GINC-APT-0877 · Targeted, sponsor unknown

Operation Rusty Flag

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Unknown
Motivation
Information theft and espionage
Seen
2023
Sources
3 sources carry it
Identifier
GINC-APT-0877 · operation-rusty-flag

What it is

(Deep Instinct) The operation has at least two different initial access vectors. The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language. One of the lures used in the operation is a modified document that was used by the 'Tropical Scorpius, RomCom' group. This could be a deliberate “false flag”.

Targets

Countries
Azerbaijan

Sources