Witchetty

Witchetty was first documented by ESET in April 2022, who concluded that it was one of three sub-groups of TA410, a broad cyber-espionage operation with some links to the Cicada group (aka APT10). Witchetty’s activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload known as LookBack. ESET reported that the group had targeted governments, diplomatic missions, charities, and industrial/manufacturing organizations.

Grubun kökeni Çin olarak bildiriliyor.

Diğer adları: LookingFrog

Bu aktör hakkında yayımlanmış raporlar:

• https://www.rewterz.com/rewterz-news/rewterz-threat-alert-witchetty-apt-group-active-iocs
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage
• https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/

Kaynak: MISP Galaxy, Malpedia.