- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2022–2023
- Status
- Dormant
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0285 · dalbit
ChinaWhat it is
The group usually targets vulnerable servers to breach information including internal data from companies or encrypts files and demands money. Their targets of attack are usually Windows servers that are poorly managed or are not patched to the latest version. Besides these, there are also attack cases that targeted email servers or MS-SQL database servers.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- South Korea
- Sectors
- Automotive, Chemical, Construction, Education, Energy, Food and Agriculture, High-Tech, Hospitality, Industrial, Maritime and Shipbuilding, Media, Shipping and Logistics, Technology
Tools
The tools and malware families the sources tie to it.
- ASPXSpy
- AntSword
- BadPotato
- BlueShell
- China Chopper
- Cobalt Strike
- EFSPotato
- FRP
- Godzilla
- HTran
- JuicyPotato
- LadonGo
- Metasploit
- Mimikatz
- NPS
- ProcDump
- PsExec
- Remcom
- RottenPotato
- SweetPotato
- Windows Remote Desktop
- reGeorg
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de