Also known as: LookingFrog
Witchetty was first documented by ESET in April 2022, who concluded that it was one of three sub-groups of TA410, a broad cyber-espionage operation with some links to the Cicada group (aka APT10). Witchetty’s activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload known as LookBack. ESET reported that the group had targeted governments, diplomatic missions, charities, and industrial/manufacturing organizations.
Executive Summary
Witchetty, also known as LookingFrog, is a sub-group of TA410 associated with Cicada (APT10) involved in cyber-espionage. They use X4 and LookBack malware targeting governments, diplomatic missions, charities, and industrial sectors globally. Their activities pose risks to sensitive data and require attention to advanced attack techniques.
Goals & Targeting
Witchetty likely aims to gather intelligence and steal sensitive data from targeted sectors, aligning with broader TA410 operations. Their victims include government agencies and industrial organizations, suggesting an intent to undermine national security and economic interests through espionage.
Enhanced Description
Witchetty emerged in April 2022 as part of TA410, linked to the Cicada group (APT10), engaging in cyber-espionage. Known for X4 and LookBack malware, they initially deploy X4 as a first-stage backdoor before delivering LookBack for data theft or espionage. Targeting includes governments, diplomatic entities, NGOs, and industrial sectors across multiple countries, indicating a strategic focus on sensitive information and critical infrastructure.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
Witchetty's campaigns likely involve long-term, targeted operations for data collection. Their malware deployment suggests a patient approach to achieve persistence and stealth. Past activities include compromising diplomatic communications and industrial designs, necessitating robust defensive measures.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Moderate confidence in known attributes, with gaps in specific TTPs and exact targeting locations.
No techniques linked yet.
No tools linked yet.
No campaigns linked yet.
No observed data linked yet.
No IOCs linked yet.
No references recorded yet.
0
Techniques
0
Tools
0
Campaigns
0
IOCs
0
Observed Data
0
Tactics