Overview Highlights State-Linked Cyber Threat Groups, Targets and Tools
Summary
A high-level overview profiles eight state-linked threat groups, outlining their suspected origins, motivations, target sectors, and reported malware and tactics, including espionage, phishing, credential theft, and surveillance.
Key points
- The article profiles Sea Turtle, DarkHotel, ShroudedSnooper, MuddyWater, Scarcruft, Sidewinder, Iron Tiger, and APT28.
- Reported targets include governments, telecommunications, media, defense, research, finance, and critical infrastructure.
- Espionage, information gathering, surveillance, and theft of sensitive information are recurring motivations.
- Initial access methods mentioned include DNS hijacking, account compromise, spear-phishing, and watering-hole attacks.
- The groups use varied tools, including backdoors, keyloggers, remote access tools, custom scripts, and proxy software.
- The article recommends staying informed about adversaries, using layered security measures, and fostering security awareness.
Article Details
- Topic
- Overview of state-linked cyber threat groups, their aliases, suspected origins, target sectors, motivations, malware, and tools.
Threat Actors
APT28Threat group active since 2004, tied to the Russian GRU, and reported to target governments, energy facilities, and technology companies.APT37Alias for Scarcruft, attributed to Mandiant/Google; the article says the group is more commonly referred to by this name.Bronze UnionAlias for Iron Tiger, attributed to SecureWorks.BudwormAlias for Iron Tiger, attributed to Symantec.DarkHotelThreat group reported to target business travelers, research and development, political figures, governments, and the medical field.Fallout TeamAlias for DarkHotel, attributed to CrowdStrike.Fancy BearAlias for APT28, attributed to CrowdStrike.HigaisaAlias for DarkHotel, attributed to Tencent.InkySquidAlias for Scarcruft, attributed to Volexity.Iron TigerThreat group reported to target governments, telecommunications, defense, and private sectors worldwide.LuckyMouseAlias for Iron Tiger, attributed to Kaspersky.Mango SandstormAlias for MuddyWater, attributed to Microsoft.MarbledDustAlias for Sea Turtle, attributed to Microsoft.MuddyWaterThreat group active since 2017 and believed to be associated with Iran's MOIS; reported to conduct espionage and target organizations across multiple regions.Pawn StormAlias for APT28, attributed to Trend Micro.Razor TigerAlias for Sidewinder, attributed to CrowdStrike.Ricochet ChollimaAlias for Scarcruft, attributed to CrowdStrike.RubySleetAlias for Scarcruft, attributed to Microsoft.ScarCruftThreat group reported to conduct espionage and surveillance, primarily targeting South Korea and also targeting other countries.Sea TurtleState-linked threat group reported to target government and public organizations, telecommunications providers, media organizations, and think tanks.SeedwormAlias for MuddyWater, attributed to Symantec.SHORE CASTLEAlias for Iron Tiger, attributed to Mandiant/Google.ShroudedSnooperThreat group reported to target telecommunications companies in the Middle East.SidewinderThreat group reported to target the Pakistani armed forces, government, media, financial institutions, and targets in other Asian countries.SofacyAlias for APT28, attributed to Kaspersky.Teal KurmaAlias for Sea Turtle, attributed to PwC.TG-4127Alias for APT28, attributed to SecureWorks.UNC1326Alias for Sea Turtle, attributed to Mandiant/Google.Zigzag HailAlias for DarkHotel, attributed to Microsoft.
Malware
ASPXSPYMalware Used: Tools used by Iron Tiger include China Chopper, Gh0st, HTran, HyperBro, PlugX, ASPXSPY, etc.China ChopperMalware Used: Tools used by Iron Tiger include China Chopper, Gh0st, HTran, HyperBro, PlugX, ASPXSPY, etc.DealersChoiceMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.Gh0stwas "Ramsay"6, which targeted air-gapped networks. Researchers have also reported that the group uses Gh0st RAT and PlugX; although both are available through various means, these tools have historically beenGh0st RATwas "Ramsay"6, which targeted air-gapped networks. Researchers have also reported that the group uses Gh0st RAT and PlugX; although both are available through various means, these tools have historically beenGold BackdoorMalware Used: Some tools Scarcruft has been reported using RokRAT, Cobalt Strike, Gold Backdoor, and Konni, among many others.GraphiteMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.HEADLACEMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.HIDEDRVMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.HTranMalware Used: Tools used by Iron Tiger include China Chopper, Gh0st, HTran, HyperBro, PlugX, ASPXSPY, etc.HTTPSnoopMalware Used: ShroudedSnooper has used two backdoors, HTTPSnoop and PipeSnoop. Talos' report indicates that the group targets public-facing servers and attempts to evade defenses by spoofing Microsoft Exchange WebHyperBroMalware Used: Tools used by Iron Tiger include China Chopper, Gh0st, HTran, HyperBro, PlugX, ASPXSPY, etc.KonniMalware Used: Some tools Scarcruft has been reported using RokRAT, Cobalt Strike, Gold Backdoor, and Konni, among many others.PipeSnoopMalware Used: ShroudedSnooper has used two backdoors, HTTPSnoop and PipeSnoop. Talos' report indicates that the group targets public-facing servers and attempts to evade defenses by spoofing Microsoft Exchange WebPlugXwhich targeted air-gapped networks. Researchers have also reported that the group uses Gh0st RAT and PlugX; although both are available through various means, these tools have historically been associated withRamsayMalware Used: One of the more interesting tools DarkHotel used was "Ramsay"6, which targeted air-gapped networks. Researchers have also reported that the group uses Gh0st RAT and PlugX; although both are availableRokRATMalware Used: Some tools Scarcruft has been reported using RokRAT, Cobalt Strike, Gold Backdoor, and Konni, among many others.SedkitMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.SnappyTCPX-TunnelMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.ZebrocyMalware Used: Notable malicious software the group uses include Headlace, Graphite, Zebrocy, Sedkit, Koadic, X-Tunnel, DealersChoice, and HIDEDRV, just to name a few.
Tools
Cobalt StrikeMalware Used: Some tools Scarcruft has been reported using RokRAT, Cobalt Strike, Gold Backdoor, and Konni, among many others.Koadicoperations include MuddyC2Go8, heavy use of custom scripts, Revsocks9, and a SOCKS5 proxy server, Koadic, LaZagne, and PowerSploit.LaZagneinclude MuddyC2Go8, heavy use of custom scripts, Revsocks9, and a SOCKS5 proxy server, Koadic, LaZagne, and PowerSploit.MuddyC2Go(https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel)PowerSploitMuddyC2Go8, heavy use of custom scripts, Revsocks9, and a SOCKS5 proxy server, Koadic, LaZagne, and PowerSploit.revsocksWarHawkMalware Used: Spear-phishing using malicious Office and shortcut files allows initial access into victim environments. Tools used include Koadic, and WarHawk.
Countries
Afghanistangathering on the Pakistani government, media, and financial institutions. However, China, Nepal, and Afghanistan have also been targeted. The theft of sensitive information from their victims makes the group aChinaSummary: Active since 2012, the group, more commonly referred to as APT37 has primarily targeted their neighbors in South Korea but is also known to target Japan, Russia, China, and the Middle East.IndiaSuspected Origin: ð®ð³ IndiaIranSuspected Origin: ð®ð· IranJapanSummary: Active since 2012, the group, more commonly referred to as APT37 has primarily targeted their neighbors in South Korea but is also known to target Japan, Russia, China, and the Middle East.Nepalbe intelligence gathering on the Pakistani government, media, and financial institutions. However, China, Nepal, and Afghanistan have also been targeted. The theft of sensitive information from their victims makes theNorth KoreaSuspected Origin: ð°ðµ North KoreaPakistanSidewinder puts the "P" in persistent threats. While the group has targeted several countries in Asia, Pakistan (specifically the military) has garnered much of their attention. Almost daily, domain names targetingRussiaSummary: Active since 2012, the group, more commonly referred to as APT37 has primarily targeted their neighbors in South Korea but is also known to target Japan, Russia, China, and the Middle East.South KoreaSuspected Origin: ð°ð· South KoreaTurkeySuspected Origin: ð¹ð· Turkey
Industries
Critical infrastructurethe group. Victims include governments, private organizations, telecommunications companies, and critical infrastructure. Siphoning information once on the objective is the group's primary focus, and deployingDefensecycle, making minor changes to evade defenders. Since 2010, the group has targeted governments, telecom, defense, and private sectors worldwide.EnergySummary: From election interference to false flags, Olympic committees, and energy facilities, just to name a few, it's safe to say Fancy Bear stays quite busy. Active since 2004 and tied to the Russian GRU, we couldFinancial ServicesGovernmentSummary: First reported on by Talos, Sea Turtle has targeted multiple sectors of government and public organizations across Europe and MENA, most notably, the Kurdistan Workers Party, or PKK. With only a handful ofMediato the above mentioned areas, operations have been detected against telecommunications providers, media organizations, and think tanks.Medicalgathering) and expanded to include research and development, political figures5, governments, and the medical field, among others.Public organizationsSummary: First reported on by Talos, Sea Turtle has targeted multiple sectors of government and public organizations across Europe and MENA, most notably, the Kurdistan Workers Party, or PKK. With only a handful ofResearch and developmenton business travelers (likely for surveillance or information gathering) and expanded to include research and development, political figures5, governments, and the medical field, among others.Technologygovernment, APT28 has targeted governments, the World Anti-Doping Agency, energy facilities, and technology companies. These operations have been conducted to counter existing narratives around the government,Telecommunicationstheir targeting. In addition to the above mentioned areas, operations have been detected against telecommunications providers, media organizations, and think tanks.Think tanksareas, operations have been detected against telecommunications providers, media organizations, and think tanks.