Cut through the noise. See the threats that matter to you.

Introduction This Detection engineering brief is based on the analysis of an advanced North Korean APT multi-stage malware framework (EPOINT-AES) documented in my previous blog. The malware represents a sophisticated attack chain incorporating AES-encrypted payloads, Donut-generated shellcode, AMSI bypass techniques, and memory-only execution patterns. The framework is designed for covert operations with multiple evasion techniques […]

Introduction This analysis documents a sophisticated multi-stage malware framework discovered during an investigation into North Korean Advanced Persistent Threat (APT) activities. The framework was identified as part of a broader campaign targeting critical infrastructure and high-value intelligence targets. The technical assessment in this document results from reverse engineering efforts performed on malware samples recovered from […]

The PowerShell script analyzed in this document (shell.ps1) was recovered from an unprecedented takedown operation of North Korean APT infrastructure, security researchers gained access to actual malware and operational tools used by Kimsuky/APT43. This rare opportunity allows us to analyze authentic, state-sponsored malware rather than samples collected from targeted organizations. This analysis provides insight into […]

Introduction This technical analysis is derived from the groundbreaking “APT Down — The North Korea Files” published in Phrack Magazine Issue 72. Our security team gained unprecedented access to the actual infrastructure, logs, and code of Kimsuky/APT43, a North Korean state-sponsored threat actor, following a major takedown operation. This rare opportunity to analyze real attacker […]