Cyber threats / Threat actors

Sandman APT

CN Suspected sponsor: China
1
APAC targets
0
Techniques
0
Incidents
0
News · 30d
Profile

First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.

ATT&CK techniques
MITRE ATT&CK has no technique mapping for this actor.
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
  • No Asia-Pacific article names this actor yet.
Targets
Elsewhere: United Arab Emirates, Afghanistan, Egypt, France, Iraq, Iran, Kuwait, Sri Lanka, Libya, Oman, Pakistan, Saudi Arabia, Sudan, South Sudan, Türkiye, Yemen
Sectors: Government, Telecommunications
Relevance to the EU
EU relevance: High
Targets EU member states (France) as well as 1 Asia-Pacific country
9 EU cooperation projects in the Asia-Pacific countries this actor targets:
Infrastructure & Transport
2
Development Cooperation
2
Trade & Investment
1
Peace & Security
1
Research & Innovation
1
Education & Skills
1
Climate & Environment
1
Threats to the EU →