Threat video1:00
K2F Agent via NIKKE Launcher CDN Hijack: Detection & IOCs
NIKKE launcher CDN scripts were modified to load K2F, a remote-access agent: 9 detection rules, 27 IOCs and a free Splunk SPL rule.
Read the full threat intel for K2F Agent via NIKKE Launcher CDN Hijack: Detection & IOCs →
Chapters
- 0:00The hookFour launcher CDN files modified.
- 0:04The storyInjected code loads malware loader.
- 0:10Attack pathInjection hides the loader URL.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise21 indicators to hunt: 4 IPs, 3 domains and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques19 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Block insightjs[.]com, analytics[.]insightjs[.]com, insightjs[.]org.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Four launcher CDN files modified.
0:05Injected code loads malware loader.
0:07Malware steals passwords and wallets.
0:11Injection hides the loader URL.
0:13Launcher fetches and runs malware.
0:16Agent profiles hosts and users.
0:18Steals passwords, wallets, secrets.
0:20Data exfiltrated over HTTPS.
0:26No threat actor is attributed. Confidence: low.
0:3121 indicators to hunt: 4 IPs, 3 domains and 2 URLs, and more.
0:3819 ATT&CK techniques, from resource development to impact.
0:434 steps now: Block insightjs[.]com, analytics[.]insightjs[.]com, insightjs[.]org.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.