“Tick” Group Continues Attacks
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 tracks the Tick espionage group attacking Korean and Japanese defense and high-tech targets with Daserf, Minzen, 9002, Invader, and custom Gh0st RAT variants.
The Tick group has conducted long-running espionage attacks against organizations in the Republic of Korea and Japan, focusing on defense and high-tech companies holding intellectual property, and repeatedly attacked one high-profile Japanese target for three years. Unit 42 links the Daserf backdoor, the 9002 RAT, and the Invader backdoor through shared C2 infrastructure used between July 2012 and April 2013. Minzen samples install a "NamelessHdoor" backdoor derived from publicly available code over a decade old, modified with ReflectiveDLLLoader DLL injection, and the group also uses custom Gh0st RAT variants. Tick has shifted from privacy-protected domain registration to compromised websites for C2 infrastructure.
Key facts
- Tick repeatedly attacks a high-profile Japanese target with multiple malware families over three years.
- Daserf, 9002, and Invader linked through shared C2 servers used 2012-2013.
- Minzen installs NamelessHdoor backdoor built from decade-old public code with DLL injection.
- Group moved from privacy-protected domains to compromised Japanese and Korean websites for C2.
- Custom Gh0st RAT variant uses 'lowmain' export DLLs on softfix.co.kr infrastructure.
- Vendors
- Palo Alto Networks
- Threat actors
- Tick
- Countries
- South KoreaJapan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bbs.softfix.co | b181757b3309995acd1f92e0f63f888aa89423). Another subdomain, bbs.softfix.co[.]kr was hosted on same IP address as bbs.gokickes[.]com, w |
| domain | blog.softfix.co | g: Executable files that connect to the same remote server, blog.softfix.co[.]kr:80, download a DLL file and execute the 'lowmain' expo |
| domain | gmarketshop.net | 50df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 C2 lywjrea.gmarketshop[.]net krjregh.sacreeflame[.]com psfir.sacreeflame[.]com lywja.h |
| domain | gokickes.com | n, bbs.softfix.co[.]kr was hosted on same IP address as bbs.gokickes[.]com, which was reported as the C2 server of Invader by Cyphor |
| domain | healthsvsolu.com | services in 2008 and 2011. krjregh.sacreeflame[.]com lywja.healthsvsolu[.]com Though we don't know the targets of these malware samples |
| domain | jpn.com | oftfix.co[.]kr www.gokickes[.]com log.gokickes[.]com sansei.jpn[.]com |
| domain | news.softfix.co | softfix.co[.]kr was registered in 2014. One of subdomains, news.softfix.co[.]kr was the C2 server of Daserf (SHA256: 9c7a34390e92d4551 |
| domain | sacreeflame.com | h the privacy protection services in 2008 and 2011. krjregh.sacreeflame[.]com lywja.healthsvsolu[.]com Though we don't know the targets |
| domain | softfix.co | RAT has been used by multiple actors for years. The domain, softfix.co[.]kr was registered in 2014. One of subdomains, news.softfi |
| sha256 | 01d681c51ad0c7c3d4b320973c61c28a353624ac665fd390553b364d17911f46 | substitution cipher is used in a variant of Daserf (SHA256: 01d681c51ad0c7c3d4b320973c61c28a353624ac665fd390553b364d17911f46). We also found a very similar table in other Tick tools. S |
| sha256 | 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a | he discussed threats. Indicator of compromise SHA256 Daserf 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cb |
| sha256 | 055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 | 0540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe 055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 Minzen 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe79 |
| sha256 | 0df20ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 | 4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 Invader 0df20ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7c |
| sha256 | 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd | e4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa |
| sha256 | 26727d139b593486237b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 | tified for their associated malware samples: Minzen (SHA256:26727d139b593486237b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82): 1 2 plain text = "5j2Cnx`^@$*(]{}|+mX k3DK'LGc!hHNPgZ |
| sha256 | 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe | 6b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe 055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2c |
| sha256 | 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb | kickes[.]com was the C2 of another Invader variant (SHA256: 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb). In addition to the infrastructure, the attacker also shar |
| sha256 | 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 | 93401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 Minzen 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196 |
| sha256 | 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849 | aw./BJlk,yUPjgI`^@$*tumYA'p2RoX=v_:M43" Datper (SHA256: 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849): 1 2 plain text = "KhL9V1ds5Z" QnfNC & Fb8xGr - ( ) &l |
| sha256 | 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 | 3cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 Datper 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac |
| sha256 | 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e | 6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb 9002 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c |
| sha256 | 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 | ration data in its body. One of the Minzen samples (SHA256: 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2) found in the Republic of Korea in December 2016 installs s |
| sha256 | 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 | , news.softfix.co[.]kr was the C2 server of Daserf (SHA256: 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423). Another subdomain, bbs.softfix.co[.]kr was hosted on same |
| sha256 | a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 | e0a1bf423ab7e54b9df361360933bac3bb852a31849 HomamDownloader a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 C2 lywjrea.gmarketshop[.]net krjregh.sacreeflame[.]com psfi |
| sha256 | ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 | 2e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af0 |
| sha256 | dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f | b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 NamelessHdoor dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda04 |
| sha256 | e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c | 7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582 |
| sha256 | e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 | a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd |
| sha256 | e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e | ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928 |
| sha256 | f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 | fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a499135 |
From the original article
8 min read at unit42.paloaltonetworks.com
The “Tick” group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years. The group focuses on companies that have intellectual property or sensitive information like those in the Defense and High-Tech industries.
By Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.