Operation DRBControl
Operation DRBControl is classified as state-sponsored.
- Type
- State-sponsored
- Origin
- China
Operation DRBControl is a cyberespionage campaign targeting gambling companies in Southeast Asia, first identified in 2019. The operation involves the use of HyperBro malware and SysUpdate variants, with evidence of customer database and source code exfiltration. The threat actor has employed domain spoofing for command and control and has shown a consistent interest in the gambling industry. Trend Micro's analysis linked multiple tools and malware families to this campaign, indicating a sophisticated and evolving threat landscape.
The group's reported origin is China.
Published reports on this actor:
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.