🇨🇳

Sandman

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 6

Countries highlighted in red

United Arab Emirates Chile United Kingdom India Pakistan United States

Sectors Targeted

Public Relations Agencies 54182 Professional, Scientific, and Technical Services 54 Data Processing, Hosting, and Related Services 51821 Public Administration 92 Data Processing, Hosting, and Related Services 518 Other Information Services 519 Telecommunications Commercial Banking 52211 Telecommunications 517

Details

Origin 🇨🇳 CN

Last Updated 11 May 2024

MITRE ATT&CK 4

T1071.001 T1078 T1105 T1547.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Sandman SentinelLabs

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Middle East, Western Europe, and South Asia

Description

(SentinelLabs) In collaboration with QGroup GmbH, SentinelLabs observed over August 2023 a threat activity cluster targeting the telecommunication sector. The activities have been conducted by a threat actor of unknown origin using a novel modular backdoor based on the LuaJIT platform. We dub this threat actor and the backdoor Sandman and LuaDream in reference to what we suspect to be the backdoor’s internal name – DreamLand client. The activities we observed are characterized by strategic lateral movement to specific targeted workstations and minimal engagement, suggesting a deliberate approach aimed at achieving the set objectives while minimizing the risk of detection.

Tools Used 1

LuaDream

Reports & References 2

https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/ https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/

ETDA Profile

Sandman

Origin

China

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗