Threat actor
Fire Ant
Iran
Tracked by CyberSIXT since 9 Feb
- Articles · all time
- 5
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 3
5 articles from 1 outlet since 9 Feb; the latest 56 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 31 Aug · 11:29 UTC | Security Affairs | Chinese Fire Ant Hackers Hijack Cisco Routers to Steal Credentials |
| Mon 31 Aug · 10:48 UTC | The Hacker News | Fire Ant hackers exploit Cisco router flaws to steal credentials |
| Mon 31 Aug · 04:11 UTC | SecurityOnline | Fire Ant Threat Actor Targets Trusted Infrastructure |
| Tue 31 Mar · 16:51 UTC | Dark Reading | Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations |
| Mon 9 Feb · 18:40 UTC | The Hacker News | China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage Campaign |
Names and sources
- Pink Sandstorm
- Named by CyberSIXT coverage
- AMERICIUM
- Named by Malpedia · pink_sandstorm
- Agonizing Serpens
- Named by Malpedia · pink_sandstorm
- Agrius
- Named by Malpedia · pink_sandstorm
- BlackShadow
- Named by Malpedia · pink_sandstorm
- DEV-0022
- Named by Malpedia · pink_sandstorm
- Pink Sandstorm
- Named by Malpedia · pink_sandstorm
- SPECTRAL KITTEN
- Named by Malpedia · pink_sandstorm
All 34 names
- UNC2428
- Named by Malpedia · pink_sandstorm
- AMERICIUM
- Named by Microsoft · Pink Sandstorm
- Agrius
- Named by Microsoft · Pink Sandstorm
- BlackShadow
- Named by Microsoft · Pink Sandstorm
- Deadwood
- Named by Microsoft · Pink Sandstorm
- FireAnt
- Named by Microsoft · Pink Sandstorm
- Justice Blade
- Named by Microsoft · Pink Sandstorm
- Pink Sandstorm
- Named by Microsoft · Pink Sandstorm
- SPECTRAL KITTEN
- Named by Microsoft · Pink Sandstorm
- SharpBoys
- Named by Microsoft · Pink Sandstorm
- AMERICIUM
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- Agonizing Serpens
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- Agrius
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- BlackShadow
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- DEV-0022
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- Pink Sandstorm
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- SPECTRAL KITTEN
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- UNC2428
- Named by MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05
- AMERICIUM
- Named by MITRE ATT&CK · G1030
- Agonizing Serpens
- Named by MITRE ATT&CK · G1030
- Agrius
- Named by MITRE ATT&CK · G1030
- BlackShadow
- Named by MITRE ATT&CK · G1030
- Pink Sandstorm
- Named by MITRE ATT&CK · G1030
- Fire Ant
- Named by CyberSIXT coverage
- fireant
- Named by CyberSIXT coverage
- 0876c327-c82a-45f7-82fa-267c312ceb05
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Pink Sandstorm)
- origin
- Iran (Microsoft · Pink Sandstorm)
- origin
- Iran (MISP Galaxy · 0876c327-c82a-45f7-82fa-267c312ceb05)
Malware and tools
Mimikatz (MITRE ATT&CK · G1030) ASPXSpy (MITRE ATT&CK · G1030) NBTscan (MITRE ATT&CK · G1030) IPsec Helper (MITRE ATT&CK · G1030) Apostle (MITRE ATT&CK · G1030) DEADWOOD (MITRE ATT&CK · G1030) MultiLayer Wiper (MITRE ATT&CK · G1030) BFG Agonizer (MITRE ATT&CK · G1030) Moneybird (MITRE ATT&CK · G1030) Apostle (Malpedia · pink_sandstorm)
ATT&CK techniques
Tactic not recorded
- T1003.001
- LSASS Memory (MITRE ATT&CK · G1030)
- T1003.002
- Security Account Manager (MITRE ATT&CK · G1030)
- T1005
- Data from Local System (MITRE ATT&CK · G1030)
- T1018
- Remote System Discovery (MITRE ATT&CK · G1030)
- T1021.001
- Remote Desktop Protocol (MITRE ATT&CK · G1030)
- T1036
- Masquerading (MITRE ATT&CK · G1030)
- T1041
- Exfiltration Over C2 Channel (MITRE ATT&CK · G1030)
- T1046
- Network Service Discovery (MITRE ATT&CK · G1030)
- T1059.003
- Windows Command Shell (MITRE ATT&CK · G1030)
- T1074.001
- Local Data Staging (MITRE ATT&CK · G1030)
- T1078.002
- Domain Accounts (MITRE ATT&CK · G1030)
- T1110
- Brute Force (MITRE ATT&CK · G1030)
© The MITRE Corporation. Reproduced with permission. All techniques on MITRE ATT&CK
- Chinese Fire Ant Hackers Hijack Cisco Routers to Steal CredentialsSecurity Affairs
- Fire Ant hackers exploit Cisco router flaws to steal credentialsThe Hacker News
- Fire Ant Threat Actor Targets Trusted InfrastructureSecurityOnline
- Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key OperationsDark Reading
- China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage CampaignThe Hacker News · first in our coverage