Rewterz Threat Alert – Muhstik Botnet – Active IOCs
December 20, 2021Rewterz Threat Advisory – CVE-2021-44145 – Apache NiFi Vulnerability
December 20, 2021Rewterz Threat Alert – Muhstik Botnet – Active IOCs
December 20, 2021Rewterz Threat Advisory – CVE-2021-44145 – Apache NiFi Vulnerability
December 20, 2021Severity
High
Analysis Summary
Kimsuky is a North Korean threat actor that has been active since 2012, primarily focuses on government entities in South Korea, and conducts espionage campaigns against targets in the U.S. and Japan. The Kimsuky group can set up phishing infrastructure to effectively mimic well-known websites and trick victims to enter their credentials. “This is one of the main methods used by this actor to collect email addresses that later will be used to send spear-phishing emails.” Earleir this year, a mobile malware researcher has shared information about a fake KISA vaccine or a security android app disguised as the KISA security program deployed by Kimsuky group. When the target downloads the APK implanted file from the email and installs the application on his device, the malicious code does its job. It executes in the background without the target’s knowledge and collects sensitive information from his device.
Impact
- Exposure of sensitive data
- Information theft and espionage
Indicators of Compromise
Domain Name
- portable[.]epizy[.]com
- ramble[.]myartsonline[.]com
Filename
- 185[.]176[.]43[.]98
- 185[.]27[.]134[.]213
- 185[.]176[.]43[.]98
MD5
- 386c29bb30ffd6aa0e9ae209425a240b
SHA-256
- 2ef30a004e68213faa8cfef567af2292ff03f8ea9f273ae1c9c2b7845ba6ea87
SHA-1
- 494c810f8044c21f3cc0113e9f8cdefda070e822
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Always be suspicious about emails sent by unknown senders.