- Category
- State · Attributed to a state or working for one.
- Origin
- Ukraine(high confidence)contested
- Motivation
- Information theft and espionage
- Seen
- 2018
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0230 · poison-needles
UkraineWhat it is
2018年11月25日，360高级威胁应对团队就在全球范围内第一时间发现了一起针对俄罗斯的APT攻击行动，攻击目标则指向俄罗斯总统办公室所属的医疗机构，此次攻击行动使用了Flash 0day漏洞CVE-2018-15982和Hacking Team的RCS后门程序，结合被攻击目标医疗机构的职能特色，360将此次APT攻击命名为“毒针”行动。
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Qihoo 360
- APT-C-31
- Operations
- Operation Poison Needles
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTUkraine
- ThreatActor.info (Malpedia et al.)Ukraine
Chinese and Russian sources
- Qihoo 360Kazakhstan
Targets
- Countries
- Russia
- Sectors
- Healthcare
Tools
The tools and malware families the sources tie to it.
- 0-day Flash exploit
- FLASHFLOOD
- Hacking Team UEFI Rootkit
- PoisonIvy
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net