Threat Actors Strider

Strider

G0041 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: ProjectSauron, Strider, Sauron, Project Sauron, G0041

Description

Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)

Goals & Targeting

Targeted Sectors

Government

Defense

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Command & Control

1 technique

T1090.001

Internal Proxy

Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.(Citation: Kaspersky ProjectSauron Blog)

Defense impairment

1 technique

T1556.002

Password Filter DLL

Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.(Citation: Kaspersky ProjectSauron Full Report)

Stealth

1 technique

T1564.005

Hidden File System

Strider has used a hidden file system that is stored as a file on disk.(Citation: Kaspersky ProjectSauron Full Report)

Software / Tooling

S0125

Remsec

Family

(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

Symantec Strider Blog — Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.
Kaspersky ProjectSauron Blog — Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.
Kaspersky ProjectSauron Full Report — Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G0041
Type: Unknown
Country of Origin: U
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--277d2f87-2ae5-4730-a3aa-50c1fdff9656

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.