This article provides a comprehensive analysis of two new variants of the KimJongRAT stealer.
Palo Alto Unit 42 combine new research findings with existing knowledge to provide a comprehensive resource for understanding and combating these new KimJongRAT variants. The KimJongRAT stealer was first described in 2013 by the Malware.lu CERT. Palo Alto researchers documented another variant of this family in 2019. One of the new variants uses a Portable Executable (PE) file and the other uses a PowerShell implementation. The PE and PowerShell variants are both initiated by clicking a Windows shortcut (LNK) file that downloads a dropper file from an attacker-controlled content delivery network (CDN) account.
Read more…
Source: Palo Alto Unit 42
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Critical Vulnerability in Fortra FileCatalyst Workflow
June 27, 2024
Fortra has released a security update addressing a critical vulnerability found in FileCatalyst Workflow. FileCatalyst is an accelerated file transfer software solution that allows the transfer of large files over remote networks. CVE-2024-5276 is an SQL Injection vulnerability with a CVSSv3 score of 9.8 (critical), which if exploited could allow an unauthenticated attacker to modify or ...
- Michigan County Restores 80 Percent of Systems After Cyber Attack
June 27, 2024
The computer-aided dispatch system for Grand Traverse County’s 911 service is officially back online following a cyberattack that disabled the system and many other governmental services. “As of 2 p.m. yesterday, it was operational for all first responders,” said County Administrator Nate Alger at Wednesday’s county board meeting. “I know Cherry Festival is just three days ...
- Cyber attack ‘nothing to do with dispute’, says British Medical Association
June 27, 2024
The British Medical Association (BMA) has defended doctors striking at hospitals running at reduced capacity due to a significant cyber attack. While some junior doctors have been granted permission to return to work due to safety concerns, a number have continued with their industrial action at trusts in London hit by the attack. A senior BMA ...
- Federal Reserve “breached” data may actually belong to Evolve Bank
June 26, 2024
A shockwave went through the financial world when ransomware group LockBit claimed to have breached the US Federal Reserve, the central banking system of the United States. On LockBit’s dark web leak site, the group threatened to release over 30 TB of banking information containing Americans’ banking data if a ransom wasn’t paid by June 25. ...
- Ransomware disrupts South Africa’s national health lab
June 26, 2024
South Africa’s response to an ongoing Mpox outbreak is being stymied by a ransomware attack against its National Health Laboratory Service, which resulted in the deletion of backup servers and other parts of its system, hindering lab result dissemination since Saturday. While no patient information was noted to be impacted by the compromise, such an attack ...
- New SnailLoad side-channel attack detailed
June 25, 2024
SecurityWeek reports that website and content inferencing could be remotely conducted by threat actors without direct network traffic access via the new SnailLoad side-channel attack technique. Several latency measurements for websites and YouTube videos viewed by targets are being conducted by threat actors to establish digital fingerprints before luring targets to download files from a malicious ...