GINC-APT-0570 · Targeted, sponsor unknown

Rebel Jackal

Also ATK130, Fallaga team, FallagaTeam.

Category: Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin: Tunisia(high confidence)
Motivation: Defacement; Hacktivists-Nationalists
Sources: 4 sources carry it
Identifier: GINC-APT-0570 · rebel-jackal

What it is

This is a pro-Islamist organization that generally conducts attacks motivated by real world events in which its members believe that members of the Muslim faith were wronged. Its attacks generally involve website defacements; however, the group did develop a RAT that it refers to as Fallaga RAT, but which appears to simply be a fork of the njRAT malware popular amongst hackers in the Middle East/North Africa region.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Thales: ATK130
Other names: Fallaga team, FallagaTeam

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

MISP Galaxy (CFR tagging)Tunisia
ThreatActor.info (Malpedia et al.)Tunisia

Tools

The tools and malware families the sources tie to it.

NJRat
jRAT

Sources

Malpedia malpedia.caad.fkie.fraunhofer.de