Threat Intelligence & Research
Threat Intelligence & Research
We track adversary infrastructure targeting Japan (phishing and look-alike sites, malware delivery infrastructure), DPRK IT-worker networks, and foreign influence operations, combining public reporting with our own observation records. Technical findings that can be released are published under the name of Sola.com Co., Ltd. as research articles and advisories.
Observed facts are separated from assessments, and indicators of compromise are defanged. Tools and services used in our investigations are referred to generically rather than by product name.
Services
What we deliver
01 / Infrastructure Tracking
Infrastructure tracking
We analyze links between domains, IPs, certificates and hosting to follow how attack infrastructure spreads and how its operation changes.
02 / IOC & Detection
IOCs and detection logic
We turn what we track into indicators of compromise and detection logic, delivered in a form monitoring and response teams can use.
03 / Reporting
Reporting
Initial reports, follow-ups and continuous-monitoring reports for public-sector and enterprise clients.
Publications
Articles
| Date | Type | Title | Lang |
|---|---|---|---|
| 2026-10-24 | Threat Research | Tracking NAVER-impersonating phishing infrastructure, 2022–2026: assessing Kimsuky involvement Our archived scan records compared against 2022 public reporting; domain, IP, certificate and code-fragment links and their limits. IOC appendix and English edition in preparation. |
JA |
| 2026-09-22 | Landscape | Reading Taiwan's cybersecurity ecosystem: ACS, NICS, TWCERT/CC Taiwan's principal institutions and vendors, with comparisons to South Korea. |
JA |
| 2026-08-22 | Research Series | OVERRIDE 2022 #01 What happened on Japanese-language social media right after the invasion / #02 Not a switch but an accumulation: anti-vaccine and pro-Russia narratives / #03 How the "bioweapons lab" claim became a justification narrative |
JA |
| 2026-07-26 | Landscape | Reading South Korea's cybersecurity ecosystem: KISA, KrCERT/CC, AhnLab, ESRC | JA |
| 2026-07-12 | Note | If an AI execution environment is compromised: risks and protections for Cowork runtimes | JA |
Forthcoming: #004 A 2026 campaign abusing dynamic DNS (infrastructure selection and operational changes), #005 What a 2022–2026 comparison reveals.
Third-party Coverage
Press and Third-party References
- 2022-03-31 · Sankei ShimbunOur staff commented in the feature "The dark side of cyberspace"
- 2020-09-04 · Sankei ShimbunA cyberattack case analyzed by Sola.com was reported
Our analysis found that the data leak also affected retired Self-Defense Forces personnel. - 2020-08-17 · International pressA cyberattack case analyzed by Sola.com was reported by major newspapers abroad
Theft of about 7,600 Facebook account records; the data included work addresses at aerospace research institutions, universities and government agencies (Kahoku Shimpo, Nikkei, Mainichi, Japan Times, Kyodo News and others).
Policy
Publication Policy
- Facts and assessments — directly verified facts are stated separately from assessments drawn from them.
- Defanged indicators — domains and URLs are written with
[.]; hashes are given in full. - Attribution — co-occurrence or shared hosting alone is not treated as evidence of a common operator; assessments rest on multiple independent lines of evidence.
- Client information — findings from client engagements are published only after anonymization and with the client's consent.