Andariel Hackers Leveraging Remote Tools To Exploit Organizations

The report details Andariel group activity against Korean companies, describing use of AndarLoader (downloader using KoiVM), ModeLoader (JS delivered via mshta), MeshAgent for remote management and lateral movement, credential theft via Mimikatz and a keylogger, and evidence removal (wevtutil). It provides MD5 hashes and C2 domains/IPs for detection and notes this as the first observed use of MeshAgent by the group.