Where does one grouping end and another begin? 🧩

Where does one group end and another begin? 🧩

In a new study, we examined a case that clearly demonstrates how the MaaS model complicates attack attribution.

The study focuses on a malware delivery chain using SocGholish, linked to the Mustard Tempest group. At the same time, the infrastructure involved in this scheme was also used in Cloud Atlas attacks.

🕵️ In the article, we break down:

• the full attack chain
• the distribution of roles between MaaS service operators
• the mechanics of FakeUpdate
• possible points of intersection between Cloud Atlas and Mustard Tempest

More details — in the article on Habr.

#APT #TI #Malware
@ptescalator