Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines Advanced Persistent Threat (APT) attacks targeting South Korea in June 2025. Spear phishing emerged as the primary attack vector, with LNK files being the most prevalent method, followed by an increase in HWP file-based attacks. The report details two types of spear phishing attacks: Type A, which uses CAB files containing malicious scripts for information exfiltration and additional malware downloads, and Type B, which deploys RAT malware like XenoRAT and RoKRAT using cloud storage APIs. Both types often include decoy documents to appear legitimate. The attacks targeted various sectors, using carefully crafted emails and malicious attachments to exploit victims.

The June 2025 APT Attack Trends Report focuses on a series of Advanced Persistent Threat (APT) campaigns targeting South Korea, primarily observed in June 2025. The attacks predominantly leverage spear phishing as the initial infection vector, exploiting social engineering to deliver malicious payloads. The spear phishing campaigns utilize two main attack types: Type A and Type B. Type A attacks employ CAB archive files containing malicious scripts designed to exfiltrate sensitive information and download additional malware onto compromised systems. Type B attacks deploy Remote Access Trojans (RATs), specifically XenoRAT and RoKRAT, which utilize cloud storage APIs to communicate with command and control (C2) infrastructure, enabling persistent remote control and data theft. The attackers use LNK shortcut files as the most common delivery mechanism, followed by an increase in attacks using HWP files, a popular document format in South Korea. Both attack types frequently include decoy documents to deceive victims into believing the attachments are legitimate, increasing the likelihood of successful compromise. The campaigns target multiple sectors, indicating a broad strategic interest. Indicators of compromise include specific file hashes, IP addresses, and domains associated with the malware and C2 infrastructure. The attack techniques align with known tactics such as spear phishing (T1566), use of malicious scripts (T1059), persistence mechanisms (T1547), and data exfiltration (T1074). Although no known exploits in the wild or CVEs are associated, the campaign demonstrates sophisticated multi-stage infection chains and evasion tactics typical of APT groups. The report references external analysis from AhnLab, a South Korean security firm, providing additional technical context.

Detailed information about June 2025 APT Attack Trends Report (South Korea). Get real-time updates, technical details, and mitigation strategies.

June 2025 APT Attack Trends Report (South Korea) - Live Threat Intelligence - Threat Radar | OffSeq.com

June 2025 APT Attack Trends Report (South Korea)

A sophisticated spearphishing campaign targeting South Korea has been uncovered, utilizing GitHub as attack infrastructure. The threat actor, linked to the North Korean group Kimsuky, created multiple private repositories to store malware, decoy files, and exfiltrated victim data. The attack leveraged GitHub Personal Access Tokens to access private repositories and distribute XenoRAT malware. The campaign also employed Dropbox for malware distribution. The attackers used tailored decoy documents and impersonated legitimate entities to increase the effectiveness of their phishing attempts. Analysis of the infrastructure and malware samples revealed connections to previous Kimsuky operations, including shared test IP addresses and similar malware build environments.

The threat involves a sophisticated spearphishing campaign attributed to the North Korean threat actor group Kimsuky, targeting South Korean entities. The attackers leveraged GitHub as a core part of their malicious infrastructure by creating multiple private repositories to store malware samples, decoy documents, and exfiltrated victim data. They exploited GitHub Personal Access Tokens to gain unauthorized access to these private repositories, enabling them to distribute XenoRAT malware covertly. Additionally, Dropbox was used as an alternative malware distribution channel. The campaign employed highly tailored decoy documents and impersonated legitimate organizations to increase the likelihood of successful phishing attacks. Technical analysis revealed that the infrastructure and malware samples share characteristics with previous Kimsuky operations, including the use of shared test IP addresses and similar malware build environments, indicating a consistent operational methodology. The malware, XenoRAT, is a remote access trojan capable of extensive system reconnaissance, data exfiltration, and command execution. The attack chain involves initial spearphishing to deliver the malware, leveraging stolen GitHub tokens to maintain persistence and distribute payloads, and the use of cloud services to obfuscate command and control (C2) communications. The tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as spearphishing (T1566.001), use of cloud services for C2 (T1102), credential access (T1056.001), and remote access tools (T1219). This campaign demonstrates an evolution in threat actor use of legitimate cloud platforms to evade detection and maintain operational security.

Detailed information about Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure. Get real-time updates, techn

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

This analysis examines Advanced Persistent Threat (APT) attacks in South Korea during May 2025. The majority of identified attacks utilized spear phishing as the primary infiltration method. Two main types of attacks were observed: Type A, which uses LNK files to execute malicious scripts and download additional malware, and Type B, which employs LNK files to download and execute obfuscated Python scripts. Both types use deception techniques, including decoy documents and task scheduler manipulation. The attacks targeted various sectors, using topics such as financial reporting, privacy protection, and business registration to lure victims. The report provides detailed information on file names, decoy documents, and indicators of compromise, including MD5 hashes, URLs, FQDNs, and IP addresses associated with the malicious activities.

The May 2025 APT Group Trends report focuses on a series of Advanced Persistent Threat (APT) attacks observed in South Korea during May 2025. These attacks primarily leveraged spear phishing as the initial infiltration vector, targeting various sectors with socially engineered lures themed around financial reporting, privacy protection, and business registration. The attackers employed two main attack types involving malicious LNK (Windows shortcut) files. Type A attacks use LNK files to execute malicious scripts that subsequently download additional malware payloads. Type B attacks also use LNK files but specifically to download and execute obfuscated Python scripts, increasing complexity and evasion capabilities. Both attack types incorporate deception techniques such as decoy documents to distract victims and manipulation of the Windows Task Scheduler (MITRE ATT&CK technique T1053.005) to maintain persistence. Additional tactics include obfuscation (T1027), masquerading (T1036), user execution (T1204), command and scripting interpreter usage (T1059.001, T1059.006, T1059.003), and remote file copy (T1105). Indicators of compromise (IOCs) include multiple IP addresses (e.g., 103.149.98.230, 213.145.86.223), domain names (e.g., mugem.n-e.kr), and MD5 hashes of malicious files. The campaign does not currently have known exploits in the wild beyond these spear phishing methods. The attack complexity is moderate, relying on user interaction (opening malicious LNK files) and social engineering, but the use of obfuscated scripts and task scheduler manipulation enhances stealth and persistence. This campaign is geographically focused on South Korea but demonstrates techniques that could be adapted elsewhere.

Detailed information about May 2025 APT Group Trends (South Korea). Get real-time updates, technical details, and mitigation strategies.

May 2025 APT Group Trends (South Korea) - Live Threat Intelligence - Threat Radar | OffSeq.com

May 2025 APT Group Trends (South Korea)

APT37, a North Korean state-sponsored hacking group, launched a spear phishing campaign targeting activists focused on North Korea. The attack involved emails with Dropbox links to malicious LNK files, which when executed, activated additional malware. The group utilized legitimate cloud services as Command and Control servers, a tactic known as 'Living off Trusted Sites.' The malware, identified as RoKRAT, collected system information, captured screenshots, and exfiltrated data to cloud-based C2 servers. The campaign, named 'Operation: ToyBox Story,' employed sophisticated techniques including fileless attacks and multiple encryption layers to evade detection. The threat actors impersonated academic events and used decoy documents to lure targets, highlighting the need for advanced endpoint detection and response solutions.

The threat described is a sophisticated cyber espionage campaign named 'Operation ToyBox Story,' attributed to APT37, a North Korean state-sponsored advanced persistent threat group. This campaign targets activists focused on North Korea by leveraging spear phishing emails containing Dropbox links to malicious Windows shortcut (LNK) files. When these LNK files are executed by the victim, they trigger the deployment of RoKRAT malware. RoKRAT is capable of collecting extensive system information, capturing screenshots, and exfiltrating sensitive data to cloud-based Command and Control (C2) servers. The attackers employ 'Living off the Land' tactics by using legitimate cloud services such as Dropbox as C2 infrastructure, which complicates detection and attribution efforts. The malware uses fileless attack techniques and multiple layers of encryption to evade traditional endpoint security solutions. The threat actors impersonate academic events and use decoy documents to increase the likelihood of successful compromise. The attack chain includes reconnaissance, initial access via spear phishing, execution of malicious LNK files, persistence, credential access, command and control communication, and data exfiltration. The campaign exploits CVE-2022-41128, a known vulnerability, although no active exploits in the wild have been reported. The use of legitimate cloud services for C2 and fileless techniques indicates a high level of operational security and sophistication, requiring advanced endpoint detection and response (EDR) capabilities for effective mitigation.

Detailed information about Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story). Get r

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story) - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

Earth Ammit, a Chinese-linked threat actor, conducted two campaigns targeting drone supply chains in Taiwan and South Korea from 2023 to 2024. The VENOM campaign focused on software service providers using open-source tools, while TIDRONE targeted military industries with custom malware. Their tactics included supply chain attacks, credential theft, and cyberespionage. Victims spanned military, satellite, heavy industry, media, technology, and healthcare sectors. Earth Ammit's goal was to compromise trusted networks for downstream attacks. They employed evolving techniques like fiber-based evasion and custom backdoors CXCLNT and CLNTEND. The campaigns showed progression from broad, low-cost tools to tailored capabilities for sensitive targets.

The threat actor Earth Ammit, linked to Chinese state-sponsored activities, has executed coordinated multi-wave cyber campaigns targeting drone supply chains primarily in Taiwan and South Korea between 2023 and 2024. These campaigns, named VENOM and TIDRONE, represent a strategic effort to disrupt and infiltrate critical supply chains associated with drone manufacturing and military industries. The VENOM campaign leveraged open-source tools to compromise software service providers, enabling broad access to downstream targets through trusted networks. In contrast, the TIDRONE campaign employed custom malware specifically designed to target military sectors, demonstrating an evolution from generic to highly tailored attack methodologies. The threat actor utilized a variety of sophisticated tactics including supply chain attacks, credential theft, and cyberespionage to gain persistent access. Notably, they deployed custom backdoors such as CXCLNT and CLNTEND and employed fiber-based evasion techniques to avoid detection. The victim profile is diverse, spanning military, satellite, heavy industry, media, technology, and healthcare sectors, indicating a wide-reaching impact on critical infrastructure and strategic industries. The campaigns also incorporated multiple MITRE ATT&CK techniques such as T1583 (Acquire Infrastructure), T1003 (Credential Dumping), T1543 (Create or Modify System Process), T1190 (Exploit Public-Facing Application), and T1078 (Valid Accounts), among others, highlighting a comprehensive and multi-faceted approach to compromise and persistence. The progression from broad, low-cost tools to customized malware underscores the threat actor’s adaptability and focus on high-value targets within sensitive sectors.

MD5 of 5235fecd3e1449ba9f78a25ddb89948a638484411a7bf91af3bb4d1b159f255a

MD5 of 19bbc2daa05a0e932d72ecfa4e08282aa4a27becaabad03b8fc18bb85d37743a

MD5 of 8907907a571a90c28ae72c10945f626fd22a6f587f664a6b86ad3a8f344f1aae

MD5 of 40bcd87bcd851c5c2d6e5c901c59312d480eed58b4ebb2981607c0d80c27b529

MD5 of 1b08f1af849f34bd3eaf2c8a97100d1ac4d78ff4f1c82dbea9c618d2fcd7b4c8

MD5 of c3c4443c3fee858e71fb8017288d9f3b79b2ae0f3f37f93d373765261b299d46

MD5 of 2f2d4cc6266fe1671fa03737059622e03466a80d43a0342bff21b73c7aa5419a

SHA1 of 40bcd87bcd851c5c2d6e5c901c59312d480eed58b4ebb2981607c0d80c27b529

SHA1 of 8907907a571a90c28ae72c10945f626fd22a6f587f664a6b86ad3a8f344f1aae

SHA1 of c3c4443c3fee858e71fb8017288d9f3b79b2ae0f3f37f93d373765261b299d46

SHA1 of 19bbc2daa05a0e932d72ecfa4e08282aa4a27becaabad03b8fc18bb85d37743a

SHA1 of 5235fecd3e1449ba9f78a25ddb89948a638484411a7bf91af3bb4d1b159f255a

SHA1 of 1b08f1af849f34bd3eaf2c8a97100d1ac4d78ff4f1c82dbea9c618d2fcd7b4c8

SHA1 of 2f2d4cc6266fe1671fa03737059622e03466a80d43a0342bff21b73c7aa5419a

Detailed information about Disruption of Drone Supply Chains Through Coordinated Multi-Wave Attacks in Taiwan. Get real-time updates, technical details, and mit

Disruption of Drone Supply Chains Through Coordinated Multi-Wave Attacks in Taiwan - Live Threat Intelligence - Threat Radar | OffSeq.com

Disruption of Drone Supply Chains Through Coordinated Multi-Wave Attacks in Taiwan

This analysis covers APT attacks detected in South Korea during April 2025. Spear phishing emerged as the primary distribution method for these attacks. Two main types of spear phishing were observed: Type A, which uses LNK files to distribute compressed malicious scripts for information leakage and additional malware downloads, and Type B, which executes RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks often employ decoy documents and target specific individuals or groups with crafted emails. Various file names were used to disguise the malicious content, often mimicking official documents or applications. The report highlights the sophisticated nature of these APT attacks and their potential impact on South Korean targets.

The April 2025 Threat Trend Report details a series of advanced persistent threat (APT) attacks primarily targeting South Korea, with spear phishing as the main distribution vector. Two spear phishing variants were identified: Type A uses malicious LNK shortcut files that execute compressed scripts designed to leak sensitive information and download additional malware payloads. Type B spear phishing campaigns deploy Remote Access Trojans (RATs), specifically XenoRAT and RoKRAT, leveraging legitimate cloud storage APIs such as Dropbox and Google Drive to execute malicious code. These attacks employ decoy documents and carefully crafted emails to target specific individuals or groups, often mimicking official documents or applications to increase the likelihood of engagement. The use of LNK files is notable because they can execute code without triggering traditional executable file detection, while the exploitation of trusted cloud services complicates detection and response efforts. Indicators of compromise include multiple malware file hashes, IP addresses, and domains linked to command and control infrastructure. Although no known exploits in the wild have been reported, the sophistication and stealth of these campaigns suggest a well-resourced adversary focused on espionage, information exfiltration, and establishing long-term persistence within victim networks. The attacks utilize various MITRE ATT&CK techniques such as spear phishing attachments (T1566.001), execution through LNK files (T1204.002), use of cloud services for command and control (T1102.002), and obfuscation (T1027). The campaign’s focus on RAT deployment and information leakage poses significant risks to confidentiality, integrity, and availability of targeted systems.

Detailed information about April 2025 Threat Trend Report on APT Attacks (South Korea). Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'south korea'

Filter Threats

Threats Tagged 'south korea'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility