Windows TCO: EDRKillShifter and East Asia
-
Cyble Inc ☛ North Korean Threat Cluster UAT-5394 Evolves MoonPeak Infra
This constant evolution suggests that the threat actors are actively developing and refining MoonPeak to evade detection. The threat actors have been observed deploying their implant variants several times on their test machines, demonstrating capability as well as the resources for adaptability.
-
Threat Source ☛ MoonPeak malware from North Korean actors unveils new details on attacker infrastructure
The UAT-5394 activity over the past two months shows the interconnections between the several servers used by this threat actor.
-
The Register UK ☛ RansomHub-linked EDR-killing malware spotted in the wild
Discovered by Sophos analysts after a failed attack and dubbed EDRKillShifter, the malware leverages legitimate but vulnerable drivers on Windows machines to deliver ransomware to targets.
-
The Record ☛ Hackers deployed new malware against university in Taiwan
To infect their victims, the malware operators likely exploited a recently patched PHP vulnerability tracked as CVE-2024-4577, according to researchers at the cybersecurity firm Symantec. The vulnerability primarily affects Windows installations using Chinese and Japanese languages.