SPIRE CASTLE

Reported Context (15)

Telecom monitoring priority associated with spear-phishing, exposed-system exploitation, credential theft, web shells and malware deployment; no period-specific SAARC activity was observed. CYFIRMA Report Maps Cyber Threats Facing India and SAARC Telecom Sector
Presented as a China-aligned threat actor profile relevant to the sector, with IP theft and supply-chain objectives; the report does not claim confirmed activity against India/SAARC manufacturing during the reporting period. CYFIRMA Report Warns of Ransomware and Supply-Chain Risks for South Asian Manufacturing
Listed as a China-aligned nation-state espionage group targeting India's Government and Defence ecosystem. CYFIRMA Report: Persistent Espionage and Identity Attacks Target India’s Government and Defence Sector
Previously used name mapped to the new name SPIRE CASTLE. Google Threat Intelligence Group Introduces Unified Threat Actor Naming System
Named as an example of an advanced persistent threat group. How External Threat Intelligence Can Help Track APT Activity

CVE (24)

Malware (40)

People (9)

Threat Actors (111)

MITRE ATT&CK (46)

Vendors (35)

Products (57)

Tools (33)

Industries (36)

Countries (43)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.