SparklingGoblin

▲ High Threat

Primary Aliases: APT41 Brass Typhoon Leopard Typhoon WICKED PANDA

Confidence Rating 70% (Grounded)

ESET researchers have discovered a new undocumented modular backdoor, SideWalk, being used by an APT group they’ve named SparklingGoblin; this backdoor was used during one of SparklingGoblin’s recent campaigns that targeted a computer retail company based in the USA. This backdoor shares multiple similarities with another backdoor used by the group: CROSSWALK.

🎯 Target Sectors & Focus

Defense & Aerospace Government & Diplomacy Financial & Crypto Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (82 TTPs)

📥 Download Navigator JSON

Initial Access 5

T1566 Valid Accounts

T1566 Compromise Software Supply Chain

T1566 External Remote Services

T1566 Spearphishing Attachment

T1566 Exploit Public-Facing Application

Execution 5

T1059 PowerShell

T1059 Scheduled Task

T1059 Windows Command Shell

T1059 Service Execution

T1059 Exploitation for Client Execution

Persistence & Privilege Escalation 6

T1547 Registry Run Keys / Startup Folder

T1547 Dynamic Linker Hijacking

T1547 Compute Hijacking

T1547 Modify Registry

T1547 Query Registry

Defense Evasion 3

T1027 Code Signing

T1027 Process Injection

Credential Access & Discovery 13

T1003 System Information Discovery

T1003 Permission Groups Discovery

T1003 Credentials from Web Browsers

T1003 Remote System Discovery

T1003 Network Share Discovery

T1003 Brute Force

T1003 Network Service Discovery

T1003 Credentials from Password Stores

T1003 System Network Connections Discovery

T1003 System Network Configuration Discovery

T1003 System Owner/User Discovery

T1003 File and Directory Discovery

T1003 Keylogging

Lateral Movement & Collection 3

T1021 SMB/Windows Admin Shares

T1021 Pass the Hash

T1021 Remote Desktop Protocol

Command & Control 5

T1071 Web Protocols

T1071 Domain Generation Algorithms

T1071 Dead Drop Resolver

T1071 Ingress Tool Transfer

T1071 Lateral Tool Transfer

Exfiltration & Impact 1

T1485 Data Encrypted for Impact

Operational Techniques 40

T1000 Wordlist Scanning

T1000 Domain Account

T1000 Match Legitimate Resource Name or Location

T1000 Windows Service

T1000 File Transfer Protocols

T1000 Software Packing

T1000 Scan Databases

T1000 Additional Local or Domain Groups

T1000 Boot or Logon Initialization Scripts

T1000 Local Account

T1000 Clear Windows Event Logs

T1000 Network Boundary Bridging

T1000 Environmental Keying

T1000 Group Policy Modification

T1000 Vulnerability Scanning

T1000 Data from Local System

T1000 File Deletion

T1000 Disable or Modify Tools

T1000 Accessibility Features

T1000 Security Account Manager

T1000 Archive via Utility

T1000 Fallback Channels

T1000 Unix Shell

T1000 Compiled HTML File

T1000 LSASS Memory

T1000 Impersonation

T1000 Code Repositories

T1000 BITS Jobs

T1000 Obfuscated Files or Information

T1000 Multi-Stage Channels

T1000 Data Transfer Size Limits

T1000 Windows Management Instrumentation

T1000 Clear Command History

T1000 Masquerade Task or Service

Copied to clipboard

LINK COPIED TO CLIPBOARD