{"id":38079,"date":"2020-11-06T13:51:19","date_gmt":"2020-11-06T13:51:19","guid":{"rendered":"http:\/\/7722a270-b7e0-42c3-951d-dc02124e03de"},"modified":"2020-11-06T13:51:19","modified_gmt":"2020-11-06T13:51:19","slug":"this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/","title":{"rendered":"This hacking group is using previously unknown tools to target defence contractors"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/r\/2018\/07\/25\/61403dac-8632-454f-a4a5-d61fe1ab373d\/thumbnail\/770x578\/24f921a4ff4a16777aec6b1484802302\/istock-silly-hacker-hands.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>Hackers used previously unknown tools in a cyber espionage campaign targeting defence and aerospace companies in a social engineering and phishing campaign which is more widely targeted than first thought.<\/p>\n<p>Researchers at McAfee <a href=\"https:\/\/www.zdnet.com\/article\/us-defense-and-aerospace-sectors-targeted-in-new-wave-of-north-korean-attacks\/\">first detailed Operation North Star earlier this year<\/a>, but further analysis of reveals additional tactics and techniques of the campaign which has almost identical elements to Hidden Cobra \u2013 AKA The Lazarus Group \u2013 a hacking operation which the US government and others say is working out of North Korea on behalf of the government in Pyongyang.<\/p>\n<p>The campaign is still based around <a href=\"https:\/\/www.zdnet.com\/article\/what-is-phishing-how-to-protect-yourself-from-scam-emails-and-more\/\" target=\"_blank\" rel=\"noopener noreferrer\">spear-phishing emails<\/a> and LinkedIn messages which pose as job recruitment messages in an effort to lure victims into opening malicious attachments. Hackers even used legitimate recruitment adverts and documents taken from popular US defence contractor websites to make the emails look more authentic.<\/p>\n<p>But <a href=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/mcafee-defenders-blog-operation-north-star-campaign\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">now additional analysis by McAfee<\/a> has revealed how the attackers use two stages of malware implants. All targets are compromised with the first stage of malware, which allows attackers to gather data including disk information, free disk space, computer name and logged in username and process information.<\/p>\n<p>The hackers analyse this information to determine if the victim is high value enough to continue to with an attack \u2013 if the victim isn&#8217;t deemed important enough, the machine is sidelined while the attackers focus on distributing a second stage malware to victims deemed more worthwhile of attention.<\/p>\n<p><strong><strong>SEE:&nbsp;<\/strong><\/strong><a href=\"http:\/\/www.zdnet.com\/topic\/a-winning-strategy-for-cybersecurity\/\"><strong><strong>A winning strategy for cybersecurity<\/strong><\/strong><\/a><strong>&nbsp;<strong>(ZDNet special report) |&nbsp;<\/strong><\/strong><a href=\"https:\/\/www.techrepublic.com\/resource-library\/whitepapers\/a-winning-strategy-for-cybersecurity-free-pdf\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\"><strong><strong>Download the report as a PDF<\/strong><\/strong><\/a><strong>&nbsp;<strong>(TechRepublic)<\/strong><\/strong> <\/p>\n<p>The second stage uses a previously known implant called Torisma, a custom-developed tool focused on specialised monitoring of high value victims&#8217; systems, looking to gain access to login credentials and remote desktop sessions \u2013 all while remaining undetected. <\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\"> <\/section>\n<p>&#8220;What is clear is that the campaign&#8217;s objective was to establish a long-term, persistent espionage campaign focused on specific individuals in possession of strategically valuable technology from key countries around the world,&#8221; McAfee researchers said in <a href=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/mcafee-defenders-blog-operation-north-star-campaign\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">a blog post<\/a>.<\/p>\n<p>For Operation North Star, this meant researching specific target victims and created custom content to lure victims in, then infecting them with malware in an effort to commit espionage.<\/p>\n<p>Initial reporting of the campaign detailed attacks against targets in the US, but those weren&#8217;t the only ones hackers were looking to compromise \u2013 analysis of the attacks has revealed that defence and technology contractors in Israel, Russia, India and Australia have also been targeted by this campaign.<\/p>\n<p>&#8220;The actors behind the campaign were more sophisticated than they initially appeared. They are focused and deliberate in what they meant to achieve and more disciplined and patient in executing to achieve their objective,&#8221; said researchers.<\/p>\n<p>Cyber espionage isn&#8217;t the only form of cyber attacks that North Korea is involved in; hackers working on behalf of Pyongyang <a href=\"https:\/\/www.zdnet.com\/article\/this-cryptocurrency-stealing-malware-just-got-a-significant-upgrade-and-new-tactics\/\">regularly steal cryptocurrency<\/a> to get around internatioanl sanctons. North Korea was also blamed&nbsp;for <a href=\"https:\/\/www.zdnet.com\/article\/wannacry-ransomware-crisis-one-year-on-are-we-ready-for-the-next-global-cyber-attack\/\">the WannaCry ransomware outbreak<\/a>.<\/p>\n<p><strong>READ MORE ON CYBERSECURITY<\/strong><\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Researchers have analysed &#8216;Operation North Star&#8217; and found that as well as using new techniques, it picks and chooses infected targets to focus on the most valuable.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":38080,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-38079","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>This hacking group is using previously unknown tools to target defence contractors 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"This hacking group is using previously unknown tools to target defence contractors 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-11-06T13:51:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"This hacking group is using previously unknown tools to target defence contractors\",\"datePublished\":\"2020-11-06T13:51:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/\"},\"wordCount\":504,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/\",\"name\":\"This hacking group is using previously unknown tools to target defence contractors 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg\",\"datePublished\":\"2020-11-06T13:51:19+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"This hacking group is using previously unknown tools to target defence contractors\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"This hacking group is using previously unknown tools to target defence contractors 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/","og_locale":"en_US","og_type":"article","og_title":"This hacking group is using previously unknown tools to target defence contractors 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-11-06T13:51:19+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"This hacking group is using previously unknown tools to target defence contractors","datePublished":"2020-11-06T13:51:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/"},"wordCount":504,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/","url":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/","name":"This hacking group is using previously unknown tools to target defence contractors 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg","datePublished":"2020-11-06T13:51:19+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors.jpg","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/this-hacking-group-is-using-previously-unknown-tools-to-target-defence-contractors\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"This hacking group is using previously unknown tools to target defence contractors"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/38079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=38079"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/38079\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/38080"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=38079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=38079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=38079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}