Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The APT-C-55 (Kimsuky) group, a North Korean threat actor, has launched a new attack campaign targeting South Korea. They used a disguised Bandizip installation package to deliver malicious code and a VMP-protected HappyDoor trojan for espionage activities. The attack involves remote script loading, multi-stage malware deployment, and information theft. The malware collects sensitive data, including user information, system details, and files from specific directories. It also implements keylogging, screen capture, and mobile device monitoring functionalities. The attack methodology and infrastructure align with Kimsuky's historical patterns, including the use of similar scripts, backdoor families, and domain naming conventions.

The threat detailed involves the APT-C-55 group, also known as Kimsuky, a North Korean state-sponsored advanced persistent threat actor. This group has initiated a new espionage campaign primarily targeting South Korea, leveraging a sophisticated multi-stage malware attack. The initial infection vector is a disguised Bandizip installation package, which serves as a trojanized delivery mechanism for the HappyDoor backdoor malware. HappyDoor is protected by VMP (VMProtect), a strong shell obfuscation technology designed to hinder reverse engineering and detection efforts. The attack chain involves remote script loading and multi-stage deployment, enabling the malware to evade early detection and maintain persistence. Once deployed, HappyDoor conducts extensive information theft operations, including harvesting user credentials, system information, and files from targeted directories. It also incorporates advanced surveillance capabilities such as keylogging, screen capturing, and monitoring of mobile devices connected to the infected system. The attack infrastructure and methodologies align with Kimsuky’s historical tactics, techniques, and procedures (TTPs), including the use of similar scripting techniques, backdoor families, and domain naming conventions. Indicators of compromise include multiple file hashes, IP addresses, and suspicious domains linked to the campaign. The malware leverages a variety of MITRE ATT&CK techniques such as T1113 (Screen Capture), T1547 (Boot or Logon Autostart Execution), T1082 (System Information Discovery), T1071 (Application Layer Protocol), T1053 (Scheduled Task), T1005 (Data from Local System), T1140 (Deobfuscate/Decode Files or Information), T1055 (Process Injection), T1059 (Command and Scripting Interpreter), T1083 (File and Directory Discovery), T1074 (Data Staged), T1571 (Non-Standard Port), T1027 (Obfuscated Files or Information), T1056 (Input Capture), T1012 (Query Registry), and T1132 (Data Encoding). This campaign demonstrates a high level of operational security and technical sophistication, emphasizing espionage and data exfiltration objectives.

Detailed information about Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell. Get real-time updates, technical d

Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell

A critical vulnerability named DanaBleed was discovered in DanaBot's C2 server, causing memory leaks from June 2022 to early 2025. This bug, introduced in version 2380, exposed sensitive information including threat actor details, server data, and victim credentials. The leak resulted from uninitialized memory in the C2 protocol update. Researchers gained insights into DanaBot's operations, infrastructure, and affiliates. In May 2025, law enforcement dismantled DanaBot's infrastructure and indicted 16 individuals in Operation Endgame. The blog details the technical analysis of the vulnerability, its impact, and the type of data exposed through the memory leak.

DanaBot is a malware-as-a-service platform primarily engaged in cybercrime activities such as banking fraud and information theft. A critical vulnerability, named DanaBleed, was discovered in the Command and Control (C2) server infrastructure of DanaBot. This vulnerability was introduced in version 2380 of the C2 server software and caused a memory leak due to uninitialized memory during a C2 protocol update. The memory leak persisted from June 2022 until early 2025, inadvertently exposing sensitive internal data including threat actor identities, server infrastructure details, and victim credentials. This flaw was a result of poor memory management in the C2 server’s protocol implementation, leading to inadvertent disclosure of critical data. The vulnerability did not require active exploitation in the wild but was an internal bug within the malware’s own infrastructure. Security researchers and law enforcement leveraged this leak to gain unprecedented insight into DanaBot’s operations, infrastructure, and affiliates. This intelligence gathering culminated in Operation Endgame in May 2025, where law enforcement dismantled DanaBot’s infrastructure and indicted 16 individuals. The malware employs a sophisticated and multi-faceted attack framework, utilizing various MITRE ATT&CK techniques such as Windows Management Instrumentation (T1047), External Remote Services (T1133), Application Layer Protocol (T1071), process injection (T1055), credential dumping (T1003), and phishing (T1566), among others. While the vulnerability primarily affected the DanaBot C2 server infrastructure rather than victim endpoints directly, the leaked data included victim credentials, amplifying risks to affected organizations. No direct exploits of this vulnerability were observed in the wild, but the exposure significantly undermined the threat actor’s operational security and exposed their internal mechanisms.

Detailed information about DanaBot C2 Server Memory Leak Bug. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'information theft'

Filter Threats

Threats Tagged 'information theft'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility