ExpressVPN

Reported Context (1)

During our investigation, we observed the threat actor accessing RelayShell through shared VPN services, including ExpressVPN, further obscuring the origin of their infrastructure. Lazarus Uses AFD.sys Zero-Day in Operation Dream Job Campaign Targeting Defense Sector

CVE (4)

Malware (6)

Threat Actors (1)

MITRE ATT&CK (16)

Vendors (1)

Products (7)

Industries (3)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.