Threat Investigation
Request a demo
State-sponsored

Sandman APT

Sandman APT is classified as state-sponsored.

Type
State-sponsored
Suspected state sponsor
China

First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.

The group is suspected of operating with the support of China.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.