Deputy Director, Global Research & Analysis TeamSergey joined Kaspersky in 2002 and was appointed Deputy Director for the company’s Global Research & Analysis Team in March 2013. Prior to becoming Deputy Director, Sergey was the Head of the company’s Global Research & Analysis Team in the EEMEA region. Sergey is responsible managing the department’s operational activities in addition organizing Kaspersky’s annual Security Analyst Summit. Each year the summit brings the world’s best IT security experts together to collaborate and exchange research alongside international organizations, law enforcement agencies and technology companies. Sergey has a degree in Applied Mathematics from the Moscow State University of Railway Engineering and holds a postgraduate degree in IT Security. He is based in Moscow.
The ScarCruft group (also known as APT37 or Temp.Reaper) is a nation-state sponsored APT actor. Recently, we had an opportunity to perform a deeper investigation on a host compromised by this group.
In this report we provide details on a malicious VBS implant distributed via MS Excel droppers and a fake “Kaspersky Update Agent” which we attribute to WIRTE APT who may be linked to Gaza Cybergang.
The APT trends reports are based on our threat intelligence research and provide a representative snapshot of what we have discussed in greater detail in our private APT reports. This is our latest installment, focusing on activities that we observed during Q3 2021.
According to older public researches, Lyceum conducted operations against organizations in the energy and telecommunications sectors across the Middle East. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.