- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Financial gain; Information theft and espionage
- Seen
- 2018
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0305 · hagga
What it is
Hagga is believed to have been using Agent Tesla, 2021’s sixth most prevalent malware, to steal sensitive information from his victims since the latter part of 2021.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Operations
- Operation “Red Deer”, Operation “Roma225”
- Other names
- Aggah, TH-157
Targets
- Countries
- Austria, Bahrain, Brazil, Canada, China, Egypt, France, Germany, India, Ireland, Israel, Italy, Japan, Norway, Romania, Russia, Saudi Arabia, South Korea, Spain, Sweden, Taiwan, United Arab Emirates, United Kingdom, United States
- Sectors
- Automotive, Education, Government, Healthcare, Hospitality, Manufacturing, Media, Retail, Technology
Tools
The tools and malware families the sources tie to it.
- Agent Tesla
- Agent.btz
- Aggah
- NanoCore RAT
- RevengeRAT
- Warzone RAT
- njRAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de