GINC-APT-0371 · State

Stealth Mango and Tangelo

Also Stealth Mango, Stealth Mango & Tangelo, Stealth Mango and Tangelo.

Category: State · Attributed to a state or working for one.
Origin: Pakistan(high confidence)
Sponsor: Pakistan
Motivation: Espionage
Sources: 5 sources carry it
Identifier: GINC-APT-0371 · stealth-mango-and-tangelo

What it is

This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names: Stealth Mango, Stealth Mango & Tangelo, Stealth Mango and Tangelo

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

MISP Galaxy (CFR tagging)Pakistan
ThreatActor.info (Malpedia et al.)Pakistan

Targets

Countries: Afghanistan, Australia, Germany, India, Iraq, Pakistan, United Arab Emirates, United States
Sectors: Civil society, Government

Tools

The tools and malware families the sources tie to it.

Stealth Mango
UNITEDRAKE

Sources

Malpedia malpedia.caad.fkie.fraunhofer.de