Dancing Salome

Executive Summary

Dancing Salome, a Kaspersky-named APT group, specializes in targeting Ukrainian ministries of foreign affairs, think tanks, and related entities. The actor leverages compromised HackingTeam RCS implants, likely obtained during the 2016 HackingTeam breach, to conduct espionage. This makes the group a significant threat to diplomatic and strategic intelligence operations in Ukraine.

Goals & Targeting

Dancing Salome appears to prioritize intelligence collection focused on Ukrainian foreign policy, defense strategy, and strategic think tank research. The targeting of ministries of foreign affairs and think tanks suggests an objective of gaining insights into diplomatic communications, geopolitical analysis, and national security planning. Ukraine’s geopolitical position as a focal point of regional conflict and its role in international policy likely drive the actor’s interest in this sector. The use of HackingTeam implants implies a focus on compromising sensitive communications infrastructure, potentially to access classified or confidential data.

Dancing Salome is a sophisticated, state-sponsored or highly organized APT group with a focus on geopolitical intelligence gathering. The group's use of HackingTeam RCS implants, compiled after the 2016 HackingTeam data breach, suggests an intent to exploit compromised surveillance tools for covert operations. This actor has demonstrated an ability to infiltrate high-value targets, including Ukrainian diplomatic institutions and think tanks, likely to extract sensitive information on foreign policy, defense strategies, and geopolitical initiatives. The reuse of compromised tools highlights the group's resourcefulness in leveraging publicly available exploits for stealthy operations, which may help evade detection by traditional security measures. The actor’s focus on this specific region and sector indicates a strategic interest in Ukraine’s diplomatic and intellectual capital.

Key Capabilities

• Exploitation of compromised HackingTeam RCS implants for surveillance and data exfiltration
• Targeted spear-phishing campaigns against diplomatic and think tank entities
• Stealthy persistence mechanisms leveraging known, outdated surveillance tools for evasion
• Focused intelligence collection on diplomatic communications and strategic documents

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Dancing Salome’s campaigns appear to be low-frequency but highly targeted, focusing on Ukrainian diplomatic and think tank entities. The actor’s reliance on HackingTeam tools suggests a strategic intent to maintain operational stealth by leveraging compromised, previously legitimate surveillance infrastructure. Campaigns likely involve multi-stage compromises, with initial access achieved through spear-phishing or compromised credentials, followed by lateral movement and data exfiltration. Notable past operations include the targeting of Ukrainian diplomatic networks and academic think tanks, with a focus on compromising communications infrastructure.

IOC Patterns

• Spear-phishing emails with malicious Office documents embedded with HackingTeam RCS components
• C2 traffic using domain names registered through bulletproof hosting providers
• Use of legitimate SSH protocols for command-and-control communication
• Compromised HackingTeam implant signatures in memory dumps or network traffic

Recommended Actions

• Monitor for HackingTeam RCS implant signatures in network traffic and endpoint memory dumps
• Implement advanced email filtering to detect malicious Office documents linked to known campaigns
• Conduct regular audits of SSH and remote access protocols for anomalous C2 activity
• Deploy threat intelligence feeds specific to Ukrainian diplomatic and think tank entities
• Enhance detection capabilities for compromised surveillance tool usage

Suggested Tags