GINC-APT-1070 · Tracked, unattributed

Void Banshee

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-1070 · void-banshee

What it is

Void Banshee is an APT group targeting North America, Europe, and Southeast Asia for information theft and financial gain. They exploit vulnerabilities like CVE-2024-38112 to deliver the Atlantida info-stealer through malicious PDFs disguised as book files. The group uses internet shortcuts with MHTML protocol handlers to access and execute files through disabled Internet Explorer, posing a significant threat to organizations. Void Banshee's TTPs include crafting URL strings to control window sizes in IE and using HTML files to hide malicious downloads from victims.

Tools

The tools and malware families the sources tie to it.

  • Windows Remote Desktop
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de