- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- China(high confidence)
- Motivation
- Financial crime
- Seen
- 2016
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0349 · ta530
ChinaWhat it is
TA530, who we previously examined in relation to large-scale personalized phishing campaigns
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, United Kingdom, United States
- Sectors
- Automotive, Construction, Education, Energy, Engineering, Financial, Food and Agriculture, Healthcare, Hospitality, Manufacturing, Media, Pharmaceutical, Retail, Technology, Telecommunications, Transportation, Utilities
Tools
The tools and malware families the sources tie to it.
- AbaddonPOS
- August Stealer
- CryptoWall
- Dridex
- Gozi ISFB
- H1N1 Loader
- Nymaim
- Smoke Loader
- TeamSpy
- TinyLoader
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de