- Category
- State · Attributed to a state or working for one.
- Origin
- Unknown
- Sponsor
- Unknown
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2015–2026
- Status
- Active
- ATT&CK
- G0054 · 9 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0071 · sowbug
What it is
Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0054
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)no origin
Targets
- Countries
- Argentina, Brazil, Brunei, Ecuador, Malaysia, Peru
- Sectors
- Government
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Felismus
- StarLoader
- Starloader
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de