“Tick” Group Continues Attacks
Summary: The "Tick" group has run cyber espionage campaigns against organizations in the Republic of Korea and Japan for several years, targeting Defense and High-Tech companies holding intellectual property or sensitive information, using custom malware such as Daserf alongside commodity tools, exploits, and social engineering. Unit 42 reports the group moved from privacy-protected domains to compromised websites for command and control, repeatedly attacked a high-profile target in Japan with multiple malware families over three years, and linked Daserf to the 9002 and Invader threats through shared infrastructure between July 2012 and April 2013.
Bottom line: A single high-profile Japanese target was hit repeatedly for three years with multiple malware families, and the group's shared domains and substitution-cipher code point to one developer building tools that tie Daserf, Invader, Minzen, and Gh0st RAT variants together - so a detection on one family may be the only warning before the next.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026