popup

Cyber Threat Trends

  1. Day Week

Gemelli flickerflypro flickerfly

Summary: 2025/04/28 18:55

First reported date: 2014/08/04
Inquiry period : 2025/03/29 18:55 ~ 2025/04/28 18:55 (1 months), 86 search results

전 기간대비 31% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 C2 c&c NetWireRC njRAT live 입니다.
악성코드 유형 DarkComet DslogdRAT GootLoader 도 새롭게 확인됩니다.
공격자 UNC5221 도 새롭게 확인됩니다.
공격기술 RCE hijack Webshell 도 새롭게 확인됩니다.
기관 및 기업 CISA Europe Government Google 도 새롭게 확인됩니다.
기타 Update DNS keylogger Group Additional 등 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/24 DslogdRAT Malware Installed in Ivanti Connect Secure
    ㆍ 2025/04/17 Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1
    ㆍ 2025/04/16 Chinese UNC5174 Group Expands Arsenal with New Open Source Tool and C2 Infrastructure

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1C2 86 ▲ 27 (31%)
2c&c 82 ▲ 27 (33%)
3NetWireRC 46 ▲ 19 (41%)
4njRAT 45 ▲ 22 (49%)
5live 15 ▲ 7 (47%)
6Campaign 8 ▲ 4 (50%)
7Nanocore 7 ▲ 2 (29%)
8Malware 6 ▼ -4 (-67%)
9DarkComet 5 ▲ new
10IP 4 ▲ 2 (50%)
11Update 4 ▲ new
12DDNS 3 - 0 (0%)
13target 3 - 0 (0%)
14APT 3 - 0 (0%)
15China 3 ▲ 2 (67%)
16abusech 3 ▼ -1 (-33%)
17XWorm 3 - 0 (0%)
18RedLine 3 ▼ -1 (-33%)
19IoC 3 ▼ -3 (-100%)
20Low 3 ▲ 1 (33%)
21File 2 - 0 (0%)
22DNS 2 ▲ new
23keylogger 2 ▲ new
24Group 2 ▲ new
25Additional 2 ▲ new
26same 2 ▲ 1 (50%)
27server 2 ▲ 1 (50%)
28RCE 2 ▲ new
29Advertising 2 ▼ -2 (-100%)
30Operation 2 ▲ 1 (50%)
31Lazarus 2 ▲ 1 (50%)
32CISA 2 ▲ new
33SideWinder 2 - 0 (0%)
34Phishing 2 ▼ -1 (-50%)
35shell 1 ▲ new
36manufacturerviewingglatplygg 1 ▲ new
37internetsearchviewdnsnet 1 ▲ new
38introductionsatisfyglatplygg 1 ▲ new
39UNC5221 1 ▲ new
40rayishim 1 ▲ new
41httpstcoUrkESIP 1 ▲ new
42DslogdRAT 1 ▲ new
43vpn 1 - 0 (0%)
44yetcontinentalglatplygg 1 ▲ new
45httpstcoiP 1 ▲ new
46diseaseexpendituresglatplygg 1 ▲ new
47studentwifiglatplygg 1 ▲ new
48photobucksglatplygg 1 ▲ new
49Proxy 1 ▲ new
50time 1 ▲ new
51Grade 1 ▲ new
52evolution 1 ▲ new
53amp 1 ▲ new
54StarProxy 1 ▲ new
55thorscanner 1 ▲ new
56Europe 1 ▲ new
57h4rmsw4yX 1 ▲ new
58Trojan 1 - 0 (0%)
59hijack 1 ▲ new
60Backdoor 1 - 0 (0%)
61Government 1 ▲ new
62sample 1 - 0 (0%)
63GitHub 1 ▼ -1 (-100%)
64Windows 1 ▼ -1 (-100%)
65Promotion 1 ▲ new
66IIIdocx 1 ▲ new
67Report 1 ▼ -2 (-200%)
68intelligence 1 ▼ -2 (-200%)
69Vulnerability 1 ▲ new
70GootLoader 1 ▲ new
71Japan 1 - 0 (0%)
72ZeroDay 1 ▲ new
73NortonLifeLock 1 ▲ new
74hub 1 ▲ new
75infrastructure 1 ▲ new
76Proton 1 ▲ new
77cyberthreat 1 ▲ new
78Exploit 1 - 0 (0%)
79proton66 1 ▲ new
80Google 1 ▲ new
81ThreatProtection 1 ▲ new
82Microsoft 1 ▼ -1 (-100%)
83UNIX 1 ▲ new
84hiesa 1 ▲ new
85Webshell 1 ▲ new
86plenoryvantyxeu 1 ▲ new
87attack 1 ▼ -6 (-600%)
88biamiraqorg 1 ▲ new
89Forward 1 ▲ new
90recommendedcollinsglatplygg 1 ▲ new
91Password 1 - 0 (0%)
92panelthrownglatplygg 1 ▲ new
93paperclip 1 ▲ new
94content 1 ▲ new
95https 1 ▲ new
96httpsfancyhill 1 ▲ new
97naumovax 1 ▲ new
98dl 1 ▲ new
99microsoftftpserveftpcom 1 ▲ new
100UNC 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

Keyword Average Label
NetWireRC
46 (39.3%)
njRAT
45 (38.5%)
Nanocore
7 (6%)
DarkComet
5 (4.3%)
XWorm
3 (2.6%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

Keyword Average Label
Lazarus
2 (66.7%)
UNC5221
1 (33.3%)
Attack technique
Technique

This is an attack technique that is becoming an issue.

Keyword Average Label
Campaign
8 (40%)
APT
3 (15%)
RCE
2 (10%)
Phishing
2 (10%)
hijack
1 (5%)
Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
China
3 (17.6%)
CISA
2 (11.8%)
Europe
1 (5.9%)
Government
1 (5.9%)
Japan
1 (5.9%)
Threat info
Last 5

SNS

(Total : 82)
  Total keyword

C2 c&c njRAT NetWireRC Nanocore Campaign DarkComet XWorm DDNS RedLine APT Lazarus Malware Update IoC SideWinder Phishing vpn keylogger SnakeKeylogger Microsoft DNS GootLoader SectopRAT ShadowPad Downloader ArechClient France Targeting target ...

No Title Date
1SarlackLab @SarlackLab
#njrat #C2 server 94.26.90.81:6666 confirmed 2025-04-26		2025.04.27
2MalwareHunterTeam @malwrhunterteam
@elslahaty @3onine @thor_scanner @h4rmsw4yX This sample is related to the 85.239.62.36 C2 IP: 236ff897dee7d21319482cd67815bd22391523e37e0452fa230813b30884a86f From: http://154.91.0.103:27017/download/tyu/3cev.py https://t.co/pEjvFhDxpr		2025.04.26
3SarlackLab @SarlackLab
#njrat #C2 server 147.185.221.27:31185 team-evaluating.gl.at.ply.gg confirmed 2025-04-26		2025.04.26
4blackorbird @blackorbird
The evolution of Lazarus malware & C2 Infrastructure Update https://t.co/30TBuYQsxA https://t.co/AKtTQ1r9Yp		2025.04.25
5Threat Intelligence @threatintel
#ThreatProtection #Proton66 infrastructure, a hub for phishing, C2 ops and malware campaigns including GootLoader, SpyNote and XWorm. Read more about Symantec's protection: https://t.co/GeYC3ac1F5 #CyberThreat		2025.04.24

News

(Total : 4)
  Total keyword

Malware C2 c&c China RCE Campaign Attacker Operation target CISA Update Advertising keylogger Vulnerability Europe NetWireRC Exploit Report Japan ZeroDay hijack Google intelligence Webshell attack Password UNC5221 DslogdRAT Trojan GitHub Backdoor United States Australia Canada DNS FBI Chinese Government Cobalt Strike MUSTANG PANDA Zscaler IoC Victim EDR TONESHELL UNIX Windows Phishing

No Title Date
1DslogdRAT Malware Installed in Ivanti Connect Secure - Malware.News2025.04.24
2Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 - Malware.News2025.04.17
3Chinese UNC5174 Group Expands Arsenal with New Open Source Tool and C2 Infrastructure - Malware.News2025.04.16
4CISA and FBI Warn Fast Flux is Powering Resilient Malware, C2, and Phishing Networks - The Hacker News2025.04.07

Additional information

No Title Date
128th April – Threat Intelligence Report - Malware.News2025.04.28
2Navigating Through The Fog - Malware.News2025.04.28
3Huawei Set to Test Powerful AI Chip to Rival Nvidia’s, WSJ Says - Bloomberg Technology2025.04.28
4Gamers Beware! New Attack Targets Gamers to Deploy AgeoStealer Malware - Malware.News2025.04.26
5Threat Hunting: For what, when, and how? - Malware.News2025.04.26
View only the last 5
No data
No data
No Category URL CC ASN Co Date
1malwarehttps://mira-store.com/runday2020.07.03
No URL CC ASN Co Reporter Date
1http://59.88.23.194:49027/Mozi.m
c2 Mozi 		IN INNational Internet Backbonestopransom2025.03.27
2http://cobolrationumelawrtewarms.com/3ofn3jf3e2ljk/Plugins/cred.dll
Amadey c2 dll 		US USPONYNETabus3reports2025.03.02
3http://cobolrationumelawrtewarms.com/3ofn3jf3e2ljk/Plugins/cred64.dll
Amadey c2 dll 		US USPONYNETabus3reports2025.03.02
4http://cobolrationumelawrtewarms.com/3ofn3jf3e2ljk/Plugins/clip64.dll
Amadey c2 dll 		US USPONYNETabus3reports2025.03.02
5http://cobolrationumelawrtewarms.com/3ofn3jf3e2ljk/Plugins/clip.dll
Amadey c2 dll 		US USPONYNETabus3reports2025.03.02
View only the last 5
Beta Service, If you select keyword, you can check detailed information.