{"id":45015,"date":"2023-11-02T19:21:04","date_gmt":"2023-11-02T16:21:04","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=45015"},"modified":"2026-03-28T04:27:43","modified_gmt":"2026-03-28T01:27:43","slug":"kaspersky-uncovers-apt-campaign-targeting-apac-government-entities","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-uncovers-apt-campaign-targeting-apac-government-entities\/","title":{"rendered":"Kaspersky uncovers APT campaign targeting APAC government entities\u00a0"},"content":{"rendered":"\n

Kaspersky researchers have discovered a persistent campaign compromising a specific type of secure USB drive, used to provide encryption for safe data storage. Dubbed ‘TetrisPhantom,’ this espionage effort targets government entities in the Asia-Pacific region (APAC), and shows no discernible overlap with any known threat actor. These and other findings are detailed in Kaspersky\u2019s new quarterly APT threat landscape <\/strong>report<\/strong><\/a>.<\/strong><\/p>\n\n\n\n

In early 2023, Kaspersky\u2019s Global Research and Analysis team uncovered a long-running espionage campaign operated by a previously unknown actor. The attacker covertly spied on and harvested sensitive data from APAC government entities by exploiting a particular type of secure USB drive, protected by hardware encryption to ensure the secure storage and transfer of data between computer systems. These secure USB drives are employed by government organizations worldwide, implying that more entities might potentially fall prey to similar techniques.<\/p>\n\n\n\n

The campaign comprises various malicious modules, through which the actor can gain extensive control over the victim\u2019s device. This allows them to execute commands, collect files and information from compromised machines, and transfer them to other machines using the same or different secure USB drives as carriers. Additionally, the APT is proficient in executing other malicious files on the infected systems.<\/p>\n\n\n\n

Kaspersky researchers report there are a limited number of victims, highlighting the highly targeted nature of the attack.<\/p>\n\n\n\n

\u201cOur investigation reveals a high-level of sophistication, including <\/em>virtualization-based software obfuscation, low-level communication with the USB drive using direct SCSI commands, and self-replication through connected secure USBs.<\/em> These operations were conducted by a highly skilled and resourceful threat actor, with a keen interest in espionage activities within sensitive and safeguarded government networks,<\/em>\u201d comments Noushin Shabab, senior security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

Kaspersky researchers have not observed any overlaps with any existing threat actor, but with this attack campaign still ongoing, experts continue to track its progress, and expect to see more sophisticated attacks from them in the future.<\/p>\n\n\n\n

Further details on TetrisPhantom will be unveiled at upcoming Security Analyst Summit (SAS), taking place on October 25 \u2013 28. Make sure to secure<\/a> your spot to learn about latest trends of threat landscape.<\/p>\n\n\n\n

To learn more about APT threat landscape in Q3 2023, visit Securelist.com<\/a>.<\/p>\n\n\n\n

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n