Web traffic rerouted through China

While attacks initially involved the distribution of a malicious HTML app that facilitated retrieval of a script enabling NetSupport RAT malware deployment, threat actors shifted to impersonate Next.js and other JavaScript libraries to deliver NetSupport RAT and BurnsRAT, according to an analysis from Kaspersky.

Malicious emails sent by Kimsuky using Mail.ru's "mail.ru", "bk.ru", "internet.ru", "list.ru", and "inbox.ru" domains impersonated financial organizations and web portals, which had been exploited in the group's attacks involving U.S., South Korean, and Japanese email address domains earlier this year, a report from South Korean cybersecurity firm Genians revealed.

Initially identified in the phone of the assassin of Dutch journalist Peter de Vries, Matrix — also known as Mactrix, X-quantum, Totalsec, and Q-safe — was later infiltrated by a joint Dutch and French investigation team, resulting in the discovery and shutdown of 40 servers leveraged by the platform to support at least 8,000 subscriber accounts.