🇵🇭

TA2722

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

Balikbayan Foxes

Target Countries 1

Countries highlighted in red

United States

Sectors Targeted

Shipping and Logistics Financial Manufacturing Energy Pharmaceutical

Details

Origin 🇵🇭 PH

Last Updated 10 Feb 2024

MITRE ATT&CK 4

T1071.001 T1105 T1190 T1499.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

TA2722 Proofpoint

Balikbayan Foxes Proofpoint

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

USA Europe and Southeast Asia

Description

(Proofpoint) Proofpoint identified a new and highly active cybercriminal threat actor, TA2722, colloquially referred to by Proofpoint threat researchers as the Balikbayan Foxes. Throughout 2021, a series of campaigns impersonated multiple Philippine government entities including the Department of Health, the Philippine Overseas Employment Administration (POEA), and the Bureau of Customs. Other related campaigns masqueraded as the Manila embassy for the Kingdom of Saudi Arabia (KSA) and DHL Philippines. The messages were intended for a variety of industries in North America, Europe, and Southeast Asia, with the top sectors including Shipping, Logistics, Manufacturing, Business Services, Pharmaceutical, Energy, and Finance.

Tools Used 2

NanoCore RAT RemcosRAT

Reports & References 1

https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-spoofs-philippine-government-covid-19-health-data-widespread

ETDA Profile

TA2722

Origin

[Unknown]

First Seen 2020

Motivation

Information theft and espionage

View on ETDA APT Groups ↗