#APT #APT37 #RicochetChollima #ScarCruft #RokRat #threat #malware

📍🇰🇵
💥🇰🇷🌏

⛓️#Phishing > RAR|ZIP > #LNK extract .bat/PS/DOCs > #PS > #BAT execution > #PS decrypt #RokRat SC > Load + RUN #RAT> #C2

🔗360 Advanced Threat Research: mp.weixin.qq.com/s?__biz=MzUy...

#Lazarus #LabyrinthChollima #HiddenCobra APT-C-26 #Threat #APT #malware

📍🇰🇵
💥🌏

⛓️ Social media mal delivery > Exe (Electron #bot) > .js compress > steal wallet info > Download plugins+Run > Monitor host & steal info > #C2

🔗360 Advanced TRI: mp.weixin.qq.com/s?__biz=MzUy...

Tracking #Lumma & #Emmenhtal #loader through weeks targeting LATAM - #threat #malware

📍🏴
💥🇨🇴🇲🇽🇦🇷🌎

⛓️ #Link | Mal domain > Fake CAPTCHA | ZIP/RAR > Encoded PS | mshta (HTA) > download next > Obfuscated script exec > File | ZIP dropped > Injection over file > #LummaStealer

#APT #DarkPink #Saaiwc CVE-2023-38831 #TelePowerBot #KamiKakaBot #threat #malware

#Phishing > RAR + #CVE > Dropp dll > Side-Loading > Injection > Persistence + UAC bypass > Telegram API connection

Nsfocus Report: blog.nsfocus.net/aptdarkpinkw...