Summary: 2025/04/29 04:18

First reported date: 2018/04/19
Inquiry period : 2025/03/30 04:18 ~ 2025/04/29 04:18 (1 months), 10 search results

전 기간대비 70% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는
Xloader Malware Email Advertising 입니다.
악성코드 유형 Remcos RAT NetWireRC Lumma GameoverP2P Emotet Raccoon Nanocore RecordBreaker DYEPACK RedLine 도 새롭게 확인됩니다.
공격기술 Campaign Phishing Stealer 도 새롭게 확인됩니다.
기관 및 기업 Palo Alto Networks Microsoft 도 새롭게 확인됩니다.
기타 attack multistage powershell Tesla Agent 등 신규 키워드도 확인됩니다.

Xloader is a Rebranding of Formbook malware (mainly a stealer), available for macOS as well.

Formbook has a "magic"-value FBNG (FormBook-NG), while Xloader has a "magic"-value XLNG (XLoader-NG). This "magic"-value XLNG is platform-independent.

Not to be confused with apk.xloader or ios.xloader.  Ref.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/18 Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader
    ㆍ 2025/04/18 Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis
    ㆍ 2025/04/17 Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis


참고로 동일한 그룹의 악성코드 타입은 SmokeLoader GuLoader Zloader 등 47개 종이 확인됩니다.

Trend graph by period


Related keyword cloud
Top 100

# Trend Count Comparison
1Xloader 10 ▲ 7 (70%)
2Remcos 9 ▲ new
3Campaign 7 ▲ new
4Malware 7 ▲ 5 (71%)
5Phishing 6 ▲ new
6RAT 5 ▲ new
7attack 5 ▲ new
8NetWireRC 5 ▲ new
9multistage 4 ▲ new
10powershell 3 ▲ new
11Tesla 2 ▲ new
12Agent 2 ▲ new
13Palo Alto Networks 2 ▲ new
14Email 2 ▲ 1 (50%)
15recent 2 ▲ new
16Advertising 2 ▲ 1 (50%)
17IoC 2 ▲ new
18Report 2 ▲ new
19Shadows 2 ▲ new
20Avoid 1 ▲ new
21Chain 1 ▲ new
22Palo 1 ▲ new
23Approach 1 ▲ new
24FormBook 1 ▼ -1 (-100%)
25Altos 1 ▲ new
26Saqib 1 ▲ new
27Khanzada 1 ▲ new
28past 1 ▲ new
29simple 1 ▲ new
30complex 1 ▲ new
31target 1 ▲ new
32Russia 1 - 0 (0%)
33Kaspersky 1 - 0 (0%)
34Cascading 1 ▲ new
35Threat 1 ▼ -1 (-100%)
36Leverage 1 ▲ new
37utilizes 1 ▲ new
38detection 1 ▲ new
39Lumma 1 ▲ new
40analysis 1 ▲ new
41GameoverP2P 1 ▲ new
42Emotet 1 ▲ new
43Malware download 1 ▲ new
44Raccoon 1 ▲ new
45Nanocore 1 ▲ new
46Cobalt Strike 1 ▲ new
47Android 1 - 0 (0%)
48United States 1 - 0 (0%)
49c&c 1 ▲ new
50RecordBreaker 1 ▲ new
51Microsoft 1 ▲ new
52DYEPACK 1 ▲ new
53GitHub 1 ▲ new
54Stealer 1 ▲ new
55Linux 1 ▲ new
56Windows 1 ▲ new
57Education 1 ▲ new
58NodeDownloader 1 ▲ new
59LummaC 1 ▲ new
60nodeexe 1 ▲ new
61download 1 ▲ new
62githubcomJohsHuxhelloworldreleasesdownloadvRBXLoaderexe 1 ▲ new
63RedLine 1 ▲ new
64delivery 1 ▲ new
Special keyword group
Top 5

Malware Type
Malware Type

This is the type of malware that is becoming an issue.


Keyword Average Label
Xloader
10 (26.3%)
Remcos
9 (23.7%)
RAT
5 (13.2%)
NetWireRC
5 (13.2%)
FormBook
1 (2.6%)
Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.


Keyword Average Label
Attack technique
Technique

This is an attack technique that is becoming an issue.


Keyword Average Label
Campaign
7 (50%)
Phishing
6 (42.9%)
Stealer
1 (7.1%)
Country & Company
Country & Company

This is a country or company that is an issue.


Keyword Average Label
Palo Alto Networks
2 (33.3%)
Russia
1 (16.7%)
Kaspersky
1 (16.7%)
United States
1 (16.7%)
Microsoft
1 (16.7%)
Malware Family
Top 5

A malware family is a group of applications with similar attack techniques.
In this trend, it is classified into Ransomware, Stealer, RAT or Backdoor, Loader, Botnet, Cryptocurrency Miner.

Threat info
Last 5

SNS

(Total : 6)
  Total keyword

Xloader Remcos Malware Campaign Phishing RAT Email NetWireRC attack Attacker Advertising target Russia Kaspersky powershell Report GitHub Lumma IoC Palo Alto Networks

No Title Date
1Cyber_OSINT @Cyber_O51NT
A recent multi-stage malware attack utilizes .JSE and PowerShell to deliver Agent Tesla, Remcos RAT, and XLoader, as noted by Palo Alto Networks' Saqib Khanzada, who highlights attackers' tactics to evade detection and ensure payload execution. https://t.co/i7vn5wZL9L
2025.04.18
2The Hacker News @TheHackersNews
???? Attackers are now using multi-stage payloads that slip past detection—via simple tricks, not complex code. One phishing email = 3 malware strains: • Agent Tesla • Remcos RAT • XLoader ???? Plus: a new MysterySnail variant is targeting Mongolia & Russia—40+ commands, remote https://t.co/NA
2025.04.18
3Cyber_OSINT @Cyber_O51NT
A recent report reveals that Agent Tesla, Remcos RAT, and XLoader are being delivered through a complex phishing campaign, using multi-stage delivery to complicate analysis and evade detection. #CyberSecurity #Phishing https://t.co/D1lXUtRgyg
2025.04.17
4Virus Bulletin @virusbtn
Palo Alto's Saqib Khanzada looks into a multi-layered campaign that delivers malware like Agent Tesla variants, Remcos RAT or XLoader. This multi-layered attack chain leverages multiple execution paths to evade detection and complicate analysis. https://t.co/CsbOhKy9w5 https://t.co/BbMf6FnK1D
2025.04.17
5Unit 42 @Unit42_Intel
Our analysis of a phishing campaign examines multistage malware. The malware is delivered via fake order release emails, leading to installation of Agent Tesla variants, Remcos RAT or XLoader. https://t.co/lFQ4XkP61r https://t.co/2x63aoCmxc
2025.04.17

Additional information

No data
No data
No data
No URL CC ASN Co Reporter Date
1http://dndmelectrical.co.za/tt/tt.exe
Formbook xloader
ZA ZAGridhostJames_inthe_box2025.04.10
2http://combo.s3.eu-north-1.amazonaws.com/lisontek2.1.exe
xloader
US USJames_inthe_box2025.03.11
3https://www2.0zz0.com/2025/02/19/16/117645293.png
xloader
US USCLOUDFLARENETJames_inthe_box2025.02.24
4https://www2.0zz0.com/2025/02/17/16/513083181.png
xloader
US USCLOUDFLARENETJames_inthe_box2025.02.18
5https://www2.0zz0.com/2025/02/12/20/925844558.png
xloader
US USCLOUDFLARENETJames_inthe_box2025.02.17
View only the last 5
Beta Service, If you select keyword, you can check detailed information.