Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT37, a North Korean state-sponsored hacking group, launched a spear phishing campaign targeting activists focused on North Korea. The attack involved emails with Dropbox links to malicious LNK files, which when executed, activated additional malware. The group utilized legitimate cloud services as Command and Control servers, a tactic known as 'Living off Trusted Sites.' The malware, identified as RoKRAT, collected system information, captured screenshots, and exfiltrated data to cloud-based C2 servers. The campaign, named 'Operation: ToyBox Story,' employed sophisticated techniques including fileless attacks and multiple encryption layers to evade detection. The threat actors impersonated academic events and used decoy documents to lure targets, highlighting the need for advanced endpoint detection and response solutions.

The threat described is a sophisticated cyber espionage campaign named 'Operation ToyBox Story,' attributed to APT37, a North Korean state-sponsored advanced persistent threat group. This campaign targets activists focused on North Korea by leveraging spear phishing emails containing Dropbox links to malicious Windows shortcut (LNK) files. When these LNK files are executed by the victim, they trigger the deployment of RoKRAT malware. RoKRAT is capable of collecting extensive system information, capturing screenshots, and exfiltrating sensitive data to cloud-based Command and Control (C2) servers. The attackers employ 'Living off the Land' tactics by using legitimate cloud services such as Dropbox as C2 infrastructure, which complicates detection and attribution efforts. The malware uses fileless attack techniques and multiple layers of encryption to evade traditional endpoint security solutions. The threat actors impersonate academic events and use decoy documents to increase the likelihood of successful compromise. The attack chain includes reconnaissance, initial access via spear phishing, execution of malicious LNK files, persistence, credential access, command and control communication, and data exfiltration. The campaign exploits CVE-2022-41128, a known vulnerability, although no active exploits in the wild have been reported. The use of legitimate cloud services for C2 and fileless techniques indicates a high level of operational security and sophistication, requiring advanced endpoint detection and response (EDR) capabilities for effective mitigation.

Detailed information about Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story). Get r

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story) - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

Interlock Ransomware has recently targeted National Defense Corporation and its subsidiaries, impacting the defense industrial base supply chain. The group's attack on AMTEC, a manufacturer of ammunition and explosives, has exposed sensitive information about global defense contractors and their supply chains. This incident highlights the cascading effects of such attacks on military operations, national security, and intellectual property. The compromised data includes details about contracts, logistics, and distribution networks of major defense corporations. The attack underscores the critical need for robust cybersecurity measures in the defense sector, especially given the potential involvement of state-sponsored actors and the implications for geopolitical influence and espionage.

Interlock Ransomware is a sophisticated ransomware threat actor that has recently targeted entities within the defense industrial base (DIB), specifically focusing on National Defense Corporation and its subsidiaries such as AMTEC, a manufacturer of ammunition and explosives. The attack methodology involves encrypting critical operational data and simultaneously exfiltrating sensitive information related to defense contractors, including contract details, logistics, and distribution networks. This double extortion tactic not only disrupts the availability of essential systems but also threatens confidentiality by threatening to leak intellectual property and sensitive supply chain data. The ransomware campaign appears to leverage a combination of tactics including lateral movement (T1133), service stop (T1489), exploitation of public-facing applications (T1190), data from local system (T1567), remote services (T1021), data destruction (T1491), data manipulation (T1565), valid accounts (T1078), data encrypted for impact (T1486), and data exfiltration (T1490). The absence of known affected software versions or publicly known exploits suggests the adversary may be exploiting zero-day vulnerabilities, supply chain weaknesses, or social engineering vectors to gain initial access. The use of multiple IP addresses and a Tor-based leak site for publishing stolen data indicates a high level of operational security and sophistication, possibly pointing to state-sponsored involvement. The attack has cascading effects on military operations and national security by compromising the integrity and confidentiality of defense supply chains, potentially delaying or degrading defense readiness and exposing strategic defense capabilities to adversaries. This threat highlights the critical need for enhanced cybersecurity frameworks such as CMMC compliance within the defense sector to mitigate risks associated with ransomware and data leaks.

Detailed information about How Interlock Ransomware Affects the Defense Industrial Base Supply Chain. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'national security'

Filter Threats

Threats Tagged 'national security'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility