- Category
- State · Attributed to a state or working for one.
- Origin
- Syria(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2011
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0192 · deadeye-jackal
What it is
The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. Using spamming, website defacement, malware, phishing, and denial of service attacks, it has targeted political opposition groups, western news organizations, human rights groups and websites that are seemingly neutral to the Syrian conflict. It has also hacked government websites in the Middle East and Europe, as well as US defense contractors. As of 2011 the SEA has been *the first Arab country to have a public Internet Army hosted on its national networks to openly launch cyber attacks on its enemies*. The precise nature of SEA's relationship with the Syrian government has changed over time and is unclear
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Syrian Electronic Army (SEA), Deadeye Jackal
- Other names
- Syrian Electronic Army (SEA), ATK 196, SEA, Syria Malware Team, Syrian Electronic Army, SyrianElectronicArmy, TAG-CT2
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Canada, France, United Kingdom, United States
- Sectors
- Country, Defense, Government, Government, Administration, High-Tech, Media, News - Media, Opposition, Political party, Retail, Telecommunications
Tools
The tools and malware families the sources tie to it.
- AndoServer
- Cyber Eye RAT
- CyberGate
- Executer Webshell
- SLRat
- SandroRAT
- SeANux: Sea Shell (Basic Web Shell)
- SilverHawk
- SpyNote RAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de