6 ms·
anyone know the APT designations for threat actors based in the US and Israel?
by DarkmSparks 3y ago
anyone know the APT designations for threat actors based in the US and Israel?
- fragmede 3y agoCIA, NSA, and Mossad.
- sillywalk 3y agoUS: The Equation Group [0] Israel: Unit 8200 [1] According to this[2] Wikipedia article on APTs. I'd be curious to know what kind of non-state APT groups in "The West" are at least tacitly approved, or 'sub-contracted'. The equivalent of say crime groups in Russia. [0] https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group [1] https://en.wikipedia.org/wiki/Unit_8200 https://en.wikipedia.org/wiki/Unit_8200 [2] https://en.wikipedia.org/wiki/Advanced_persistent_threat#APT_groups https://en.wikipedia.org/wiki/Advanced_persistent_threat#APT...
- halJordan 3y agoThose are not really apt designations except the equation group. The sanctioned ngo cyber actors are groups like finfisher, nso, the greek one that was just sanctioned, the remnants of Hacking Team. Alongside DIB companies like Raytheon, LockMart, etc. it's all rather aboveboard.
- DarkmSparks 3y agoEquation group was the one I was trying to remember thnx (didnt know unit 8200, just seen them in an old homey trap a while ago trying SQL injections from some Israeli government IP addresses)
- halJordan 3y agoFor actual apt designations, you would be hard pressed. You kind of need to find actual unattributed instruction sets. Like Regin or Flame, which is not a group so much as the name for an attack. However, generally speaking The Lamberts (BlackLambert, WhiteLambert, etc) are allegedly the CIA, EquationGroup allegedly NSA, ProjectSauron is allegedly Western. DarkHotel is allegedly South Korean. Mainly these are Kaspersky designations. As the West doesn't really track the various intrusions, and the Chinese public-facing info is either deliberately wrong, or so old it's useless.