DigitalPulse Proxyware Being Distributed Through Ad Pages - ASEC
DigitalPulse Proxyware Being Distributed Through Ad Pages ASEC| ASEC
Darkweb | ASEC
Darkweb | ASEC
Darkweb | ASEC
Malware | ASEC
Malware | ASEC
AhnLab SEcurity intelligence Center (ASEC) introduced a case of threat actors distributing proxyware through the advertising page of a freeware software site in the past blog post “DigitalPulse Proxyware Being Distributed Through Ad Pages” [1]. The same threat actor has been continuously distributing proxyware, and multiple infection cases have been| ASEC
Darkweb | ASEC
Malware | ASEC
AhnLab SEcurity intelligence Center (ASEC) introduced a case of threat actors distributing proxyware through the advertising page of a freeware software site in the past blog post “DigitalPulse Proxyware Being Distributed Through Ad Pages” [1]. The same threat actor has been continuously distributing proxyware, and multiple infection cases have been| ASEC
DigitalPulse Proxyware Being Distributed Through Ad Pages ASEC| ASEC
ASEC Blog publishes “Mobile Security & Malware Issue 3st Week of August, 2025”| ASEC
The Underground ransomware gang is launching continuous ransomware attacks against companies in various countries and industries, including South Korea. This post describes the analysis and characteristics of the Underground ransomware. 1. Overview 1.1 Team Underground The ransomware strain operated by the group known as Underground was first identified in early July 2023. Afterward, their […]| ASEC
Trends of Key APT Groups by Region 1) North Korea North Korea’s APT group actively utilized the ClickFix technique and performed the DLL side-loading technique through OLE objects inserted in Hangul (HWP) documents. Kimsuky The Kimsuky group utilized the ClickFix tactic to launch a multi-stage spear phishing attack targeting diplomats […]| ASEC
AhnLab SEcurity intelligence Center (ASEC) has covered cases where Proxyware malware is distributed by sites posing as YouTube video download pages. Although the attack methods and malware installed are similar, the same attacker continues to distribute the malware, leading to the infection of numerous systems. The following blog posts detail the latest attack cases: […]| ASEC
ASEC Blog publishes Ransom & Dark Web Issues Week 3, August 2025 WARLOCK launched a ransomware attack targeting a telecommunications provider in France. The pro-Israeli hacktivist group “313 Team” claims to have conducted DDoS attacks against nine institutions in Saudi Arabia. Qilin carried out ransomware attacks targeting financial and […]| ASEC
ASEC Blog publishes Ransom & Dark Web Issues Week 2, August 2025 Ransomware Group ‘World Leaks’ Claims Attack on U.S. Defense Contractors Ongoing Identity Data Leaks Target Hotels in Montecatini, Rimini, Milan, and Bardonecchia, Italy New Cyber Threat Group Emerges: Scattered Lapsus$ Hunters| ASEC
ASEC Blog publishes “Mobile Security & Malware Issue 2st Week of August, 2025”| ASEC
Overview Ahnlabs is monitoring APT (Advanced Persistent Threat) attacks in South Korea using its own infrastructure. This report covers the classification, statistics, and features of the APT attacks that were identified during the month of July 2025. Figure 1. Statistics of APT attacks in South Korea in July 2025 The majority of APT attacks […]| ASEC
This report provides statistics on the number of new ransomware samples and affected systems, and affected companies that were collected over the course of July 2025, as well as major ransomware issues in and out of Korea. Below is a summary of the information. Disclaimer: The number of ransomware samples and damaged systems is […]| ASEC
This report provides the distribution quantity, statistics, trends, and case information on phishing emails and email threats collected and analyzed for one month in July 2025. The following are some statistics and cases included in the original report. 1) Statistics of Phishing Email Threats In July 2025, the most common type of threat among phishing […]| ASEC
Pluggable Authentication Modules (PAM) is a modular framework that allows applications such as su, sudo, and sshd to perform security policy logic such as authentication without implementing it directly. Applications delegate authentication to the libpam library, which then loads and executes PAM modules according to the configuration information before aggregating the results. For example, when […]| ASEC
AhnLab SEcurity intelligence Center (ASEC) has recently discovered the massive distribution of SmartLoader malware through GitHub repositories. These repositories are carefully crafted to appear as legitimate projects and are attracting user interest by focusing on topics such as game cheats, software cracks, and automation tools. Each repository contains a README file and a compressed file, […]| ASEC
Background With the prevalence of smartphones and the Internet, security concerns regarding online activities are increasing. There are apps being developed and serviced that allow users to monitor and control smartphones remotely, for protecting family members and acquaintances who are not familiar with using smartphones, such as children and senior family members. In particular, during […]| ASEC
This report comprehensively covers actual cyber threats and security issues that have taken place targeting financial companies in Korea and abroad. This report includes an analysis of malware and phishing cases distributed to the financial industry, the top 10 malware strains targeting the financial sector, and statistics on the industries of the leaked Korean accounts. […]| ASEC
Proxyware Malware Being Distributed on YouTube Video Download Site ASEC| ASEC
ASEC Blog publishes “Mobile Security & Malware Issue 1st Week of August, 2025”| ASEC
ASEC Blog publishes Ransom & Dark Web Issues Week 1, August 2025 Emergence of New Ransomware Groups: BQTLock, Pear, and Black Nevas Increase in Cyberattacks Targeting South Korea [1], [2], [3] Ongoing Identity Information Leaks Targeting Hotels in Europe [1], [2], [3], [4]| ASEC
AhnLab SEcurity intelligence Center (ASEC) recently identified cases of Makop ransomware attacks targeting South Korean users. The Makop ransomware has been distributed to South Korean users by disguising as resumes or emails related to copyrights for several years. Recently, it has been reported that the ransomware is exploiting RDP for attacks. 1. Installing Malware […]| ASEC
AhnLab SEcurity intelligence Center (ASEC) has identified malware being distributed through Facebook ads targeting cryptocurrency users. The identified malware is disguised as a specific cryptocurrency exchange to prompt users to install the malicious program. When users download a file from the disguised website, a file named “installer.msi” is saved and installed. During the installation process, […]| ASEC
ASEC Blog publishes “Mobile Security & Malware Issue 5st Week of July, 2025”| ASEC
Ransom & Dark Web Issues Week 5, July 2025 ASEC| ASEC
Redline Stealer Targeting Accounts Saved to Web Browser with Automatic Login Feature Included ASEC| ASEC
ASEC Blog publishes “Mobile Security & Malware Issue 4st Week of July, 2025”| ASEC
ASEC Blog publishes Ransom & Dark Web Issues Week 4, July 2025 Pro-Russian Hacktivist Group NoName057(16) Launches DDoS Attack on Europol Website Data from French Defense Contractor for Sale on DarkForums XSS Forum Shutdown: Analyzing the Impact on the Russian-Speaking Cybercrime Ecosystem| ASEC
AhnLab TIP monitors the current ransomware group activities across dark web forums, marketplaces, and other sources. Through the Live View > Dark Web Watch menu, users can track the most active ransomware groups, uncover their collaborations, and gain insights into planned attacks and techniques—enabling user organizations to anticipate threats, prepare defenses, and prevent damage before […]| ASEC
AhnLab SEcurity intelligence Center (ASEC) has recently identified a case where a malicious LNK file is disguised as the credit card security email authentication pop-up to steal user information. The identified malicious LNK file has the following file name, disguising itself as the credit card company. **card_detail_20250610.html.lnk The threat actor has been using PowerShell scripts for keylogging […]| ASEC
ASEC Blog publishes “Mobile Security & Malware Issue 3st Week of July, 2025”| ASEC
ACRStealer is an Infostealer that has been distributed since last year. It began to be actively distributed from early this year. AhnLab SEcurity intelligence Center (ASEC) has previously covered ACRStealer, which utilizes Google Docs and Steam as a C2 via a Dead Drop Resolver (DDR) technique. [AhnLab SEcurity intelligence Center (ASEC) Blog] ACRStealer Infostealer […]| ASEC
AhnLab SEcurity intelligence Center (ASEC) recently discovered the distribution of RokRAT malware using a Hangul Word Processor document (.hwp). RokRAT is typically distributed by including a decoy file and malicious script inside a shortcut (LNK) file. However, ASEC found a case where the malware was distributed through HWP documents instead of an LNK file. […]| ASEC
AhnLab SEcurity intelligence Center (ASEC) is monitoring attacks targeting poorly managed Linux servers by utilizing multiple honeypots. One of the most common honeypots is the SSH service using weak credentials, and a large number of DDoS and CoinMiner threat actors are attacking this service. ASEC has recently identified a case of an attack that installs […]| ASEC
ASEC Blog publishes Ransom & Dark Web Issues Week 3, July 2025 Data from Indonesian government agencies leaked on DarkForums. User data from a Korean portal site was sold on a cybercrime forum. A multinational investigation, Operation Eastwood, was launched targeting the pro-Russian hacktivist group NoName057(16).| ASEC
June 2025 APT Attack Trends Report (South Korea) ASEC| ASEC
Darkweb | ASEC
Malware | ASEC
Malware | ASEC
Darkweb | ASEC
Ransom & Dark Web Issues Week 2, July 2025 ASEC| ASEC
June 2025 Trend Report on the Deep Web & Dark Web ASEC| ASEC
June 2025 Security Issues in Korean & Global Financial Sector ASEC| ASEC
CoinMiner Attacks Exploiting GeoServer Vulnerability ASEC| ASEC
Statistics Report on Malware Targeting Windows Database Servers in Q2 2025 ASEC| ASEC
Statistical Report on Malware Targeting Windows Web Servers in Q2 2025 ASEC| ASEC
AhnLab SEcurity intelligence Center (ASEC) collects information on malware distributed through phishing emails by using its own “email honeypot system.” Based on this information, ASEC publishes the “Phishing Email Trend Report” and “Infostealer Trend Report” on the ASEC Blog every month. Recently, XwormRAT has been confirmed to be distributed using steganography. This malware starts […]| ASEC
Malware | ASEC
Malware | ASEC
Security Advisory | ASEC
Malware | ASEC
Malware | ASEC
Ransom & Dark Web Issues Week 1, July 2025 ASEC| ASEC
AhnLab SEcurity intelligence Center (ASEC) monitors attacks targeting Linux servers that are inappropriately managed using honeypots. One of the representative honeypots is the SSH service that uses weak credentials, which is targeted by a large number of DDoS and coinminer attackers. ASEC has identified cases where Linux servers were attacked to install proxies. In […]| ASEC
Lately, attacks on South Korean web servers utilizing MeshAgent and SuperShell have been identified. The presence of ELF-based malware at the malicious code distribution address suggests that the attackers are targeting not only Windows servers but also Linux servers. It is assumed that the attackers installed a web shell using a file upload vulnerability and […]| ASEC
Malware | ASEC
Malware | ASEC
Malware | ASEC
AhnLab SEcurity intelligence Center (ASEC) has confirmed that Infostealer malware disguised as a document containing legal responsibilities and copyright infringement facts is continuously being distributed in Korea. It is mainly distributed through links in email attachments, and the email instructs the recipients to download the evidence related to the copyright infringement. Link in Email […]| ASEC
Trend | ASEC
May 2025 Threat Trend Report on Ransomware ASEC| ASEC
Ransom & Dark Web Issues Week 2, June 2025 ASEC| ASEC
May 2025 Trends Report on Phishing Emails ASEC| ASEC
May 2025 Security Issues in Korean & Global Financial Sector ASEC| ASEC
May 2025 Deep Web and Dark Web Trends Report ASEC| ASEC
The AhnLab SEcurity intelligence Center (ASEC) recently discovered ransomware being distributed disguised a password cracker tool. Such tools are typically used in brute force attacks. Brute force attacks involve by trying every possible combination to find the correct password. Attackers repeatedly attempt to breach a system’s authentication procedure to steal passwords. This method is particularly […]| ASEC
In recent breach incidents, threat actors have been observed not only accessing systems, but also directly querying internal databases and stealing sensitive information. Particularly, more threat actors are installing DB client tools directly on targeted systems to exfiltrate data, and legitimate tools such as DBeaver, Navicat, and sqlcmd are being used in this process. […]| ASEC
This report provides statistics, trends, and case information on the distribution of Infostealer malware, including the distribution volume, methods, and disguises, based on the data collected and analyzed in April 2025. The following is a summary of the report. 1) Data Source and Collection Method The AhnLab SEcurity intelligence Center (ASEC) operates various […]| ASEC
Ransom & Dark Web Issues Week 3, May 2025 ASEC| ASEC
