GINC Technology
GINC-APT-0329 · State

Pat Bear

Also APT-C-37, Papa Bear, Pat Bear, APT-C-37, Racquet Bear.

Category
State · Attributed to a state or working for one.
Origin
Syria(low confidence)contested
Sponsor
Syrian Electronic Army
Motivation
Information theft and espionage
Seen
2015–2019
Status
Dormant
Sources
6 sources carry it
Identifier
GINC-APT-0329 · pat-bear

What it is

拍拍熊组织（APT-C-37）针对极端组织“伊斯兰国”展开了有组织、有计划、针对性的长期不间断攻击，其攻击平台为Windows和Android。

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Papa Bear, Racquet Bear
Qihoo 360
APT-C-37
Other names
Pat Bear, APT-C-37

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Egypt, Israel
Sectors
Defense

Tools

The tools and malware families the sources tie to it.

  • Androrat
  • DroidJack
  • H-Worm
  • SSLove RAT
  • SpyNote RAT
  • Windows Remote Desktop
  • njRAT

Sources