Threat Investigation
Request a demo
State-sponsored

Witchetty

Witchetty is classified as state-sponsored.

Origin
China
Also known as
1

Witchetty was first documented by ESET in April 2022, who concluded that it was one of three sub-groups of TA410, a broad cyber-espionage operation with some links to the Cicada group (aka APT10). Witchetty’s activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload known as LookBack. ESET reported that the group had targeted governments, diplomatic missions, charities, and industrial/manufacturing organizations.

The group's reported origin is China.

Also known as: LookingFrog

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.