GINC-APT-0786 · Targeted, sponsor unknown

HiddenArt

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Russia(high confidence)
Sources
3 sources carry it
Identifier
GINC-APT-0786 · hiddenart

What it is

It was observed that a mobile network threat actor designated as ‘HiddenArt’ actively sustains a capacity to remotely access the personal devices of targeted individuals around the world on an ongoing basis. Since detecting this threat actor, periodic reconnaissance activities were observed in at least 7 target mobile networks around the world and given the wide geographic distribution of these targeted mobile operators, it is probable that the threat actor is active on a global scale.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • GraphicBooting
  • MobileOrder
  • Remote Utilities
  • RemoteCMD
  • RemotePC

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de