In the second half of 2022, a wave of attacks from an unknown threat actor targeted victims with a new type of attack framework that we dubbed P8.
The campaign targeted Vietnamese victims, mostly from the financial sector, with some from the real estate sector. Later, in 2023, Elastic Lab published a report about an OceanLotus APT (aka APT32) attack that leveraged a new set of malicious tools called Spectral Viper. Although the campaigns are the same, Kaspersky cannot conclusively attribute P8 to OceanLotus.
Read more…
Source: Kaspersky
Related:
- Suspected Chinese cyber spies target unpatched SonicWall devices
March 9, 2023
Suspected Chinese cyber criminals have zeroed in on unpatched SonicWall gateways and are infecting the devices with credential-stealing malware that persists through firmware upgrades, according to Mandiant. The spyware targets the SonicWall Secure Mobile Access (SMA) 100 Series – a gateway device that provides VPN access to remote users. Read more… Source: The Register
- Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting
March 1, 2023
Iron Tiger is an advanced persistent threat (APT) group that has been focused primarily on cyberespionage for more than a decade. In 2022, we noticed that they updated SysUpdate, one of their custom malware families, to include new features and add malware infection support for the Linux platform. We found the oldest sample of this updated ...
- Suspected espionage in Palestine highlights spread of hacking skills
February 16, 2022
A wave of recent espionage activity from suspected Palestinian hackers is the latest evidence that wealthy spy agencies no longer are the sole operators of malware that covertly vacuums up victims’ data. A shadowy group has targeted governments in the Middle East, a state-affiliated airline and foreign policy think tanks as part of a “highly targeted” ...