Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
Tags
country: China North Korea Japan South Korea
attack-pattern: Data Direct Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Hardware - T1592.001 Ip Addresses - T1590.005 Mshta - T1218.005 Social Media - T1593.001 Software - T1592.002 Tool - T1588.002 Connection Proxy - T1090 Mshta - T1170 Remote Access Tools - T1219
Show in Graph
Common Information
Type Value
UUID e8ae8776-9562-4339-bc0a-7e0047276811
Fingerprint 26253017923713d3
Analysis status DONE
Considered CTI value -2
Text language
Published Nov. 7, 2024, 11 a.m.
Added to db Nov. 13, 2024, 12:25 p.m.
Last updated Nov. 17, 2024, 6:54 p.m.
Headline Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
Title Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
Detected Hints/Tags/Attributes 127/2/14
Source URLs
Redirection Url
Details Source https://unit42.paloaltonetworks.com/north-korean-it-workers/
URL Provider
Details Provider Source level domain
Details paloaltonetworks.com unit42.paloaltonetworks.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 256 ✔ Unit 42 https://unit42.paloaltonetworks.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 8 
spur.us
Details Domain 12 
level.io
Details Domain 5 
vscode.dev
Details File 7 
ateraagent.exe
Details File 1 
pcilic.exe
Details File 1 
pcideply.exe
Details File 5 
quickassist.exe
Details File 2 
rustdesk.exe
Details File 1 
simpplehelp.exe
Details File 3 
srservice.exe
Details File 6 
tv_w32.exe
Details File 456 
mshta.exe
Details File 41 
code.exe
Details File 27 
client32.exe