Cyber Threat Trends

Summary: 2025/04/28 20:30

First reported date: 2014/08/08
Inquiry period : 2025/03/29 20:30 ~ 2025/04/28 20:30 (1 months), 37 search results

전 기간대비 24% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 Cobalt Strike Campaign Report Backdoor Windows 입니다.
악성코드 유형 TONESHELL AsyncRAT BlackSuit SectopRAT RMS 도 새롭게 확인됩니다.
공격자 Tick Anonymous 도 새롭게 확인됩니다.
공격기술 Dropper 도 새롭게 확인됩니다.
기관 및 기업 Zscaler Chinese 도 새롭게 확인됩니다.
기타 MUSTANG PANDA Mustang keylogger ThreatLabz Password 등 신규 키워드도 확인됩니다.

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.  Ref.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/28 Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries
    ㆍ 2025/04/23 Introducing ToyMaker, an Initial Access Broker working in cahoots with double extortion gangs
    ㆍ 2025/04/23 ATT&CK v17: New Platform (ESXi), Collection Optimization, & More Countermeasures

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	Cobalt Strike	37	▲ 9 (24%)
2	Malware	24	- 0 (0%)
3	Campaign	15	▲ 2 (13%)
4	Report	14	▲ 1 (7%)
5	Backdoor	14	▲ 10 (71%)
6	Windows	13	▲ 5 (38%)
7	China	12	▲ 5 (42%)
8	Victim	12	- 0 (0%)
9	Update	11	▲ 2 (18%)
10	MUSTANG PANDA	11	▲ new
11	United States	11	▲ 2 (18%)
12	c&c	11	▲ 1 (9%)
13	IoC	10	- 0 (0%)
14	Mustang	9	▲ new
15	target	9	▲ 3 (33%)
16	EDR	8	▲ 3 (38%)
17	Kaspersky	8	▲ 5 (63%)
18	Cobalt	8	▼ -8 (-100%)
19	Microsoft	8	▲ 1 (13%)
20	Phishing	8	▼ -1 (-13%)
21	NetWireRC	7	▲ 3 (43%)
22	Russia	7	▲ 4 (57%)
23	Operation	7	▲ 3 (43%)
24	TONESHELL	7	▲ new
25	Ransomware	6	- 0 (0%)
26	FIN7	6	▲ 2 (33%)
27	FIN	6	▲ 4 (67%)
28	Panda	6	▲ 5 (83%)
29	GameoverP2P	6	▲ 4 (67%)
30	Zscaler	6	▲ new
31	Advertising	6	▲ 2 (33%)
32	hacking	6	▲ 3 (50%)
33	Government	6	▲ 4 (67%)
34	powershell	5	▼ -1 (-20%)
35	Vulnerability	5	▼ -3 (-60%)
36	Anubis	5	▲ 4 (80%)
37	attack	5	▲ 1 (20%)
38	Android	4	▼ -1 (-25%)
39	Exploit	4	▼ -4 (-100%)
40	MFA	4	▼ -1 (-25%)
41	Social Engineering	4	▲ 1 (25%)
42	APT41	4	▲ 1 (25%)
43	Linux	4	- 0 (0%)
44	Cisco	4	▼ -1 (-25%)
45	keylogger	4	▲ new
46	Email	4	▲ 2 (50%)
47	RATel	4	▲ 3 (75%)
48	Trojan	4	▲ 2 (50%)
49	ThreatLabz	3	▲ new
50	Password	3	▲ new
51	Stealer	3	- 0 (0%)
52	Germany	3	▲ 2 (67%)
53	Education	3	▲ 1 (33%)
54	intelligence	3	▼ -1 (-33%)
55	Taiwan	3	▼ -2 (-67%)
56	Remote Code Execution	3	▼ -1 (-33%)
57	GitHub	3	▼ -3 (-100%)
58	hijack	3	▲ 2 (67%)
59	threat	3	▲ 1 (33%)
60	Criminal	3	- 0 (0%)
61	group	3	▲ new
62	Canada	2	▲ 1 (50%)
63	SplatCloak	2	▲ new
64	VirusTotal	2	▲ 1 (50%)
65	ZeroDay	2	▲ 1 (50%)
66	ttps	2	▲ new
67	StarProxy	2	▲ new
68	United Kingdom	2	▲ 1 (50%)
69	Telegram	2	▼ -2 (-100%)
70	schtasks	2	▲ 1 (50%)
71	Distribution	2	▼ -1 (-50%)
72	Chinese	2	▲ new
73	Tick	2	▲ new
74	UNIX	2	▲ new
75	AsyncRAT	2	▲ new
76	Sliver	2	▲ new
77	Anonymous	2	▲ new
78	Malware download	2	▲ new
79	Ucraina	2	▲ 1 (50%)
80	BlackSuit	2	▲ new
81	Alux	2	▲ new
82	Earth	2	▲ new
83	securityaffairs	2	▲ new
84	full	2	▲ new
85	Chinalinked	2	▲ new
86	Dropper	2	▲ new
87	Russian	2	▲ new
88	Türkiye	2	▲ 1 (50%)
89	Black Basta	2	▲ 1 (50%)
90	India	2	- 0 (0%)
91	SectopRAT	2	▲ new
92	DarkWeb	2	- 0 (0%)
93	Up	1	▲ new
94	Mustan	1	▲ new
95	Zero Trust	1	▼ -1 (-100%)
96	RMS	1	▲ new
97	Google	1	▼ -2 (-200%)
98	Mandiant	1	- 0 (0%)
99	North Korea	1	▼ -1 (-100%)
100	South Korea	1	▼ -1 (-100%)

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
NetWireRC		7 (14.9%)
TONESHELL		7 (14.9%)
Ransomware		6 (12.8%)
GameoverP2P		6 (12.8%)
RATel		4 (8.5%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Tick		2 (33.3%)
Anonymous		2 (33.3%)
Equation Group		1 (16.7%)
Hacking Team		1 (16.7%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Campaign		15 (23.8%)
Backdoor		14 (22.2%)
Phishing		8 (12.7%)
hacking		6 (9.5%)
Exploit		4 (6.3%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
China		12 (13.2%)
United States		11 (12.1%)
Kaspersky		8 (8.8%)
Microsoft		8 (8.8%)
Russia		7 (7.7%)

Threat info

Last 5

SNS

(Total : 16)

Total keyword

Cobalt Strike MUSTANG PANDA Backdoor Malware FIN7 Windows Zscaler Campaign Cobalt TONESHELL Report hacking attack China Kaspersky Russia keylogger EDR Beacon Government APT Chinese IoC Intelligence APT41 iocs Ransomware BlackSuit IDATLoader RATel SectopRAT Operation DoTNet Dropper Spain Phishing Password Update target

No	Title	Date
1	Cyber_OSINT @Cyber_O51NT Mustang Panda has emerged with new TTPs, utilizing advanced tools like ToneShell and StarProxy to target government, military, and NGOs in Myanmar and East Asia, employing evasion techniques for espionage. #CyberSecurity #MustangPanda https://t.co/lnUfK40xXG	2025.04.27
2	Kimberly @StopMalvertisin Dark Reading \| Chinese APT Mustang Panda Debuts 4 New Attack Tools https://t.co/5k6cmxR5ag	2025.04.18
3	ANY.RUN @anyrun_app ???? Explore Threat Intelligence Reports from #ANYRUN. Discover detailed research on active cyber threats and APTs with actionable insights, #IOCs, & #TTPs. Enrich proactive security, report on #APT41 inside ???? https://t.co/ZkhxJ3hf17	2025.04.18
4	Kimberly @StopMalvertisin NVISO Labs \| Crisis Management – Beacon in the Storm https://t.co/38lUEOpj4p	2025.04.17
5	Virus Bulletin @virusbtn Zscaler researchers present the second part of a series on Mustang Panda tools. This time they analyse two new keyloggers, PAKLOG and CorKLOG, as well as an EDR evasion driver (SplatCloak). https://t.co/ni8tV0XVIH https://t.co/841bhFetTp	2025.04.17

News

(Total : 21)

Total keyword

Cobalt Strike Malware Attacker Campaign Victim Report c&c United States China Update IoC Windows Microsoft Backdoor target Phishing NetWireRC EDR Operation GameoverP2P Advertising Kaspersky powershell Government Ransomware Vulnerability Russia Cobalt MFA Social Engineering Cisco TONESHELL Android Exploit Email MUSTANG PANDA Linux Trojan Zscaler hacking Germany Taiwan Education APT41 Remote Code Execution attack Criminal RATel GitHub hijack Stealer VirusTotal Tick AsyncRAT Telegram United Kingdom Canada Sliver Anonymous keylogger UNIX Ucraina schtasks Distribution ZeroDay Türkiye FIN7 Black Basta DarkWeb India Password intelligence Zero Trust Dropper Equation Group RMS Google Mandiant The Shadow Brokers PlugX Maze APT15 Palo Alto Networks Cobra Carbon System Israel Italy France Australia North Korea Hacking Team ZXShell ...

No	Title	Date
1	Top Tier Target \| What It Takes to Defend a Cybersecurity Company from Today’s Adversaries - Malware.News	2025.04.28
2	Introducing ToyMaker, an Initial Access Broker working in cahoots with double extortion gangs - Malware.News	2025.04.23
3	ATT&CK v17: New Platform (ESXi), Collection Optimization, & More Countermeasures - Malware.News	2025.04.23
4	Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates - The Hacker News	2025.04.18
5	Unmasking the new XorDDoS controller and infrastructure - Malware.News	2025.04.17

Additional information

No	Title	Date
1	Top Tier Target \| What It Takes to Defend a Cybersecurity Company from Today’s Adversaries - Malware.News	2025.04.28
2	28th April – Threat Intelligence Report - Malware.News	2025.04.28
3	Navigating Through The Fog - Malware.News	2025.04.28
4	Huawei Set to Test Powerful AI Chip to Rival Nvidia’s, WSJ Says - Bloomberg Technology	2025.04.28
5	Gamers Beware! New Attack Targets Gamers to Deploy AgeoStealer Malware - Malware.News	2025.04.26
View only the last 5

No	Title	Date
1	Top Tier Target \| What It Takes to Defend a Cybersecurity Company from Today’s Adversaries - Malware.News	2025.04.28
2	Top Tier Target \| What It Takes to Defend a Cybersecurity Company from Today’s Adversaries - Malware.News	2025.04.28
3	Top Tier Target \| What It Takes to Defend a Cybersecurity Company from Today’s Adversaries - Malware.News	2025.04.28
4	Introducing ToyMaker, an Initial Access Broker working in cahoots with double extortion gangs - Malware.News	2025.04.23
5	Introducing ToyMaker, an Initial Access Broker working in cahoots with double extortion gangs - Malware.News	2025.04.23
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	toolspab1.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	74237f2f009020c7bfe80f274a049843	23951	2022.02.25
2	toolspab3.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	9efd29a1bfac21fbd3843dd95acc8582	23949	2022.02.25
3	toolspab2.exe Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32	f2336cbcb716869cea7e6d49f5749f1b	23947	2022.02.25
4	Updated_Payments_Statements.li... Darkside Ransomware Cobalt Strike Generic Malware Antivirus Malicious Library UPX AntiDebug AntiVM GIF Format PE File PE32 OS Processor Check	8bdf50e9270b6f6e3c461be75999305d	22459	2022.01.18
5	invoice.exe Darkside Ransomware Cobalt Strike Malicious Library UPX PE File PE32	9fca8332a98b2475b8c5243f70ce5058	22464	2022.01.18
View only the last 5

Level	Description
danger	Executed a process and injected code into it
warning	File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch	Allocates execute permission to another process indicative of possible code injection
watch	Detects Avast Antivirus through the presence of a library
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Foreign language identified in PE resource
notice	One or more potentially interesting buffers were extracted
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	This executable has a PDB path

No data

No	URL	CC	ASN Co	Reporter	Date
1	http://gh-hr.cn/beacon.exe Cobalt strike CobaltStrike exe	CN	...	DonPasci	2025.01.17
2	http://39.107.254.213/beacon.exe Cobalt strike CobaltStrike	CN	...	lontze7	2025.01.16
3	http://106.53.83.169/beacon.exe c2 Cobalt strike	CN	...	lontze7	2025.01.13
4	http://zzz.hnyzh.co/beacon_x86.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
5	http://zzz.hnyzh.co/beacon_x64.exe Cobalt strike CobaltStrike	US	PONYNET	lontze7	2025.01.10
View only the last 5

Beta Service, If you select keyword, you can check detailed information.