Threat Group Cards: A Threat Actor Encyclopedia
Excerpt
Home > List all groups > List all tools > List all groups using tool Sword2033 Tool: Sword2033
Names Sword2033
Category Malware
Type Backdoor, Downloader, Exfiltration
Description
(Palo Alto) Pivoting on the C2 domain, we identified one additional sample that also communicated with yrhsywu2009.zapto[.]org.
Similar to the PingPull variant above, this sample was designed to connect to port 8443 over HTTPS. However, analysis of the sample revealed that it’s a simple backdoor that we track as Sword2033.
Information Malpedia Last change to this tool card: 22 June 2023
Download this tool card in JSON format
All groups using tool Sword2033
Changed Name Country Observed
APT groups
Gallium 2018-Jun 2022
1 group list…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ETDA Threat Group Cards on apt.etda.or.th.
More from ETDA Threat Group Cards19
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 20 Oct
- listgroups.cgi?u=72670111-f95a-423c-a296-f424939cc08eETDA Threat Group Cards · Added 19 Oct
- listgroups.cgi?u=cacc4de8-a9b2-4231-9fdb-8aefa8ed0a5cETDA Threat Group Cards · Added 19 Oct
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
