Provides information on how to use Logpresso and its technology.
PHP Core Remote Code Execution Vulnerabilities (PHP2Shell): Recommended Actions
- Urgent Security Advisory: PHP Core Remote Code Execution Vulnerabilities (PHP2Shell) - Vulnerability details leaked before patch release · Security updates and temporary mitigations · Guidance on checking for signs of compromise
2026-10-21
[Logpresso CTI] ARTEX Campaign Analysis
Following CrowdStrike's October 7 analysis of the ARTEX campaign targeting South Korean financial institutions, Logpresso cross-referenced Telegram, GitHub commit history, and infostealer logs to further verify the nature of the threat group behind the attacks. Our analysis found that the Telegram account named by CrowdStrike served on the administrator team of GodNet/VITAS, a DDoS-for-hire group, and that infostealer logs from another member of the same group contain email addresses, domains, and M365 tenants that can be matched against cloud service providers' subscriber information. The findings suggest that the attacks may have been carried out with a group behind them rather than by a lone individual.
2026-10-09
[Logpresso CTI] Analysis of a macOS Malware Campaign Impersonating a Major South Korean Brokerage
Facebook Ads Distribute macOS Malware Impersonating a Major South Korean Brokerage
2026-09-18
[Logpresso CTI] Supply Chain Compromise Analysis of Korean-Language Windows 11 Installation Media
A New Distribution Vector for the JSCEAL Campaign
2026-09-08
PHP Core Remote Code Execution Vulnerabilities (PHP2Shell): Recommended Actions
- Urgent Security Advisory: PHP Core Remote Code Execution Vulnerabilities (PHP2Shell) - Vulnerability details leaked before patch release · Security updates and temporary mitigations · Guidance on checking for signs of compromise
2026-10-21
[Logpresso CTI] ARTEX Campaign Analysis
Following CrowdStrike's October 7 analysis of the ARTEX campaign targeting South Korean financial institutions, Logpresso cross-referenced Telegram, GitHub commit history, and infostealer logs to further verify the nature of the threat group behind the attacks. Our analysis found that the Telegram account named by CrowdStrike served on the administrator team of GodNet/VITAS, a DDoS-for-hire group, and that infostealer logs from another member of the same group contain email addresses, domains, and M365 tenants that can be matched against cloud service providers' subscriber information. The findings suggest that the attacks may have been carried out with a group behind them rather than by a lone individual.
2026-10-09
[Logpresso CTI] Analysis of a macOS Malware Campaign Impersonating a Major South Korean Brokerage
Facebook Ads Distribute macOS Malware Impersonating a Major South Korean Brokerage
2026-09-18
[Logpresso CTI] Supply Chain Compromise Analysis of Korean-Language Windows 11 Installation Media
A New Distribution Vector for the JSCEAL Campaign
2026-09-08
[Logpresso CTI] DPRK Remote IT Worker OSINT Analysis Report
Tracking Undercover DPRK IT Workers Through InfoStealer Logs - Uncovering Coordinated Multi-Identity Operations Through 1 Million Botnet Telemetry Records
2026-03-10
2025년 10월 말, 건강검진 안내 문서로 위장한 JSE 파일이 조직적인 APT 공격에 활용되었으며, 분석 결과 북한 Kimsuky 조직에 의한 공격으로 판단됩니다. Kimsuky는 북한과 연계된 것으로 추정되는 APT(Advanced Persistent Threat) 그룹으로, 주로 정보 수집과 관련된 각종 스파이 활동을 수행합니다.
2025-11-06
[Cyber Threat Analysis] Malware Analysis Targeting Windows and macOS by the Lazarus Group
In September 2025, a coordinated **Advanced Persistent Threat (APT)** campaign was discovered, targeting both Windows and macOS systems.
2025-10-13
[Cyber Threat Analysis] Kimsuky Attack Disguised as Sex Offender Notification
In late July 2025, a coordinated APT attack was identified, leveraging sex offender notifications and national tax notices as lures.
2025-09-22
Jan 2025 — Cyber Attack Trends
“With the rapid expansion of cloud and SaaS, the limitations of traditional legacy cybersecurity strategies have become increasingly apparent.”
2025-02-12
Oct 2024 — Cyber Attack Trends
“Are Cyber Attacks Originating from North Korea Actually the Work of Actually the Work of North Korea?”
2024-11-18
Jul 2024 — Cyber Attack Trends
“Korean companies expanding overseas should pay close attention to local cyber attack incidents”
2024-08-09
Jun 2024 — Cyber Attack Trends
“APT attacks are evolving by actively leveraging open-source tools like GitHub”
2024-07-08
