AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

#AhnLab #ASEC AhnLab ASEC ahnlab.com South Korea Joined June 2020

Tweets

113
Followers

357
Following

27
Likes

0

780th Military Intelligence Brigade (Cyber) @780thC

2 years ago

Kimsuky Group Using Meterpreter to Attack Web Servers | ASEC has recently discovered the distribution of malware targeting web servers by Kimsuky group; a threat group deemed supported by North Korea. asec.ahnlab.com/en/53046/ @AhnLab_ASEC

0 4 9 3K 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

2 years ago

#Trigona #Ransomware Attacking MS-SQL Servers. Typical attacks that target MS-SQL servers include brute force attacks and dictionary attacks on systems where account credentials are poorly managed. asec.ahnlab.com/en/51343/

0 1 1 2K 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

2 years ago

#Kimsuky Uses Alternate Data Stream (ADS) to Conceal Malware. asec.ahnlab.com/en/50625/

0 0 3 1K 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

2 years ago

#AhnLab #MDS detects and blocks malicious #IcedID ms-office word file that uses anti-sandbox techniques. asec.ahnlab.com/en/50198/ 👍AhnLab MDS global.ahnlab.com/site/product/p…

0 2 3 1K 1

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

2 years ago

#Nevada #Ransomware is being distributed. b673d92b77489d12779dc1fb5e8f6fdd ".NEVADA" extension 1. Main Features of Nevada Ransomware 2. Nevada Encryption Targets and Exception Conditions asec.ahnlab.com/en/50063/

0 1 0 715 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

ASEC has recently discovered the #ShellBot, also known as #PerlBot, malware being installed on poorly managed Linux SSH servers. If ShellBot is installed, Linux servers can be used as DDoS Bots for DDoS attacks against specific targets. asec.ahnlab.com/en/49769/

0 2 1 459 0

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

ASEC discovered a malware strain disguised as a password file and being distributed alongside a normal file within a compressed file. The recently discovered malware was in #CHM and #LNK file formats. asec.ahnlab.com/en/49760/

0 4 6 915 1

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

📝AhnLab Threat Intelligence Report A comprehensive report on monitoring the activities of Kimsuky (FlowerPower, AppleSeed) in 2022 asec.ahnlab.com/wp-content/upl… asec.ahnlab.com/en/49520/

1 1 3 364 1

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

📝AhnLab Threat Intelligence Report Unique characteristics of Kimsuky group’s spear phishing emails. Kimsuky used FQDN disguised as a famous Korean web portal. asec.ahnlab.com/wp-content/upl… asec.ahnlab.com/en/49507/ #AhnLab #Kimsuky #Anlaysis #Thallium

0 0 0 248 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

📝AhnLab Threat Intelligence Report Threat Trend Report on Region-Specific Ransomware - Localized Ransomware Attacks - Case Study: South Korea, Taiwan, China, Chile asec.ahnlab.com/wp-content/upl… asec.ahnlab.com/en/49515/ #AhnLab #Ransomware #Anlaysis

0 0 0 183 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

#Mallox #ransomware, which targets vulnerable MS-SQL servers, has been historically distributed at a consistently high rate. Mallox disguised as a program related to DirectPlay is a file built in .NET file. 📝Analysis: asec.ahnlab.com/en/49366/

0 1 2 308 2

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

AhnLab Security Emergency response Center (ASEC) has recently discovered #CHM malware which is assumed to have been created by #Kimsuky. It is distributed as an email attachment. IOC: 726af41024d06df195784ae88f2849e4 C2: hxxp://mpevalr.ria[.]monster asec.ahnlab.com/en/49295/

0 0 1 227 1

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

❗MS-SQL Attack The attacker used not only #CobaltStrike but also #Netcat to gain control over the infected system. It targets poorly managed MS-SQL servers. Various other malware were also installed like privilege escalator, infostealer, and proxy tools. asec.ahnlab.com/en/49249/

0 0 1 111 0

780th Military Intelligence Brigade (Cyber) @780thC

3 years ago

According to ASEC the North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. thehackernews.com/2023/03/lazaru… @TheHackersNews

1 15 8 2K 2

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

#iswr #ransomware can be decrypted!!! iswr ransomware is a variant of #STOP ransomware. #AhnLab #ASEC offers a free script for decrypting files infected by iswr ransomware. 😆asec.ahnlab.com/en/48989/

0 0 0 132 0

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

CHM Malicious File Disguised as Security Email from a Korean Financial Company #RedEyes #Scarcruft asec.ahnlab.com/en/49089/

0 0 1 184 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

ASEC has recently discovered the installation of the #PlugX #malware through the Chinese remote control programs #Sunlogin and #Awesun’s remote code execution #vulnerability asec.ahnlab.com/en/49097/

0 3 2 381 0

Download Image

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

#Lazarus exploited a zero-day #vulnerability in Korea’s widely used digital signature authentication software. They attacked Korean defense contractors, satellite companies, IT, and media companies. #0day This report will be translated into English soon. asec.ahnlab.com/ko/48416/

0 2 1 218 0

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

Anti-Forensic Techniques Used By #Lazarus Group - Data Hiding: Encryption, Other Forms of Data Hiding - Artifact Wiping: File Wiping - Trail Obfuscation: Timestamp Changes 📝Analysis by #AhnLab #ASEC #AFIRST asec.ahnlab.com/en/48223/

1 1 1 219 1

AhnLab Security Emergency Response Center (ASEC) @AhnLab_ASEC

3 years ago

#Magniber #Ransomware’s Relaunch Technique using Windows Registry 🤐 Registering to be relaunched is a preliminary phase of encryption. asec.ahnlab.com/en/48312/