{"id":41016,"date":"2023-05-01T16:27:48","date_gmt":"2023-05-01T13:27:48","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=41016"},"modified":"2026-03-28T03:09:55","modified_gmt":"2026-03-28T00:09:55","slug":"apt-q1-2023-playbook-advanced-techniques-broader-horizons-and-new-targets","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/apt-q1-2023-playbook-advanced-techniques-broader-horizons-and-new-targets\/","title":{"rendered":"APT Q1 2023 playbook: advanced techniques, broader horizons, and new targets\u00a0"},"content":{"rendered":"\n

Kaspersky’s latest Advanced Persistent Threats (APTs) trends <\/strong>report<\/strong><\/a> reveals bustling APT activity in the first quarter of 2023, with a mix of new and established actors spotted engaging in a range of campaigns. The <\/strong>report<\/strong> shows that, during this time, APT actors have been busy updating their toolsets and expanding their attack vectors both in terms of geographical location and target industries.<\/strong><\/strong><\/p>\n\n\n\n

During the first three months of this year, Kaspersky researchers have uncovered new tools, techniques and campaigns launched by APT groups in cyberattacks around the world. The APT trends <\/a>report<\/a> is derived from Kaspersky\u2019s private threat intelligence research and major developments, plus cyber incidents that researchers believe everyone should be aware of. The report highlighted several trends, including:<\/p>\n\n\n\n

New techniques and updated tools<\/strong><\/p>\n\n\n\n

APT actors have been continuously looking for new ways to perform their attacks in order to avoid detection and achieve their goals. In Q1 2023, Kaspersky researchers have seen that established threat actors such as Turla, MuddyWater, Winnti, Lazarus, and ScarCruft – which have been in the APT arena for many years – are not standing still and continue to develop their toolsets. For instance, Turla has been spotted using TunnusSched backdoor, a relatively unusual tool for this group, which Tomiris has been known to employ. This demonstrates how established APT actors are adapting and evolving their tactics to stay ahead of the game.<\/p>\n\n\n\n

There have also been campaigns from newly discovered threat actors such as Trila targeting Lebanese governmental entities. <\/p>\n\n\n\n

More industries becoming an interest subject for APT actors<\/strong><\/p>\n\n\n\n

APT actors continue to expand beyond their traditional victims, such as state institutions and high-profile targets, to include aviation, energy, manufacturing, real estate, finance, telecoms, scientific research, IT, and gaming sectors. Such companies possess substantial amounts of data that serve strategic requirements related to national priorities, or create additional accesses and vectors to facilitate future campaigns.<\/p>\n\n\n\n

Geographical expansion<\/strong><\/p>\n\n\n\n

Kaspersky experts have also witnessed advanced actors performing attacks with a focus on Europe, the US, the Middle East, and various parts of Asia. While most actors previously targeted victims in specific countries, more and more APTs are now targeting victims globally. For instance, MuddyWater, an actor that previously showed a preference for targeting Middle Eastern and North African entities, has expanded its malicious activity to organizations in Azerbaijan, Armenia, Malaysia, and Canada, in addition to its previous targets in Saudi Arabia, Turkey, UAE, Egypt, Jordan, Bahrain, and Kuwait.<\/p>\n\n\n\n

\"david<\/a><\/figure>\n\n\n\n

\u201cWhile we have been tracking the same APT actors for decades, it\u2019s clear they are continually evolving with new techniques and toolsets. Additionally, the emergence of newly developed threat actors means the APT landscape is rapidly changing, especially in these turbulent times. Organizations must remain vigilant and ensure they are equipped with threat intelligence and the appropriate tools to defend against existing and emerging threats. By sharing our insights and findings, we aim to empower cybersecurity professionals to be prepared against high-profile threats,\u201d\u00a0<\/em>comments David Emm, a principal security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

To read the full APT Q1 2023 trends report, please visit\u00a0Securelist<\/a>.<\/p>\n\n\n\n

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n