Threat Actor: KRBanker Syndicate

Classification: Organized Cybercrime Syndicate · Origin / Sponsoring State: East Asia · Active Since: 2013 - 2018 · Cataloged Payloads: 1 · Observed Samples: 228

Executive Threat Summary

KRBanker Syndicate is classified as an advanced Organized Cybercrime Syndicate originating primarily from East Asia. Driven by operational objectives spanning hosts file tampering, banking pharming redirections & financial infiltration, this threat entity has maintained an active footprint from 2013 - 2018. In enterprise telemetry and malware repository classification, KRBanker Syndicate has been corroborated across 1 distinct malware families with over 228 validated sample hashes.

Operational Threat Profile & Targeting

Known Aliases	`BlackMoon Gang, KRBanker Cybercrime Operators`
Targeted Sectors	South Korean Banking Portals, Commercial Accounting, Financial Institutions
Primary Motivations	Hosts File Tampering, Banking Pharming Redirections & Financial Infiltration
Dominant Payload Categories	Banking Trojan
MITRE ATT&CK Reference	`https://attack.mitre.org/software/S0103/` ↗

Primary Observed MITRE ATT&CK Tradecraft

The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by KRBanker Syndicate:

T1565.002 — weaponized across 1 catalog payload(s)
T1185 — weaponized across 1 catalog payload(s)
T1555.003 — weaponized across 1 catalog payload(s)
T1071.001 — weaponized across 1 catalog payload(s)
T1566.002 — weaponized across 1 catalog payload(s)
T1056.001 — weaponized across 1 catalog payload(s)

→ Explore all 226 MITRE ATT&CK Technique Hubs

Exploited Vulnerabilities (CVEs)

Telemetry confirms KRBanker Syndicate has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:

CVE-2014-0515 — Technical Dossier & Exploitation Analysis (NVD ↗)
CVE-2015-5119 — Technical Dossier & Exploitation Analysis (NVD ↗)

Attributed Catalog Malware Families (1 Families)

The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to KRBanker Syndicate:

1 families

Family	Category	Sample Count	Technical Summary
blackmoon	Banking Trojan	`228`	Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, speci...

SOC Hardening & Defensive Containment

Defending enterprise perimeters against campaigns staged by KRBanker Syndicate requires defense-in-depth posture enforcement:

Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).

→ Threat Defense Playbook: Read our Active Incident Response Playbook