- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Morocco(high confidence)
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0547 · kasablanka
MoroccoWhat it is
The Kasablanka group is a cyber-criminal organization that has specifically targeted Russia between September and December 2022, using various payloads delivered through phishing emails containing socially engineered lnk files, zip packages, and executables attached to virtual disk image files.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de