State-backedMITRE G0076
Thrip
Also known as G0076, ATK78
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.
Targets: Private sector, United States
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1059.001 PowerShellT1219.002 Remote Desktop SoftwareT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.cfr.org/interactive/cyber-operations/thrip
- https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
- https://attack.mitre.org/groups/G0076/
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
- https://cyberthreat.thalesgroup.com/sites/default/files/2022-05/THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf
- https://attack.mitre.org/groups/G0076
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.