- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2020
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0233 · redstinger
What it is
In October 2022, Kaspersky identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar methods. The victims navigated to a URL pointing to a ZIP archive hosted on a malicious web server.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Bad Magic, Bad Magic, RedStinger, CloudWizard
Targets
- Countries
- Ukraine
- Sectors
- Defense, Food and Agriculture, Government, Transportation
Tools
The tools and malware families the sources tie to it.
- CommonMagic
- PowerMagic
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de