#ThreatIntel Researcher @S2W_Official @TALON_INTEL Main Author of Threat Intel Report 'Campaign DOKKAEBI : Documents of Korean and Evil Binary' / Formerly FSI
λνλ―Όκ΅
Joined April 2010
- Tweets5.8K
- Following3K
- Followers1.4K
- Likes18.7K
ππͺπ¬π΄2 retweeted
π Unit 42 research wins the PΓ©ter SzΕr Award at #VB2025! The development of our Attribution Framework by Andy Piazza, Kyle Wilhoit, Robert Falcone and David Fuertes is recognized as outstanding technical security research. Read it here: bit.ly/46nvHvB
ALT Two individuals are on stage at the 2025 Virus Bulletin Berlin conference, shaking hands and standing by a screen displaying the Pèter Szâr Award for Best Technical Research, which has been won by Unit 42 researchers for their attribution framework.
ππͺπ¬π΄2 retweeted
In their latest report S2W researchers look into TheftCRow, a voice phishing distribution group targeting Korean users with TheftCalls malware. medium.com/s2wblog/detailed-β¦
ππͺπ¬π΄2 retweeted
New updates on #voicephishing malware.
S2W categorizes six main organizations distributing voice phishing #malware targeting users in Korea. This report provides a detailed analysis of phishing sites and malware.
π Learn more here. bit.ly/4hFSuqi
ππͺπ¬π΄2 retweeted
π S2W's Threat Intelligence Center, #TALON, has released a detailed analysis report on the #ZeroDay vulnerability discovery related to the #NorthKorea-based threat group, #APT37.
Check it out through the link below!
medium.com/s2wblog/unmaskingβ¦
ππͺπ¬π΄2 retweeted
S2W has published an analysis report on the #Handala Group.
The report details Handala's claim of responsibility for the #Israeli supply chain attack related to the #Hezbollah walkie-talkie explosion incident.
For the full report, please contact us.
π s2w.inc/en/contact
ππͺπ¬π΄2 retweeted
Really enjoyed this podcast on DPRK threat actors by MSTIC. Here's a note on the two actors mentioned!
Podcast: thecyberwire.com/podcasts/miβ¦
π΅οΈββοΈ Citrine Sleet:
1. North Korean threat actor primarily focused on crypto theft and financial gain
2. One of the three main actors dedicated to crypto theft, alongside Sapphire Sleet and Jade Sleet
3. Known for targeting financial institutions, blockchain technology companies, and crypto exchanges
4. Associated with the AppleJeus malware
5. Recently used a sophisticated exploit chain involving, 0-day in Chromium (CVE-2024-7971) leading to RCE and a sandbox escape vulnerability
6. Deployed the FudModule rootkit as part of their attack
π΅οΈββοΈ Onyx Sleet:
1. Also known as Silent Chollima and Andariel
2. One of the oldest North Korean threat actors
3. Primarily focused on traditional espionage
4. Targets defense companies, energy companies, and organizations in the US and India
5. Has pivoted to include ransomware operations since 2021
6. Uses both custom malware and off-the-shelf tools
7. Employs various malware including:
- D-Track, Sliver framework, Custom RATs and proxy tools
8. Exploits various vulnerabilities, including Apache ActiveMQ, Confluence, PaperCut, TeamCity, and Log4j
9. Associated with Storm-0530 (also known as H0lyGh0st), which conducts ransomware operations
10. Targeted multiple aerospace and defense organizations from October 2023 through June 2024
ππͺπ¬π΄2 retweeted
This morning, Talos shared new research on network infrastructure we assess with high confidence is being used by a state-sponsored North Korean nexus of threat actors we track as βUAT-5394" cs.co/6015lQCy7
ππͺπ¬π΄2 retweeted
@INTERPOL_Cyber supported INTERPOL's Joint Task Force, which was deployed to assist French authorities with securing the Cyber aspect of #Paris2024
INTERPOL's Gateway and adhoc partners Group-IB, Trend Micro, Kaspersky, Fortinet, SecurityScoreCard, Uppsala and S2W provided intel
ππͺπ¬π΄2 retweeted
This morning, we published the Root Cause Analysis (RCA) detailing the findings, mitigations and technical details of the July 19, 2024, Channel File 291 incident. We apologize unreservedly and will use the lessons learned from this incident to become more resilient and better serve our customers. To any customer still affected, please know we will not rest until all systems are restored.
For the executive summary and full RCA, please visit crowdstrike.com/falcon-conteβ¦
ππͺπ¬π΄2 retweeted
π₯ S2W Threat Intelligence Center #TALON has published a report on the TellYouThePass #ransomware exploiting a PHP #vulnerability.
This advanced report goes beyond simple #malware analysis, providing insights into tracking associated virtual assets.
bit.ly/3ypLKef
ππͺπ¬π΄2 retweeted
Well, it has been a heck of a morning... With the outage, I present to you perhaps the most cobbled-together forecast of all time! Thanks for bearing with us today!! #CAwx
ππͺπ¬π΄2 retweeted
π οΈ We experienced a Storage incident in Central US which had downstream impact to a number of Azure services. This is currently mitigated, however we are still in the process of validating recovery to a small percentage of those downstream services. This was communicated to affected customers via the Service Health dashboard in the Azure portal. We are also aware of an issue impacting Virtual Machines running Windows, running the CrowdStrike Falcon agent, which may encounter a bug check (BSOD) and get stuck in a restarting state. While this is an external dependency, we are currently investigating potential options for Azure customers to mitigate and will be providing updates via the status page here: azure.status.microsoft/en-gbβ¦ as well as our Azure portal, where possible.
ππͺπ¬π΄2 retweeted
KrCERT has published a report on #Andariel, including analysis of the group's leased servers to understand how they operated.
thorcert.notion.site/TTPs-11β¦
ππͺπ¬π΄2 retweeted
Thrilled to shared #Kimsuky's latest activity using TRANSLATEXT to focus on the South Korean education sector in an intelligence gathering effort. π΅οΈββοΈ
zscaler.com/blogs/security-rβ¦
What caught our attention:
βΆοΈ Found a Chrome extension on a attacker-controlled GitHub.
βΆοΈ It snags cookies, screenshots, and even email passwords.
βΆοΈ Can bypass security measures from email providers.
βΆοΈ Uses a dead drop resolver to receive extra commands via a legitimate blog service.
βΆοΈ Target confirmed: South Korean education sector linked to North Korea research.
ππͺπ¬π΄2 retweeted
In March 2024, ThreatLabz spotted #Kimsuky (aka #APT43) leveraging #TRANSLATEXT to target the South Korean education sector as part of an intelligence collection operation.
Read our analysis here: zscaler.com/blogs/security-rβ¦
ππͺπ¬π΄2 retweeted
Malware Next-Gen Analysis allows any org to submit malware samples and other suspicious artifacts for analysis. It enables us to more effectively support our partners by automating analysis of newly identified malware and enhancing cyber defense efforts. go.dhs.gov/JrN
ππͺπ¬π΄2 retweeted
We posted our third writeup of N-day full chain series:
Chaining N-days to Compromise All: Part 3βββWindows Driver LPE: Medium to System medium.com/theori-blog/chainβ¦
ππͺπ¬π΄2 retweeted
We dug into the mystery of "Jia Tan," the polite, conscientious volunteer coder who inserted a surprisingly sophisticated backdoor into XZ Utilsβand is most likely the persona of a state-sponsored hacking group based in an Eastern European time zone. wired.com/story/jia-tan-xz-bβ¦
ππͺπ¬π΄2 retweeted
π S2W's AI chatbot, #DarkCHAT, has reached 1.5 million views on YouTube!
DarkCHAT is a product that combines a #chatbot with S2W's #darkweb big data analysis solution, '#Xarvis.'
Enjoy watching the demo video, and stay tuned with S2W's technology.
bit.ly/4bQr9yz
ππͺπ¬π΄2 retweeted
I processed the image files from the ISOON/Anxun leak (using Tesseract OCR) the result is probably approximative but you can grab it here github.com/soufianetahiri/Anβ¦β¦. Now working on translating the stuff locally using facebook/mbart-large-50-many-to-many-mmt, will take some time.
