Suspected DPRK Campaign Persists with SparkRAT Activity (in "Unmasking SparkRAT")

Date (as written): 2025-01-28T00:00:00.000Z
Year: 2025
Country: South Korea (server hosted in Seoul)
Actors (as written): suspected DPRK
Actor pages: suspected DPRK

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

macOS Users · 28/01/2025

Researchers at Hunt.io uncover a surge in attacks leveraging SparkRAT, a cross-platform Remote Access Trojan (RAT) written in GoLang. [Date Occurred: Since at least late November 2024; Date Discovered: Late November 2024]

https://www.hackmageddon.com/2025/06/04/16-30-january-cyber-attacks-timeline/

https://cybersecuritynews.com/hackers-using-sparkrat-in-wild/

Hunt.io blog

Suspected DPRK Campaign Persists with SparkRAT Activity (in "Unmasking SparkRAT") · 2025-01-28T00:00:00.000Z

Hosted in Seoul, South Korea, this server exhibits several characteristics frequently associated with DPRK-linked infrastructure.

https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections

Suggest a correction on GitHub