Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia. They use a custom backdoor named Merdoor, developed since 2018, and employ various tactics to gain access, including phishing emails, SSH credential brute-forcing, and exploiting server vulnerabilities. Additionally, Lancefly has been observed using a newer version of the ZXShell rootkit and tools like PlugX and ShadowPad RAT, which are typically associated with Chinese-speaking APT groups.
Executive Summary
Lancefly is an advanced persistent threat (APT) group targeting government, aviation, and telecom organizations in South and Southeast Asia. They employ a variety of attack techniques including phishing, SSH credential brute-forcing, server vulnerability exploitation, and deployment of custom malware such as Merdoor backdoor, ZXShell rootkit, PlugX, and ShadowPad RAT.
Goals & Targeting
Lancefly's strategic objectives likely revolve around collecting sensitive information from targeted sectors such as government for diplomatic or military intelligence. Their focus on aviation and telecom may aim at gathering technological insights or operational data. The choice of specific regions indicates a potential regional focus or resource availability.
Enhanced Description
Lancefly is suspected to be an APT group with heightened activity since 2018. They primarily target government, aviation, telecom sectors in South and Southeast Asia, possibly for espionage or strategic information theft. Their arsenal includes Merdoor backdoor, ZXShell rootkit, PlugX, ShadowPad RAT. They use phishing emails, SSH brute-forcing, and server exploitation to infiltrate networks. The sophistication of their tools, like evolving ZXShell rootkit, suggests a level of expertise akin to other notable Chinese-speaking APTs.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
Lancefly's campaigns since 2018 demonstrate persistence and adaptability, evolving their tools in response to defenses. Their targeting of specific sectors suggests a deliberate focus on information gathering rather than immediate disruption.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
The available data on Lancefly provides moderate confidence in understanding their capabilities and targeting patterns. However, gaps exist in precisely mapping their long-term objectives, campaign structures, and specific infrastructure details, hindering more precise threat intelligence.
No techniques linked yet.
No tools linked yet.
No campaigns linked yet.
No observed data linked yet.
No IOCs linked yet.
No references recorded yet.
0
Techniques
0
Tools
0
Campaigns
0
IOCs
0
Observed Data
0
Tactics