ProjectSauronThreat actor
- g0041
- project sauron
- Sauron
- strider
ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes.From MISP Galaxy
Last reported 12 days ago, by The Hacker News2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1053.005Scheduled Task
“This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server.”
- T1110.003Password Spraying
“The group, UNK_CondorFiltration, is using TeamFiltration, a tool to enumerate Entra ID accounts and launch password-spraying attacks.”
- T1213.005Messaging Applications
“Max analysis: Researchers at InterSecLab have published an in-depth analysis of Max, Russia's state-mandated messaging applications, and all the ways the app can spy on its users and what data it collects.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“…ommunicates via Fox, an encrypted peer-to-peer (P2P) messaging network, to fetch commands and additional payloads from the operator, and Sauron Loader, which offers loader-type functionality exclusively to Russian-speaking cybercriminals.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“Sauron Loader: And speaking of new loaders, there's another one named Sauron that's being advertised on underground hacking forums.”
Indicators in its reports
named in the reports above- third-party[.]comin 1 report
- fbijobs[.]govin 1 report
- 104.194.9[.]227in 1 report
- raphae[.]liin 1 report
- verticalmailer[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.