ctrlINT What the industry said about every indicator, with the quote

TaskMastersThreat actor

  • BlueTraveller

TaskMasters is a state-sponsored Chinese APT that has been active since at least 2010, primarily targeting industrial, energy, and government sectors in Russia and the CIS. The group has been linked to the Webdav-O Trojan, which employs techniques to bypass network defenses by connecting to legitimate services.From MISP Galaxy

Last reported 3 years ago, by Group-IB2 reports

Suspected originChinaMISP Galaxy

ATT&CK techniques

6 of 22 · each with the sentence it comes from
  1. T1001Data Obfuscation

    “T1001 Data Obfuscation”

    Group-IBVendor
  2. T1016System Network Configuration Discovery

    “T1016 System Network Configuration Discovery”

    Group-IBVendor
  3. T1027Obfuscated Files or Information

    “T1027 Obfuscated Files or Information”

    Group-IBVendor
  4. T1033System Owner/User Discovery

    “T1033 System Owner/User Discovery”

    Group-IBVendor
  5. T1041Exfiltration Over C2 Channel

    “T1041 Exfiltration Over C2 Channel”

    Group-IBVendor
  6. T1057Process Discovery

    “T1057 Process Discovery”

    Group-IBVendor

What the reports say

2 reports, newest first · the exact sentence from each

  1. “Group-IB experts have previously warned about threats from TaskMasters and TA428, other Chinese nation-state cyber threat actors.”

    Group-IBVendor
    Nice Try Tonto Team

  2. “Group-IB specialists established that Webdav-O has a set of commands similar to a popular Trojan called BlueTraveller (aka RemShell), which was developed in China and has been linked to the hacker group called TaskMasters.”

    Group-IBVendor
    The Art of Cyberwarfare

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with TaskMasters here?
No account needed. We do not store your IP address.