Grayling is an advanced persistent threat (APT) group first observed in February 2023, engaged in cyber-espionage campaigns primarily targeting entities with strategic interest to China, particularly within Taiwan. The group's primary motivation is intelligence gathering, focusing on long-term access and data exfiltration rather than financial gain. A distinguishing characteristic of Grayling is its use of a distinctive DLL sideloading technique employing a custom decryptor to deploy various payloads, effectively blending custom malware with publicly available tools to achieve its objectives and evade detection. While Symantec, which initially identified the group, could not definitively link Grayling to a specific geography, the heavy targeting of Taiwanese organizations strongly suggests operations from a region with strategic interest in Taiwan, implicitly pointing to China.

Aliases del actor

APT GRAYLING

Actores similares

apt-graylingactor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1apt-30actor · 1apt-38actor · 1