Sowbug

Bedrohungsakteur

auch bekannt als

Weitere Namen und Kennungen dieser Entität.

ATT&CK

Sowbug

MISP

Sowbug

Sowbug has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets. Sowbug has been seen mounting classic espionage attacks by stealing documents from the organizations it infiltrates.

zugeordnete ATT&CK-Gruppen

Zugehörige Bedrohungsgruppen.

G0054Sowbug

genutzte Techniken (9)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

T1003OS Credential Dumping
T1036.005Match Legitimate Resource Name or Location
T1039Data from Network Shared Drive
T1056.001Keylogging
T1059.003Windows Command Shell
T1082System Information Discovery
T1083File and Directory Discovery
T1135Network Share Discovery
T1560.001Archive via Utility

genutzte Software (2)

Zugehörige Malware und Tools.

S0171Felismus
S0188Starloader

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments
https://www.cfr.org/interactive/cyber-operations/sowbug
https://attack.mitre.org/groups/G0054/