR codes to perpetrate phishing attacks, deliver malware, and exfiltrate data without the user’s knowledge.
Oftentimes, this is caught after the attack occurs. This is why you should [use a safe online QR code scanner](https://www.qrstuff.com/scan) that authenticates the link before you click on it is so critical.
A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core component, EggStremeAgent, is a full-featured backdoor enabling extensive system reconnaissance, lateral movement, and data theft via an injected keylogger. The attack begins with EggStremeFuel deploying EggStremeLoader to set up a persistent service, which then executes EggStremeReflectiveLoader to launch EggStremeAgent. The framework's fileless nature and use of legitimate Windows processes make it difficult to detect, posing a significant and persistent threat.
Chinese APT Hits Philippine Military Firm with New EggStreme Fileless Malware
Source: https://hackread.com/chinese-apt-philippine-military-eggstreme-fileless-malware/
Silver Fox APT Exploits Signed Windows Driver to Deliver ValleyRAT Malware
Source: https://hackread.com/silver-fox-apt-exploit-signed-windows-driver-valleyrat/
APT-C-53, also known as Gamaredon, is a Russian state-sponsored threat group active since 2013, targeting Ukrainian government and military entities. The group has upgraded its attack techniques, focusing on dynamic cloud-based C2 infrastructure and targeted delivery of cloud storage tools. In 2025, they conducted high-density intelligence theft activities against Ukrainian government agencies. The attack chain involves dynamic changes in infrastructure, abuse of Microsoft Dev Tunnels, and sophisticated data exfiltration techniques. The group employs white-listed domain camouflage, domain shadowing, and weaponization of cloud tunnel services to evade detection. Their data theft process includes registry-based persistence, multi-stage payload delivery via Cloudflare Workers, and exfiltration through legitimate cloud tools like Dropbox.
Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling
Source: https://thehackernews.com/2025/08/attackers-abuse-velociraptor-forensic.html
This analysis explores the infrastructure of Laundry Bear, a Russian state-sponsored APT group active since April 2024, targeting NATO countries and Ukraine. The investigation expands on initial indicators, using advanced pivoting techniques to uncover additional domains and infrastructure. Key findings include the discovery of multiple lookalike domains, similar registration patterns, and shared hosting infrastructure. The analysis reveals a network of domains with login and account management themes, redirecting to legitimate Microsoft services. The investigation also uncovers connections to other potential malicious activities, including spear-phishing attempts and the use of PDF files for possible malware delivery. The findings demonstrate the extensive infrastructure used by the threat actor and highlight the importance of advanced threat hunting techniques in uncovering related malicious activities.
The TAOTH campaign leveraged an abandoned Sogou Zhuyin IME update server and spear-phishing operations to deliver multiple malware families, primarily targeting users across Eastern Asia. Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or login pages, to distribute malware and collect sensitive information. The campaign focused on high-value targets, including dissidents, journalists, researchers, and technology/business leaders in China, Taiwan, Hong Kong, Japan, South Korea, and overseas Taiwanese communities. Infrastructure and tool analysis link TAOTH to previously documented threat activity, showing shared C&C infrastructure, malware variants, and tactics indicative of a single, persistent attacker group with a focus on reconnaissance, espionage, and email abuse.
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Source: https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html
Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign
Source: https://securityaffairs.com/181513/apt/pakistan-linked-apt36-abuses-linux-desktop-files-to-drop-custom-malware-in-new-campaign.html
A sophisticated spear-phishing campaign, likely linked to APT MuddyWater, is targeting CFOs and finance executives across multiple continents. The attackers use Firebase-hosted phishing pages with custom CAPTCHA challenges, malicious VBS scripts, and multi-stage payload delivery to deploy NetBird, a legitimate remote-access tool, for persistent system control. The campaign employs social engineering tactics, impersonating a Rothschild & Co recruiter to lure victims. Analysis revealed evolving infrastructure, updated payload paths, and overlaps with known MuddyWater activities. The attackers abuse legitimate tools like NetBird and AteraAgent for remote access and monitoring, while using sophisticated techniques such as AES encryption and math-based CAPTCHA lures to evade detection.
The report analyzes Advanced Persistent Threat (APT) attacks in South Korea during July 2025. Spear phishing was the primary attack method, with LNK files being the most common vector. Two types of LNK-based attacks were identified: Type A, which uses compressed CAB files containing malicious scripts, and Type B, which executes RAT malware like XenoRAT and RoKRAT. The attacks targeted various sectors, including finance and blockchain, using sophisticated techniques such as email spoofing and exploiting product vulnerabilities. The report provides detailed information on file names, MD5 hashes, URLs, and IP addresses associated with these attacks, highlighting the ongoing threat to South Korean organizations.
