{"id":33566,"date":"2022-04-27T15:53:18","date_gmt":"2022-04-27T12:53:18","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=33566"},"modified":"2026-03-28T00:51:40","modified_gmt":"2026-03-27T21:51:40","slug":"low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/","title":{"rendered":"Low-level implants, cryptocurrency hunt and geopolitical attacks: what APT actors got up to in Q1 2022\u00a0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>According to Kaspersky\u2019s latest APT trends\u00a0<\/strong><a href=\"https:\/\/securelist.com\/apt-trends-report-q1-2022\/106351\/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>report<\/strong><\/a><strong>\u00a0for Q1 2022, Advanced Persistent Threat (APT) actors had a busy quarter. Both recently uncovered and ongoing campaigns conducted by new and well-known operators made significant changes to the APT threat landscape. Mostly targeting businesses and governmental entities, APT actors updated already existing malicious toolsets and diversified their techniques to elevate their attacks. These and other trends are covered in Kaspersky\u2019s latest\u00a0<\/strong><a href=\"https:\/\/securelist.com\/apt-trends-report-q1-2022\/106351\/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>quarterly threat intelligence summary<\/strong><\/a><strong>.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During the first three months of 2022, Kaspersky researchers continued to&nbsp;uncover new tools, techniques and campaigns launched by APT groups in cyberattacks all around the world. The three-month APT trends report is derived from Kaspersky\u2019s private threat intelligence research and major developments and cyber incidents that researchers believe everyone should be aware of.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Throughout the first quarter of 2022, the ongoing APT activity was driven by newly launched campaigns and a number of attacks around sensitive geopolitical events. The most significant findings include:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Geopolitical crises as a key driver of APT developments<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The threat landscape saw numerous attacks around the Ukrainian crisis. HermeticRansom, DoubleZero and many other new attacks targeting Ukrainian entities were reported throughout February and March. There was a significant spike in the amount of new infrastructure deployed by the APT groups Gamaredon and UNC1151 (Ghostwriter). Throughout the investigation, Kaspersky researchers identified two WhisperGate prototype samples developed in December 2021 containing test strings and earlier revisions of the ransom note observed in Microsoft\u2019s shared samples. They concluded with high confidence that these samples were earlier iterations of the wiper reportedly used in Ukraine.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the same time, Kaspersky researchers identified three campaigns linked to the Konni threat actor, active since mid-2021, targeting Russian diplomatic entities. While the attackers used the same Konni RAT implant throughout the different campaigns, the infection vectors were different in each campaign: documents containing embedded macros, an installer masquerading as a COVID-19 registration application and, finally, a downloader with a New Year screensaver decoy.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>The return of low-level attacks<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Last year, Kaspersky researchers predicted the further development of low-level implants in 2022. A striking example of this trend is&nbsp;<a href=\"https:\/\/securelist.com\/moonbounce-the-dark-side-of-uefi-firmware\/105468\/\">Moonbounce<\/a>&nbsp;discovered by Kaspersky, which was the third known case of a firmware bootkit in the wild. This malicious implant was hidden within Unified Extensible Firmware Interface (UEFI) firmware, an essential part of computers. The implant was found in the SPI flash, a storage component external to the hard drive.&nbsp;The campaign was attributed to the&nbsp;well-known APT actor APT41.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>APT actors go after cryptocurrency<\/strong><strong><\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In this quarter, Kaspersky also observed APT actors continuing their hunt for cryptocurrency. Unlike most state-sponsored APT groups, Lazarus and other threat actors associated with this APT have made financial gain one of their primary goals. This actor distributed Trojanized decentralized finance (DeFi) apps in order to increase profit. Lazarus abuses legitimate applications used to manage cryptocurrency wallets by distributing malware that provides control over victims\u2019 systems.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Updates and online services abuse<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">APT actors are constantly looking for new ways to increase the efficiency of their attacks. The cyber mercenary group dubbed DeathStalker continues updating its unsophisticated tools to make attacks more efficient. Janicab, its oldest malware, first introduced in 2013, is a prime example of this trend. Overall, Janicab shows the same functionalities as its counterpart malware families, but instead of downloading several tools later in the intrusion lifecycle, as the group used to do with EVILNUM and Powersing intrusions, the new samples have most of the tools embedded and obfuscated within the dropper.&nbsp;Additionally, DeathStalker uses the world&#8217;s biggest online services, such as YouTube, Google+, and WordPress among others, as dead-drop resolvers (DDRs) to execute effective stealthy command and control.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>\u2018Geopolitics have always been the main driver of APT attacks, and never has it been so evident, as now. We are living in turbulent times and this is clear through the cybersecurity lens, too. At the same time, we can see that for many threat actors the first quarter has been business as usual, with continuous update of tools and new campaigns that seek after not just information, but also money\u201d,&nbsp;<\/em>comments David Emm, principal security researcher at Kaspersky\u2019s GReAT.&nbsp;<em>\u201cThis means that organizations need to be as alert as ever and make sure they are armed with threat intelligence and the right tools to protect from existing and emerging threats\u201d<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Q1 APT Trends report summarizes the findings of Kaspersky\u2019s subscriber-only threat intelligence reports, which also include Indicators of Compromise (IoC) data and YARA rules to assist in forensics and malware-hunting. For more information, please contact:\u00a0<a href=\"mailto:intelreports@kaspersky.com\" target=\"_blank\" rel=\"noreferrer noopener\">intelreports@kaspersky.com<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Earlier this quarter,&nbsp;Kaspersky\u2019s GReAT gave a presentation about cyberattacks in Ukraine, including the latest APT activity. You can find the recording of the webinar&nbsp;<a href=\"https:\/\/www.brighttalk.com\/webcast\/15591\/534324\">here<\/a>&nbsp;and its summary&nbsp;<a href=\"https:\/\/securelist.com\/webinar-on-cyberattacks-in-ukraine-summary-and-qa\/106075\/\">here<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To read the full APT Q1 2022 trends report, please visit\u00a0<a href=\"https:\/\/securelist.com\/apt-trends-report-q1-2022\/106351\/\" target=\"_blank\" rel=\"noreferrer noopener\">Securelist.com<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Provide your SOC team with access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal is a single point of access for the company\u2019s TI, providing cyberattack data and insights gathered by Kaspersky spanning over 20 years.\u00a0To help businesses enable effective defenses in these turbulent times, Kaspersky announced access to independent, continuously updated and globally-sourced information on ongoing cyberattacks and threats, at no charge. Request your access to this offer\u00a0<a href=\"https:\/\/go.kaspersky.com\/uchub#form\">here<\/a>.<\/li><li>Upskill your cybersecurity team to tackle the latest targeted threats with\u00a0<a href=\"https:\/\/xtraining.kaspersky.com\/?utm_source=pr-media&amp;utm_medium=partner&amp;utm_campaign=gl_xtr-gen-pr_je0066&amp;utm_content=sm-post&amp;utm_term=gl_pr-media_organic_66jpzgkgnjbgdrn&amp;redef=1&amp;THRU&amp;reseller=gl_xtr-gen-pr_acq_ona_smm__onl_b2b_pr-media_post_______\" target=\"_blank\" rel=\"noreferrer noopener\">Kaspersky online training<\/a>\u00a0developed by GReAT experts\u00a0developed by GReAT experts<\/li><li>For endpoint level detection, investigation, and timely remediation of incidents, implement EDR solutions such as\u00a0<a href=\"https:\/\/www.kaspersky.com\/enterprise-security\/endpoint-detection-response-edr\" target=\"_blank\" rel=\"noreferrer noopener\">Kaspersky Endpoint Detection and Response<\/a><\/li><li>In addition to adopting essential endpoint protection, implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as\u00a0<a href=\"https:\/\/www.kaspersky.com\/enterprise-security\/anti-targeted-attack-platform\" target=\"_blank\" rel=\"noreferrer noopener\">Kaspersky Anti Targeted Attack Platform<\/a><\/li><li>As many targeted attacks start with phishing or other social engineering techniques, introduce security awareness training and teach practical skills to your team \u2013 for example, through the\u00a0<a href=\"https:\/\/www.kaspersky.com\/small-to-medium-business-security\/security-awareness-platform\" target=\"_blank\" rel=\"noreferrer noopener\">Kaspersky Automated Security Awareness Platform<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>According to Kaspersky\u2019s latest APT trends\u00a0report\u00a0for Q1 2022, Advanced Persistent Threat (APT) actors had a busy quarter. Both recently uncovered and ongoing campaigns conducted by new and well-known operators made significant changes to the APT threat landscape. Mostly targeting businesses and governmental entities, APT actors updated already existing malicious toolsets and diversified their techniques to [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":11122,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-33566","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>APT actors Q1 2022 - Trends report | Saudi Shopper<\/title>\n<meta name=\"description\" content=\"APT actors Q1 2022: Kaspersky\u2019s latest APT trends report covers new campaigns, tool updates, and geopolitical attacks targeting businesses.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"APT actors Q1 2022 - Trends report | Saudi Shopper\" \/>\n<meta property=\"og:description\" content=\"APT actors Q1 2022: Kaspersky\u2019s latest APT trends report covers new campaigns, tool updates, and geopolitical attacks targeting businesses.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/\" \/>\n<meta property=\"og:site_name\" content=\"Saudishopper\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SaudiShopper\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-27T12:53:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-27T21:51:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2019\/06\/kaspersky-logo3.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1174\" \/>\n\t<meta property=\"og:image:height\" content=\"668\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mohamed Ghamdi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ssict\" \/>\n<meta name=\"twitter:site\" content=\"@ssict\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mohamed Ghamdi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/\"},\"author\":{\"name\":\"Mohamed Ghamdi\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/person\\\/c91ff01097dcdc0d20ea79378eb83440\"},\"headline\":\"Low-level implants, cryptocurrency hunt and geopolitical attacks: what APT actors got up to in Q1 2022\u00a0\",\"datePublished\":\"2022-04-27T12:53:18+00:00\",\"dateModified\":\"2026-03-27T21:51:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/\"},\"wordCount\":1032,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/kaspersky-logo3.jpg\",\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#respond\"]}],\"copyrightYear\":\"2022\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/\",\"name\":\"APT actors Q1 2022 - Trends report | Saudi Shopper\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/kaspersky-logo3.jpg\",\"datePublished\":\"2022-04-27T12:53:18+00:00\",\"dateModified\":\"2026-03-27T21:51:40+00:00\",\"description\":\"APT actors Q1 2022: Kaspersky\u2019s latest APT trends report covers new campaigns, tool updates, and geopolitical attacks targeting businesses.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#primaryimage\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/kaspersky-logo3.jpg\",\"contentUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/kaspersky-logo3.jpg\",\"width\":1174,\"height\":668,\"caption\":\"kaspersky logo 3\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Low-level implants, cryptocurrency hunt and geopolitical attacks: what APT actors got up to in Q1 2022\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\",\"name\":\"Saudishopper\",\"description\":\"Saudi ICT Shopper News\",\"publisher\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\",\"name\":\"Saudi ICT News\",\"alternateName\":\"Saudi ICT Shopper News\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/SSTrans.png\",\"contentUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/SSTrans.png\",\"width\":423,\"height\":165,\"caption\":\"Saudi ICT News\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/SaudiShopper\",\"https:\\\/\\\/x.com\\\/ssict\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/person\\\/c91ff01097dcdc0d20ea79378eb83440\",\"name\":\"Mohamed Ghamdi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/74c52ae9ccb128bafec358a5e56b2f53c4de12681285f3ab3e85c351172859bc?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/74c52ae9ccb128bafec358a5e56b2f53c4de12681285f3ab3e85c351172859bc?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/74c52ae9ccb128bafec358a5e56b2f53c4de12681285f3ab3e85c351172859bc?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"caption\":\"Mohamed Ghamdi\"},\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/author\\\/mgamdi\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"APT actors Q1 2022 - Trends report | Saudi Shopper","description":"APT actors Q1 2022: Kaspersky\u2019s latest APT trends report covers new campaigns, tool updates, and geopolitical attacks targeting businesses.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/","og_locale":"en_US","og_type":"article","og_title":"APT actors Q1 2022 - Trends report | Saudi Shopper","og_description":"APT actors Q1 2022: Kaspersky\u2019s latest APT trends report covers new campaigns, tool updates, and geopolitical attacks targeting businesses.","og_url":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/","og_site_name":"Saudishopper","article_publisher":"https:\/\/www.facebook.com\/SaudiShopper","article_published_time":"2022-04-27T12:53:18+00:00","article_modified_time":"2026-03-27T21:51:40+00:00","og_image":[{"width":1174,"height":668,"url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2019\/06\/kaspersky-logo3.jpg","type":"image\/jpeg"}],"author":"Mohamed Ghamdi","twitter_card":"summary_large_image","twitter_creator":"@ssict","twitter_site":"@ssict","twitter_misc":{"Written by":"Mohamed Ghamdi","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#article","isPartOf":{"@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/"},"author":{"name":"Mohamed Ghamdi","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/person\/c91ff01097dcdc0d20ea79378eb83440"},"headline":"Low-level implants, cryptocurrency hunt and geopolitical attacks: what APT actors got up to in Q1 2022\u00a0","datePublished":"2022-04-27T12:53:18+00:00","dateModified":"2026-03-27T21:51:40+00:00","mainEntityOfPage":{"@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/"},"wordCount":1032,"commentCount":0,"publisher":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#primaryimage"},"thumbnailUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2019\/06\/kaspersky-logo3.jpg","articleSection":["Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#respond"]}],"copyrightYear":"2022","copyrightHolder":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"}},{"@type":"WebPage","@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/","url":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/","name":"APT actors Q1 2022 - Trends report | Saudi Shopper","isPartOf":{"@id":"https:\/\/saudishopper.com.sa\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#primaryimage"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#primaryimage"},"thumbnailUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2019\/06\/kaspersky-logo3.jpg","datePublished":"2022-04-27T12:53:18+00:00","dateModified":"2026-03-27T21:51:40+00:00","description":"APT actors Q1 2022: Kaspersky\u2019s latest APT trends report covers new campaigns, tool updates, and geopolitical attacks targeting businesses.","breadcrumb":{"@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#primaryimage","url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2019\/06\/kaspersky-logo3.jpg","contentUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2019\/06\/kaspersky-logo3.jpg","width":1174,"height":668,"caption":"kaspersky logo 3"},{"@type":"BreadcrumbList","@id":"https:\/\/saudishopper.com.sa\/en\/low-level-implants-cryptocurrency-hunt-and-geopolitical-attacks-what-apt-actors-got-up-to-in-q1-2022\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/saudishopper.com.sa\/en\/"},{"@type":"ListItem","position":2,"name":"Low-level implants, cryptocurrency hunt and geopolitical attacks: what APT actors got up to in Q1 2022\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/saudishopper.com.sa\/en\/#website","url":"https:\/\/saudishopper.com.sa\/en\/","name":"Saudishopper","description":"Saudi ICT Shopper News","publisher":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/saudishopper.com.sa\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/saudishopper.com.sa\/en\/#organization","name":"Saudi ICT News","alternateName":"Saudi ICT Shopper News","url":"https:\/\/saudishopper.com.sa\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/logo\/image\/","url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/08\/SSTrans.png","contentUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/08\/SSTrans.png","width":423,"height":165,"caption":"Saudi ICT News"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/SaudiShopper","https:\/\/x.com\/ssict"]},{"@type":"Person","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/person\/c91ff01097dcdc0d20ea79378eb83440","name":"Mohamed Ghamdi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/74c52ae9ccb128bafec358a5e56b2f53c4de12681285f3ab3e85c351172859bc?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/74c52ae9ccb128bafec358a5e56b2f53c4de12681285f3ab3e85c351172859bc?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/74c52ae9ccb128bafec358a5e56b2f53c4de12681285f3ab3e85c351172859bc?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","caption":"Mohamed Ghamdi"},"url":"https:\/\/saudishopper.com.sa\/en\/author\/mgamdi\/"}]}},"_links":{"self":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/33566","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/comments?post=33566"}],"version-history":[{"count":1,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/33566\/revisions"}],"predecessor-version":[{"id":70149,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/33566\/revisions\/70149"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/media\/11122"}],"wp:attachment":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/media?parent=33566"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/categories?post=33566"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/tags?post=33566"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}