- Category
- Tracked, unattributed · A vendor’s working cluster, not yet attributed.
- Origin
- Unknown
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0390 · clockwork-spider
What it is
Opportunistic actor that installs custom root certificate on victim to support man-in-the-middle network monitoring.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Clockwork Spider
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de