{"id":23226,"date":"2021-04-06T13:29:00","date_gmt":"2021-04-06T10:29:00","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=23226"},"modified":"2026-03-27T22:04:51","modified_gmt":"2026-03-27T19:04:51","slug":"advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/","title":{"rendered":"Advanced threat actors engaged in cyberespionage up their game in new campaign"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>In June 2020, Kaspersky researchers uncovered an advanced cyberespionage campaign targeting entities in the government and military sector in Vietnam. The final payload is a remote administration tool that provides full control over the infected device. Further analysis suggested that this campaign was conducted by a group related to Cycldek, a Chinese-speaking threat group active since at least 2013, and it represents a major step up in terms of sophistication.&nbsp;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Chinese-speaking threat actors often share their techniques and methodologies with each other, which makes it easier for Kaspersky researchers to hunt for advanced persistent threat (APT) activity related to such well-known cyberespionage groups as\u00a0<a href=\"https:\/\/securelist.com\/luckymouse-ndisproxy-driver\/87914\/\" target=\"_blank\" rel=\"noreferrer noopener\">LuckyMouse<\/a>, HoneyMyte, and\u00a0<a href=\"https:\/\/securelist.com\/cycldek-bridging-the-air-gap\/97157\/\" target=\"_blank\" rel=\"noreferrer noopener\">Cycldek<\/a>. That\u2019s why, when they saw one of their most well-known tactics\u2014\u201cthe DLL side-loading triad\u201d\u2014targeting government and military entities in Vietnam, they immediately took notice.\u00a0\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DLL, or dynamic-link libraries, are pieces of code meant to be used by other programs on a computer. In DLL side-loading, a legitimately signed file (such as from Microsoft Outlook) is tricked into loading a malicious DLL, allowing the attackers to bypass security products. In this recently discovered campaign, the DLL side-loading infection chain executes a shellcode that decrypts the final payload: a remote access Trojan Kaspersky named, \u201cFoundCore\u201d that gives the attackers full control over the infected device.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More interesting, however, was the method used to protect the malicious code from analysis\u2014a method that signals a major advancement in sophistication for attackers in this region. The headers (the destination and source for the code) for the final payload were completely stripped away, and the few that remained contained incoherent values. In doing this, the attackers make it significantly more difficult for researchers to reverse engineer the malware for analysis. What\u2019s more, the components of the infection chain are tightly coupled, meaning&nbsp;single pieces are difficult\u2014sometimes impossible\u2014to analyze in isolation, preventing a full picture of malicious activity.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kaspersky researchers also discovered that this infection chain was downloading two additional malware. The first, DropPhone,&nbsp;collects environment information from the victim machine and sends it to DropBox. The second is CoreLoader, which runs code that helps the malware evade detection by security products.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dozens of computers were affected by this campaign, with 80% of them based in Vietnam. Most belonged to the government or military sector, however, other targets were related to health, diplomacy, education or politics. There were also occasional targets in Central Asia and in Thailand.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>\u201cBased on the similarities of the dropped malware with the RedCore malware we discovered last year, we attribute this campaign with low confidence to Cycldek, which, until now, we have considered a less sophisticated Chinese-speaking actor conducting cyberespionage campaigns in this region. However, this recent activity signals a major leap in their abilities,\u201d comments Ivan Kwiatkowski, senior security researcher with Kaspersky\u2019 Global Research and Analysis Team (GReAT).&nbsp;<\/em><em>&nbsp;<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>\u201cIn general, over the past year, we\u2019ve noticed that many of these Chinese-speaking groups are investing more resources into their campaigns and honing their technical capabilities. Here, they\u2019ve added many more layers of obfuscation and significantly complicated reverse engineering. And this signals that these groups may be looking to expand their activities. Right now, it may seem as if this campaign is more of a local threat, but it\u2019s highly likely the FoundCore backdoor will be found in more countries in different regions in the future,\u201d adds Mark Lechtik, senior security researcher with GReAT.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>\u201cWhat\u2019s more, given that these Chinese-speaking groups tend to share their tactics with one another, we wouldn\u2019t be surprised to find these same obfuscation tactics in other campaigns. We\u2019ll be monitoring the threat landscape for similar suspicious activity closely. For companies, the best thing they can do is keep their company up-to-date with the latest threat intelligence, so they know what to be on the lookout for,\u201d comments Pierre Delcher, senior security researcher with GReAT.<\/em><em><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more about this Cycldek-related campaign on\u00a0<a href=\"https:\/\/securelist.com\/the-leap-of-a-cycldek-related-threat-actor\/101243\/\" target=\"_blank\" rel=\"noreferrer noopener\">Securelist<\/a>. Detailed information on Indicators of Compromise related to this group, including file hashes, can be accessed on the\u00a0<a href=\"https:\/\/me-en.kaspersky.com\/enterprise-security\/threat-intelligence\" target=\"_blank\" rel=\"noreferrer noopener\">Kaspersky Threat Intelligence Portal.<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To see the DE obfuscation of this Cycldek-related malware in action and learn how to reverse engineer like GReAT experts, you can join the\u00a0<a href=\"https:\/\/www.brighttalk.com\/webcast\/15591\/477861?utm_source=pr-media&amp;utm_medium=partner&amp;utm_campaign=gl_xtrainings-2021_sl0099&amp;utm_content=link&amp;utm_term=gl_pr-media_organic_t998lmg2nf6ta7s\" target=\"_blank\" rel=\"noreferrer noopener\">Targeted Malware Reverse Engineering Workshop<\/a>\u00a0on April 8 at 17:00 MSK (18:00 UAE time). This webinar offers a sneak peek at Kaspersky\u2019s brand new, self-study, intermediate-level reverse engineering training. Check out\u00a0<a href=\"https:\/\/xtraining.kaspersky.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/xtraining.kaspersky.com<\/a>\u00a0for more info.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>To protect your company from advanced persistent threat campaigns such as these, Kaspersky expert recommend:&nbsp;<\/strong><\/h4>\n\n\n\n<h4 class=\"wp-block-heading\">\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Install anti-APT and EDR solutions, enabling threat discovery and detection, investigation, and timely remediation of incidents capabilities. Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within<strong>\u00a0<\/strong><a href=\"https:\/\/www.kaspersky.com\/enterprise-security\/security-awareness\" target=\"_blank\" rel=\"noreferrer noopener\">Kaspersky Expert<strong>\u00a0<\/strong>Security framework<\/a>.<\/h4>\n","protected":false},"excerpt":{"rendered":"<p>In June 2020, Kaspersky researchers uncovered an advanced cyberespionage campaign targeting entities in the government and military sector in Vietnam. The final payload is a remote administration tool that provides full control over the infected device. Further analysis suggested that this campaign was conducted by a group related to Cycldek, a Chinese-speaking threat group active [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":13822,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-23226","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cyberespionage campaign - Advanced threat actors | Saudi Shopper<\/title>\n<meta name=\"description\" content=\"Cyberespionage campaign: Kaspersky uncovered a Vietnam government and military attack using a remote administration tool, linked to Cycldek.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyberespionage campaign - Advanced threat actors | Saudi Shopper\" \/>\n<meta property=\"og:description\" content=\"Cyberespionage campaign: Kaspersky uncovered a Vietnam government and military attack using a remote administration tool, linked to Cycldek.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/\" \/>\n<meta property=\"og:site_name\" content=\"Saudishopper\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SaudiShopper\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-06T10:29:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-27T19:04:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/05\/New-Project-4-2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Nour Elotaiby\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ssict\" \/>\n<meta name=\"twitter:site\" content=\"@ssict\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nour Elotaiby\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/\"},\"author\":{\"name\":\"Nour Elotaiby\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/person\\\/e270afe93563c3ba9c14eea256a983d7\"},\"headline\":\"Advanced threat actors engaged in cyberespionage up their game in new campaign\",\"datePublished\":\"2021-04-06T10:29:00+00:00\",\"dateModified\":\"2026-03-27T19:04:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/\"},\"wordCount\":815,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/New-Project-4-2.jpg\",\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#respond\"]}],\"copyrightYear\":\"2021\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/\",\"name\":\"Cyberespionage campaign - Advanced threat actors | Saudi Shopper\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/New-Project-4-2.jpg\",\"datePublished\":\"2021-04-06T10:29:00+00:00\",\"dateModified\":\"2026-03-27T19:04:51+00:00\",\"description\":\"Cyberespionage campaign: Kaspersky uncovered a Vietnam government and military attack using a remote administration tool, linked to Cycldek.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#primaryimage\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/New-Project-4-2.jpg\",\"contentUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/New-Project-4-2.jpg\",\"width\":1000,\"height\":620,\"caption\":\"kaspersky logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Advanced threat actors engaged in cyberespionage up their game in new campaign\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\",\"name\":\"Saudishopper\",\"description\":\"Saudi ICT Shopper News\",\"publisher\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\",\"name\":\"Saudi ICT News\",\"alternateName\":\"Saudi ICT Shopper News\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/SSTrans.png\",\"contentUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/SSTrans.png\",\"width\":423,\"height\":165,\"caption\":\"Saudi ICT News\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/SaudiShopper\",\"https:\\\/\\\/x.com\\\/ssict\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/person\\\/e270afe93563c3ba9c14eea256a983d7\",\"name\":\"Nour Elotaiby\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27a3f377f4ef014b4334305e358f12befadbb055d461166d37c62c672332d9d?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27a3f377f4ef014b4334305e358f12befadbb055d461166d37c62c672332d9d?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27a3f377f4ef014b4334305e358f12befadbb055d461166d37c62c672332d9d?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"caption\":\"Nour Elotaiby\"},\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/author\\\/nour\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyberespionage campaign - Advanced threat actors | Saudi Shopper","description":"Cyberespionage campaign: Kaspersky uncovered a Vietnam government and military attack using a remote administration tool, linked to Cycldek.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/","og_locale":"en_US","og_type":"article","og_title":"Cyberespionage campaign - Advanced threat actors | Saudi Shopper","og_description":"Cyberespionage campaign: Kaspersky uncovered a Vietnam government and military attack using a remote administration tool, linked to Cycldek.","og_url":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/","og_site_name":"Saudishopper","article_publisher":"https:\/\/www.facebook.com\/SaudiShopper","article_published_time":"2021-04-06T10:29:00+00:00","article_modified_time":"2026-03-27T19:04:51+00:00","og_image":[{"width":1000,"height":620,"url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/05\/New-Project-4-2.jpg","type":"image\/jpeg"}],"author":"Nour Elotaiby","twitter_card":"summary_large_image","twitter_creator":"@ssict","twitter_site":"@ssict","twitter_misc":{"Written by":"Nour Elotaiby","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#article","isPartOf":{"@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/"},"author":{"name":"Nour Elotaiby","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/person\/e270afe93563c3ba9c14eea256a983d7"},"headline":"Advanced threat actors engaged in cyberespionage up their game in new campaign","datePublished":"2021-04-06T10:29:00+00:00","dateModified":"2026-03-27T19:04:51+00:00","mainEntityOfPage":{"@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/"},"wordCount":815,"commentCount":0,"publisher":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/05\/New-Project-4-2.jpg","articleSection":["Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#respond"]}],"copyrightYear":"2021","copyrightHolder":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"}},{"@type":"WebPage","@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/","url":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/","name":"Cyberespionage campaign - Advanced threat actors | Saudi Shopper","isPartOf":{"@id":"https:\/\/saudishopper.com.sa\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#primaryimage"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/05\/New-Project-4-2.jpg","datePublished":"2021-04-06T10:29:00+00:00","dateModified":"2026-03-27T19:04:51+00:00","description":"Cyberespionage campaign: Kaspersky uncovered a Vietnam government and military attack using a remote administration tool, linked to Cycldek.","breadcrumb":{"@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#primaryimage","url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/05\/New-Project-4-2.jpg","contentUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/05\/New-Project-4-2.jpg","width":1000,"height":620,"caption":"kaspersky logo"},{"@type":"BreadcrumbList","@id":"https:\/\/saudishopper.com.sa\/en\/advanced-threat-actors-engaged-in-cyberespionage-up-their-game-in-new-campaign\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/saudishopper.com.sa\/en\/"},{"@type":"ListItem","position":2,"name":"Advanced threat actors engaged in cyberespionage up their game in new campaign"}]},{"@type":"WebSite","@id":"https:\/\/saudishopper.com.sa\/en\/#website","url":"https:\/\/saudishopper.com.sa\/en\/","name":"Saudishopper","description":"Saudi ICT Shopper News","publisher":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/saudishopper.com.sa\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/saudishopper.com.sa\/en\/#organization","name":"Saudi ICT News","alternateName":"Saudi ICT Shopper News","url":"https:\/\/saudishopper.com.sa\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/logo\/image\/","url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/08\/SSTrans.png","contentUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/08\/SSTrans.png","width":423,"height":165,"caption":"Saudi ICT News"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/SaudiShopper","https:\/\/x.com\/ssict"]},{"@type":"Person","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/person\/e270afe93563c3ba9c14eea256a983d7","name":"Nour Elotaiby","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e27a3f377f4ef014b4334305e358f12befadbb055d461166d37c62c672332d9d?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e27a3f377f4ef014b4334305e358f12befadbb055d461166d37c62c672332d9d?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e27a3f377f4ef014b4334305e358f12befadbb055d461166d37c62c672332d9d?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","caption":"Nour Elotaiby"},"url":"https:\/\/saudishopper.com.sa\/en\/author\/nour\/"}]}},"_links":{"self":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/23226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/comments?post=23226"}],"version-history":[{"count":1,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/23226\/revisions"}],"predecessor-version":[{"id":67688,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/23226\/revisions\/67688"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/media\/13822"}],"wp:attachment":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/media?parent=23226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/categories?post=23226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/tags?post=23226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}