- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2024
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0881 · operation-slow-tempest
ChinaWhat it is
(Securonix) The Securonix Threat Research team has uncovered a covert campaign targeting Chinese-speaking users with Cobalt Strike payloads likely delivered through phishing emails. The attackers managed to move laterally, establish persistence and remain undetected within the systems for more than two weeks.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- ThreatActor.info (Malpedia et al.)China
Targets
- Countries
- China
Tools
The tools and malware families the sources tie to it.
- Cobalt Strike
- Mimikatz
Sources
- ETDA Threat Group Card apt.etda.or.th