- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2023
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0877 · operation-rusty-flag
What it is
(Deep Instinct) The operation has at least two different initial access vectors. The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language. One of the lures used in the operation is a modified document that was used by the 'Tropical Scorpius, RomCom' group. This could be a deliberate “false flag”.
Targets
- Countries
- Azerbaijan
Sources
- ETDA Threat Group Card apt.etda.or.th