SugarGh0st RAT Used to Target American Artificial Intelligence Experts


Proofpoint recently identified a SugarGh0st RAT campaign targeting organizations in the United States involved in artificial intelligence efforts, including those in academia, private industry, and government service.

Proofpoint tracks the cluster responsible for this activity as UNK_SweetSpecter. SugarGh0st RAT is a remote access trojan, and is a customized variant of Gh0stRAT, an older commodity trojan typically used by Chinese-speaking threat actors. SugarGh0st RAT has been historically used to target users in Central and East Asia, as first reported by Cisco Talos in November 2023.

Read more…
Source: ProofPoint


Sign up for our Newsletter


Related:

  • SugarGh0st RAT Used to Target American Artificial Intelligence Experts

    May 16, 2024

    Proofpoint recently identified a SugarGh0st RAT campaign targeting organizations in the United States involved in artificial intelligence efforts, including those in academia, private industry, and government service. Proofpoint tracks the cluster responsible for this activity as UNK_SweetSpecter. SugarGh0st RAT is a remote access trojan, and is a customized variant of Gh0stRAT, an older commodity trojan typically ...

  • FBI Leak Exposes Alleged Order for Warrantless Spying on Americans by Agency Personnel

    May 9, 2024

    There is a new leak from the Federal Bureau of Investigation (FBI) centering on an official who allegedly sent out an email that asks for warrantless spying on Americans, urging employees to find ways to do so. It was allegedly sent to FBI employees last April 20 by FBI Deputy Director Paul Abbate, telling employees to ...

  • Germany recalls envoy to Russia over cyberattack

    May 6, 2024

    The German ambassador to Russia was recalled for consultations on Monday after Berlin accused Moscow of carrying out cyberattacks. A newly concluded government investigation found the cyberattack had been carried out by a group — linked to Moscow’s GRU military intelligence agency — known as APT28. The group, also known as Fancy Bear, has been accused ...

  • Scaly Wolf’s new loader: the right tool for the wrong job

    May 2, 2024

    The BI.ZONE Threat Intelligence team has uncovered a fresh campaign by the group targeting Russian and Belarusian organizations. The threat actors are distributing phishing emails under the guise of a federal agency. The emails have a legitimate document as an attachment. It aims to lull the recipient’s vigilance and prompt them to open the other file, ...

  • Governments issue alerts after ‘sophisticated’ state-backed actor found exploiting flaws in Cisco security boxes

    April 25, 2024

    A previously unknown and “sophisticated” nation-state group compromised Cisco firewalls as early as November 2023 for espionage purposes — and possibly attacked network devices made by other vendors including Microsoft, according to warnings from the networking giant and three Western governments. A Cisco spokesperson declined to comment on which country the snooping crew – tracked as ...

  • Spain reopens Israeli spyware probe, sharing information with France

    April 23, 2024

    Spain’s High Court on Tuesday reopened an investigation into the use of Israeli cyber-intelligence firm NSO Group’s Pegasus software to spy on Prime Minister Pedro Sanchez and other Spanish politicians. The investigators will share information with France, where politicians and other figures were also targeted. The probe aims to find out who was behind the snooping. ...