GINC-APT-0894 · Tracked, unattributed

ProCC

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0894 · procc

What it is

ProCC is a threat actor targeting the hospitality sector with remote access Trojan malware. They use email attachments to exploit vulnerabilities like CVE-2017-0199 and deploy customized versions of RATs such as RevengeRAT, NjRAT, NanoCoreRAT, and 888 RAT. ProCC's malware is capable of collecting data from the clipboard and printer spooler, as well as capturing screenshots on infected machines.

Tools

The tools and malware families the sources tie to it.

  • NJRat
  • NanoCore
  • Remote Utilities
  • RemoteCMD
  • RemotePC
  • Revenge-RAT
  • Trojan.Karagany
  • Trojan.Mebromi
  • Xploit
  • jRAT

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de