Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines Advanced Persistent Threat (APT) attacks targeting South Korea in June 2025. Spear phishing emerged as the primary attack vector, with LNK files being the most prevalent method, followed by an increase in HWP file-based attacks. The report details two types of spear phishing attacks: Type A, which uses CAB files containing malicious scripts for information exfiltration and additional malware downloads, and Type B, which deploys RAT malware like XenoRAT and RoKRAT using cloud storage APIs. Both types often include decoy documents to appear legitimate. The attacks targeted various sectors, using carefully crafted emails and malicious attachments to exploit victims.

The June 2025 APT Attack Trends Report focuses on a series of Advanced Persistent Threat (APT) campaigns targeting South Korea, primarily observed in June 2025. The attacks predominantly leverage spear phishing as the initial infection vector, exploiting social engineering to deliver malicious payloads. The spear phishing campaigns utilize two main attack types: Type A and Type B. Type A attacks employ CAB archive files containing malicious scripts designed to exfiltrate sensitive information and download additional malware onto compromised systems. Type B attacks deploy Remote Access Trojans (RATs), specifically XenoRAT and RoKRAT, which utilize cloud storage APIs to communicate with command and control (C2) infrastructure, enabling persistent remote control and data theft. The attackers use LNK shortcut files as the most common delivery mechanism, followed by an increase in attacks using HWP files, a popular document format in South Korea. Both attack types frequently include decoy documents to deceive victims into believing the attachments are legitimate, increasing the likelihood of successful compromise. The campaigns target multiple sectors, indicating a broad strategic interest. Indicators of compromise include specific file hashes, IP addresses, and domains associated with the malware and C2 infrastructure. The attack techniques align with known tactics such as spear phishing (T1566), use of malicious scripts (T1059), persistence mechanisms (T1547), and data exfiltration (T1074). Although no known exploits in the wild or CVEs are associated, the campaign demonstrates sophisticated multi-stage infection chains and evasion tactics typical of APT groups. The report references external analysis from AhnLab, a South Korean security firm, providing additional technical context.

Detailed information about June 2025 APT Attack Trends Report (South Korea). Get real-time updates, technical details, and mitigation strategies.

June 2025 APT Attack Trends Report (South Korea) - Live Threat Intelligence - Threat Radar | OffSeq.com

June 2025 APT Attack Trends Report (South Korea)

A new phishing campaign targeting healthcare and IT organizations in Russia has been attributed to the Rainbow Hyena cluster. The attackers used compromised email addresses to distribute malicious attachments, including polyglot files and LNK files mimicking legitimate documents. A new custom-built backdoor called PhantomRemote was identified, capable of system information gathering and command execution. The campaign demonstrates a shift in tactics, with threat actors abandoning traditional malicious documents in favor of alternative formats. The sophistication of the tools and techniques suggests a move towards more conventional illicit activities such as espionage and financial gain.

The Rainbow Hyena threat actor cluster has launched a new phishing campaign targeting healthcare and IT organizations in Russia, employing a shift in tactics and novel malware tools. Unlike previous campaigns that relied on traditional malicious document attachments, this campaign uses compromised email addresses to distribute polyglot files and LNK shortcut files that masquerade as legitimate documents. These alternative file formats help evade detection by conventional security solutions that focus on common document exploits. The campaign delivers a newly identified custom backdoor named PhantomRemote, which provides capabilities for system information gathering and remote command execution. This backdoor enables the attackers to maintain persistence, conduct reconnaissance, and execute arbitrary commands on compromised systems. The use of polyglot and LNK files indicates a sophisticated approach to social engineering and evasion, leveraging Windows shortcut files that can execute commands when clicked, and polyglot files that can be interpreted in multiple ways to bypass security filters. The campaign’s tactics align with MITRE ATT&CK techniques such as T1566 (phishing), T1204 (user execution), T1082 (system information discovery), T1059.003 (command and scripting interpreter: Windows Command Shell), and T1105 (ingress tool transfer). The shift away from traditional malicious documents towards alternative file formats and the deployment of a custom backdoor suggest an evolution in Rainbow Hyena’s operational methods, possibly reflecting a move towards more conventional cyber espionage and financially motivated intrusions. While currently observed in Russia, the sophistication and targeting of healthcare and IT sectors highlight the potential for broader impact if the campaign expands geographically or sector-wise.

Detailed information about Rainbow Hyena strikes again: new backdoor and shift in tactics. Get real-time updates, technical details, and mitigation strategies.

Rainbow Hyena strikes again: new backdoor and shift in tactics - Live Threat Intelligence - Threat Radar | OffSeq.com

Rainbow Hyena strikes again: new backdoor and shift in tactics

This analysis examines Advanced Persistent Threat (APT) attacks in South Korea during May 2025. The majority of identified attacks utilized spear phishing as the primary infiltration method. Two main types of attacks were observed: Type A, which uses LNK files to execute malicious scripts and download additional malware, and Type B, which employs LNK files to download and execute obfuscated Python scripts. Both types use deception techniques, including decoy documents and task scheduler manipulation. The attacks targeted various sectors, using topics such as financial reporting, privacy protection, and business registration to lure victims. The report provides detailed information on file names, decoy documents, and indicators of compromise, including MD5 hashes, URLs, FQDNs, and IP addresses associated with the malicious activities.

The May 2025 APT Group Trends report focuses on a series of Advanced Persistent Threat (APT) attacks observed in South Korea during May 2025. These attacks primarily leveraged spear phishing as the initial infiltration vector, targeting various sectors with socially engineered lures themed around financial reporting, privacy protection, and business registration. The attackers employed two main attack types involving malicious LNK (Windows shortcut) files. Type A attacks use LNK files to execute malicious scripts that subsequently download additional malware payloads. Type B attacks also use LNK files but specifically to download and execute obfuscated Python scripts, increasing complexity and evasion capabilities. Both attack types incorporate deception techniques such as decoy documents to distract victims and manipulation of the Windows Task Scheduler (MITRE ATT&CK technique T1053.005) to maintain persistence. Additional tactics include obfuscation (T1027), masquerading (T1036), user execution (T1204), command and scripting interpreter usage (T1059.001, T1059.006, T1059.003), and remote file copy (T1105). Indicators of compromise (IOCs) include multiple IP addresses (e.g., 103.149.98.230, 213.145.86.223), domain names (e.g., mugem.n-e.kr), and MD5 hashes of malicious files. The campaign does not currently have known exploits in the wild beyond these spear phishing methods. The attack complexity is moderate, relying on user interaction (opening malicious LNK files) and social engineering, but the use of obfuscated scripts and task scheduler manipulation enhances stealth and persistence. This campaign is geographically focused on South Korea but demonstrates techniques that could be adapted elsewhere.

Detailed information about May 2025 APT Group Trends (South Korea). Get real-time updates, technical details, and mitigation strategies.

May 2025 APT Group Trends (South Korea) - Live Threat Intelligence - Threat Radar | OffSeq.com

May 2025 APT Group Trends (South Korea)

APT37, a North Korean state-sponsored hacking group, launched a spear phishing campaign targeting activists focused on North Korea. The attack involved emails with Dropbox links to malicious LNK files, which when executed, activated additional malware. The group utilized legitimate cloud services as Command and Control servers, a tactic known as 'Living off Trusted Sites.' The malware, identified as RoKRAT, collected system information, captured screenshots, and exfiltrated data to cloud-based C2 servers. The campaign, named 'Operation: ToyBox Story,' employed sophisticated techniques including fileless attacks and multiple encryption layers to evade detection. The threat actors impersonated academic events and used decoy documents to lure targets, highlighting the need for advanced endpoint detection and response solutions.

The threat described is a sophisticated cyber espionage campaign named 'Operation ToyBox Story,' attributed to APT37, a North Korean state-sponsored advanced persistent threat group. This campaign targets activists focused on North Korea by leveraging spear phishing emails containing Dropbox links to malicious Windows shortcut (LNK) files. When these LNK files are executed by the victim, they trigger the deployment of RoKRAT malware. RoKRAT is capable of collecting extensive system information, capturing screenshots, and exfiltrating sensitive data to cloud-based Command and Control (C2) servers. The attackers employ 'Living off the Land' tactics by using legitimate cloud services such as Dropbox as C2 infrastructure, which complicates detection and attribution efforts. The malware uses fileless attack techniques and multiple layers of encryption to evade traditional endpoint security solutions. The threat actors impersonate academic events and use decoy documents to increase the likelihood of successful compromise. The attack chain includes reconnaissance, initial access via spear phishing, execution of malicious LNK files, persistence, credential access, command and control communication, and data exfiltration. The campaign exploits CVE-2022-41128, a known vulnerability, although no active exploits in the wild have been reported. The use of legitimate cloud services for C2 and fileless techniques indicates a high level of operational security and sophistication, requiring advanced endpoint detection and response (EDR) capabilities for effective mitigation.

Detailed information about Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story). Get r

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story) - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

Arctic Wolf Labs discovered a new campaign by Venom Spider targeting corporate HR departments with fake resumes containing the More_eggs backdoor. The financially motivated threat group uses spear-phishing emails and abuses legitimate job platforms to apply for real jobs. The backdoor can steal credentials, customer data, and intellectual property. Several upgrades were found, including server-side polymorphism and evasion techniques. The attack chain involves obfuscated JavaScript, LNK files, and a dropper that generates polymorphic code. Organizations are advised to train employees on phishing awareness, especially those in HR who regularly open attachments from unknown senders.

The Venom Spider threat group has launched a new campaign targeting corporate Human Resources (HR) departments by leveraging spear-phishing emails containing fake resumes embedded with the More_eggs backdoor malware. This campaign abuses legitimate job application platforms to submit these malicious resumes, increasing the likelihood of bypassing initial suspicion. The attack chain is sophisticated, involving obfuscated JavaScript, LNK (Windows shortcut) files, and a dropper that generates polymorphic code on the server side. Server-side polymorphism means that the malware payload dynamically changes its code structure with each infection attempt, making traditional signature-based detection ineffective. The More_eggs backdoor enables attackers to steal sensitive information such as user credentials, customer data, and intellectual property. The campaign also incorporates evasion techniques to avoid detection by security tools. The use of spear-phishing specifically targeting HR personnel is strategic, as these employees frequently handle attachments from unknown senders during recruitment processes, increasing the risk of successful compromise. The malware leverages multiple MITRE ATT&CK techniques including command and scripting interpreter abuse (T1059.007), remote system discovery (T1016.001), user execution (T1204.002), and persistence mechanisms (T1547.001), among others. Although no known exploits in the wild have been reported yet, the campaign's complexity and targeted nature pose a significant threat to organizations, especially those with active recruitment processes and large HR departments.

Detailed information about Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims. Get real-time updates, technical details, and mitigation st

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims - Live Threat Intelligence - Threat Radar | OffSeq.com

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

This analysis covers APT attacks detected in South Korea during April 2025. Spear phishing emerged as the primary distribution method for these attacks. Two main types of spear phishing were observed: Type A, which uses LNK files to distribute compressed malicious scripts for information leakage and additional malware downloads, and Type B, which executes RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks often employ decoy documents and target specific individuals or groups with crafted emails. Various file names were used to disguise the malicious content, often mimicking official documents or applications. The report highlights the sophisticated nature of these APT attacks and their potential impact on South Korean targets.

The April 2025 Threat Trend Report details a series of advanced persistent threat (APT) attacks primarily targeting South Korea, with spear phishing as the main distribution vector. Two spear phishing variants were identified: Type A uses malicious LNK shortcut files that execute compressed scripts designed to leak sensitive information and download additional malware payloads. Type B spear phishing campaigns deploy Remote Access Trojans (RATs), specifically XenoRAT and RoKRAT, leveraging legitimate cloud storage APIs such as Dropbox and Google Drive to execute malicious code. These attacks employ decoy documents and carefully crafted emails to target specific individuals or groups, often mimicking official documents or applications to increase the likelihood of engagement. The use of LNK files is notable because they can execute code without triggering traditional executable file detection, while the exploitation of trusted cloud services complicates detection and response efforts. Indicators of compromise include multiple malware file hashes, IP addresses, and domains linked to command and control infrastructure. Although no known exploits in the wild have been reported, the sophistication and stealth of these campaigns suggest a well-resourced adversary focused on espionage, information exfiltration, and establishing long-term persistence within victim networks. The attacks utilize various MITRE ATT&CK techniques such as spear phishing attachments (T1566.001), execution through LNK files (T1204.002), use of cloud services for command and control (T1102.002), and obfuscation (T1027). The campaign’s focus on RAT deployment and information leakage poses significant risks to confidentiality, integrity, and availability of targeted systems.

Detailed information about April 2025 Threat Trend Report on APT Attacks (South Korea). Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'lnk files'

Filter Threats

Threats Tagged 'lnk files'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility