Trusted Design

TDrop2 Attacks Suggest Dark Seoul Attackers Return

概要

In March 2013, the country of South Korea experienced a major cyberattack, affecting tens of thousands of computer systems in the financial and broadcasting industries. This attack was dubbed ‘Dark Seoul’; it involved wreaking havoc on affected systems by wiping their hard drives, in addition to seeking military intelligence. The attack was initially thought to be attributed to North Korea, by way of a Chinese IP found during the attack, but no other strong evidence of North Korea’s involvement has been produced since then. In June 2013, McAfee published a report detailing the chronology and variance of the Dark Seoul campaign, but renamed it ‘Operation Troy’. The report analyzed the entirety of the purported attack campaign, beginning in 2009 using a family of tools dubbed ‘Troy’.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 52939b9ec4bc451172fa1c5810185194af7f5f6fa09c3c20b242229f56162b0f -
• URL - http://mcm-yachtmanagement.com/installx/install_ok.php -
• hostname - www.junfac.com -
• FileHash-SHA256 - 52d465e368d2cb7dbf7d478ebadb367b3daa073e15d86f0cbd1a6265abfbd2fb -
• FileHash-SHA256 - 43eb1b6bf1707e55a39e87985eda455fb322afae3d2a57339c5e29054fb52042 -
• domain - mcm-yachtmanagement.com -
• hostname - www.combra.eu -
• FileHash-SHA256 - a02e1cb1efbe8f3551cc3a4b452c2b7f93565860cde44d26496aabd0d3296444 -
• URL - http://www.junfac.com/tires/skin/tires.php -
• hostname - www.htomega.com -
• URL - http://www.combra.eu/includes/images/logo.jpg -
• FileHash-SHA256 - 1dee9b9d2e390f217cf19e63cdc3e53cc5d590eb2b9b21599e2da23a7a636184 -
• URL - http://www.htomega.com/rgboard/image/rgboard.gif -

類似Pulses

• FortiGuard Lion: A Peek into BlackMoon’s Sustained Attacks against South Korea (score: 0.60)
• South Korea NIS’s use of Hacking Team’s RCS (score: 0.59)
• Chinese Actors attacks on US Government and EU Media (score: 0.59)
• Operation Armageddon (score: 0.59)
• Targeted Attack Distributes PlugX in Russia (score: 0.58)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る