Daily Writeups
@Daily_Writeups
4.13K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.13K subscribers
Daily Writeups
⤷ Title: North Korean APT37’s “ToyBox Story”: Stealthy Attacks Unveiled
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 13 May 2025 00:40:49 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #APT37 #cloud #cyberattack #dropbox #Fileless Malware #malware #North Korea #RokRAT #spear_phishing
Daily CyberSecurity
North Korean APT37's "ToyBox Story": Stealthy Attacks Unveiled
New report details APT37's "ToyBox Story" campaign, using spear phishing and cloud services to deploy RoKRAT malware. Fileless attacks and stealthy tactics revealed.
14 views
Daily Writeups
⤷ Title: APT37’s Stealthy RoKRAT Malware Uses Steganography in JPEGs to Evade Detection
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 05 Aug 2025 03:11:55 +0000
════════════════════════
⌗ Tags: #Malware #APT37 #Cyberespionage #cybersecurity #DLL hijacking #Fileless Malware #malware #North Korea #RoKRAT #Steganography
Penetration Testing Tools
APT37's Stealthy RoKRAT Malware Uses Steganography in JPEGs to Evade Detection
APT37's new RoKRAT malware variant uses steganography to hide encrypted payloads in JPEG images, bypassing antivirus and traditional defenses by executing entirely in memory.
15 views
Daily Writeups
⤷ Title: ScarCruft APT Deploys VCD Ransomware, Uses PubNub & New Malware in Espionage Campaign
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 11 Aug 2025 00:11:57 +0000
════════════════════════
⌗ Tags: #Cybercriminals #APT #APT37 #Cyberespionage #malware #North Korea #NubSpy #PubNub #ScarCruft #VCD Ransomware
Daily CyberSecurity
ScarCruft APT Deploys VCD Ransomware, Uses PubNub & New Malware in Espionage Campaign
S2W’s Threat Analysis and Intelligence Center (TALON) has uncovered a sophisticated malware campaign attributed to the North Korean APT group ScarCruft (a.k.a. APT37, Reaper, Ricochet Chollima). T…
13 views
Daily Writeups
⤷ Title: From Lure to Shell: Reproducing APT37’s CHM Exploitation Tactics
════════════════════════
𐀪 Author: Alok kumar
════════════════════════
ⴵ Time: Fri, 22 Aug 2025 19:14:53 GMT
════════════════════════
⌗ Tags: #mitre_attack #red_team #apt37 #social_engineering #infosec
Medium
From Lure to Shell: Reproducing APT37’s CHM Exploitation Tactics
Reproducing the tactics of APT37, this blog shows how CHM files can be weaponized for threat emulation. From lure design to reverse shell.
11 views
Daily Writeups
⤷ Title: North Korea’s ScarCruft Targets Academics With RokRAT Malware
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Mon, 01 Sep 2025 17:21:51 +0000
════════════════════════
⌗ Tags: #Security #Malware #APT37 #Cyber Attack #Cybersecurity #HanKook Phantom #North Korea #Phishing #RokRAT #ScarCruft
Hackread
North Korea’s ScarCruft Targets Academics With RokRAT Malware
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
36 views
Daily Writeups
⤷ Title: North Korean Hackers Launch Widespread Cyberespionage Campaign
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 02 Sep 2025 04:14:36 +0000
════════════════════════
⌗ Tags: #Cyber Security #APT37 #Cyberespionage #cybersecurity #LNK file #North Korea #RoKRAT #ScarCruft
Penetration Testing Tools
North Korean Hackers Launch Widespread Cyberespionage Campaign
A North Korean hacking group, APT37, is targeting government and research organizations with a new cyberespionage campaign using a malicious LNK file.
7 views
Daily Writeups
⤷ Title: APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 10 Sep 2025 00:01:29 +0000
════════════════════════
⌗ Tags: #Malware #APT37 #Chinotto #cyber_espionage #cybersecurity #malware #North Korea #Rustonotto #ScarCruft #Zscaler
Daily CyberSecurity
APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer
A new report reveals North Korea's APT37 is using Rust-based malware called Rustonotto, marking a shift toward modern languages and multi-platform attacks.
10 views
Daily Writeups
⤷ Title: Hackers Use KakaoTalk and Google Find Hub in Android Spyware Attack
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Wed, 12 Nov 2025 14:19:34 +0000
════════════════════════
⌗ Tags: #Android #Malware #Scams and Fraud #Security #APT37 #Cyber Attack #Cybersecurity #Google Fund Hub #KakaoTalk #Kimsuky #Konni #North Korea #South Korea
Hackread
Hackers Use KakaoTalk and Google Find Hub in Android Spyware Attack
North Korea-linked KONNI hackers used KakaoTalk and Google Find Hub to spy on victims and remotely wipe Android devices in a targeted phishing campaign.
39 views
Daily Writeups
⤷ Title: “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 24 Dec 2025 00:35:11 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #APT37 #Artemis Campaign #cyber_espionage #Genians Security Center #HWP Malware #North Korea #pCloud #Reaper #Ricochet Chollima #social engineering #Yandex Cloud
Daily CyberSecurity
“Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets
A notorious threat group is auditioning victims for a new cyber-espionage campaign, masquerading as television production staff to slip malware past defenses. A new report from Genians Security Ce…
14 views
Daily Writeups
⤷ Title: Operation Artemis: North Korean ScarCruft Hijacks HWP Files to Deploy RoKRAT
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 30 Dec 2025 03:00:35 +0000
════════════════════════
⌗ Tags: #Cybercriminals #APT37 #Cyber Espionage #DLL side_loading #Genians #HWP #Operation Artemis #phishing #RoKRAT #ScarCruft #South Korea #Steganography
Penetration Testing Tools
Operation Artemis: North Korean ScarCruft Hijacks HWP Files to Deploy RoKRAT
As part of a large-scale malware campaign dubbed Operation Artemis, the North Korean hacking group APT37—also known as
16 views
Daily Writeups
⤷ Title: Atomic Red Team notes — TryHackMe
════════════════════════
𐀪 Author: Jose Praveen
════════════════════════
ⴵ Time: Mon, 12 Jan 2026 12:22:39 GMT
════════════════════════
⌗ Tags: #apt37 #powershell #atomic_red_team #tryhackme
Medium
Atomic Red Team notes — TryHackMe
Leveraging the Atomic Red Team Framework to strengthen the Security Operations’ detection capabilities.
18 views
Daily Writeups
⤷ Title: Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 03 Mar 2026 00:05:18 +0000
════════════════════════
⌗ Tags: #Malware #Air_gap attack #APT37 #Cloud C2 #infosec #North Korean APT #Ruby Jumper #ScarCruft #SNAKEDROPPER #THUMBSBD #USB malware #VIRUSTASK
Daily CyberSecurity
Bridging the Gap: North Korean APT37 Deploys 'Ruby Jumper' to Infiltrate Isolated Air-Gapped Networks
Zscaler unmasked APT37's "Ruby Jumper" campaign, which uses weaponized USBs and cloud services to bypass network isolation and steal data from air-gapped systems.
7 views
Daily Writeups
⤷ Title: Jumping the Gap: APT37’s “Ruby Jumper” Campaign Weaponizes Cloud Storage and USBs to Breach Isolated Networks
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 04 Mar 2026 07:01:03 +0000
════════════════════════
⌗ Tags: #Cybercriminals #air_gapped network #APT37 #Cybersecurity 2026 #RESTLEAF #Ruby Jumper #ScarCruft #SNAKEDROPPER #THUMBSBD #USB Malware #Velvet Chollima #VIRUSTASK #Zoho WorkDrive #Zscaler ThreatLabz
Penetration Testing Tools
Jumping the Gap: APT37’s "Ruby Jumper" Campaign Weaponizes Cloud Storage and USBs to Breach Isolated Networks
The DPRK-affiliated syndicate APT37 has augmented its arsenal dedicated to breaching air-gapped networks. The Zscaler ThreatLabz vanguard has
15 views
Daily Writeups
⤷ Title: The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 07:40:02 +0000
════════════════════════
⌗ Tags: #Cybercriminals #APT37 #Code Cave Injection #Facebook Phishing #Fileless Malware #Genians Security Center #North Korean APT #PE Patching #RokRAT #social engineering #Wondershare PDFelement #Zoho WorkDrive
Daily CyberSecurity
The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT
APT37 pivots to Facebook social engineering, using Wondershare PDFelement "code caves" to deploy RokRAT. Learn how they bypass EDR with memory-only payloads.
15 views
Daily Writeups
⤷ Title: Rigged Game: How North Korea’s ScarCruft Group Infiltrated a Gaming Platform to Deploy BirdCall Spyware
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 07:54:33 +0000
════════════════════════
⌗ Tags: #Malware #Android malware #APT37 #BirdCall #BirdCall Backdoor #Cybersecurity 2026 #ESET #North Korea #RoKRAT #ScarCruft #sqgame.net #supply chain attack #Windows Spyware #Yanbian
Penetration Testing Tools
Rigged Game: How North Korea’s ScarCruft Group Infiltrated a Gaming Platform to Deploy BirdCall Spyware
The seemingly innocuous download of a mobile game could culminate in a smartphone being compromised by sophisticated spyware.
13 views
Daily Writeups
⤷ Title: APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 12 May 2026 08:13:34 +0000
════════════════════════
⌗ Tags: #Malware #APT37 #Batch Script Obfuscation #Cyberespionage #Genians #infosec #LNK File #Malware Analysis #North Korea APT #phishing #Python Malware #threat intelligence
Daily CyberSecurity
APT37’s New "Python-in-a-Cat" Malware Uses Environment Variable Obfuscation
Genians unmasks an APT37 campaign using environment variable tricks and compiled Python malware to bypass EDR. Protect your network from these stealthy lures.
15 views
Daily Writeups
⤷ Title: APT37 NarwhalRAT Malware: A Python Backdoor Threat
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 19 Jun 2026 07:22:56 +0000
════════════════════════
⌗ Tags: #Malware #APT37 #cybersecurity #NarwhalRAT #Python backdoor
Daily CyberSecurity
APT37 NarwhalRAT Malware: A Python Backdoor Threat
Discover how APT37 NarwhalRAT malware uses MS-themed phishing and a dead-drop C2 to target users with a sophisticated Python backdoor.
11 views
Daily Writeups
⤷ Title: RokRAT Malware Hides in Fake PDF Files to Spy on Academics
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 17 Jul 2026 13:24:33 +0000
════════════════════════
⌗ Tags: #Malware #APT37 #Genians #malware #North Korea #Operation Capsule Vault #RokRAT #spear_phishing
Daily CyberSecurity
RokRAT Malware Hides in Fake PDF Files to Spy on Academics
At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed) Target / victims People in research, policy, and academic fields Delivery vecto…
24 views
Daily Writeups
⤷ Title: Suspected North Korean Hackers Deploy Ted Backdoor
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Wed, 09 Sep 2026 12:10:22 +0000
════════════════════════
⌗ Tags: #Malware #APT37 #CurlRAT #HAProxy Malware #Ted Backdoor
Information Security News
Suspected North Korean Hackers Deploy Ted Backdoor
Suspected North Korean hackers may have spied on South Korean organizations for years using trojanized Linux system services and an HAProxy backdoor. Rapid7 researchers discovered a previously unk…
18 views
Daily Writeups
⤷ Title: Ted Backdoor Hides in HAProxy to Spy on South Korea
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 10 Sep 2026 08:01:11 +0000
════════════════════════
⌗ Tags: #Cybercriminals #APT37 #curlRAT #DPRK APT #HAProxy #Linux Malware #Rapid7 #south korea #ted backdoor
Daily CyberSecurity
Ted Backdoor Hides in HAProxy to Spy on South Korea
At a glance Actor or group Suspected DPRK APTs (APT37 links, medium confidence) Activity type Linux backdoor, watering-hole injection, credential theft Targets or victims South Korean media and au…
15 views