RAZOR TIGER

An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages.

Grubun Hindistan devletinin desteğiyle çalıştığından şüpheleniliyor.

Grup 3 zararlı yazılım ailesiyle ilişkilendirildi.

Diğer adları: SideWinder, Rattlesnake, APT-C-17, T-APT-04

Grup 3 zararlı yazılım ailesiyle ilişkilendirildi.

Bu aktör hakkında yayımlanmış raporlar:

• https://securelist.com/apt-trends-report-q1-2018/85280/
• https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/
• https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742/

Kaynak: MISP Galaxy, Malpedia.