- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Sabotage and destruction
- Seen
- 2012–2018
- Status
- Dormant
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0100 · terbium
What it is
Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Terbium, Disttrack, Shamoon
Targets
- Sectors
- Energy
Tools
The tools and malware families the sources tie to it.
- Depriz
- Shamoon / Disttrack
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de