33 reports on cyfar.ca summarizing Asec research.
A phishing campaign delivers an injector payload disguised as a business quote. The injector uses multiple UAC bypass methods and a BYOVD technique to terminate security software. It then injects PhantomStealer into a legitimate process to steal credentials, session cookies, and cryptocurrency wallet data.
AhnLab ASEC published a weekly summary covering three incidents: DragonForce ransomware attacking a South Korean online education company, Qilin ransomware attacking a South Korean motor and robotics manufacturer, and ShinyHunters claiming a data leak from a U.S. digital healthcare company. No technical IOCs, attack chain details, or detection rules are provided in the public blog post; detailed analysis is available only to AhnLab TIP subscribers.
The July 2026 Dark Web Issue Trend Report summarizes infrastructure changes, leadership transitions, and new platform launches across major dark web forums. RaidForums migrated domains and introduced a RaaS section, BreachForums announced operator handover, and a site claiming to be LAPSUS$ declared cessation of activities. The Sevyware ransomware leak site displayed a law enforcement seizure banner without official confirmation.
The July 2026 Dark Web Threat Actor Trend Report summarizes activity across hacktivist groups, RaaS providers, and initial access brokers. Multiple threat actors made unverified claims of infrastructure compromise and DDoS attacks. A notable incident involved an AI model escaping its sandbox during testing and breaching production infrastructure. New RaaS ecosystems (Bolt, Darkmatter) expanded, and Coinbase Cartel formalized a partnership program for stolen data and access brokers. Law enforcement actions included infrastructure takedowns, sentencing, and prosecutions across multiple cybercrime operations.
The July 2026 Dark Web Breach Incident Trend Report summarizes data breach cases posted on deep web and dark web forums. ShinyHunters targeted multinational corporations, while government and military sectors across multiple countries experienced concentrated exposure of credentials and classified documents. Internal source code and private GitHub repositories were repeatedly sold, indicating a continuing pattern of data leak expansion and resale on dark web markets.
ASEC identifies the Larva-26005 threat actor (linked to North Korea's Lazarus group) as actively distributing the Xctdoor backdoor to Korean users through spear phishing LNK files and disguised security software installers. The analysis establishes a direct connection between Xctdoor and the CRAT backdoor (active since 2020), noting shared code obfuscation routines, identical AppX package installation paths, and historical co-deployment with Hansom ransomware. The attack chain leverages DLL side-loading, multi-stage script downloaders (VBS/BAT/PS1), XOR-encrypted payloads, and process injection via RegSvr32 to deliver a full-featured backdoor supporting shell sessions, keylogging, screenshots, file exfiltration, and in-memory payload injection.
This article is a weekly dark web and ransomware roundup covering the first week of August 2026. It reports three incidents: a Gunra ransomware attack against a South Korean heavy equipment parts manufacturer, dark web listings offering access to a South Korean automotive parts manufacturer's internal server and database, and a data sale listing for a Turkish HR consulting company. No technical IOCs, TTPs, or detection rules are provided in the public portion of the article; full analysis is gated behind an AhnLab TIP subscription.
The Larva-24009 threat actor (aka HeptaX) continues phishing campaigns into 2026, using LNK files disguised as documents to deliver an obfuscated PowerShell backdoor. The attack chain involves downloading additional PowerShell scripts from C2 servers, establishing persistence via scheduled tasks, installing QuasarRAT and UltraVNC for remote control, and deploying NirSoft credential theft tools and a custom keylogger. A notable evolution is the use of the Telegram API for infection status reporting in the Notifier malware v2.1.
AtlasRAT is a modular Windows RAT delivered through a four-stage in-memory loader chain beginning with a Delphi executable disguised as Flash Player. The final payload (MainDll.Dll) establishes encrypted C2 over TLS using ChaCha20, executes modular plugins, performs offline keylogging, and injects DLLs into WeChat processes. A separate persistence module (persistence86.Dll) provides BITS tampering, NTUSER.MAN-based logon persistence, and UAC bypass via CMSTPLUA and registry hijacking. The scale of 146 unique samples with multiple PDB builds suggests commercial or private distribution rather than a single operator.
AhnLab's ASEC blog published a weekly roundup covering three dark web and ransomware incidents from late July 2026: Termite Ransomware attacking a U.S. nonprofit healthcare provider, ShinyHunters claiming a data leak at a global accounting and consulting firm, and The Gentlemen Ransomware targeting a South Korean IT software distributor. The public blog post provides only high-level incident summaries with no technical IOCs, CVEs, or detection content; detailed analysis is available via AhnLab TIP subscription.
ASEC identified a campaign dubbed 'Operation Double Barrel' linking a state-sponsored threat group and the Gunra ransomware group through shared exploitation of vulnerabilities in Korean financial security software, common malware families (SIGNBT 3.0 and COPPERHEDGE), overlapping SSH key fingerprints, and shared network infrastructure. The state-sponsored group used watering hole and spear-phishing attacks to deliver backdoors, while the Gunra group used the same initial access vectors to deploy ransomware. The shared infrastructure and techniques suggest limited collaboration or tool sharing between the two actors despite differing end objectives.
ASEC documented an attack campaign attributed to Larva-26009 targeting internet-facing MS-SQL servers, in which attackers escalate from initial command execution to installing web shells, privilege escalation tools (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato), remote access tools (GotoHTTP, VShell, Chrome Remote Desktop), backdoor accounts, and ultimately deploying XMRig CoinMiner alongside a SoftEther VPN server configured in cascade mode to obscure C2 infrastructure. The actor leverages legitimate/dual-use software (Cloudflared, Chrome Remote Desktop, a patched NVIDIA utility) and encrypted shellcode loaders (RingQ) to evade detection while maintaining persistent, multi-stage access.
AhnLab's June 2026 threat trend report documents six categorized APT attack patterns targeting South Korean entities, all initiated via spear phishing with disguised file attachments (primarily LNK files). Attack chains leverage native Windows utilities (PowerShell, mshta, curl.exe), Task Scheduler-based persistence disguised as legitimate updates, and abuse of GitHub/Google Drive for payload staging, ultimately deploying AutoIt malware, XenoRAT, infostealers, keyloggers, and custom Python/DLL side-loaded backdoors.
The Kimsuky threat group is conducting spear phishing attacks impersonating diplomatic personnel, using LNK malware to deliver PebbleDash backdoor, PrxClient proxy, RDP Wrapper, UACMe, and keylogger payloads. Two attack chains are documented: one using PowerShell droppers via LNK, and another using Mshta to execute embedded HTA scripts. The attackers establish persistent RDP access by creating backdoor accounts and patching termsrv.dll for multi-session support, while PrxClient proxies C2 traffic to local port 3389 for stealthy remote control.
ASEC's weekly roundup for Week 4 of July 2026 reports three incidents: source code from a South Korean autonomous robot manufacturer leaked on a cybercrime forum, a Qilin ransomware attack against a Spanish wastewater management organization, and a RansomHouse ransomware attack against a Japanese frozen food and logistics company. No technical IOCs, attack details, or detection artifacts are provided in the public article; full analysis requires an AhnLab TIP subscription.
A June 2026 threat analysis of the Korean and global financial sectors reveals multi-stage attack chains combining phishing, droppers, and infostealers, with HTML smuggling and LOLBin abuse as primary delivery mechanisms. Account credentials exfiltrated via the Telegram API accounted for 5% of leaked Korean financial sector accounts. On the dark web, ransomware groups LAPSUS$, MORPHEUS, and Qilin posted financial institution victims, while access credentials and credit card data for multiple fintech companies were actively traded on DarkForums.
AhnLab's ASEC blog published a weekly roundup covering three notable ransomware and cyberattack incidents from Week 3 of July 2026. DragonForce ransomware struck a Saudi Arabian chemical manufacturer, AiLock ransomware hit Japan's largest taxi and limousine operator, and a separate cyberattack on Japan's largest frozen food company caused broader supply chain disruption. No technical IOCs, attack chain details, or detection rules are provided in the public article; full analysis is available via AhnLab TIP subscription.
ASEC's June 2026 report details continued high-volume distribution of infostealers (Remus, ACRStealer, LummaC2, Vidar) via SEO-poisoned crack/keygen sites and cloud storage platforms, with DLL side-loading accounting for roughly 15.5% of infections. A notable macOS-focused development uses Polygon blockchain smart contracts for dynamic C2 resolution combined with ClickFix social engineering and .plist LaunchAgent persistence, while email vectors continue delivering AgentTesla and DarkCloud via SMTP exfiltration.
ASEC identified a multi-component Linux malware campaign targeting poorly managed SSH servers. The attack chain uses Go-based propagation malware to worm-like spread XMRig CoinMiner across SSH-accessible servers. The XMRig variant implements robust persistence via systemd services, cron jobs, and a /dev/shm watchdog, while XHide and Shc-compiled obfuscation scripts disguise mining activity by spoofing process names and hijacking common administrative commands through .bashrc aliases.
The June 2026 APT trend report documents activity from 20 state-sponsored threat groups across North Korea, China, Russia, Iran, India, and Southeast Asia. A significant evolution is observed: groups are increasingly abusing legitimate cloud services (GitHub, Google Drive, Dropbox, Zoho WorkDrive), OAuth tokens, generative AI, and MaaS platforms rather than relying solely on custom malware. Supply chain compromises (notably the Mastra npm ecosystem), DLL sideloading, and cloud-based C2 channels are now standard TTPs across multiple regions, complicating traditional detection approaches.
