- Category
- State · Attributed to a state or working for one.
- Origin
- Unknown
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2018
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0364 · urpage
What it is
What sets Urpage attacks apart is its targeting of InPage, a word processor for Urdu and Arabic languages. However, its Delphi backdoor component, which it has in common with Confucius and Patchwork, and its apparent use of Bahamut-like malware, is what makes it more intriguing as it connects Urpage to these other known threats. Trend Micro covered the Delphi component in the context of the Confucius and Patchwork connection. They mentioned Urpage as a third unnamed threat actor connected to the two.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTno origin
Targets
- Countries
- Pakistan
Tools
The tools and malware families the sources tie to it.
- Arabian-Attacker RAT
- Backdoor.Oldrea
- Trojaned Android applications
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de