{"id":42843,"date":"2023-07-31T16:56:22","date_gmt":"2023-07-31T13:56:22","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=42843"},"modified":"2026-03-28T03:47:11","modified_gmt":"2026-03-28T00:47:11","slug":"kaspersky-unveils-latest-apt-trends-for-q2","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-unveils-latest-apt-trends-for-q2\/","title":{"rendered":"Kaspersky unveils latest APT trends for Q2\u00a0"},"content":{"rendered":"\n

In Kaspersky’s latest\u00a0<\/strong>report<\/strong><\/a>\u00a0on Advanced Persistent Threat (APT) trends for the second quarter of 2023, researchers analyzed the development of new and existing campaigns. The report highlights APT activity during this period, including updating toolsets, creating new malware variants, and adopting fresh techniques by threat actors.<\/strong><\/p>\n\n\n\n

\"david<\/a><\/figure>\n\n\n\n

A significant new revelation was the exposure of the long-running \u201cOperation Triangulation<\/a>\u201d campaign involving a previously unknown iOS malware platform. Experts also observed other exciting developments that everyone should be aware of. Here are key highlights from the report:\u00a0<\/p>\n\n\n\n

Asia-Pacific witnesses a new threat actor \u2013 Mysterious Elephant<\/strong><\/p>\n\n\n\n

Kaspersky\u00a0uncovered a new threat actor from the Elephants family operating in the Asia-Pacific region, dubbed \u201cMysterious Elephant.\u201d In their latest campaign, the threat actor employed new backdoor families capable of executing files and commands on the victim\u2019s computer and receiving files or orders from a malicious server for execution on the infected system. While Kaspersky researchers have observed overlaps with Confucius and SideWinder,\u00a0Mysterious Elephant possesses a distinctive and unique set of TTPs, setting them apart from other groups.<\/p>\n\n\n\n

Toolsets upgraded: Lazarus develops a new malware variant, BlueNoroff attacks macOS, and more<\/strong><\/p>\n\n\n\n

Threat actors are constantly improving their techniques, with Lazarus upgrading its MATA framework and introducing a new variant of the sophisticated MATA malware family, MATAv5. BlueNoroff<\/a>, a financial attack-focused subgroup of Lazarus, now employs new delivery methods and programming languages, including the use of Trojanized PDF readers in recent campaigns, the implementation of macOS malware, and the Rust programming language. Additionally, ScarCruft APT group has developed new infection methods, evading Mark-of-the-Web (MOTW) security mechanism. The ever-evolving tactics of these threat actors present new challenges for cybersecurity professionals.<\/p>\n\n\n\n

Geopolitical influences remain, primary drivers of APT activity,<\/strong><\/p>\n\n\n\n

APT campaigns remain geographically dispersed, with actors concentrating their attacks on regions such as Europe, Latin America, the Middle East, and various parts of Asia. Cyber espionage, with a solid geopolitical backdrop, continues to be a dominant agenda for these endeavors.<\/p>\n\n\n\n

\u201cWhile some threat actors stick to familiar tactics like social engineering, others have evolved, refreshing their toolsets and expanding their activities. Moreover, new advanced actors, such as <\/em>those conducting the \u2018Operation Triangulation\u2019 campaign, constantly emerge. This actor uses a previously unknown iOS malware platform distributed through zero-click iMessage exploits. Staying vigilant with threat intelligence and the right defense tools is crucial for global companies so that they can protect themselves against both existing and emerging threats. Our quarterly reviews are designed to highlight the most significant developments among APT groups to help defenders combat and mitigate related risks,\u201d\u00a0comments David Emm, a principal security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/em><\/p>\n\n\n\n

To read the full APT Q2 2023 trends\u00a0report<\/a>, please visit\u00a0Securelist.<\/p>\n\n\n\n

To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n