SongXY

SongXY is a Chinese APT group that employs phishing tactics to initiate cyberespionage campaigns. They utilize the Royal Road RTF builder, exploiting the CVE-2018-0798 vulnerability in Microsoft Equation Editor. In one instance, they sent a document containing a link to an attacker-controlled server, which automatically triggered upon opening, allowing them to gather information about the target's system configuration.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/
• http://www.ptsecurity.com/upload/corporate/ww-en/analytics/APT-Attacks-eng.pdf

Mənbə: MISP Galaxy, Malpedia.