Viper style

Viper Style 🐍

Can an attacker use well-known tools and remain undetected for over a year and a half? Our answer is yes.

In mid-October 2024, the cyber intelligence department of the Positive Technologies Expert Security Center (PT Expert Security Center) detected a targeted Revenge RAT campaign aimed at employees of financial departments in Russian companies.

Particular attention was drawn to the unusual African names used for the attackers’ command-and-control infrastructure. Delving deeper into the investigation, we identified and tracked a new, previously undocumented APT group that has been attacking Russian companies since at least May 2023.

Due to the use of African names, regular updates of samples and lures, the “spotted” pattern of malicious file names, and prolonged stealth in cyberspace, we named the group DarkGaboon — after the African Gaboon viper, which can be found in the vicinity of the Kilimanjaro stratovolcano.

😏 You can read more about the group and its techniques in the research on our website.

#TI #APT #Malware
@ptescalator