Scarab

Also known as: Scarab

Scarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small number of individuals across the world, including Russia and the United States. The backdoor deployed by Scarab in their campaigns is most commonly known as Scieron.

🌍 Country China
🎯 Incident Type Espionage

Targeted Victims

Russia Ukraine United States

Introduction

Scarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small number of individuals across the world, including Russia and the United States. The backdoor deployed by Scarab in their campaigns is most commonly known as Scieron.

Activities and Tactics

Country of Origin: 🇨🇳 China

Incident Type: Espionage

Suspected Victims: Russia, Ukraine, United States

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Backdoor.Oldrea
  • Small-Net
  • UNITEDRAKE
  • CrossRat
  • Scieron:
  • Trojan.Scieron:
  • Trojan.Scieron.B:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.