🇺🇿

SandCat

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 2

Countries highlighted in red

Saudi Arabia United States

Sectors Targeted

Motion Picture and Video Production 51211 Computer Systems Design and Related Services 54151

Details

Origin 🇺🇿 UZ

Last Updated 01 Jun 2022

MITRE ATT&CK 4

T1059.003 T1071.001 T1071.004 T1078.003

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

SandCat Kaspersky

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

Saudi Arabia Middle East

Description

(Kaspersky) SandCat is a relatively new APT group; we first observed them in 2018, although it would appear they have been around for some time,” Costin Raiu, director of global research and analysis team at Kaspersky Lab, told Threatpost. “They use both FinFisher/FinSpy [spyware] and the CHAINSHOT framework in attacks, coupled with various zero-days. Targets of SandCat have been mostly observed in Middle East, including but not limited to Saudi Arabia.

Tools Used 3

FinFisher CHAINSHOT several 0-days

Reports & References 2

https://threatpost.com/sandcat-fruityarmor-exploiting-microsoft-win32k/142751/ https://www.vice.com/en_us/article/3kx5y3/uzbekistan-hacking-operations-uncovered-due-to-spectacularly-bad-opsec

ETDA Profile

SandCat

Origin

Uzbekistan

First Seen 2018

Sponsor State-sponsored, Military Unit 02616

Motivation

Information theft and espionage

View on ETDA APT Groups ↗