CybercrimeMITRE G0135
BackdoorDiplomacy
Also known as BackDip, CloudComputating, Quarian
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
An APT group that we are calling BackdoorDiplomacy, due to the main vertical of its victims, has been targeting Ministries of Foreign Affairs and telecommunication companies in Africa and the Middle East since at least 2017.
Targets: Government, Telecomms, Libya, Namibia, Sudan, Albania, Croatia, Georgia, Poland, Iran, Qatar, Saudi Arabia, Sri Lanka, Uzbekistan
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1027 Obfuscated Files or InformationT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1055.001 Dynamic-link Library InjectionT1074.001 Local Data StagingT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1120 Peripheral Device DiscoveryT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1574.001 DLLT1588.001 MalwareT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/
- https://attack.mitre.org/groups/G0135
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.