- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Singapore(medium confidence)
- Motivation
- Financial gain
- Seen
- 2020
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0376 · altdos
What it is
ALTDOS is a threat actor group that has targeted entities in Southeast Asia, including Singapore, Thailand, and Malaysia. They have been involved in data breaches of companies in various sectors, such as real estate and retail, compromising sensitive information like customer names, bank account numbers, and transaction details. ALTDOS uses tactics like ransomware attacks, data exfiltration, and dumping data publicly or for sale on underground forums. The group has been known to demand ransom payments from victims, but also leaks data if demands are not met.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Desorden, GhostR, 0mid16B, ALTDOS, Desorden
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTSingapore
Targets
- Countries
- Australia, Austria, Bangladesh, Cambodia, Canada, France, India, Indonesia, Malaysia, New Zealand, Pakistan, Philippines, Singapore, Taiwan, Thailand, United Kingdom, United States
Tools
The tools and malware families the sources tie to it.
- Ghost
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de