Author: Knownsec 404 Team Chinese version: https://paper.seebug.org/3062/ 一．Abstract There are numerous VPN nodes in the cyberspace, and what kind of organizations or individuals are behind these VPN nodes? What do they do with VPN nodes? This article applies the concepts of “behavioral mapping” and “cross-mapping” in practice, taking SoftEther VPN nodes…

Author: Knownsec 404 Team Chinese version: https://paper.seebug.org/3026/ 1. Abstract In May 2023, the ZoomEye team [1] released ZoomEyeGPT, a Chrome browser extension based on GPT that aims to provide AI-assisted search experience for ZoomEye users. ZoomEyeGPT applies GPT on the input side of ZoomEye search. Meanwhile, this article applies GPT on the…

Author: Nan&XWS@Knownsec 404 Advanced Threat Intelligence team Chinese version: https://paper.seebug.org/3032/ 1. Attack Activity Overview In a recent research report from the Knownsec 404 Advanced Threat Intelligence team, titled “Analysis of the recent offensive operations conducted by North Korean APT groups”, APT37 & Konni groups’ recent attacks on South Korea were discussed. The tactics, techniques…

Author: Nan&XWS@Knownsec 404 Advanced Threat Intelligence team Chinese version: https://paper.seebug.org/3030/ 1.Overview of APT Attacks by North Korean Organization In August 2023, the Knownsec 404 Advanced Threat Intelligence team observed a significant increase in APT attacks by a North Korean organization targeting South Korea. …

Author: Knownsec 404 Team Chinese version: https://paper.seebug.org/3024/ 1. Abstract After obtaining the mapping data in cyberspace, to analyze the data and interpret the data, and let the data speak, which is the “soul of the data” often said by the ZoomEye team, and is also the real value of the mapping in…

Author: Knownsec 404 Team Chinese version: https://paper.seebug.org/3015/ 1. Abstract After obtaining the mapping data in cyberspace, to analyze the data and interpret the data, and let the data speak, which is the “soul of the data” often said by the ZoomEye team, and is also the real value of the mapping in…

Author: K&XWS@Knownsec 404 Advanced Threat Intelligence team Chinese version: https://paper.seebug.org/3011/ 1. Summarize APT37 is suspected to be a state-sponsored attack organization in the peninsula region, also known as ScarCruft, Reaper, RedEye, and Ricochet Chollima. The group has been active since 2012,the primarily targets public organizations and private enterprises in South Korea. …

Author: Knownsec 404 Advanced Threat Intelligence team Chinese version:https://paper.seebug.org/3000/ In March 2023, we learned that the Knownsec 404 Advanced Threat Intelligence team was the first in the world to capture a new APT weapon backdoor, which we called “ORPCBackdoor”, and released a detailed analysis of the weapon backdoor in May…

Author: Knownsec 404 Team Chinese version:https://paper.seebug.org/2093/ 1. Abstract After obtaining the mapping data in cyberspace, to analyze the data and interpret the data, and let the data speak, which is the “soul of the data” often said by the ZoomEye team, and is also the real value of the mapping in cyberspace…