- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- Seems state-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2010
- ATT&CK
- G0031
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0291 · dust-storm
ChinaWhat it is
Threat actors behind the Operation Dust Storm have been active since at least 2010, the hackers targeted several organizations in Japan, South Korea, the US, Europe, and other Asian countries.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0031
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Japan, South Korea, United States
- Sectors
- Energy, Oil and gas
Tools
The tools and malware families the sources tie to it.
- Gh0st RAT
- MiS-Type
- Misdat
- Poison Ivy
- S-Type
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de