China-Linked 'Thrip' Spies Target Satellite, Defense Companies

guest · Jun 20, 2018

China-Linked 'Thrip' Spies Target Satellite, Defense Companies
June 20, 2018
https://www.securityweek.com/china-linked-thrip-spies-target-satellite-defense-companies

Symantec has been tracking the threat actor, which it has named “Thrip,” since 2013. However, the security firm says the group’s activities have not been made public until now.

The list of victims identified by Symantec also includes three telecoms firms in Southeast Asia. The companies themselves appear to have been Thrip’s targets rather than their customers. Another victim is a defense contractor, but no details have been shared by the security firm on this attack.

As for the legitimate tools used by the cyberspies, the list includes the Windows SysInternals utility PSExec, PowerShell, the post-exploitation tool Mimikatz, the open source FTP client WinSCP, and the LogMeIn remote access software.

“This is likely espionage,” said Greg Clark, CEO of Symantec. “The Thrip group has been working since 2013 and their latest campaign uses standard operating system tools, so targeted organizations won’t notice their presence.
Click to expand...

guest · Sep 9, 2019

China-Linked 'Thrip' Cyberspies Continue Attacks on Southeast Asia
September 9, 2019
https://www.securityweek.com/china-linked-thrip-cyberspies-continue-attacks-southeast-asia

The activities of the Thrip group were brought to light in June 2018 by Symantec. The company revealed at the time that the threat actor had been active since at least 2013 and it had targeted entities in Southeast Asia and the United States.
In a new report published on Monday, Symantec said the group has continued launching attacks against entities in Southeast Asia, including military, satellite communications, media and educational organizations. The company has identified a dozen victims in this region, including in Hong Kong, Macau, Indonesia, the Philippines, Malaysia and Vietnam.

During its analysis of the most recent Thrip campaigns, Symantec has identified a new backdoor called Hannotog, which the hackers appear to have used since at least January 2017.
Sagerunex, which provides attackers remote access to systems, helped Symantec link Thrip to another group, Billbug, also known as Lotus Blossom.

“[Thrip’s] link to the Billbug group puts its activities into context and proves its attacks are part of a broader range of espionage activity heavily focused on (but not limited to) governments, armed forces, and communications providers,” Symantec said.
Click to expand...

Symantec: Thrip: Ambitious attacks against high level targets continue

Log in or Sign up

China-Linked 'Thrip' Spies Target Satellite, Defense Companies

guest Guest

guest Guest

Log in or Sign up

China-Linked 'Thrip' Spies Target Satellite, Defense Companies

guest Guest

guest Guest

Useful Searches