How did SaT entangle several groups at once in a tangle?

How did CaT entangle several groups at once? 🧶

In the fall of 2024, our attention was drawn to an interesting tool discovered while studying the activity of the PhaseShifters group. It turned out to be a subscription-based crypter (CaaS) called Crypters And Tools — we already covered it in detail in the first part of our research: how it works, what sets it apart from others, and how its infrastructure is organized.

Now we return to the topic of APT groups, but shift the focus to other threat actors — TA558, Blind Eagle, and Aggah — whose activities we will examine in more detail.

🐾 Which groups definitely used Crypters And Tools in their attacks?

🔎 How interconnected are these groups that use CaT?

🇵🇰 How is Aggah faring after 2022?

🧩 How did we identify specific users?

💥 Which users are members of the TA558 group, and what does negrocock have to do with it?

🇳🇬 From which African country were 60 thousand emails sent, and what does Crypters And Tools have to do with it?

You will find answers to these and other questions in the second part of our article about Crypters And Tools.

#TI #APT #hacktool
@ptescalator