GINC-APT-0817 · Tracked, unattributed

LabHost

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0817 · labhost

What it is

LabHost is a threat actor group targeting Canadian Banks with Phishing-as-a-Service attacks. They have been observed using tools like LabRat and LabSend for real-time campaign management and SMS lures. LabHost's phishing campaigns have similarities to Frappo campaigns, but they operate separately and offer different subscription packages.

Tools

The tools and malware families the sources tie to it.

  • Brat
  • RIPTIDE

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de