Lilac Typhoon, also tracked by Microsoft as DEV-0234, is a state-sponsored cyber threat actor attributed to China. The group's primary motivation is cyber espionage and broader system compromise, often leveraging critical vulnerabilities to gain initial access. This group is distinguished by its opportunistic exploitation of zero-day or recently disclosed vulnerabilities, as exemplified by its rapid exploitation of the Atlassian Confluence remote code execution vulnerability, CVE-2022-26134, shortly after its public disclosure in June 2022. While their activities primarily involve espionage-related objectives, they have been observed deploying diverse payloads, including those associated with cryptojacking and potential ransomware use, indicating a versatile operational approach. The name 'Typhoon' within Microsoft's naming taxonomy consistently designates groups originating from China.

Aliases del actor

DEV-0234

Actores similares

devmanransomware · 184apt-flaxtyphoonactor · 1Network Devicesactor · 1Compromise Software Dependencies and Development Toolsactor · 1Device Driver Discoveryactor · 1Volt Typhoonapt · 1Salt Typhoonactor · 1CS FQL: 32. Detect Data Exfiltration via external storage devicesactor · 1dev-0322actor · 1volt-typhoonactor · 1