DEV-0147
Observation period
0
Techniques
0
Reports
- Latest observed activity
- No dated reports available
- First observed
- —
Profile
DEV-0147 is a China-based cyber espionage actor was observed compromising diplomatic targets in South America, a notable expansion of the group's data exfiltration operations that traditionally targeted gov't agencies and think tanks in Asia and Europe. DEV-0147 is known to use tools like ShadowPad, a remote access trojan associated with other China-based actors, to maintain persistent access, and QuasarLoader, a webpack loader, to deploy additional malware. DEV-0147's attacks in South America included post-exploitation activity involving the abuse of on-premises identity infrastructure for recon and lateral movement, and the use of Cobalt Strike for command and control and data exfiltration.
Relevance for Germany, Austria and Switzerland
medium
Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).
Target countries according to source South America, Asia, European Union