Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
56 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_58179cc3a307a2fc7fRecent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Contents The AhnLab SEcurity intelligence Center (ASEC) collected attack logs targeting poorly managed Linux SSH servers through honeypots. This report compiles statistics by categorizing the attack sources identified in the third quarter of 2026, the attacks carried out from those sources, and the malware used. The report also provides a classification of the malware used […]
First reported Oct 07, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
1. Overview  AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as […]
First reported Sep 30, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Summary of Vulnerability Trends for the Third Quarter of 2026 A total of 36,971 CVEs were disclosed in the third quarter of 2026, representing an increase of approximately 78.6% Compared to the second quarter. Among the vulnerabilities for which CVSS assessments were completed, approximately 12.7% Were rated “Critical” and approximately 42.6% Were rated “High,” meaning […]
First reported Oct 06, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Purpose and Scope This report summarizes statistics on new ransomware samples, affected systems, and statistics on targeted businesses collected during the month of August 2026, as well as major Korean & Global ransomware issues. Statistics on targeted businesses were compiled based on the time when publicly available information from ransomware groups’ DLS (Dedicated Leak Sites, […]
First reported Sep 22, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as project material purchase request forms. These emails impersonate employees of a specific company in Korea and trick recipients into opening a malicious XLS file attached to the email, which is disguised as a project material purchase request form. […]
First reported Sep 27, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Overview AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the types and statistics on domestic APT attacks identified during the month of August 2026. Trends of APT Attacks in South Korea Most of the APT attacks detected in South Korea were distributed via spear phishing […]
First reported Sep 29, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Content The AhnLab SEcurity intelligence Center (ASEC) analyzed the attack status of Windows web servers in the third quarter of 2026 based on AhnLab Smart Defense (ASD) logs. The targets were Internet Information Services (IIS) web servers and Apache Tomcat web servers running in Windows environments, with attacks primarily exploiting unpatched vulnerabilities, misconfigurations, and inadequate […]
First reported Oct 07, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
ASEC Blog publishes Ransom & Dark Web Issues Week 2, October 2026           International Operation Seizes KillSec Ransomware Infrastructure and Arrests Three Suspects Customer Data of a South Korean Health and Beauty Retailer Offered for Sale Saudi Intelligence Agency Personnel and Organizational Data Allegedly Leaked
First reported Oct 06, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
The AhnLab SEcurity intelligence Center (ASEC) has been monitoring proxyjacking attacks and confirmed that, in the second half of 2026, the Larva-25012 threat actor has resumed actively distributing Proxyware. Rather than conducting malware distribution through new methods, the threat actor appears to have targeted already infected systems to distribute Proxyware.    1. Proxyjacking Attacks A […]
First reported Sep 16, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Note In August 2026, widespread instances of database leaks, the sale of internal data, and the trading of initial access privileges were observed on dark web and deep web forums. Due to the nature of the sources, it was difficult to fully verify the accuracy of some posts. Major Issues ShinyHunters continued to make claims […]
First reported Sep 13, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Content This report summarizes the distribution channels, number of Infostealers, number of detections, and companies disguised as targets by new Infostealers collected during the month of August 2026. It is based on data from AhnLab SEcurity intelligence Center (ASEC), AhnLab product diagnostic logs, automated data collection systems, email honeypot systems, and automated C2 analysis systems. […]
First reported Sep 21, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
ASEC Blog publishes Ransom & Dark Web Issues Week 4, September 2026           Metaencryptor Ransomware Attack on a South Korean Camera Module and Equipment Manufacturer Metaencryptor Ransomware Attack on a Japanese Automotive Parts Manufacturer ShinyHunters Claims Breach of a U.S. Federal Law Enforcement Agency and Theft of Sensitive Data
First reported Sep 22, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Content The AhnLab SEcurity intelligence Center (ASEC) observed and classified attacks targeting MS-SQL servers and MySQL servers installed on Windows operating systems via the ASD infrastructure. This report summarizes the damage status, attack status, and the types of malware used in the attacks, based on logs identified in the third quarter of 2026. Purpose and […]
First reported Oct 07, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Purpose and Scope The August 2026 APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabilities. A key finding is the use of GitHub, GitLab, OneDrive, Telegram, […]
First reported Sep 17, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which ransomware was distributed through a private home trading system (HTS). The HTS program used to distribute the ransomware is called “UBP Asset” and has long been exploited in online investment scams. Given that a photo of the same HTS program was also found in […]
First reported Sep 15, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to confirm purchase orders. The email body asks recipients to review the attached purchase order and reply with the relevant information, prompting users to download and open the attached DOCX file. Attachment: PURCHASED ORDER.Docx   [Figure […]
First reported Oct 08, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
ASEC Blog publishes Ransom & Dark Web Issues Week 1, October 2026           Dutch Police Confirm Arrest of 24-Year-Old Man in ShinyHunters Hacking Investigation [1] [2]  Ulose Claims Data Leak from a South Korean General Hospital Qilin Ransomware Attack on a Japanese Freight and Logistics Company
First reported Sep 30, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Note The September 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. However, the report notes that due to the nature of the sources, it may be difficult to fully verify the accuracy of some information. Major Issues The official launch of a new dark web […]
First reported Oct 11, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
One day, out of the blue, I received a text message claiming to protect my cryptocurrency account. However, this message concealed a sinister intent: to steal the user’s wallet information. Recently, a smishing campaign was identified that impersonated Pi Coin account protection to lure users to phishing pages and steal their cryptocurrency wallet information. The […]
First reported Sep 29, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
In January 2026, the AhnLab SEcurity intelligence Center (ASEC) reported on attack cases that distributed RMM (Remote Monitoring and Management) tools through video files or attachments in phishing emails. [1] [2] In these attack cases, tools such as Syncro, ConnectWise ScreenConnect, NinjaOne, and SuperOps were exploited. RMM (Remote Monitoring and Management) tools are not malware […]
First reported Sep 30, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Note The September 2026 Dark Web Threat Actor Trend Report focuses on threat actors active on the deep web and dark web, as well as publicly reported cyberattack incidents. It is noted that the factual accuracy of some content cannot be independently verified. Major Issues Some hacktivist groups claimed responsibility for DDoS attacks targeting the […]
First reported Oct 11, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
The threat actor used SEO poisoning (a technique that exploits search results to redirect users to fake sites) to distribute a malicious installer disguised as a KakaoTalk installer. The appearance and packaging method of the installer changed continuously, and the threat actor sequentially used NSIS, Advanced Installer, and Inno Setup. It contained both legitimate installation […]
First reported Sep 27, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
Overview In the third quarter of 2026, there was a notable increase in cases where attackers attempted to establish persistence and expand their attacks using paths trusted by the organization following their initial access. Attacks on perimeter devices such as NetScaler and Cisco FMC led to the installation of web shells (server-side scripts for remote […]
First reported Oct 06, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
ASEC Blog publishes Ransom & Dark Web Issues Week 3, October 2026           n0n Ransomware Attacks on 12 South Korean Port and Logistics Companies Cyberattack Targets Refrigeration Systems at Major French Supermarket Chains Payment and Transaction Data Leak Claimed at a Saudi Fintech Company
First reported Oct 13, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 10:12 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.