GINC Technology
GINC-APT-1168 · Targeted, sponsor unknown

Automated Libra

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
South Africa(medium confidence)
Sources
1 source carries it
Identifier
GINC-APT-1168 · automated-libra

What it is

Automated Libra is a South African-based freejacking group that primarily targets cloud platforms offering limited-time trials of cloud resources in order to perform their cryptomining operations.<sup>[Sysdig October 25 2022]</sup><sup>[Unit 42 December 5 2024]</sup><sup>[Free Trial PurpleUrchin]</sup>

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

  • ThreatActor.info (Malpedia et al.)South Africa

Tools

The tools and malware families the sources tie to it.

  • CloudDuke