Trusted Design

FortiGuard Lion: A Peek into BlackMoon’s Sustained Attacks against South Korea

概要

by Roland Dela Paz | Jul 21, 2016 | A few months ago, we talked about a malicious campaign that targets South Korean users in the form of malware known as BlackMoon. BlackMoon is a banking Trojan that installs a proxy auto-config file (PAC) on an infected system in order to redirect users’ browsers to phishing pages related to South Korean banks. Back then, we noticed an open directory in the C&C that revealed over 100,000 victims. Given this impact, we decided to dig further in order to understand better the scale of this attack. Mainly, we wanted to know if the statistics displayed by the C2 were real. If so, then we are looking at a not well talked about but highly active attack against South Korean users. This post shares our findings from ten weeks of monitoring this threat.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• South Korean Users Affected by BlackMoon Campaign (score: 0.84)
• Updated Blackmoon banking Trojan (score: 0.76)
• KRBanker Targets South Korea Through Adware and Exploit Kits (score: 0.73)
• BlackEnergy by the SSHBearDoor (score: 0.68)
• Infected Korean Website Installs Banking Malware (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る