- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2015
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0370 · zoopark
What it is
从2015年7月起至今，军刀狮组织（APT-C-38）在中东地区展开了有组织、有计划、针对性的不间断攻击，其攻击平台为Windows和Android。由于军刀狮组织的攻击目标有一个主要的特色目标是西亚中东某国的库尔德人，另Windows端RAT包含的PDB路径下出现多次的“Saber”，而亚洲狮为该中东国家的代表动物，结合该组织的一些其它特点以及360对 APT 组织的命名规则，我们将该组织命名为军刀狮（APT-C-38）。
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Qihoo 360
- APT-C-38, APT-C-38 (QiAnXin)
- Secureworks
- TG-2884
- Other names
- COBALT JUNO, Saber Lion, TG-2884 (SCWX CTU)
Targets
- Countries
- Egypt, Iran, Iraq, Jordan, Kuwait, Lebanon, Morocco
- Sectors
- Media
Tools
The tools and malware families the sources tie to it.
- Androrat
- Archelaus Beta
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- DroidJack
- Windows Remote Desktop
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net