WildPressure

APT Group Information theft and espionage 5 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 1

Countries highlighted in red

United States

Sectors Targeted

Oil and gas Industrial Data Processing, Hosting, and Related Services 51821

Details

Origin UNKNOWN

Last Updated 02 Dec 2023

MITRE ATT&CK 3

T1027 T1071.001 T1566.001

Related Zero-Days 5

CVE-2021-1675 CVE-2021-28310 CVE-2021-30869 CVE-2021-34527 CVE-2021-40444

Known Names 1 entries

WilePressure Kaspersky

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Middle East

Description

(Kaspersky) In August 2019, Kaspersky discovered a malicious campaign distributing a fully fledged C++ Trojan that we call Milum. All the victims we registered were organizations from the Middle East. At least some of them are related to industrial sector. Our Kaspersky Threat Attribution Engine (KTAE) doesn’t show any code similarities with known campaigns. Nor have we seen any target intersections. In fact, we found just three almost unique samples, all in one country. So we consider the attacks to be targeted and have currently named this operation WildPressure.

Tools Used 1

Milum

Operations 1

2021 Spring WildPressure targets the macOS platform https://securelist.com/wildpressure-targets-macos/103072/

Reports & References 1

https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/

ETDA Profile

WildPressure

Origin

[Unknown]

First Seen 2019

Motivation

Information theft and espionage

View on ETDA APT Groups ↗