APT Archivi - Telsy

Chinese front companies BIETA and CIII and steganography in APT operations

The cyber ecosystem sponsored by the Chinese government remains the subject of significant analysis and discoveries. In line with the numerous revelations of the last few years—detailed investigations by Intrusion...

APT operational developments, malware families and variants, new cybercrime ecosystems, and methods of compromise

27 Oct

APT: new toolkits and TTPs from state-sponsored adversaries In the state-sponsored landscape, this week saw new tactics and tools from various APTs. The Indian Bitter sent phishing emails targeting diplomatic...

The 2024 state-sponsored campaigns

02 Dec

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the...

The Turla malware

13 Jun

Turla is one of the most advanced APTs (Advanced Persistent Threat) in the world. Also, Turla Group is a well-established collective that has been operational since at least 2004 Also...

The Advanced Persistent Threats (APT)

06 Jun

“APT”, the acronym for Advanced Persistent Threat, indicates a type of targeted and persistent attacks carried out by opponents with considerable technical expertise and great resources. As the “Advanced” part...

SideCopy APT: from Windows to *nix

05 Jan

Telsy Threat Intelligence team has observed a spear-phishing campaign conducted by cyber-espionage group SideCopy against critical government entities in India. SideCopy APT: from Windows to *nix As previously published...

When a false flag doesn’t work: Exploring the digital-crime underground at campaign preparation stage

11 Dec

At the beginning of October 2020 we found copy of a malicious document potentially to be attributed to an APT group known with the name of APT34 / OilRig. The...

Operation “Space Race”: reaching the stars through professional Social Networks

19 Oct

At the beginning of May 2020, Telsy analyzed some social-engineering based attacks against individuals operating in the aerospace and avionics sector performed through the popular professional social network LinkedIn. According...

Turla / Venomous Bear updates its arsenal: “NewPass” appears on the APT threat scene

14 Jul

Recently Telsy observed some artifacts related to an attack that occurred in June 2020 that is most likely linked to the popular Russian Advanced Persistent Threat (APT) known as...

APT34 (aka OilRig, aka Helix Kitten) attacks Lebanon government entities with MailDropper implants

02 Mar

Very recently another custom malicious implant that seems to be related to APT34 (aka OilRig) has been uploaded to a major malware analysis platform. Since 2014, year in which FireEye...