🇷🇺

RedStinger

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

Bad Magic

Target Countries 1

Countries highlighted in red

Ukraine

Sectors Targeted

Defense Government Food and Agriculture Transportation

Details

Origin 🇷🇺 RU

Last Updated 08 Nov 2023

MITRE ATT&CK 23

T1005 T1012 T1041 T1046 T1047 T1053 T1055 T1057 T1059 T1078.001 T1082 T1083 T1102 T1112 T1140 T1203 T1218 T1537 T1543 T1546 T1559 T1567 T1568

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 3 entries

Bad Magic Kaspersky

RedStinger Malwarebytes

CloudWizard Kaspersky

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Ukraine

Description

(Kaspersky) In October 2022, we identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar methods. The victims navigated to a URL pointing to a ZIP archive hosted on a malicious web server.

Tools Used 2

CommonMagic PowerMagic

Operations 2

2020 Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020 https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger

2023-05 CloudWizard APT: the bad magic story goes on https://securelist.com/cloudwizard-apt/109722/

Reports & References 1

https://securelist.com/bad-magic-apt/109087/

ETDA Profile

Bad Magic, RedStinger

Origin

[Unknown]

First Seen 2020

Motivation

Information theft and espionage

View on ETDA APT Groups ↗