GINC-APT-0192 · State

Deadeye Jackal

Also Syrian Electronic Army (SEA), ATK 196, SEA, Syria Malware Team, Syrian Electronic Army, Syrian Electronic Army (SEA), Deadeye Jackal and 2 other names.

Category
State · Attributed to a state or working for one.
Origin
Syria(high confidence)
Motivation
Information theft and espionage
Seen
2011
Sources
7 sources carry it
Identifier
GINC-APT-0192 · deadeye-jackal

What it is

The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. Using spamming, website defacement, malware, phishing, and denial of service attacks, it has targeted political opposition groups, western news organizations, human rights groups and websites that are seemingly neutral to the Syrian conflict. It has also hacked government websites in the Middle East and Europe, as well as US defense contractors. As of 2011 the SEA has been *the first Arab country to have a public Internet Army hosted on its national networks to openly launch cyber attacks on its enemies*. The precise nature of SEA's relationship with the Syrian government has changed over time and is unclear

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Syrian Electronic Army (SEA), Deadeye Jackal
Other names
Syrian Electronic Army (SEA), ATK 196, SEA, Syria Malware Team, Syrian Electronic Army, SyrianElectronicArmy, TAG-CT2

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Countries
Canada, France, United Kingdom, United States
Sectors
Country, Defense, Government, Government, Administration, High-Tech, Media, News - Media, Opposition, Political party, Retail, Telecommunications

Tools

The tools and malware families the sources tie to it.

  • AndoServer
  • Cyber Eye RAT
  • CyberGate
  • Executer Webshell
  • SLRat
  • SandroRAT
  • SeANux: Sea Shell (Basic Web Shell)
  • SilverHawk
  • SpyNote RAT

Sources