APT22Threat actor
- bronze olive
- g0039
- group 46
- Suckfly
Suckfly is a China-based threat group that has been active since at least 2014From MISP Galaxy
Last reported 4 years ago, by Group-IB1 report
Suspected originChinaMISP Galaxy
ATT&CK techniques
6 of 49 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: NTDS – T1003.003”
- T1003.001LSASS Memory
“OS Credential Dumping: LSASS Memory -T1003.001”
- T1003.002Security Account Manager
“OS Credential Dumping: Security Account Manager – T1003.002”
- T1003.003NTDS
“OS Credential Dumping: NTDS – T1003.003”
- T1005Data from Local System
“Data from Local System – T1005”
- T1012Query Registry
“Query Registry – T1012”
What the reports say
1 report, newest first · the exact sentence from each-
APT41 World Tour 2021 on a tight schedule“Also known as BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly, Winnti Umbrella, Double Dragon”
Indicators in its reports
named in the reports above- fofa[.]suin 1 report
- sam[.]savein 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.