Sandman APT

    ChinaState-sponsoredUnknown

    Observation period

    0

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.

    Relevance for Germany, Austria and Switzerland

    medium

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Government
    • Telecommunications

    Target countries according to source Middle East, Southeast Asian, France, Egypt, Sudan, South Sudan, Libya, Turkey, Saudi Arabia, Oman, Yemen, Sri Lanka, India, Pakistan, Iran, Afghanistan, Kuwait, Iraq, United Arab Emirates

    Back to group overview