Operation RusticWeb is a cyber espionage group that emerged in October 2023, assessed with high confidence to be linked to Pakistan, and primarily motivated by intelligence gathering to steal confidential documents. What distinguishes this group is its adoption of new Rust-based malware and encrypted PowerShell commands for its campaigns, as well as its unique approach to data exfiltration by utilizing anonymous public web-based service engines such as OshiUpload instead of traditional command-and-control servers. While not directly aliases, Operation RusticWeb's tactics demonstrate similarities with Pakistan-linked threat actors Transparent Tribe (APT36) and SideCopy.

Aliases del actor

APT RUSTICWEB

Actores similares

apt-rusticwebactor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1apt-30actor · 1apt-38actor · 1