ScarCruft updates its toolset – Week in security with Tony Anscombe

ScarCruft updates its toolset – Week in security with Tony Anscombe | WeLiveSecurity

2 months ago AndyC

Deployed
against
carefully
selected
targets,
the
new
backdoor
combs
through
the
drives
of
compromised
systems
for
files
of
interest
before
exfiltrating
them
to
Google
Drive

This
week,
ESET
researc

Deployed
against
carefully
selected
targets,
the
new
backdoor
combs
through
the
drives
of
compromised
systems
for
files
of
interest
before
exfiltrating
them
to
Google
Drive

This
week,
ESET
researchers
published
their
analysis
of
a
previously
undocumented
backdoor
that
the
ScarCruft
APT
group
has
used
against
carefully
selected
targets.
ScarCruft
is
an
espionage
group
that
has
been
operating
since
at
least
2012
and
mainly
takes
aim
at
South
Korea.

The
group’s
new
backdoor,
which
ESET
named
Dolphin,
has
a
wide
range
of
spying
capabilities
as
it
can
monitor
drives
and
portable
devices,
exfiltrate
files,
log
keystrokes,
take
screenshots,
and
steal
credentials
from
web
browsers.

Watch
the
video
to
learn
more
about
the
group’s
new
spying
tool
and
campaigns.

Full
technical
details
are
available
here:

Who’s
swimming
in
South
Korean
waters?
Meet
ScarCruft’s
Dolphin

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts