🇺🇸

ProjectSauron

APT Group Information theft and espionage 5 zero-day CVEs ETDA ✓

Also Known As 4 names

G0041 Project Sauron Sauron Strider

Target Countries 6

Countries highlighted in red

Belgium China Islamic Republic of Iran Rwanda Sweden United States

Sectors Targeted

Financial Grantmaking and Giving Services 8132 Telecommunications Scientific research centers Government Embassies Defense

Details

Origin 🇺🇸 US

Last Updated 01 Jun 2022

MITRE ATT&CK 94

T1003 T1003.001 T1005 T1007 T1008 T1011 T1012 T1016 T1021 T1027 - Obfuscated Files or Information T1027.002 T1033 T1036 T1041 T1047 T1048 T1049 T1053 T1055 T1057 T1059 T1059.001 T1059.003 T1060 T1070 T1071 T1071.001 T1078 T1081 T1082 T1083 T1085 T1087 T1090 T1090.001 T1095 T1102 T1105 T1106 T1110 T1112 T1114 T1114.001 T1115 T1119 T1120 T1124 T1127 T1130 T1132 T1133 T1136 T1137 T1140 - Deobfuscate/Decode Files or Information T1170 T1176 T1190 T1204 - User Execution T1204.002 T1217 T1218 - Signed Binary Proxy Execution T1485 T1486 T1489 T1490 - Inhibit System Recovery T1497 T1497.003 T1498 - Network Denial of Service T1503 T1518 T1529 T1530 T1531 T1539 T1543 T1547 T1550 T1552 T1553 - Subvert Trust Controls T1555 T1556 T1556.002 T1560 T1561 T1562 T1562.001 T1564 T1564.005 T1566 - Phishing T1571 T1573 T1583 T1587 T1595

Related Zero-Days 5

CVE-2018-8174 CVE-2020-1472 CVE-2022-42475 CVE-2023-36884 CVE-2023-38831

Known Names 3 entries

Strider Symantec

ProjectSauron Kaspersky

G0041 MITRE

Observed Target Countries 6

Based on ETDA data — countries highlighted in red

Belgium China Iran Russia Rwanda Sweden

Description

(Symantec) Strider has been active since at least October 2011. The group has maintained a low profile until now and its targets have been mainly organizations and individuals that would be of interest to a nation state’s intelligence services. Symantec obtained a sample of the group’s Remsec malware from a customer who submitted it following its detection by our behavioral engine. Remsec is primarily designed to spy on targets. It opens a back door on an infected computer, can log keystrokes, and steal files. Strider has been highly selective in its choice of targets and, to date, Symantec has found evidence of infections in 36 computers across seven separate organizations. The group’s targets include a number of organizations and individuals located in Russia, an airline in China, an organization in Sweden, and an embassy in Belgium.

Tools Used 1

Remsec

Reports & References 2

https://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf

ETDA Profile

Strider, ProjectSauron

Origin

USA

First Seen 2011

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0041/

View on ETDA APT Groups ↗