- Category
- State · Attributed to a state or working for one.
- Origin
- Unknown
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2021
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0783 · harvester
What it is
(Symantec) A previously unseen actor, likely nation-state-backed, is targeting organizations in South Asia, with a focus on Afghanistan, in what appears to be an information-stealing campaign using a new toolset. The Harvester group uses both custom malware and publicly available tools in its attacks, which began in June 2021, with the most recent activity seen in October 2021. Sectors targeted include telecommunications, government, and information technology (IT). The capabilities of the tools, their custom development, and the victims targeted, all suggest that Harvester is a nation-state-backed actor.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTno origin
Targets
- Countries
- Afghanistan
- Sectors
- Government, IT, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Cobalt Strike
- Graphon
- Metasploit
Sources
- ETDA Threat Group Card apt.etda.or.th