State-backedMITRE G0054
Sowbug
Also known as G0054
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Sowbug has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets. Sowbug has been seen mounting classic espionage attacks by stealing documents from the organizations it infiltrates.
Targets: Government, Argentina, Ecuador, Brazil, Brunei, Peru, Malaysia
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003 OS Credential DumpingT1036.005 Match Legitimate Resource Name or LocationT1039 Data from Network Shared DriveT1056.001 KeyloggingT1059.003 Windows Command ShellT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1135 Network Share DiscoveryT1560.001 Archive via Utility
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments
- https://www.cfr.org/interactive/cyber-operations/sowbug
- https://attack.mitre.org/groups/G0054/
- https://attack.mitre.org/groups/G0054
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.