Play Ransomware Attack Cases Detected by AhnLab EDR

AhnLab describes Play ransomware intrusion tradecraft and notes Palo Alto Unit42 reporting that linked Play activity to Andariel through shared infrastructure after Andariel used Sliver and DTrack for information theft. The excerpt states that Play operat…

북한 APT 리퍼(Reaper)에서 만든 악성코드-동북공정(미국의회조사국(CRS Report).pdf.lnk(2024.4.3)

A Korean analysis attributes a malicious LNK file disguised as a CRS report PDF to North Korea's Reaper, also known as APT37. The shortcut searches for PowerShell, locates an embedded payload by file size, extracts and opens a decoy PDF, then writes panic…