Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces

hunt.io | blog | #threat-intelligence | #phishing | #dprk | #ssh-keys | #bluenoroff | #ta444

Summary

Hunt.io resurfaces a suspected TA444/BlueNoroff cluster: a server hosting a fake 'JustJoin' macOS app landing page, plus two IPs sharing SSH keys pointing to coordinated DPRK-linked infrastructure.
Published
Collected

original ↗

Related coverage

incident · hunt.io
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444
Axios's npm maintainer account was hijacked to ship trojanized 1.14.1 and 0.30.4: an obfuscated dropper installed RATs for macOS, Windows and Linux, with C2 linked to DPRK's BlueNoroff/TA444.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia
Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.
blog · hunt.io
Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
blog · hunt.io
APT34-Like Threat Infrastructure Uncovered Before Activation
Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.
back