WIP19 Espionage | New Chinese APT Targets IT Service Providers and Telcos With Signed Malware

SentinelOne researchers uncovered a new threat cluster, tracked as WIP19, which has been targeting telecommunications and IT service providers in the Middle East and Asia.

The experts believe activity of the group  is espionage-related and that WIP19 is a Chinese-speaking threat actor.

The threat cluster has some overlap with Operation Shadow Force but utilizes new malware and techniques.

WIP19 utilizes a legitimate, stolen certificate to sign novel malware, including SQLMaggie, ScreenCap and a credential dumper.

WIP19 Espionage | New Chinese APT Targets IT Service Providers and Telcos With Signed Malware

Precision targeting of critical infrastructure industries indicates espionage-related activity by an unattributed Chinese-speaking threat group.

SentinelOneJoey Chen

#Analysis #IoCs