Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started
Threat Actors SneakyChef

SneakyChef

TLP:CLEAR
Active
Kill Chain Analysis Generate Graph Hunt Package

Also known as: adaptation, Thallium, Black Banshee, Mythic Leopard, Transparent Tribe, Agrius, OILRIG, HELIX KITTEN, Flying Kitten, Travnet, SaffronRose, Saffron Rose, AjaxSecurityTeam, Ajax Security Team, Group 26, Sayad

Description

SneakyChef is a threat actor known for using the SugarGh0st RAT to target government agencies, research institutions, and organizations worldwide. They have been active since at least August 2023, with a focus on leveraging old and new command and control domains. The group has been observed using lures in the form of scanned documents related to Ministries of Foreign Affairs and embassies. Talos Intelligence assesses with medium confidence that the operators are likely Chinese-speaking based on language preferences and specific targets.

Goals & Targeting

Targeted Sectors

Government
Financial services
Defense
Non profit
Energy
Telecommunications
Media
Education
Critical infrastructure
Healthcare
Aerospace
Manufacturing
Hospitality
Oil gas
Think tank
Food agriculture
Aviation
Gaming
Retail
Utilities
Transportation
Pharmaceutical
Mining
Information technology
Maritime
Chemical

Targeted Countries / Regions

CN
US
IN
UA
RU
KR
JP
KZ
KP
VN
SA
PL
TW
PK
MX
IL
BY
IR
GB
AE
DE
AZ
TR
NL
LB
IT
SY
FR

AI Analysis

No AI analysis yet.

ATT&CK Techniques

1 technique
T9000

T9000

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

View all →
SHA-256 Hash 7 Domain 13
SHA-256 Hash 7
06056f83e93849124dc435166c1b463bf34bbf99ea5671221ddaf6641e3db4f4
50% TLP:CLEAR
31b7e97770ffe74dad914a37a78c8f9a7286c75b62b5fae1c4ec722837ad457e
50% TLP:CLEAR
8db5a7efe1a83e43cb4acdc596b0413b4beb54f9f8e13f978c07a6eeee6b8435
50% TLP:CLEAR
951a54d2c61c3257447c4ff5fd451ee581c76d3d4d88fa482b99f5410d7b7b6f
50% TLP:CLEAR
d6bffa45aa2448b2fb584713395b742e02ef77c1d54f125cd501240e0dd91a13
50% TLP:CLEAR
8a563b3091b56eb0562f5442c90b4d28d4be2946a3dc4a225b4b96134f7e447b
50% TLP:CLEAR
e56537d09156bb77f4821d5ce005c7840ec41890de233d88a1152f68110098cf
50% TLP:CLEAR
Domain 13
OSX.SabPub
50% TLP:CLEAR
Trojan.Taidoor
50% TLP:CLEAR
CERT.NGO
50% TLP:CLEAR
malware.lu
50% TLP:CLEAR
Win.Backdoor
50% TLP:CLEAR
Trojan.APT.BaneChant
50% TLP:CLEAR
Win.Loader.Ramnit
50% TLP:CLEAR
Trojan.APT.Seinup
50% TLP:CLEAR
Trojan.Skelky
50% TLP:CLEAR
Backdoor.Winnti
50% TLP:CLEAR
SEKOIA.IO
50% TLP:CLEAR
Lnk.Dropper
50% TLP:CLEAR
authz.lib
50% TLP:CLEAR
Open in full Indicators list →

References

  1. blog.talosintelligence.com — Cited by web research for: Thallium
  2. github.com — Cited by web research for: Agrius
  3. blog.talosintelligence.com — Cited by web research for: Gh0st
  4. firsthackersnews.com — Cited by web research for: 8a563b3091b56eb0562f5442c90b4d28d4be2946a3dc4a225b4b96134f7e447b

Intel Summary

1

Techniques

40

Tools

0

Campaigns

40

IOCs

0

Observed Data

1

Tactics

Tags

Backdoor / C2
Government Targeting

Details

Type
Unknown
Primary Motivation
Espionage
Country of Origin
C
Confidence
60%
Added
May 17, 2026
Notes
0
Log in to add a note
No notes yet. Click "Add Note" to create the first analysis note.
Opinions
0
Log in to add an opinion
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.