APT Archivi - Telsy

The 2024 state-sponsored campaigns

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the...

The Turla malware

13 Jun

Turla is one of the most advanced APTs (Advanced Persistent Threat) in the world. Also, Turla Group is a well-established collective that has been operational since at least 2004 Also...

The Advanced Persistent Threats (APT)

06 Jun

“APT”, the acronym for Advanced Persistent Threat, indicates a type of targeted and persistent attacks carried out by opponents with considerable technical expertise and great resources. As the “Advanced” part...

SideCopy APT: from Windows to *nix

05 Jan

Telsy Threat Intelligence team has observed a spear-phishing campaign conducted by cyber-espionage group SideCopy against critical government entities in India. SideCopy APT: from Windows to *nix As previously published...

When a false flag doesn’t work: Exploring the digital-crime underground at campaign preparation stage

11 Dec

At the beginning of October 2020 we found copy of a malicious document potentially to be attributed to an APT group known with the name of APT34 / OilRig. The...

Operation “Space Race”: reaching the stars through professional Social Networks

19 Oct

At the beginning of May 2020, Telsy analyzed some social-engineering based attacks against individuals operating in the aerospace and avionics sector performed through the popular professional social network LinkedIn. According...

Turla / Venomous Bear updates its arsenal: “NewPass” appears on the APT threat scene

14 Jul

Recently Telsy observed some artifacts related to an attack that occurred in June 2020 that is most likely linked to the popular Russian Advanced Persistent Threat (APT) known as...

APT34 (aka OilRig, aka Helix Kitten) attacks Lebanon government entities with MailDropper implants

02 Mar

Very recently another custom malicious implant that seems to be related to APT34 (aka OilRig) has been uploaded to a major malware analysis platform. Since 2014, year in which FireEye...

Meeting POWERBAND: The APT33 .Net POWERTON variant

12 Feb

Introduction Since the Islamic revolution, US and regional rivals have put continuos effort in containing and isolating Iran. Implementing a foreign policy generally addressed as “strategic loneliness”, Iran’s defense strategy...

The Lazarus’ gaze to the world: What is behind the first stone ?

05 Nov

Introduction Lazarus (aka APT38 / Hidden Cobra / Stardust Chollima) is one of the more prolific threat actors in the APT panorama. Since 2009, the group leveraged its capability in...