Andariel Group Exploiting Korean Asset Management Solutions (MeshAgent)

AhnLab SEcurity intelligence Center (ASEC) recently discovered the Andariel group’s continuous attacks on Korean companies. It is notable that installations of MeshAgent were found in some cases. Threat actors often exploit MeshAgent along with other similar remote management tools because it offers diverse remote control features.

The Andariel group exploited Korean asset management solutions to install malware such as AndarLoader and ModeLoader, which are the malware used in the previous cases. Starting with Innorix Agent in the past, the group …

ahnlab andariel asec asset asset management attacks cases center companies continuous control exploit exploited exploiting features found intelligence malware analysis management meshagent remote control remote management security security intelligence solutions threat threat actors tools