HAZY_TIGER__2019__ASEC_REPORT_vol.93_ENG.pdf

ASEC Q4 2018 analyzes two active threats: Seon Locker ransomware (and GandCrab deliveries) propagated via a dual drive-by download using the GreenFlash Sundown exploit kit that leverages CVE-2018-4878 and fileless PowerShell execution, and the long-running Operation Bitter Biscuit campaign (Bisonal/Bisoaks) targeting Korean government, defense and marine sectors; the report provides technical breakdowns, sample code, IoCs (file hashes, C2 URLs, filenames) and behavioral indicators for detection and response.