SOUNDBITEMalware
- Denis
SOUNDBITE is a signature backdoor used by APT32.From MITRE ATT&CK
Last reported 2 days ago, by Risky Business News8 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1021Remote Services
“T1021”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“T1036”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1055Process Injection
“T1055”
- T1059Command and Scripting Interpreter
“T1059”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident“A 19-year-old named Denis A.”
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia“A Moscow court on Wednesday placed 19-year-old Denis Fridman under house arrest until December 8 in connection with the Dodo Pizza breach, which reportedly...”
-
Risky Bulletin: Russia arrests DataSuckers hacking group“A 19-year-old named Denis A.”
-
CREST Onboards First Cohort for AI-Enabled Pentesting Accreditation“Denis Kucinic, VP Operations at Packetlabs, a Canada-based CREST member, agreed: “AI will be revolutionary for security providers like Packetlabs, but it's vital that we assure customers, and the wider industry, that it's being deployed and used responsibly.”
-
FBI Probes Possible Breach of 153 Million Driver’s Licenses“Denis Calderone, CTO at Suzu Labs, argued that businesses using identity verification vendors need to ask harder questions about how long scans are retained after verification, if there are contractual data minimization obligations, and whether they can audit said firms.”
-
DDoS Attack Hits Norwegian Government Services“You get one place to enforce policy, one set of logs to monitor, one surface to harden,” explained Denis Calderone, COO at AI security firm Suzu Labs.”
-
OceanLotus: del espionaje exterior al foco en objetivos en Vietnam“Entre sus herramientas más conocidas se encuentran Denis (también conocido como SOUNDBITE), que implementa tunelización DNS para comunicaciones de C&C; PHOREAL, que utiliza el protocolo ICMP para comunicaciones de C&C; WINDSHIELD, que incorpora un interesante…”
-
OceanLotus: From external espionage to domestic targeting“Its well-known tools include Denis (aka SOUNDBITE), implementing DNS tunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxy bypass mechanism; and its latest backdoor, SPECTRALVIPER, whic…”
Indicators in its reports
named in the reports above- metakit.fireant[.]vnin 2 reports
- hxxp://metakit.fireant[.]vn/Software/version.xmlin 2 reports
- 139.162.11[.]152in 2 reports
- 142.91.98[.]77in 2 reports
- hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement.htmlin 2 reports
- financemachinelearning[.]comin 2 reports
- gatewayrvcenter[.]comin 2 reports
- 139.180.128[.]42in 2 reports
- coachcybersecurity[.]comin 2 reports
- 139.99.33[.]239in 2 reports
- mxprodesign[.]comin 2 reports
- 166.88.77[.]186in 2 reports
- power-sync-services[.]comin 2 reports
- 103.119.47[.]104in 2 reports
- 511b77459673ec42…1d233b6c39fbin 2 reports
- 59a8553a4f8130f5…0be4d4da0e98in 2 reports
- 9ca1a5c7f79882db…26bcdcb9f6ddin 2 reports
- a8e2bbbfcb865003…12755ab0c165in 2 reports
- f74f1feb62b662cd…27824e55acb9in 2 reports
- f8f8209987ca7f13…e21bd2ae93a9in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.