- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G0140 · 20 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0215 · lazyscripter
What it is
LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0140
Targets
- Countries
- Canada
- Sectors
- Aviation
Tools
The tools and malware families the sources tie to it.
- Adwind
- Cyber Eye RAT
- CyberGate
- Empire
- EmpireProject
- Empoder
- Invoke-Ngrok
- KOCTOPUS
- Koadic
- Luminosity RAT
- Nishang
- Octopus
- QuasarRAT
- RMS
- Remcos
- RemcosRAT
- ngrok
- njRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th