Dalbit__2023__Ahnlab_Dalbit-m00nlight-Chinese-APT-Campaign_02-13-2023.pdf

AhnLab ASEC details the Dalbit (m00nlight) campaign targeting primarily Korean organizations since 2022: actors gain initial access via webshells and vulnerable servers, deploy open-source tools (FRP, LCX, Potato exploit families, scanning and dumping utilities), perform internal reconnaissance and credential theft (LSASS dumps, Exchange email extraction), use compromised hosts as proxies for RDP-based lateral movement, and ultimately extort victims by locking drives with BitLocker; the report includes extensive IOCs (hashes, C2s, FRP configs), observed tactics, and remediation recommendations.