GINC Technology
GINC-APT-0303 · State

Grayling

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Sponsor
China
Motivation
Information theft and espionage
Seen
2023
Sources
6 sources carry it
Identifier
GINC-APT-0303 · grayling

What it is

Grayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading activity. Grayling appears to target organisations in Asia, however one unknown organisation in the United States was also targeted. Industries targeted include Biomedical, Government and Information Technology. Grayling use a variety of tools during their attacks, including well known tools such as Cobalt Strike and Havoc and also some others.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Solomon Islands, Taiwan, United States, Vietnam
Sectors
Biomedical, Government, Information technology, IT, Manufacturing, Pharmaceutical

Tools

The tools and malware families the sources tie to it.

  • Cobalt Strike
  • Havoc
  • Mimikatz
  • NetSpy
  • UNITEDRAKE
  • Unknown Logger

Sources