Threat Investigation
Request a demo
State-sponsored

REF7707

REF7707 is classified as state-sponsored.

Origin
China
Also known as
2

REF7707 is a cyber campaign targeting government entities, particularly a foreign ministry in South America, utilizing malware families such as FinalDraft, GuidLoader, and PathLoader for persistence and lateral movement. The threat actor employs the Microsoft Graph API for C2 communication, blending malicious traffic with legitimate activity to evade detection. Despite their technical sophistication, REF7707 operators exhibited poor operational security, leading to the exposure of their infrastructure and malware. Their tactics enable the extraction of sensitive data, including passwords and Active Directory information, facilitating ongoing espionage activities.

The group's reported origin is China.

Also known as: CL-STA-0049, Jewelbug

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

REF7707 · Threat actors · Dark Radar