GINC Technology
GINC-APT-0616 · State

Vendetta

Also TA2719, Vendetta, TA2719.

Category
State · Attributed to a state or working for one.
Origin
Türkiye(medium confidence)
Motivation
Information theft and espionage
Seen
2020
Sources
4 sources carry it
Identifier
GINC-APT-0616 · vendetta

What it is

In late March 2020, Proofpoint researchers began tracking a new actor with a penchant for using NanoCore and later AsyncRAT, popular commodity remote access trojans (RATs). Dubbed TA2719 by Proofpoint, the actor uses localized lures with colorful images that impersonate local banks, law enforcement, and shipping services. Proofpoint has observed this actor send low volume campaigns to recipients in Austria, Chile, Greece, Hungary, Italy, North Macedonia, Netherlands, Spain, Sweden, Taiwan, United States, and Uruguay.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Proofpoint
TA2719
Other names
Vendetta, TA2719

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Australia, Austria, Chile, China, Egypt, Greece, Hungary, Italy, Macedonia, Mexico, Netherlands, Romania, Russia, Singapore, Spain, Sweden, Taiwan, Thailand, United States, Uruguay

Tools

The tools and malware families the sources tie to it.

  • Archelaus Beta
  • AsyncRAT
  • NanoCore
  • Remote Utilities
  • RemoteCMD
  • RemotePC
  • Trojan.Karagany
  • Trojan.Mebromi
  • UNITEDRAKE

Sources