Prediction of future attack indicators based on the 2024 analysis of threats from malicious app distribution sites in South Korea

Prediction of future attack indicators based on the 2024 analysis of threats from malicious app distribution sites in South Korea

Speakers: Kyung Rae Noh (General Researcher, KISA); Shinho Lee (Gachon University); Eui-Tak Kim (Gachon University); Yujin Shim (KISA); Jonghwa Han (KISA); Jung-Sik Cho (KISA)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=-Tcv5iB3zsY

Overview

This talk, presented by Kyung Rae Noh (Anthony) from the Korea Internet Security Agency (KISA), delves into a sophisticated analysis of smishing attacks and malicious application distribution prevalent in South Korea throughout 2024. The research leverages data collected by KISA's Cyber Spider system to uncover intricate patterns in attack infrastructure, particularly focusing on the abuse of domain name servers and the generation of malicious URLs. By meticulously dissecting over 2,000 unique smishing-related URLs, the KISA team identified recurring technical characteristics that allowed them to move beyond reactive blocking to proactive threat prediction.

The core objective of this research was to develop a methodology for anticipating future smishing campaigns before they impact victims. This was achieved through pattern mining and name server tracking, revealing how attackers strategically register domains and deploy social engineering tactics. The findings led to the successful implementation of a new predictive detection function within Cyber Spider, demonstrating a significant leap in defensive capabilities against rapidly evolving cyber threats. The talk underscores the critical importance of understanding attacker infrastructure and behavior to build resilient and forward-looking cybersecurity defenses.

The insights presented are not only crucial for South Korea but also offer valuable lessons for the global cybersecurity community. As attack patterns and infrastructure can easily transcend national borders, the analytical methods and proactive defense strategies developed by KISA provide a blueprint for other organizations facing similar challenges. The research highlights the effectiveness of combining statistical analysis with deep technical dives into domain registration patterns to predict and neutralize threats at an earlier stage, thereby minimizing potential harm to end-users.

Background

▶ Watch: Introduction to Cyberp data analysis system (2:30)

The Korea Internet Security Agency (KISA) operates as a pivotal organization under the Ministry of Science and ICT, tasked with responding to cybersecurity incidents within South Korea's private sector. KISA’s Digital Threat Response Division, known as KISK (or KrCERT), plays a crucial role domestically and internationally, collaborating with law enforcement, national security offices, and intelligence agencies to investigate incidents and share threat intelligence. Their partnerships extend to domestic internet service providers, security companies, and foreign government agencies, fostering a collaborative environment for joint responses to cyberattacks.

Historically, KISA managed separate systems for monitoring web, network, and device-level threats. While each system functioned independently, this fragmented approach hindered a holistic understanding of attack campaigns, making it difficult to trace attacker strategies, motives, and underlying infrastructure. Recognizing this limitation, KISA launched the Cyber Spider project in 2024. This initiative consolidated detection data—including malicious IPs, suspicious URLs, attack patterns, and C2 servers—into a single data lake. This unified repository facilitated comprehensive relationship analysis, enabling KISA to respond faster, track threats more effectively, and proactively block confirmed attacks in collaboration with telecom companies. Cyber Spider represents a strategic shift from isolated incident response to an integrated, analytical, and collaborative defense framework.

The specific problem addressed in this talk is the pervasive threat of smishing attacks, which involve sending malicious text messages (SMS phishing) designed to trick recipients into installing malicious applications. These applications often lead to data theft, financial fraud, or further compromise. In 2024, Cyber Spider collected over 10 million messages, from which 2,136 unique smishing messages were identified for in-depth analysis. The goal was to deconstruct the malicious URLs embedded in these messages, identify underlying patterns, and leverage this intelligence to predict and prevent future attacks, thereby enhancing South Korea's digital security posture.

Key Findings

▶ Watch: Discovery: Same name servers, shifting attack targets (7:40)

The analysis of 2,136 unique smishing messages collected by Cyber Spider in 2024 revealed several critical insights into attacker methodologies and infrastructure. A significant portion of these attacks employed social engineering tactics to induce victims into installing malicious applications. The most prevalent social engineering themes included fake obituary messages, which constituted the largest share, followed by government impersonation and wedding invitation scams. Obituary and government impersonation attacks were observed consistently throughout the year, while wedding invitation scams peaked seasonally in May, coinciding with wedding seasons. Financial institution impersonations were concentrated in the second and third quarters, indicating a dynamic adaptation of themes by attackers based on perceived opportunities.

Further analysis focused on the Top-Level Domains (TLDs) abused in these attacks. Out of 2,000 domains, attackers utilized 79 different TLDs. The most common was .app, accounting for 390 cases (approximately 18% of the total). This was closely followed by .xyz and .com. In total, approximately 24,000 domains used Generic TLDs (gTLDs), while the use of country-code TLDs specific to Korea was notably limited. This preference for gTLDs, often low-cost and easily registered, indicates attackers' efforts to maintain anonymity and reduce operational expenses.

A particularly significant finding concerned the abuse of name servers. The research highlighted that 87% of malicious domains were concentrated on Cloudflare name servers, indicating a common infrastructure choice for attackers. Within Cloudflare, malicious activity was heavily concentrated on specific name server pairs, notably Emma and Theo, and DNI and Isa. These name server pairs were frequently associated with load balancing, suggesting attackers use them to distribute traffic and enhance the resilience of their phishing sites. The identification of these specific name server patterns proved crucial for developing predictive indicators, as it allowed KISA to track relationships between seemingly disparate phishing URLs and their underlying infrastructure, enabling a more effective response.

Technical Deep Dive

▶ Watch: Attacker tactic: Randomized URLs to bypass blocking (10:00)

The technical deep dive into smishing attacks involved a multi-faceted approach, beginning with the meticulous decomposition of URLs. Each malicious URL identified in the 2,136 unique smishing messages was broken down into its constituent parts: protocol, domain, port, and path. This granular analysis allowed researchers to identify recurring structural patterns that might otherwise be obscured. By analyzing these patterns, KISA could track relationships between various phishing URLs and the name servers they utilized, forming the bedrock of their predictive model.

A key focus was on the relationship between specific name servers and the types of social engineering campaigns. For instance, DNI name servers were heavily associated with attacks impersonating public institutions. KISA identified 241 phishing domains using DNI, which exhibited RDGA (Random Domain Generation Algorithm)-like patterns. These domains typically featured a main domain composed of four lowercase letters and numbers, followed by paths that included words like "go," "official names," "official service names," or "Korea" to mimic legitimate institutional URLs. Attackers abused 45 different gTLDs, often low-cost domains, to launch these campaigns, making the URLs appear trustworthy to victims and facilitating the download of malicious apps. The speaker showed examples of these domains targeting the National Health Insurance Service and traffic fine services, demonstrating a seasonal shift in targets while maintaining the same underlying DNI name server infrastructure.

Another distinct pattern emerged with malicious wedding invitation apps, which used a different set of name servers: Rosali, Basley, Emma, and Theo. From July 2024 to January 2025, Rosali and Basley were dominant, with a shift to Emma and Theo starting in December 2024. These malicious URLs often inserted brand names directly into the address, leveraging brand squatting tactics to enhance credibility. A new pattern observed starting in July involved domains impersonating the "MA" brand in South Korea, generated using RDGAs and primarily used in wedding invitation smishing campaigns. These URLs, despite appearing random with varying subdomains and paths (e.g., mat.shop patterns), consistently connected to the same underlying phishing site. This technique of generating one-time or randomized URLs is a deliberate strategy by attackers to extend the lifespan of their phishing sites, bypass traditional blocking systems, and distribute a larger volume of variations simultaneously, making tracking and blocking significantly more challenging for defenders.

The concentration of malicious domains on Cloudflare name servers was a particularly striking technical finding. While Cloudflare offers legitimate services, its widespread use and robust infrastructure make it an attractive host for malicious actors. The fact that 87% of malicious domains were concentrated on Cloudflare, and specifically on certain name server pairs like Emma/Theo, provided a crucial focal point for KISA's analysis. By tracking newly registered domains associated with these specific name servers and matching them against the identified RDGA-like and brand-squatting patterns, KISA developed powerful predictive indicators. This shift from merely blocking known malicious URLs to actively identifying and intercepting newly generated domains based on their structural and infrastructural characteristics represents a significant advancement in proactive cybersecurity.

Demo / Proof of Concept

▶ Watch: Results: 23% malicious sites caught proactively (12:00)

The culmination of KISA's research was the successful integration of a new detection function into the Cyber Spider system, designed for the proactive identification of phishing domains before attacks are fully launched. This implementation serves as the practical demonstration and proof of concept for their pattern-based prediction model.

The newly established end-to-end process operates as follows:

1. Pattern Creation: Based on the detailed tracking and analysis of malicious URL and name server patterns (such as the DNI-associated RDGA-like structures or the Emma/Theo-linked wedding invitation scams), KISA created comprehensive detection patterns.
2. Daily Domain Collection: Cyber Spider automatically manages domain resources, collecting information on newly registered domains every day. This continuous feed provides a vital dataset for proactive monitoring.
3. Automated Pattern Matching: These newly registered domains are then automatically checked against the established detection patterns. This crucial step is performed by Artificial Intelligence (AI), enabling high-volume, real-time analysis to identify potential phishing domains.
4. Static and Dynamic Analysis: Detected domains that match the predictive patterns undergo further static and dynamic analysis to confirm their malicious nature. This validation step ensures accuracy before taking action.
5. KISK Control Center Review: The confirmed malicious information is then transmitted to the KISK control center. Human analysts review the AI-driven detections, providing an essential layer of oversight and verification.
6. Telecom Operator Blocking: Upon final confirmation, the KISK control center immediately requests telecom operators to block the malicious sites. This proactive blocking prevents the public from accessing these sites, effectively neutralizing the threat before it can cause widespread harm.

The effectiveness of this proactive detection process was clearly demonstrated in March 2025. During this period, Cyber Spider monitored new domains specifically for institutional and wedding invitation impersonations. The system detected a total of 326 malicious app distribution sites, averaging approximately 105 detections per day. Critically, 75 domains (or 23%) were caught in advance through this proactive detection process, meaning they were identified and blocked before they were reported as active smishing campaigns. This tangible result unequivocally validates the effectiveness of the pattern-based prediction model, showcasing its capability to intercept threats at an early stage and significantly reduce the window of opportunity for attackers.

Defensive Implications

▶ Watch: Conclusion and future plans for international cooperation (14:00)

The findings from KISA's 2024 analysis of smishing threats offer crucial defensive implications for cybersecurity professionals and organizations worldwide. The most significant takeaway is the imperative shift from purely reactive threat response to proactive, pattern-based prediction. Defenders must move beyond simply blocking known malicious indicators to actively identifying and anticipating future attack infrastructure.

Here are key defensive implications:

• Implement Proactive Domain Monitoring: Organizations should establish systems to continuously monitor newly registered domains, especially those associated with specific gTLDs (e.g., .app, .xyz) and name server pairs that have been identified as favored by attackers (e.g., Cloudflare's Emma/Theo, DNI/Isa). Integrating AI-driven pattern matching, similar to Cyber Spider's approach, can significantly enhance early detection capabilities.
• Focus on Name Server Behavior: Attackers' reliance on specific name servers for load balancing and resilience provides a powerful predictive indicator. Defenders should track patterns of domain registration under these high-risk name servers, looking for clusters of newly registered domains exhibiting RDGA-like characteristics or brand impersonation.
• Analyze URL Structure and Content Patterns: Beyond just domains, the specific structures within URLs (e.g., four-character alphanumeric main domains, inclusion of legitimate-sounding words in paths like "official" or "service") are strong indicators. Developing detection rules based on these granular URL patterns can help identify sophisticated phishing attempts that attempt to mimic legitimate sites.
• Educate Users on Evolving Social Engineering: While technical defenses are crucial, user education remains paramount. Users should be made aware of the current social engineering themes (fake obituaries, government fines, wedding invitations) prevalent in smishing attacks and understand that legitimate organizations rarely request sensitive information or app downloads via unsolicited SMS messages.
• Strengthen International Cooperation: Since RDGA-style attacks and malicious infrastructure can easily transcend national borders, international collaboration is essential. Security agencies and private companies should actively share threat intelligence, analysis methods, and detection techniques in real-time to build a collective defense against global cyber threats. This includes sharing information on abused TLDs, name servers, and attack patterns.
• Scrutinize One-Time/Randomized URLs: Attackers deliberately generate randomized or one-time URLs to bypass blocking systems and extend campaign lifespans. Defensive systems should be capable of identifying the underlying infrastructure or common patterns even when the surface-level URLs appear unique, rather than relying solely on exact URL matches.
• Leverage Centralized Threat Intelligence: The Cyber Spider project's success underscores the value of consolidating diverse threat intelligence (IPs, URLs, C2s, patterns) into a unified data lake. Organizations should strive to integrate their security data sources to enable comprehensive relationship analysis and more effective threat hunting.

By adopting these proactive and collaborative strategies, defenders can significantly improve their ability to predict, detect, and neutralize smishing and malicious app distribution campaigns, thereby safeguarding users and critical infrastructure.

Key Takeaways

• Proactive Prediction is Achievable: Through detailed pattern mining and name server tracking, KISA successfully developed a model to predict smishing attacks before they are reported, demonstrating a 23% proactive detection rate in real-world scenarios.
• Attackers Leverage Specific Infrastructure: A significant majority (87%) of malicious domains were concentrated on Cloudflare name servers, with specific pairs like Emma/Theo and DNI/Isa heavily abused, indicating critical choke points for defense.
• RDGA-like Patterns are Prevalent: Attackers frequently use Random Domain Generation Algorithm (RDGA)-like patterns, such as four-character alphanumeric domains combined with official-sounding paths, to mimic legitimate sites and evade detection.
• Social Engineering Themes Shift Seasonally: Smishing campaigns adapt their social engineering lures (e.g., fake obituaries, government impersonation, wedding invitations) based on seasonal or topical relevance, but often reuse the same underlying technical infrastructure.
• One-Time URLs Extend Attack Lifespan: Attackers generate randomized, one-time URLs to bypass blocking systems and distribute high volumes of variations, necessitating pattern-based detection over simple URL blacklisting.
• International Collaboration is Crucial: Given the cross-border nature of these threats, sharing analysis methods, detection techniques, and real-time threat information with global partners is essential for effective collective defense.

About the Speaker(s)

Kyung Rae Noh, also known by his English name Anthony, is a General Researcher at the Korea Internet Security Agency (KISA). He is actively involved in monitoring all websites in South Korea to detect hidden malicious activities and respond to cyber incidents. Within KISA, he is part of the Digital Threat Response Division, also known as KISK (or KrCERT), which is responsible for responding to cybersecurity incidents in the private sector of South Korea. His work involves collaborating closely with various national agencies and international partners to investigate cyber incidents and share threat information.

The research presented was a collaborative effort involving several experts: Shinho Lee and Eui-Tak Kim from Gachon University, and Yujin Shim, Jonghwa Han, and Jung-Sik Cho from KISA, highlighting a strong partnership between academia and government in advancing cybersecurity research.