ctrlINT What the industry said about every indicator, with the quote

PostNapTeaMalware

  • SIGNBT

PostNapTea aka SIGNBT is an HTTP(S) RAT that is written as a complex object-oriented project. In 2022-2023, it was deployed against targets like a newspaper organization, agriculture-related entity or a software vendor. The initial access was usually achieved by exploiting vulnerabilities in widely-used software in South Korea.From MISP Galaxy

Last reported 4 days ago, by Kaspersky Securelist1 report

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1543.003Windows Service

    “…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”

    Kaspersky SecurelistVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “As previously noted, similar patterns have been identified in CookiePlus, MISTPEN, SIGNBT, and IMETHOD.”

    Kaspersky SecurelistVendor
    Operation FlashHole: Lazarus breaks security, defies control

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with PostNapTea here?
No account needed. We do not store your IP address.