APT22
Also known as G0039, Suckfly, BRONZE OLIVE, Group 46
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Suckfly is a China-based threat group that has been active since at least 2014
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003 OS Credential DumpingT1046 Network Service DiscoveryT1059.003 Windows Command ShellT1078 Valid AccountsT1553.002 Code Signing
Recent activity
No posts or advisories have named this actor recently.
References
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=62e325ae-f551-4855-b9cf-28a7d52d1534&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7a60af1f-7786-446c-976b-7c71a16e9d3b&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
- https://attack.mitre.org/groups/G0039/
- https://exchange.xforce.ibmcloud.com/collection/Suckfly-APT-aa8af56fd12d25c98fc49ca5341160ab
- http://www.slideshare.net/CTruncer/ever-present-persistence-established-footholds-seen-in-the-wild
- https://www.secureworks.com/research/threat-profiles/bronze-olive
- https://www.mandiant.com/resources/insights/apt-groups
- http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks
- http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates
- https://attack.mitre.org/groups/G0039
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.