Dalbit (m00nlight): Chinese Hacker Group’s APT Attack Campaign

0. Overview

This report is a continuation of the “Attackers Using FRP (Fast Reverse Proxy) to Attack Korean Companies” post that was uploaded on August 16, 2022 and follows the group’s activities since that post.

This group has always relied on open-source tools and lacked any distinct characteristics to profile them due to the lack of PDB information. Additionally, the amount of information that could be collected was limited unless …

apt attack attackers august campaign chinese companies dalbit fast frp hacker hacker group information m00nlight malware analysis pdb profile proxy report reverse reverse proxy tools