Prediction of future attack indicators based on the 2024 analysis of threats from malicious app...

## Overview

Anthony (Kyongo), a general researcher at Korea's Internet Security Agency (KISA), presented analysis of smishing and phishing attacks targeting South Korea in 2024. His research leverages Cyberp (Cyber Spider), an integrated detection system launched by KISA in 2024 that consolidates malicious IPs, domains, patterns, and C2 server data into a unified data lake. This integrated approach enables faster tracking and response to cyber attacks across web, network, and device domains.

## Key Findings

Anthony analyzed 2,136 unique smishing and phishing URLs from over 10 million messages collected by Cyberp in 2024. The analysis revealed several attack patterns:

**Attack Types**: The most common smishing attacks impersonated fake obituary services, followed by government institutions, wedding invitations, and financial organizations. Obituaries and government impersonations occurred year-round, while wedding invitation scams peaked in May during wedding season, and financial institution impersonations concentrated in Q2-Q3.

**Domain Infrastructure**: Attackers used 79 different TLDs, with .top being most prevalent (390 cases, 18%), followed by .xyz and .com. Approximately 24,000 domains used generic TLDs, while South Korea ccTLDs saw minimal abuse. Critically, 87% of malicious domains were registered with Cloudflare, with further concentration on specific paired name servers (DNS1 and Theo being most common for load balancing).

## Technical Details

**Pattern Analysis**: Anthony identified that 241 phishing domains abusing DNI name servers followed similar URL patterns—four-character main domains with added words like "go," "official," or "Korea" to appear legitimate. Attackers registered these domains across 45 different gTLDs, primarily using low-cost providers.

For wedding invitation malicious app distribution, 205 phishing URLs were identified using Rosali, Basley, Emma, and Theo name servers. Starting in July 2024, attackers implemented randomized subdomain and path generation (approximately 34% of detected domains used Random Domain Generation/RDGAS) to create one-time URLs that evade blocking systems while maintaining connections to the same phishing infrastructure.

**Predictive Detection**: Based on tracking results, KISA developed automated detection patterns in Cyberp. Newly registered domains are checked daily against these patterns using AI analysis, followed by static/dynamic analysis, then submitted to the KISK control center for blocking requests to telecom operators.

## Results and Takeaways

In March 2025, proactive monitoring detected 326 malicious app distribution sites—approximately 105 per day. Of these, 75 domains (23%) were discovered through the new prediction model before being reported as smishing, demonstrating the effectiveness of pattern-based proactive detection.

Key insights include: social engineering campaigns evolved seasonally; attackers concentrated infrastructure on specific name server providers despite using diverse TLDs; and randomization techniques were designed to extend attack lifespan. KISA is sharing analysis methods, detection techniques, and real-time threat intelligence with domestic and international partners, emphasizing that RDGAS-style attacks spread across borders and require global cooperation.

The research establishes that the integrated Cyberp system combined with pattern mining enables faster response cycles and proactive defense against emerging phishing campaigns.