- Category
- State · Attributed to a state or working for one.
- Origin
- United States(high confidence)contested
- Sponsor
- United States
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2011–2026
- Status
- Active
- ATT&CK
- G0041 · 3 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0159 · strider
United StatesWhat it is
Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0041
- Qihoo 360
- APT-C-16
- Other names
- ProjectSauron, Project Sauron, Sauron, Strider, ProjectSauron
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTUnited States
- MISP Galaxy (CFR tagging)United States
- ThreatActor.info (Malpedia et al.)United States · high
Chinese and Russian sources
- Qihoo 360United States
- 360 Digital Security Group · 2016360 groups ProjectSauron with US-related actors on the basis of similarity to Flame.United States · medium (claimant)
- Kaspersky · 2016-08Original discovery and naming.unattributed (state-level) · Kaspersky names no state; Eugene Kaspersky has publicly linked it to the Equation Group lineage
Targets
- Countries
- Belgium, China, Iran, Russia, Rwanda, Sweden
- Sectors
- Defense, Embassies, Financial, Government, Intelligence, Military, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- GraphicBooting
- Remsec
- XtremeRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net