SlowMist: Hacker group APT37 hides malware in JPEG image files to launch attacks

2025/08/04 13:08

PANews reported on August 4th that, according to SlowMist's Chief Information Security Officer 23pds, citing an article from Genians, the North Korean-linked hacker group APT37 is using malware hidden within JPEG image files to launch attacks. This malware uses a two-stage encrypted shellcode injection method to hinder analysis. The attackers exploit shortcut files with a .lnk extension and embed Cmd or PowerShell commands within them to execute the attack. Efficient EDR monitoring optimized for detecting anomalous endpoint behavior is now crucial.

Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.