{"id":17828,"date":"2026-10-31T13:50:36","date_gmt":"2026-10-31T04:50:36","guid":{"rendered":"https:\/\/solanets.com\/?page_id=17828"},"modified":"2026-10-31T15:45:58","modified_gmt":"2026-10-31T06:45:58","slug":"security-research","status":"publish","type":"page","link":"https:\/\/solanets.com\/en\/security-research\/","title":{"rendered":"Threat Intelligence &#038; Research"},"content":{"rendered":"<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:20px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><link rel=\"stylesheet\" href=\"https:\/\/fonts.googleapis.com\/css2?family=Noto+Sans+JP:wght@100..900&display=swap\">\n<style>\n.sn-sec{\n--sn-navy:#1f2a44;\n--sn-navy-deep:#141c30;\n--sn-ecru:#f6f1e7;\n--sn-paper:#fffdf9;\n--sn-ink:#1c1c1c;\n--sn-muted:#5c6170;\n--sn-rule:#d8d0bf;\n--sn-accent:#8a6d2f;\n--sn-serif:\"Noto Sans JP\",\"Hiragino Sans\",\"Hiragino Kaku Gothic ProN\",\"Yu Gothic\",sans-serif;\n--sn-sans:\"Noto Sans JP\",\"Hiragino Sans\",\"Hiragino Kaku Gothic ProN\",\"Yu Gothic\",sans-serif;\n--sn-mono:\"JetBrains Mono\",\"SFMono-Regular\",Menlo,Consolas,monospace;\nfont-family:var(--sn-sans);\ncolor:var(--sn-ink);\nline-height:1.9;\nmax-width:1080px;\nmargin:0 auto;\npadding:8px 16px 56px;\nbox-sizing:border-box;\n}\n.sn-sec *{box-sizing:border-box}\n.sn-sec a{color:var(--sn-navy);text-decoration:underline;text-underline-offset:3px}\n.sn-sec a:hover{color:var(--sn-accent)}\n.sn-sec .sn-label{\nfont-family:var(--sn-mono);font-size:12px;letter-spacing:.14em;text-transform:uppercase;\ncolor:var(--sn-accent);margin:0 0 10px;\n}\n.sn-sec .sn-h1{font-family:var(--sn-serif);font-weight:550;letter-spacing:-.01em;font-size:34px;line-height:1.35;margin:0 0 14px;color:var(--sn-navy-deep)}\n.sn-sec .sn-h2{font-family:var(--sn-serif);font-weight:500;font-size:24px;line-height:1.4;margin:0 0 12px;color:var(--sn-navy-deep)}\n.sn-sec .sn-h3{font-family:var(--sn-serif);font-weight:500;font-size:19px;line-height:1.45;margin:0 0 8px;color:var(--sn-navy-deep)}\n.sn-sec .sn-lead{font-size:17px;color:var(--sn-ink);max-width:760px;margin:0 0 8px}\n.sn-sec .sn-sub{font-size:14.5px;color:var(--sn-muted);max-width:760px;margin:0}\n.sn-sec .sn-hero{padding:40px 0 28px;border-bottom:1px solid var(--sn-rule)}\n.sn-sec .sn-block{padding:40px 0 8px}\n.sn-sec .sn-block + .sn-block{border-top:1px solid var(--sn-rule)}\n.sn-sec .sn-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:20px;margin-top:22px}\n@media (max-width:760px){.sn-sec .sn-grid{grid-template-columns:1fr}}\n.sn-sec .sn-card{background:var(--sn-paper);border:1px solid var(--sn-rule);border-top:3px solid var(--sn-navy);padding:22px 22px 18px}\n.sn-sec .sn-card .sn-label{margin-bottom:6px}\n.sn-sec .sn-card p{margin:0 0 10px;font-size:15px}\n.sn-sec .sn-card ul{margin:6px 0 10px 1.2em;padding:0;font-size:14.5px}\n.sn-sec .sn-card li{margin:2px 0}\n.sn-sec .sn-more{font-family:var(--sn-mono);font-size:12.5px;letter-spacing:.04em}\n.sn-sec .sn-note{background:var(--sn-ecru);border-left:3px solid var(--sn-navy);padding:14px 18px;margin:22px 0 0;font-size:14.5px;color:var(--sn-ink)}\n.sn-sec .sn-note p{margin:0}\n.sn-sec .sn-feature{display:grid;grid-template-columns:1.1fr .9fr;gap:28px;align-items:start;margin-top:18px}\n@media (max-width:760px){.sn-sec .sn-feature{grid-template-columns:1fr}}\n.sn-sec .sn-spec{font-size:14.5px;margin:0;padding:0;list-style:none}\n.sn-sec .sn-spec li{padding:10px 0;border-bottom:1px dashed var(--sn-rule)}\n.sn-sec .sn-spec li:last-child{border-bottom:0}\n.sn-sec .sn-spec b{font-weight:600;color:var(--sn-navy-deep)}\n.sn-sec .sn-table{width:100%;border-collapse:collapse;font-size:14.5px;margin-top:18px}\n.sn-sec .sn-table th{font-family:var(--sn-mono);font-size:12px;letter-spacing:.1em;text-transform:uppercase;text-align:left;color:var(--sn-muted);padding:10px 10px;border-bottom:2px solid var(--sn-navy)}\n.sn-sec .sn-table td{padding:12px 10px;border-bottom:1px solid var(--sn-rule);vertical-align:top}\n.sn-sec .sn-table td.sn-date{font-family:var(--sn-mono);font-size:13px;white-space:nowrap;color:var(--sn-muted)}\n.sn-sec .sn-tag{display:inline-block;font-family:var(--sn-mono);font-size:11px;letter-spacing:.08em;text-transform:uppercase;border:1px solid var(--sn-rule);padding:1px 7px;border-radius:2px;color:var(--sn-muted);background:var(--sn-paper);white-space:nowrap}\n.sn-sec .sn-tag.is-research{border-color:var(--sn-navy);color:var(--sn-navy)}\n.sn-sec .sn-cta{display:flex;flex-wrap:wrap;gap:12px;margin-top:26px}\n.sn-sec .sn-btn{display:inline-block;font-family:var(--sn-sans);font-size:14.5px;padding:11px 20px;border:1px solid var(--sn-navy);text-decoration:none !important;color:#fff !important;background:var(--sn-navy)}\n.sn-sec .sn-btn.is-ghost{background:transparent;color:var(--sn-navy) !important}\n.sn-sec .sn-btn:hover{opacity:.9}\n.sn-sec .sn-kicker{display:block;font-family:var(--sn-mono);font-size:12px;color:var(--sn-muted);letter-spacing:.06em;margin:0 0 4px}\n.sn-sec .sn-small{font-size:13px;color:var(--sn-muted)}\n.sn-sec h1,.sn-sec h2,.sn-sec h3{text-transform:none}\n.sn-sec .sn-grid.is-3{grid-template-columns:repeat(3,minmax(0,1fr))}\n@media (max-width:760px){.sn-sec .sn-grid.is-3{grid-template-columns:1fr}}\n.sn-sec ul.sn-spec{margin:0;padding:0}\n.sn-sec ul.sn-spec li{list-style:none;margin:0}\n.sn-sec .sn-table td,.sn-sec .sn-table th{border-left:0;border-right:0;border-top:0}\n@media (max-width:760px){.sn-sec .sn-h1{font-size:26px}.sn-sec .sn-h2{font-size:21px}.sn-sec .sn-hero{padding-top:24px}.sn-sec .sn-table th:nth-child(2),.sn-sec .sn-table td:nth-child(2),.sn-sec .sn-table th:nth-child(4),.sn-sec .sn-table td:nth-child(4){display:none}}\n<\/style>\n<section class=\"sn-sec\">\n<header class=\"sn-hero\">\n<p class=\"sn-label\">Threat Intelligence & Research<\/p>\n<h1 class=\"sn-h1\">Threat Intelligence & Research<\/h1>\n<p class=\"sn-lead\">We track adversary infrastructure targeting Japan (phishing and look-alike sites, malware delivery infrastructure), DPRK IT-worker networks, and foreign influence operations, combining public reporting with our own observation records. Technical findings that can be released are published under the name of Sola.com Co., Ltd. as research articles and advisories.<\/p>\n<p class=\"sn-sub\">Observed facts are separated from assessments, and indicators of compromise are defanged. Tools and services used in our investigations are referred to generically rather than by product name.<\/p>\n<\/header>\n<div class=\"sn-block\">\n<p class=\"sn-label\">Services<\/p>\n<h2 class=\"sn-h2\">What we deliver<\/h2>\n<div class=\"sn-grid is-3\">\n<article class=\"sn-card\">\n<p class=\"sn-label\">01 \/ Infrastructure Tracking<\/p>\n<h3 class=\"sn-h3\">Infrastructure tracking<\/h3>\n<p>We analyze links between domains, IPs, certificates and hosting to follow how attack infrastructure spreads and how its operation changes.<\/p>\n<\/article>\n<article class=\"sn-card\">\n<p class=\"sn-label\">02 \/ IOC & Detection<\/p>\n<h3 class=\"sn-h3\">IOCs and detection logic<\/h3>\n<p>We turn what we track into indicators of compromise and detection logic, delivered in a form monitoring and response teams can use.<\/p>\n<\/article>\n<article class=\"sn-card\">\n<p class=\"sn-label\">03 \/ Reporting<\/p>\n<h3 class=\"sn-h3\">Reporting<\/h3>\n<p>Initial reports, follow-ups and continuous-monitoring reports for public-sector and enterprise clients.<\/p>\n<\/article>\n<\/div>\n<\/div>\n<div class=\"sn-block\">\n<p class=\"sn-label\">Publications<\/p>\n<h2 class=\"sn-h2\">Articles<\/h2>\n<table class=\"sn-table\">\n<thead>\n<tr><th>Date<\/th><th>Type<\/th><th>Title<\/th><th>Lang<\/th><\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td class=\"sn-date\">2026-10-24<\/td>\n<td><span class=\"sn-tag is-research\">Threat Research<\/span><\/td>\n<td><a href=\"\/2026\/10\/24\/naver-phishing-infrastructure-2022-2026\/\">Tracking NAVER-impersonating phishing infrastructure, 2022\u20132026: assessing Kimsuky involvement<\/a><br><span class=\"sn-small\">Our archived scan records compared against 2022 public reporting; domain, IP, certificate and code-fragment links and their limits. IOC appendix and English edition in preparation.<\/span><\/td>\n<td>JA<\/td>\n<\/tr>\n<tr>\n<td class=\"sn-date\">2026-09-22<\/td>\n<td><span class=\"sn-tag\">Landscape<\/span><\/td>\n<td><a href=\"\/2026\/09\/22\/%e5%8f%b0%e6%b9%be%e3%81%ae%e3%82%b5%e3%82%a4%e3%83%90%e3%83%bc%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e3%82%92%e8%aa%ad%e3%81%bf%e8%a7%a3%e3%81%8f-%e2%80%95-acs%e3%80%81nics%e3%80%81tw\/\">Reading Taiwan's cybersecurity ecosystem: ACS, NICS, TWCERT\/CC<\/a><br><span class=\"sn-small\">Taiwan's principal institutions and vendors, with comparisons to South Korea.<\/span><\/td>\n<td>JA<\/td>\n<\/tr>\n<tr>\n<td class=\"sn-date\">2026-08-22<\/td>\n<td><span class=\"sn-tag is-research\">Research Series<\/span><\/td>\n<td><a href=\"\/override-2022\/\">OVERRIDE 2022<\/a><br><span class=\"sn-small\">\n<a href=\"\/2026\/08\/22\/override-2022-01-information-space\/\">#01 What happened on Japanese-language social media right after the invasion<\/a> \/\n<a href=\"\/2026\/08\/22\/override-2022-02-narrative-connection\/\">#02 Not a switch but an accumulation: anti-vaccine and pro-Russia narratives<\/a> \/\n<a href=\"\/2026\/08\/22\/override-2022-03-bioweapons-narrative\/\">#03 How the \"bioweapons lab\" claim became a justification narrative<\/a>\n<\/span><\/td>\n<td>JA<\/td>\n<\/tr>\n<tr>\n<td class=\"sn-date\">2026-07-26<\/td>\n<td><span class=\"sn-tag\">Landscape<\/span><\/td>\n<td><a href=\"\/2026\/07\/26\/korea-cybersecurity-ecosystem-kisa-ahnlab-esrc\/\">Reading South Korea's cybersecurity ecosystem: KISA, KrCERT\/CC, AhnLab, ESRC<\/a><\/td>\n<td>JA<\/td>\n<\/tr>\n<tr>\n<td class=\"sn-date\">2026-07-12<\/td>\n<td><span class=\"sn-tag\">Note<\/span><\/td>\n<td><a href=\"\/2026\/07\/12\/ai%e5%ae%9f%e8%a1%8c%e7%92%b0%e5%a2%83%e3%81%8c%e4%b9%97%e3%81%a3%e5%8f%96%e3%82%89%e3%82%8c%e3%81%9f%e3%82%89%e3%80%81%e4%bd%95%e3%81%8c%e8%b5%b7%e3%81%8d%e3%82%8b%e3%81%8b%e3%80%82-cowork\/\">If an AI execution environment is compromised: risks and protections for Cowork runtimes<\/a><\/td>\n<td>JA<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div class=\"sn-note\">\n<p>Forthcoming: <b>#004 A 2026 campaign abusing dynamic DNS<\/b> (infrastructure selection and operational changes), <b>#005 What a 2022\u20132026 comparison reveals<\/b>.<\/p>\n<\/div>\n<\/div>\n<div class=\"sn-block\">\n<p class=\"sn-label\">Third-party Coverage<\/p>\n<h2 class=\"sn-h2\">Press and Third-party References<\/h2>\n<ul class=\"sn-spec\">\n<li><span class=\"sn-kicker\">2022-03-31 \u00b7 Sankei Shimbun<\/span><b><a href=\"\/2022\/03\/31\/%e7%94%a3%e7%b5%8c%e6%96%b0%e8%81%9e%e3%81%ab%e3%81%a6%e5%80%8b%e4%ba%ba%e6%83%85%e5%a0%b1%e6%b5%81%e5%87%ba%e3%81%ab%e9%96%a2%e3%81%99%e3%82%8b%e5%bc%8a%e7%a4%be%e3%81%ae%e5%88%86%e6%9e%90\/\">Our staff commented in the feature \"The dark side of cyberspace\"<\/a><\/b><\/li>\n<li><span class=\"sn-kicker\">2020-09-04 \u00b7 Sankei Shimbun<\/span><b><a href=\"\/2020\/09\/04\/%e7%94%a3%e7%b5%8c%e6%96%b0%e8%81%9e%e3%81%ab%e3%81%a6%e5%bd%93%e7%a4%be%e8%a7%a3%e6%9e%90%e3%81%ae%e3%82%b5%e3%82%a4%e3%83%90%e3%83%bc%e6%94%bb%e6%92%83%e4%ba%8b%e6%a1%88%e3%81%ab%e3%81%a4%e3%81%84\/\">A cyberattack case analyzed by Sola.com was reported<\/a><\/b><br><span class=\"sn-small\">Our analysis found that the data leak also affected retired Self-Defense Forces personnel.<\/span><\/li>\n<li><span class=\"sn-kicker\">2020-08-17 \u00b7 International press<\/span><b><a href=\"\/2020\/08\/17\/%e5%bd%93%e7%a4%be%e3%81%8c%e8%a7%a3%e6%9e%90%e3%81%97%e3%81%9f%e3%82%b5%e3%82%a4%e3%83%90%e3%83%bc%e6%94%bb%e6%92%83%e4%ba%8b%e6%a1%88%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6%e5%a0%b1%e9%81%93%e3%81%84\/\">A cyberattack case analyzed by Sola.com was reported by major newspapers abroad<\/a><\/b><br><span class=\"sn-small\">Theft of about 7,600 Facebook account records; the data included work addresses at aerospace research institutions, universities and government agencies (Kahoku Shimpo, Nikkei, Mainichi, Japan Times, Kyodo News and others).<\/span><\/li>\n<\/ul>\n<p class=\"sn-more\"><a href=\"\/media-coverage\/\">All media coverage \u2192<\/a><\/p>\n<\/div>\n<div class=\"sn-block\">\n<p class=\"sn-label\">Policy<\/p>\n<h2 class=\"sn-h2\">Publication Policy<\/h2>\n<ul class=\"sn-spec\">\n<li><b>Facts and assessments<\/b> \u2014 directly verified facts are stated separately from assessments drawn from them.<\/li>\n<li><b>Defanged indicators<\/b> \u2014 domains and URLs are written with <code>[.]<\/code>; hashes are given in full.<\/li>\n<li><b>Attribution<\/b> \u2014 co-occurrence or shared hosting alone is not treated as evidence of a common operator; assessments rest on multiple independent lines of evidence.<\/li>\n<li><b>Client information<\/b> \u2014 findings from client engagements are published only after anonymization and with the client's consent.<\/li>\n<\/ul>\n<div class=\"sn-cta\">\n<a class=\"sn-btn is-ghost\" href=\"\/en\/cyber_security\/\">Cybersecurity services<\/a>\n<a class=\"sn-btn\" href=\"\/contact_us\/\">Contact us<\/a>\n<\/div>\n<\/div>\n<\/section>\n<\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":7,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"_acf_changed":false,"_locale":"en_US","_original_post":"https:\/\/solanets.com\/?page_id=17812","footnotes":""},"class_list":["post-17828","page","type-page","status-publish","hentry","en-US"],"acf":[],"_links":{"self":[{"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/pages\/17828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/comments?post=17828"}],"version-history":[{"count":1,"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/pages\/17828\/revisions"}],"predecessor-version":[{"id":17830,"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/pages\/17828\/revisions\/17830"}],"wp:attachment":[{"href":"https:\/\/solanets.com\/wp-json\/wp\/v2\/media?parent=17828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}