- Category
- State · Attributed to a state or working for one.
- Origin
- Unknown
- Sponsor
- Unknown
- Motivation
- Espionage
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G0076 · 4 techniques
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0465 · thrip
What it is
Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0076
- Thales
- ATK78
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)no origin
Targets
- Countries
- United States
- Sectors
- Private sector
Tools
The tools and malware families the sources tie to it.
- Catchamas
- Mimikatz
- PsExec
- UNITEDRAKE
Sources
- MITRE ATT&CK attack.mitre.org