ESETPDF
ESET APT Activity Report Q2 2024-Q3 2024
Excerpt
(eset):research
APT Activity
ABUSING CLOUD SERVICES AND VPN
PLATFORMS IN THE PURSUIT OF NEW PREY
April 2024 – September 2024
Report
ESET APT ACTIVITY REPORT APRIL 2024 - SEPTEMBER 2024 | 2
Contents
Executive summary� 3
Attackers and targets� 5
China-aligned groups � 6
SoftEther VPN: A tool of choice for China-aligned
APT groups� 7
MirrorFace expands its reach: Europe now
in the crosshairs� 8
CloudSorcerer’s operations traced back
to 2022� 9
Iran-aligned groups � 10
From cyber-support to diplomatic and kinetic
operations� 11
Continued interest in being the intrusive neighbor� 12
North Korea-aligned groups � 13
Abusing cloud services� 14
Building relationships before the attack� 15
Abuse of Microsoft Management Console� 16…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ESET on web-assets.esetstatic.com.
Mentioned in the excerpt
More from ESET16
- FishMonger’s arsenal upgraded: SprySOCKS for WindowsESET · Added 25 Oct
- ceranakeeper.pdfESET · Added 17 Oct
- Killing me gently: Inside Gentlemen’s EDR killer frameworkESET · Added 23 Sep
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
