apt

Group5

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Group5

Attribution

Assessed pro-Syrian-regime, possible Iranian nexus — low-medium confidence (single primary source, no MITRE Group ID)

Origin

Unknown

First seen

2015

Last active

2016

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Syria (opposition targets)

Sectors

Opposition/activists (mobile & desktop)

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Syria (opposition targets) (Opposition/activists (mobile & desktop) sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Madi / MahdiactorTechnique overlap
Rocket KittenactorTechnique overlap
Ferocious KittenactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
Earth BogleactorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap
BahamutactorTechnique overlap
APT39 / ChaferactorTechnique overlap
Cl0pactor

Uses

Input Capture: KeyloggingtechniqueATT&CK mapping
Obfuscated Files or InformationtechniqueATT&CK mapping
User Execution: Malicious FiletechniqueATT&CK mapping
Phishing: Spearphishing AttachmenttechniqueATT&CK mapping
Obtain Capabilities: MalwaretechniqueATT&CK mapping
Screen CapturetechniqueATT&CK mapping

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?