Vendetta, TA2719
Description
(Qihoo 360) Starting in April this year, 360 Baize Lab intercepted a large number of attack samples from an unknown hacker organization. The hacker organization sent a phishing email to the victim by forging a police station investigation letter, COVID-19 detection notice, etc. Through the backdoor virus to control the victim’s machine, steal valuable sensitive data related to the target.
(Proofpoint) In late March 2020, Proofpoint researchers began tracking a new actor with a penchant for using NanoCore and later AsyncRAT, popular commodity remote access trojans (RATs). Dubbed TA2719 by Proofpoint, the actor uses localized lures with colorful images that impersonate local banks, law enforcement, and shipping services. To date, Proofpoint has observed this actor send low volume campaigns to recipients in Austria, Chile, Greece, Hungary, Italy, North Macedonia, Netherlands, Spain, Sweden, Taiwan, United States, and Uruguay.
Names
| Name | Name-Giver |
|---|---|
| Vendetta | Qihoo 360 |
| TA2719 | Proofpoint |
Country
Motivation
- Information theft and espionage
First Seen
2020
Observed Countries
- Australia
- Austria
- Chile
- China
- Egypt
- Greece
- Hungary
- Italy
- Netherlands
- Macedonia
- Mexico
- Romania
- Russia
- Singapore
- Spain
- Sweden
- Taiwan
- Thailand
- USA
- Uruguay
Tools
Information
- https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/
- https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
Alienvault Otx
Other Information
Uuid
94f7768b-107e-44ae-87c7-a028cee60e32
Last Card Change
2020-09-02