Cyritex Security Lab | APT-U4241 and APT-U2500 threat groups' attack techniques have been incorporated into the simulation attack library!

▌Attack Simulation Library Update

This update incorporates various attack techniques from the threat groups APT-U4241 and APT-U2500 into the attack library.

APT-U4241 is a multi-threat group cluster operating a credential theft network to harvest credentials from a wide range of global organisations. This group injects their credential theft code into the Outlook Web App (OWA) login page to scrape and forward user credentials to C&C servers, thereby acquiring massive volumes of user credentials to sell or use in their own attacks.

APT-U2500 is a distributed threat group that often sends emails containing malicious attachments or phishing website links. The distributed ZIP files contain malicious files targeting Word or Excel, used to download trojan payload variants such as QAKBOT, as well as downloading famous trojans like BEACON, SNOWCONE.GZIPLOADER, SNOWCONE.PHOTOLOADER, SYSTEMBC, NUTWAFFLE, URSNIF, and SMOKELOADER from malicious sites.

You can now directly search for the keywords "APT-U4241" or "APT-U2500" in our platform to find all related attack simulation experiments we have collected, allowing you to verify the protection effectiveness after implementing rectifications.