Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

Financial - socgen-compliance.com fake website delivering malicious documents

The threat involves a fraudulent website, socgen-compliance.com, impersonating a legitimate financial entity to distribute malicious documents. This campaign is designed to deceive users into downloading and opening these documents, which likely contain embedded malware. The attack leverages several sophisticated techniques identified by MITRE ATT&CK patterns, including the use of uncommonly used ports (T1065), process injection (T1055), hooking (T1179), Office application startup manipulation (T1137), and registry modification (T1112). These techniques suggest that the malicious documents exploit Office macros or similar scripting capabilities to execute code stealthily, maintain persistence, and evade detection. Process injection and hooking enable the malware to hide its presence and interfere with normal system operations, while registry modifications ensure the malware can persist across reboots. The use of uncommonly used ports indicates attempts to bypass network security controls or blend in with legitimate traffic. Although the campaign's severity is rated low and no known exploits are reported in the wild, the combination of these tactics indicates a targeted approach aimed at financial sector victims. The threat level and analysis scores suggest moderate confidence in the campaign's capabilities, but the overall certainty is about 50%, indicating some uncertainty in the full scope or impact. The campaign is perpetual, meaning it could be ongoing or reactivated over time. The lack of specific affected versions or products implies a broad targeting strategy focused on user interaction with malicious documents rather than exploiting a particular software vulnerability.

Detailed information about Financial - socgen-compliance.com fake website delivering malicious documents. Get real-time updates, technical details, and mitigati

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="office application startup - t1137"'

Filter Threats