🇰🇿

Fxmsp

APT Group ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇰🇿 KZ

Last Updated 01 Jun 2022

MITRE ATT&CK 4

T1070.004 T1078.003 T1080 T1140

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 3 entries

Fxmsp self given

ATK 134 Thales

TAG-CR17 Recorded Future

Observed Target Countries 40

Based on ETDA data — countries highlighted in red

Australia Brazil Canada Chile China Colombia Cyprus Ecuador Egypt El Salvador Germany Ghana Hong Kong India Indonesia Ireland Italy Jamaica Japan Kenya Kuwait Malaysia Maldives Mexico Netherlands Nigeria Oman Pakistan Philippines Russia Saudi Arabia Singapore South Africa South Korea Sri Lanka Thailand UAE UK USA Zimbabwe

Description

(AdvIntel) Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground. Some of the known Fxmsp TTPs included accessing network environments via externally available remote desktop protocol (RDP) servers and exposed active directory. Most recently, the actor claimed to have developed a credential-stealing botnet capable of infecting high-profile targets in order to exfiltrate sensitive usernames and passwords. Fxmsp has claimed that developing this botnet and improving its capabilities for stealing information from secured systems is their main goal.

Tools Used 2

RDP exposed AD

Operations 1

2019-05 Breaches of Three Major Anti-Virus Companies https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

Reports & References 2

https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies https://www.group-ib.com/resources/threat-research/fxmsp-report.html

ETDA Profile

Fxmsp

Origin

Kazakhstan

First Seen 2016

Motivation

Financial gain

View on ETDA APT Groups ↗