Cyber Threat Trends

Summary: 2025/04/29 00:33

First reported date: 2011/08/10
Inquiry period : 2025/03/30 00:33 ~ 2025/04/29 00:33 (1 months), 32 search results

전 기간대비 19% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 DNS Malware Exploit attack Report 입니다.
악성코드 유형 Cryptocurrency Miner CoreDN 도 새롭게 확인됩니다.
공격기술 Smishing 도 새롭게 확인됩니다.
기관 및 기업 NSA FBI Australia VirusTotal Canada China xabyss United Kingdom 도 새롭게 확인됩니다.
기타 Flux Fast Red Team 플럭스 Chrome 등 신규 키워드도 확인됩니다.

* 최근 뉴스기사 Top3:
    ㆍ 2025/04/23 CVE-2025-32955: Security mechanism bypass in Harden-Runner Github Action
    ㆍ 2025/04/22 All Gmail users at risk from clever replay attack
    ㆍ 2025/04/22 Securing our future: April 2025 progress report on Microsoft’s Secure Future Initiative

Date range button:

First seen:

Last seen:

Keyword

Trend graph by period

Related keyword cloud

Top 100

#	Trend	Count	Comparison
1	DNS	32	▲ 6 (19%)
2	Malware	20	▲ 2 (10%)
3	Exploit	13	▲ 5 (38%)
4	attack	13	▲ 4 (31%)
5	Report	12	▲ 3 (25%)
6	Phishing	12	▲ 6 (50%)
7	United States	11	▲ 2 (18%)
8	Update	11	▲ 3 (27%)
9	c&c	8	▲ 7 (88%)
10	RCE	8	▲ 7 (88%)
11	target	8	- 0 (0%)
12	Vulnerability	8	▲ 3 (38%)
13	Software	7	▲ 4 (57%)
14	intelligence	7	▲ 1 (14%)
15	CISA	7	▲ 6 (86%)
16	GitHub	6	▲ 2 (33%)
17	Flux	6	▲ new
18	Advertising	6	▼ -1 (-17%)
19	Fast	6	▲ new
20	Windows	6	▲ 1 (17%)
21	Remote Code Execution	5	▼ -7 (-140%)
22	Microsoft	5	▼ -1 (-20%)
23	LinkedIn	4	▲ 2 (50%)
24	Campaign	4	▼ -2 (-50%)
25	NSA	4	▲ new
26	Operation	4	▼ -1 (-25%)
27	Email	4	- 0 (0%)
28	Google	4	▲ 2 (50%)
29	hacking	3	▲ 1 (33%)
30	Victim	3	▼ -4 (-133%)
31	Ubuntu	3	▲ 1 (33%)
32	DYEPACK	3	▲ 2 (67%)
33	FBI	3	▲ new
34	Ransomware	3	▲ 1 (33%)
35	Education	3	- 0 (0%)
36	Linux	3	▼ -3 (-100%)
37	Distribution	3	- 0 (0%)
38	Australia	3	▲ new
39	Zero Trust	3	▲ 1 (33%)
40	Telegram	3	- 0 (0%)
41	Red Team	3	▲ new
42	플럭스	2	▲ new
43	Chrome	2	▲ new
44	ChatGPT	2	▲ new
45	Kubernetes	2	- 0 (0%)
46	Data Center	2	▲ 1 (50%)
47	Criminal	2	▼ -1 (-50%)
48	C2	2	▲ new
49	VirusTotal	2	▲ new
50	Canada	2	▲ new
51	Secure	2	▲ new
52	CVSS	2	▼ -1 (-50%)
53	IoC	2	▼ -1 (-50%)
54	Infoblox	2	▲ 1 (50%)
55	Public	2	▲ new
56	Twitter	2	▼ -1 (-50%)
57	securityaffairs	2	▲ new
58	WMI	2	▲ new
59	YouTube	2	- 0 (0%)
60	Meerkat	2	▲ 1 (50%)
61	Morphing	2	- 0 (0%)
62	IngressNightmare	2	▲ new
63	Password	2	▲ 1 (50%)
64	Supply chain	2	▲ new
65	Docker	2	- 0 (0%)
66	Red Hat	2	▲ 1 (50%)
67	IPv	2	▲ new
68	Firmware	2	▲ new
69	GameoverP2P	2	- 0 (0%)
70	MX	2	▲ 1 (50%)
71	Cloudflare	2	▼ -1 (-50%)
72	Backdoor	2	▲ 1 (50%)
73	subdomain	2	▲ new
74	MFA	2	▲ 1 (50%)
75	Hackers	1	▲ new
76	China	1	▲ new
77	Smishing	1	▲ new
78	Allows	1	▲ new
79	threat	1	- 0 (0%)
80	Wang	1	▲ new
81	payment	1	▲ new
82	Cryptocurrency Miner	1	▲ new
83	road	1	▲ new
84	Cisco	1	▼ -1 (-100%)
85	xabyss	1	▲ new
86	Forensics	1	▲ new
87	CoreDN	1	▲ new
88	toll	1	▲ new
89	Duo	1	▲ new
90	United Kingdom	1	▲ new
91	Anonymous	1	- 0 (0%)
92	ta	1	▲ new
93	blog	1	▲ new
94	plenoryvantyxeu	1	▲ new
95	biamiraqorg	1	▲ new
96	Forward	1	▲ new
97	CVE	1	▼ -2 (-200%)
98	HardenRunner	1	▲ new
99	user	1	▲ new
100	Nick	1	▲ new

Special keyword group

Top 5

Malware Type

This is the type of malware that is becoming an issue.

Keyword	Average	Label
DYEPACK		3 (27.3%)
Ransomware		3 (27.3%)
GameoverP2P		2 (18.2%)
Cryptocurrency Miner		1 (9.1%)
CoreDN		1 (9.1%)

Attacker & Actors

The status of the attacker or attack group being issued.

Keyword	Average	Label
Anonymous		1 (100%)

Technique

This is an attack technique that is becoming an issue.

Keyword	Average	Label
Exploit		13 (25.5%)
Phishing		12 (23.5%)
RCE		8 (15.7%)
Remote Code Execution		5 (9.8%)
Campaign		4 (7.8%)

Country & Company

This is a country or company that is an issue.

Keyword	Average	Label
United States		11 (22.9%)
CISA		7 (14.6%)
Microsoft		5 (10.4%)
NSA		4 (8.3%)
Google		4 (8.3%)

Threat info

Last 5

SNS

(Total : 12)

Total keyword

DNS CISA Phishing Exploit hacking Discord Telegram C2 c&c NSA Report Victim FBI Ransomware Kubernetes

No	Title	Date
1	blackorbird @blackorbird APT34 C2 : Forward DNS include biam-iraq.org ⬇️ plenoryvantyx.eu ⬇️ banner_hash="-3604737501683454749" https://t.co/MT1TAreTny https://t.co/V6noaJZLde https://t.co/IN9DMdunra	2025.04.24
2	Mandiant (part of Google Cloud) @Mandiant Detecting IngressNightmare just got easier! ???? Our new blog shares a non-intrusive technique using DNS directive injection to identify vulnerable Kubernetes Ingress Nginx Controllers. No agents, no disruption, just accurate results. ???? https://t.co/wAaj94Q5xY https://t.co/JZOjBvtaMa	2025.04.24
3	Unit 42 @Unit42_Intel Multiple domains leveraging #DNS #tunneling have been probing the Internet for public IPv4/IPv6 resolvers. Lacking TXT/PTR records, the associated DNS traffic is highly suspicious. These #scans began in Jan 2025 and peaked earlier this week. More info at https://t.co/Zve4RHnSt9 https://t.co/L2LKHJ0D	2025.04.17
4	Dark Web Informer - Cyber Threat Intelligence @DarkWebInformer With a little bit of python, I'm running a threat_actor lookup command with my own data on Discord and sending it back to Telegram all in 2 seconds. /dns_lookup -> DNS details /ip -> IP details /threat_actor -> Provides the last 3 claims (screenshots) /whois -> Whois details https://t.c	2025.04.17
5	Dark Web Informer - Cyber Threat Intelligence @DarkWebInformer ????Public DNS Comparison https://t.co/H1rFYhAszT	2025.04.10

News

(Total : 20)

Total keyword

DNS Malware attack Attacker United States Report Update Exploit Phishing Vulnerability RCE target intelligence c&c Software Advertising Windows GitHub Remote Code Execution Microsoft CISA Operation Campaign Google Email LinkedIn Zero Trust Red Team Education Australia DYEPACK NSA Ubuntu Linux Distribution CVSS FBI Canada MFA Criminal Telegram IoC WMI Data Center Victim YouTube VirusTotal Chrome Ransomware ChatGPT Cloudflare Backdoor GameoverP2P Firmware Password Twitter Red Hat Docker Supply chain Cisco Smishing China xabyss IcedID payment hijack United Kingdom Facebook Gmail XSS Government Kubernetes Hijacking Anonymous CoreDN Forensics Cryptocurrency Miner ...

No	Title	Date
1	CVE-2025-32955: Security mechanism bypass in Harden-Runner Github Action - Malware.News	2025.04.23
2	All Gmail users at risk from clever replay attack - Malware.News	2025.04.22
3	Securing our future: April 2025 progress report on Microsoft’s Secure Future Initiative - Malware.News	2025.04.22
4	Microsoft’s Secure by Design journey: One year of success - Malware.News	2025.04.18
5	Kubernetes Threat Hunting using API Server Audit Logs - Malware.News	2025.04.15

Additional information

No	Title	Date
1	Employee monitoring app exposes users, leaks 21+ million screenshots - Malware.News	2025.04.28
2	Introducing XSIAM 3.0 - Malware.News	2025.04.28
3	Deploy Bravely with Prisma AIRS - Malware.News	2025.04.28
4	2025 Cyber Resilience Research Discovers Speed of AI Advancing Emerging Attack Types - Malware.News	2025.04.28
5	Intel CEO Targets Change in Corporate Culture to Shape Up - Bloomberg Technology	2025.04.28
View only the last 5

No	Title	Date
1	All Gmail users at risk from clever replay attack - Malware.News	2025.04.22
2	Securing our future: April 2025 progress report on Microsoft’s Secure Future Initiative - Malware.News	2025.04.22
3	Securing our future: April 2025 progress report on Microsoft’s Secure Future Initiative - Malware.News	2025.04.22
4	Microsoft’s Secure by Design journey: One year of success - Malware.News	2025.04.18
5	Microsoft’s Secure by Design journey: One year of success - Malware.News	2025.04.18
View only the last 5

No	Request	Hash(md5)	Report No	Date
1	random.exe Gen1 Themida Generic Malware PhysicalDrive Downloader UPX Malicious Packer Malicious Library Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P	bfd4ad6d57c086d2e64ccd39398a908e	60244	2025.04.28
2	inv.bat Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM	503ef2150bd7a60b399fe4b9723cd967	59864	2025.04.23
3	inv.bat Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM	78c51b8bd0e0671fe91e9f56154cef4a	59866	2025.04.23
4	sch.bat Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM	fcbebab50efe0c09cafacca4f008e31d	59865	2025.04.23
5	Check.bat Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM	aafec75f6933aa0f9c26ac43155f6818	59855	2025.04.22
View only the last 5

Level	Description
danger	File has been identified by 33 AntiVirus engines on VirusTotal as malicious
watch	Attempts to stop active services
watch	Creates known SpyNet files
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a suspicious process
notice	Creates executable files on the filesystem
notice	Drops a binary and executes it
notice	Drops an executable to the user AppData folder
notice	Executes one or more WMI queries
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Uses Windows utilities for basic Windows functionality
notice	Yara rule detected in process memory
info	Checks amount of memory in system
info	Command line console output was observed
info	One or more processes crashed
info	Queries for the computername
info	The executable contains unknown PE section names indicative of a packer (could be a false positive)

No data

Beta Service, If you select keyword, you can check detailed information.