IT threat evolution Q1 2023

IT threat evolution Q1 2023

IT threat evolution in Q1 2023
IT threat evolution in Q1 2023. Non-mobile statistics
IT threat evolution in Q1 2023. Mobile statistics

Targeted attacks


BlueNoroff introduces new methods bypassing MotW


At the close of 2022, we reported the recent activities of BlueNoroff, a financially motivated threat actor known for stealing cryptocurrency. The threat actor typically exploits Word documents, using shortcut files for the initial intrusion. However, recently the group has adopted new methods to deliver its malware.


One of these, designed to evade the Mark-of-the-Web (MotW) flag, is the use of .ISO (optical disk image) and .VHD (virtual hard disk) file formats. MotW is a Windows security measure — the system displays a warning message when someone tries to open a file downloaded from the internet.


The threat actor also seems to be experimenting with new file types to deliver its malware. We observed a new Visual Basic script, a previously unseen Windows Batch file and a Windows executable.



Our analysis revealed more than 70 domains used by this group, meaning that they were very active until recently. They also created numerous fake domains that look like venture capital and bank domains: most of these imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities.


Roaming Mantis implements new DNS changer


We continue to track the activities of Roaming Mantis (aka Shaoye), a well-established th ..

Support the originator by clicking the read the rest link below.