GINC-APT-0956 · Tracked, unattributed

SPIKEDWINE

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0956 · spikedwine

What it is

SPIKEDWINE is a threat actor targeting European officials with a new backdoor called WINELOADER. They use a bait PDF document posing as an invitation letter from the Ambassador of India to lure diplomats. The attack is characterized by advanced tactics, techniques, and procedures in the malware and command and control infrastructure. The motivation behind the attacks seems to be exploiting the geopolitical relations between India and European nations.

Tools

The tools and malware families the sources tie to it.

  • Backdoor.Oldrea
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de