PassCV, first documented in 2016, is an APT group assessed with high confidence to be of Chinese origin, primarily motivated by information theft and espionage. The group uniquely distinguishes itself by consistently leveraging a wide array of stolen Authenticode-signing certificates to sign their malicious payloads, which are predominantly delivered through spear-phishing campaigns utilizing phony resumes and curriculum vitae. Over time, PassCV has evolved its operational methodology, incorporating both older Remote Administration Tools and custom-developed malware into its attack repertoire. This group is also identified by the name PassCV (Blue Coat Systems).

Aliases del actor

TG-3279Winnti UmbrellaSabreKitkiotConpeeEtsoRunxxdnsenums (custom port scanner)rdp_crkicmp_shellJynxkitGh0st RATNetCommanderCarberp RATotrosGaming CompaniesWinnti

Actores similares

gh0st-ratactor · 1madliberatorransomware · 2markiratactor · 1apt-goldenratactor · 1exileratactor · 1dimanoratactor · 1apt-packratactor · 1apt-spacepiratesactor · 1Data from Configuration Repositoryactor · 1Container Orchestration Jobactor · 1