30
45
30
45
30
30
30
30
30
30
30
30
30
30
45
30
30
“Tick” Group Continues Attacks
Unit 42 tracks the Tick espionage group attacking Korean and Japanese defense and high-tech targets with Daserf, Minzen, 9002, Invader, and custom Gh0st RAT variants.
The Tick group has conducted long-running espionage attacks against organizations in the Republic of Korea and Japan, focusing on defense and high-tech companies holding intellectual property, and repeatedly attacked one high-profile Japanese target for three years. Unit 42 links the Daserf backdoor, the 9002 RAT, and the Invader backdoor through shared C2 infrastructure used between July 2012 and April 2013. Minzen samples install a "NamelessHdoor" backdoor derived from publicly available code over a decade old, modified with ReflectiveDLLLoader DLL injection, and the group also uses custom Gh0st RAT variants. Tick has shifted from privacy-protected domain registration to compromised websites for C2 infrastructure.
50
Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.
52
30
30
30
30
30
30
30
30
30
30
45
30
30
30
45
30