#APT 6b7f9f62e7ac4d190edd42fcc7693f3adacc6158837294cccaf68498fdb3cd8d Coinone_20240504.xlsx.lnk Schtasks name: GoogleUpdateTaskMachineCoreUN[124692-58261-60629-77777] hxxp://nodesferghiwuchpaq[.]icu/dn[.]php?name=[System.Environment]::MachineName + '&prefix=tt'

#APT d0544a045aae0e316380b57a7319ec54f7f0979a7882f33a15839311c7e29888 2025년 에너지기술개발사업 최종평가위원회 위원 위촉 안내.pdf.lnk Schtasks name: JwGhKmI hxxps://meditationsecretsforwomen[.]com/wp-admin/js/widgets/hurryup/?rv=bear&za=battle0 {Same URL}?rv=bear&za=battle1

#APT [국세청] 오류발견 수정신고 제출 요청 안내 Other files distributed from the same server. Maybe Test Files. 가상자산 설명서 양식.zip (eng. Virtual Asset Documentation Form.zip)

#APT #Konni 5a8ecafbd5809000334bf5b940a497d0ed750dd11da8a03796f5ce53257cc892 가상자산사업자+검사계획민당정회의+발표자료_FN2.hwp.lnk hxxps://teamfuels.com/modules/inc/get[.]php hxxp://forum.flasholr-app.com/wp-admin/src/upload[.]php

#APT #DPRK cc31bd52386d956ed8cdcadda2ad16a21d0a9a177722465b94c8960092139e08 소명자료 목록(국세징수법 시행규칙).hwp.lnk hxxp://forum.flasholr-app[.]com/wp-admin/src/list.php, upload.php Same C2 & Obfuscation Pattern: x.com/JangPr0/status…

#APT #DPRK 4a6c23e76524364fe9b9f5ecd46dc73e7714cac93849a380f0d1b746fae3650d Decoy: 가상자산사업자 자금세탁방지 감독 방향 hxxp://kerkenraad.com/src/list[.]php, upload.php Same Decoy: x.com/JangPr0/status…

#APT #DPRK 824ed3d713a5eb6814f537ac2eba88488a0050b2ff85fc6c65563b88fab81417.lnk Decoy: 이도훈 확인 문서.hwp Similar Case1: x.com/JangPr0/status… Similar Case2: 4ed61dac39786c11ec4aea0cf29a5f65e60232170ed0ce0df63d5ea6991ca7f8 Picture 4 is Small Connection by VirusTotal

#APT #DPRK a87c663dea792121b6a17b8e605159116e30434f2c67b8be0b198ba8229d2a3d Decoy: 가상자산 사업자 자금세탁방지 감독 방향.hwp hxxps://yellowstone-marketing[.]com/wp-includes/js/inc/get.php hxxps://yellowstone-marketing[.]com/wp-includes/js/src/upload.php

#APT #SUSP 6262c5ef438992966eda78d6d58e631592c4b78d09b6dd35fea3b6cdd46ac8d9 decoy: KBS 북한 수해 인터뷰 요청서(대문화아카데미 이삼열 이사장님).docx hxxps://dl.dropboxusercontent[.]com/scl/fi/aikx6kop803lfv9uh81lt/test.docx?... and apple-ky.txt and apple-luc.txt

#APT #DPRK 411a04fdabc516379aea96a6ac2282eac48c552f042bb55b5cb7b8720131703f Decoy: 미신고 자금출처 해명자료 제출 안내(부가가치세법 시행규칙).hwp.lnk hxxps://voicevosi[.]com/plugins/content/loadmodule/src/js/upload.php and /list.php and /get.php?ra=iew&zw=lk0100

#APT #DPRK b2a57a669de93671eb658648530a6367 Decoy: 종합소득세 과세표준확정신고 및 납부계산서(소득세법 시행규칙) .hwp.lnk hxxps://deliberatecollaboration[.]com/wp-includes/js/inc/get.php?ra=iew&zw=lk0100 & upload.php & list.php Reg Run Name: startsvc1 xor Key : 0x71, 0x70

#APT #DPRK d48032d835c95af816fbcea6e659cdbe Decoy: NTS_eTaxInvoice.html.lnk https://deliberatecollaboration[.]com/wp-includes/js/src/get.php & upload.php & list.php similar x.com/JangPr0/status…

#APT #DPRK f9f3b762ed1719bf141c38f8c4f21d76cd65c5ac6c62a4b94ce68569ce87178c Decoy: 가상자산 관련 외부평가위원 위촉 안내.hwp.lnk hxxps://www.seacura[.]com/wp-includes/js/src/list.php & upload.php & get.php

#APT #DPRK 024f33b3051bc97c404020a61d22daf6567498b42cb4b7a5fc9d69466929be2b Decoy Content name (hwp): 자금출처명세서 hxxps://www.rayanlynch[.]com/wp-includes/js/common/src/upload.php

#APT #DPRK f536eee0a63f4e324de3983975a42f24 (This File is not malware. Just decoy.) Decoy: 공문_가상자산사업자 CEO 간담회 개최 안내.zip

#APT #SUSP 95fc3891ce910f34080d4781bc7641be323ba6b761ec48ef50ab2f0b74f5a5b7 174.138.186[.]157:5511 & 7788 & 9558 rr7.tmp: hxxp://www.travelyoichi[.]jp/okinawa/showphoto[.]php REG Run name: PUpdate(H3628.js), runkey(rr7.tmp) Taskschd: AMicrosoftEdgeUpdateExpanding[93852691]

#APT #DPRK eabb3b271c7f0df17b62a10461840351 Decoy: 개인정보보호 의무사항 실태점검서.hwp.lnk hxxps://24hrkpop[.]com/wp-includes/js/src/lib/list.php get.php upload.php Reg Run name: startsvc1

#APT #SUSP def6766521070a6d45b797c8c834ed88 Decoy: 국세 고지서.pdf.lnk URL = hxxps://cdn.glitch[.]global/b33b49c5-5e3d-4a33-b66b-c719b917fa62/txbib.hta Second files: {URL}/v3.hta?v=277522 hxxp://18.224.110[.]228:8080/stub.exe?v=2.0.3.txt&serial=SUCCESS!