Cut through the noise. See the threats that matter to you.

The PowerShell script analyzed in this document (shell.ps1) was recovered from an unprecedented takedown operation of North Korean APT infrastructure, security researchers gained access to actual malware and operational tools used by Kimsuky/APT43. This rare opportunity allows us to analyze authentic, state-sponsored malware rather than samples collected from targeted organizations. This analysis provides insight into […]

Introduction This technical analysis is derived from the groundbreaking “APT Down — The North Korea Files” published in Phrack Magazine Issue 72. Our security team gained unprecedented access to the actual infrastructure, logs, and code of Kimsuky/APT43, a North Korean state-sponsored threat actor, following a major takedown operation. This rare opportunity to analyze real attacker […]

Executive Summary This final blog in the series focuses on advanced network detection techniques, cross-variant behavioral analysis, and validation strategies for njRAT detection rules. We provide field-ready simulation plans and operational guidance for SOC teams. High-Fidelity Network Detection for njRAT JA3/JA3S Fingerprints for njRAT Variants Collection Point: Network traffic capture at SPAN port or proxy […]

Executive Summary This blog provides operational detection engineering guidance for njRAT, focusing on high-fidelity telemetry analysis and deployable detection rules. Based on observed campaign telemetry, we present specific detection opportunities that can be implemented immediately in enterprise environments. Kill Chain Mapping (Exact Telemetry Anchors) Kill Chain Mapping Initial Access Execution Persistence Privilege Escalation Defense Evasion […]