🇨🇳

Operation SignSight

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 2

Countries highlighted in red

Philippines Vietnam

Sectors Targeted

National Security and International Affairs 928110 Software Publishers 5112 Public Administration 92

Details

Origin 🇨🇳 CN

Last Updated 13 Apr 2026

MITRE ATT&CK 4

T1021.001 T1078.002 T1556.003 T1568.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Operation SignSight ESET

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Vietnam

Description

(ESET) Just a few weeks after the supply-chain attack on the Able Desktop software, another similar attack occurred on the website of the Vietnam Government Certification Authority (VGCA): ca.gov.vn. The attackers modified two of the software installers available for download on this website and added a backdoor in order to compromise users of the legitimate application. ESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT. We believe that the website has not been delivering compromised software installers as of the end of August 2020 and ESET telemetry data does not indicate the compromised installers being distributed anywhere else. The Vietnam Government Certification Authority confirmed that they were aware of the attack before our notification and that they notified the users who downloaded the trojanized software.

Tools Used 2

Mimikatz PhantomNet

Reports & References 1

https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/

ETDA Profile

Operation SignSight

Origin

[Unknown]

First Seen 2020

Motivation

Information theft and espionage

View on ETDA APT Groups ↗