Trusted Design

New Sofacy Attacks Against US Government Agency

概要

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted the United States government. The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan. The developer implemented a clever persistence mechanism in the Trojan, one which had not been observed in previous attacks. The focus of this blog will be on the attacks and the infrastructure associated with Sofacy using the new persistence mechanism as a correlation point.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Sofacy APT hits high profile targets (score: 0.68)
New Attacks Linked to C0d0s0 Group (score: 0.66)
A Look Into Fysbis: Sofacy’s Linux Backdoor (score: 0.65)
Chinese Actors attacks on US Government and EU Media (score: 0.65)
NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

Ember Bear

Score: 5.63

Matched TTPs:

T1491.002 - External Defacement
T1203 - Exploitation for Client Execution

MITREへのリンク →

Sandworm Team

Score: 20.70

Matched TTPs:

T1491.002 - External Defacement
T1587.001 - Malware
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1591.002 - Business Relationships
T1102.002 - Bidirectional Communication
T1203 - Exploitation for Client Execution
T1584.004 - Server

MITREへのリンク →

Kimsuky

Score: 36.44

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1657 - Financial Theft
T1583.006 - Web Services
T1591 - Gather Victim Org Information
T1534 - Internal Spearphishing
T1566 - Phishing
T1218.010 - Regsvr32
T1593.001 - Social Media
T1102.002 - Bidirectional Communication
T1598 - Phishing for Information
T1102.001 - Dead Drop Resolver

MITREへのリンク →

FIN13

Score: 4.62

Matched TTPs:

T1587.001 - Malware
T1657 - Financial Theft

MITREへのリンク →

Moonstone Sleet

Score: 13.80

Matched TTPs:

T1587.001 - Malware
T1598.003 - Spearphishing Link
T1591 - Gather Victim Org Information
T1598 - Phishing for Information
T1566.003 - Spearphishing via Service

MITREへのリンク →

Indrik Spider

Score: 4.93

Matched TTPs:

T1587.001 - Malware
T1584.004 - Server

MITREへのリンク →

Lazarus Group

Score: 22.22

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1591 - Gather Victim Org Information
T1102.002 - Bidirectional Communication
T1203 - Exploitation for Client Execution
T1584.004 - Server
T1027.007 - Dynamic API Resolution
T1566.003 - Spearphishing via Service

MITREへのリンク →

Contagious Interview

Score: 20.98

Matched TTPs:

T1587.001 - Malware
T1681 - Search Threat Vendor Data
T1593.003 - Code Repositories
T1657 - Financial Theft
T1583.006 - Web Services
T1593.001 - Social Media
T1566.003 - Spearphishing via Service

MITREへのリンク →

OilRig

Score: 10.31

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1203 - Exploitation for Client Execution
T1573.002 - Asymmetric Cryptography
T1566.003 - Spearphishing via Service

MITREへのリンク →

UNC3886

Score: 7.72

Matched TTPs:

T1587.001 - Malware
T1681 - Search Threat Vendor Data
T1203 - Exploitation for Client Execution

MITREへのリンク →

LuminousMoth

Score: 3.54

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link

MITREへのリンク →

APT29

Score: 13.42

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1550.003 - Pass the Ticket
T1583.006 - Web Services
T1203 - Exploitation for Client Execution
T1566.003 - Spearphishing via Service

MITREへのリンク →

Play

Score: 4.62

Matched TTPs:

T1587.001 - Malware
T1657 - Financial Theft

MITREへのリンク →

Aoqin Dragon

Score: 3.59

Matched TTPs:

T1587.001 - Malware
T1203 - Exploitation for Client Execution

MITREへのリンク →

RedCurl

Score: 6.29

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

Turla

Score: 10.79

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1102.002 - Bidirectional Communication
T1584.004 - Server

MITREへのリンク →

Mustang Panda

Score: 13.64

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1583.006 - Web Services
T1203 - Exploitation for Client Execution
T1027.007 - Dynamic API Resolution

MITREへのリンク →

FIN7

Score: 11.24

Matched TTPs:

T1587.001 - Malware
T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1591 - Gather Victim Org Information
T1102.002 - Bidirectional Communication

MITREへのリンク →

MuddyWater

Score: 7.35

Matched TTPs:

T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1102.002 - Bidirectional Communication
T1203 - Exploitation for Client Execution

MITREへのリンク →

Confucius

Score: 4.95

Matched TTPs:

T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1203 - Exploitation for Client Execution

MITREへのリンク →

Sidewinder

Score: 9.02

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1598.002 - Spearphishing Attachment
T1203 - Exploitation for Client Execution

MITREへのリンク →

FIN8

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

APT32

Score: 14.00

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1550.003 - Pass the Ticket
T1583.006 - Web Services
T1218.010 - Regsvr32
T1203 - Exploitation for Client Execution

MITREへのリンク →

APT3

Score: 6.56

Matched TTPs:

T1566.002 - Spearphishing Link
T1203 - Exploitation for Client Execution
T1036.010 - Masquerade Account Name

MITREへのリンク →

Leviathan

Score: 15.58

Matched TTPs:

T1566.002 - Spearphishing Link
T1534 - Internal Spearphishing
T1218.010 - Regsvr32
T1589.001 - Credentials
T1203 - Exploitation for Client Execution
T1584.004 - Server

MITREへのリンク →

APT33

Score: 7.07

Matched TTPs:

T1566.002 - Spearphishing Link
T1552.006 - Group Policy Preferences
T1203 - Exploitation for Client Execution

MITREへのリンク →

ZIRCONIUM

Score: 11.75

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1583.006 - Web Services
T1102.002 - Bidirectional Communication
T1598 - Phishing for Information

MITREへのリンク →

EXOTIC LILY

Score: 9.31

Matched TTPs:

T1566.002 - Spearphishing Link
T1593.001 - Social Media
T1203 - Exploitation for Client Execution
T1566.003 - Spearphishing via Service

MITREへのリンク →

Magic Hound

Score: 17.90

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1583.006 - Web Services
T1589.001 - Credentials
T1102.002 - Bidirectional Communication
T1036.010 - Masquerade Account Name
T1566.003 - Spearphishing via Service

MITREへのリンク →

Windshift

Score: 3.97

Matched TTPs:

T1566.002 - Spearphishing Link
T1566.003 - Spearphishing via Service

MITREへのリンク →

Cobalt Group

Score: 8.43

Matched TTPs:

T1566.002 - Spearphishing Link
T1218.010 - Regsvr32
T1203 - Exploitation for Client Execution
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

TA2541

Score: 6.21

Matched TTPs:

T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

Earth Lusca

Score: 6.29

Matched TTPs:

T1566.002 - Spearphishing Link
T1583.006 - Web Services
T1584.004 - Server

MITREへのリンク →

Storm-1811

Score: 12.13

Matched TTPs:

T1566.002 - Spearphishing Link
T1667 - Email Bombing
T1036.010 - Masquerade Account Name
T1566.003 - Spearphishing via Service

MITREへのリンク →

Wizard Spider

Score: 5.58

Matched TTPs:

T1566.002 - Spearphishing Link
T1552.006 - Group Policy Preferences

MITREへのリンク →

Patchwork

Score: 8.68

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1203 - Exploitation for Client Execution
T1102.001 - Dead Drop Resolver

MITREへのリンク →

LazyScripter

Score: 3.46

Matched TTPs:

T1566.002 - Spearphishing Link
T1583.006 - Web Services

MITREへのリンク →

APT42

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

APT39

Score: 3.84

Matched TTPs:

T1566.002 - Spearphishing Link
T1102.002 - Bidirectional Communication

MITREへのリンク →

Scattered Spider

Score: 12.96

Matched TTPs:

T1598.003 - Spearphishing Link
T1657 - Financial Theft
T1598 - Phishing for Information
T1538 - Cloud Service Dashboard

MITREへのリンク →

APT28

Score: 23.06

Matched TTPs:

T1598.003 - Spearphishing Link
T1583.006 - Web Services
T1591 - Gather Victim Org Information
T1589.001 - Credentials
T1102.002 - Bidirectional Communication
T1203 - Exploitation for Client Execution
T1598 - Phishing for Information
T1498 - Network Denial of Service

MITREへのリンク →

Star Blizzard

Score: 6.08

Matched TTPs:

T1598.003 - Spearphishing Link
T1598.002 - Spearphishing Attachment

MITREへのリンク →

CURIUM

Score: 4.98

Matched TTPs:

T1598.003 - Spearphishing Link
T1566.003 - Spearphishing via Service

MITREへのリンク →

Dragonfly

Score: 17.87

Matched TTPs:

T1598.003 - Spearphishing Link
T1591.002 - Business Relationships
T1598.002 - Spearphishing Attachment
T1203 - Exploitation for Client Execution
T1036.010 - Masquerade Account Name
T1584.004 - Server

MITREへのリンク →

LAPSUS$

Score: 11.13

Matched TTPs:

T1591.002 - Business Relationships
T1593.003 - Code Repositories
T1589.001 - Credentials

MITREへのリンク →

HAFNIUM

Score: 5.86

Matched TTPs:

T1593.003 - Code Repositories
T1583.006 - Web Services

MITREへのリンク →

BRONZE BUTLER

Score: 8.62

Matched TTPs:

T1550.003 - Pass the Ticket
T1203 - Exploitation for Client Execution
T1102.001 - Dead Drop Resolver

MITREへのリンク →

INC Ransom

Score: 5.81

Matched TTPs:

T1657 - Financial Theft
T1566 - Phishing

MITREへのリンク →

Storm-0501

Score: 5.27

Matched TTPs:

T1657 - Financial Theft
T1218.010 - Regsvr32

MITREへのリンク →

AppleJeus

Score: 5.81

Matched TTPs:

T1657 - Financial Theft
T1566 - Phishing

MITREへのリンク →

Medusa Group

Score: 7.28

Matched TTPs:

T1657 - Financial Theft
T1583.006 - Web Services
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

Gamaredon Group

Score: 8.03

Matched TTPs:

T1583.006 - Web Services
T1534 - Internal Spearphishing
T1102.002 - Bidirectional Communication

MITREへのリンク →

Saint Bear

Score: 3.51

Matched TTPs:

T1583.006 - Web Services
T1203 - Exploitation for Client Execution

MITREへのリンク →

POLONIUM

Score: 4.41

Matched TTPs:

T1583.006 - Web Services
T1102.002 - Bidirectional Communication

MITREへのリンク →

SideCopy

Score: 3.62

Matched TTPs:

T1598.002 - Spearphishing Attachment

MITREへのリンク →

Volt Typhoon

Score: 6.12

Matched TTPs:

T1591 - Gather Victim Org Information
T1584.004 - Server

MITREへのリンク →

HEXANE

Score: 6.02

Matched TTPs:

T1534 - Internal Spearphishing
T1102.002 - Bidirectional Communication

MITREへのリンク →

Sea Turtle

Score: 4.78

Matched TTPs:

T1566 - Phishing
T1203 - Exploitation for Client Execution

MITREへのリンク →

Axiom

Score: 4.78

Matched TTPs:

T1566 - Phishing
T1203 - Exploitation for Client Execution

MITREへのリンク →

GOLD SOUTHFIELD

Score: 3.29

Matched TTPs:

T1566 - Phishing

MITREへのリンク →

Inception

Score: 4.24

Matched TTPs:

T1218.010 - Regsvr32
T1203 - Exploitation for Client Execution

MITREへのリンク →

Chimera

Score: 3.44

Matched TTPs:

T1589.001 - Credentials

MITREへのリンク →

APT37

Score: 3.89

Matched TTPs:

T1102.002 - Bidirectional Communication
T1203 - Exploitation for Client Execution

MITREへのリンク →

APT12

Score: 3.89

Matched TTPs:

T1102.002 - Bidirectional Communication
T1203 - Exploitation for Client Execution

MITREへのリンク →

Tropic Trooper

Score: 4.24

Matched TTPs:

T1203 - Exploitation for Client Execution
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

APT41

Score: 4.78

Matched TTPs:

T1203 - Exploitation for Client Execution
T1102.001 - Dead Drop Resolver

MITREへのリンク →

FIN6

Score: 5.27

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1566.003 - Spearphishing via Service

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

APT38

Score: 4.54

Matched TTPs:

T1036.006 - Space after Filename

MITREへのリンク →

Rocke

Score: 3.29

Matched TTPs:

T1102.001 - Dead Drop Resolver

MITREへのリンク →

RTM

Score: 3.29

Matched TTPs:

T1102.001 - Dead Drop Resolver

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.83

Matched TTPs:

T1102.002 - Bidirectional Communication
T1598 - Phishing for Information
T1102.001 - Dead Drop Resolver
T1593.001 - Social Media
T1598.003 - Spearphishing Link
T1583.006 - Web Services
T1218.010 - Regsvr32
T1587.001 - Malware
T1657 - Financial Theft
T1591 - Gather Victim Org Information
T1566 - Phishing
T1566.002 - Spearphishing Link
T1534 - Internal Spearphishing

MITREへのリンク →

APT28

Score: 0.62

Matched TTPs:

T1102.002 - Bidirectional Communication
T1598 - Phishing for Information
T1589.001 - Credentials
T1203 - Exploitation for Client Execution
T1598.003 - Spearphishing Link
T1583.006 - Web Services
T1591 - Gather Victim Org Information
T1498 - Network Denial of Service

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る