- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2012
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0239 · scarab
ChinaWhat it is
Scarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small number of individuals across the world, including Russia and the United States. The backdoor deployed by Scarab in their campaigns is most commonly known as Scieron.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0026
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Russia, Syria, Ukraine, United States
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- CrossRat
- Scieron
- Small-Net
- Trojan.Scieron
- Trojan.Scieron.B
- UNITEDRAKE
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de