Tag: certificate exploitation

1 Attack Reports | 0 Vulnerabilities

Attack reports

Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate - Malware Signed with Nexaweb Certificate

AhnLab Security Intelligence Center discovered malware signed with Nexaweb Inc.'s certificate, linked to the Kimsuky group's activities. The malware, tracked as Larva-25004, was found in two files signed on May 24 and 28, 2024. When executed, it displays a PDF file related to employment as bait, li…
kimsuky
2025-05-23
certificate exploitation
signed malware
nexaweb
certificate leak
Published: May 23, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports