🇾🇪

LazyScripter

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 6

Countries highlighted in red

United Arab Emirates Canada Egypt Nigeria Saudi Arabia South Africa

Sectors Targeted

Finance and Insurance 52 Aviation Professional, Scientific, and Technical Services 54 Insurance Carriers and Related Activities 524 NAICS:48 48 Other Services (except Public Administration) 81 Accommodation and Food Services 72 Public Administration 92 Accommodation 721 Information 51 Air Transportation 481

Details

Origin 🇾🇪 YE

Last Updated 11 May 2024

Malware Families 7

dilljuice

Vantom

houdini

remcom

H-worm

dubrute

adwind

MITRE ATT&CK 31

T1027 T1027.010 T1036 T1059 T1059.001 T1059.003 T1059.005 T1059.007 T1071 T1071.001 T1071.004 T1102 T1105 T1204 T1204.001 T1204.002 T1218 T1218.005 T1218.011 T1547 T1547.001 T1566 T1566.001 T1566.002 T1583 T1583.001 T1583.006 T1588 T1588.001 T1608 T1608.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

LazyScripter Malwarebytes

G0140 MITRE

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Canada

Description

(Malwarebytes) Malwarebytes’ Threat Intelligence analysts are continually researching and monitoring active malware campaigns and actor groups as the prevalence and sophistication of targeted attacks rapidly evolves. In this paper, we introduce a new APT group we have named LazyScripter, presenting in-depth analysis of the tactics, techniques, procedures, and infrastructure employed by this actor group.

Tools Used 13

Adwind EmpireProject Empoder Invoke-Ngrok Koadic KOCTOPUS Luminosity RAT Nishang njRAT Octopus QuasarRAT RemcosRAT RMS

Reports & References 1

https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf

ETDA Profile

LazyScripter

Origin

[Unknown]

First Seen 2018

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0140/

View on ETDA APT Groups ↗