GINC-APT-0425 · Targeted, sponsor unknown

NewsPenguin

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Unknown
Sources
5 sources carry it
Identifier
GINC-APT-0425 · newspenguin

What it is

NewsPenguin is threat actor that has been targeting organizations in Pakistan. They use a complex payload delivery mechanism and exploit the upcoming Pakistan International Maritime Expo & Conference as a lure to trick their victims. The group has been linked to a phishing campaign that leverages spear-phishing emails and weaponized documents to deliver an advanced espionage tool.

Tools

The tools and malware families the sources tie to it.

  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de