A group monitored as REF2924 by Elastic Security Labs is wielding novel data-stealing malware — an HTTP listener written in C# dubbed Naplistener by the researchers — in attacks against victims operating in southern and southeast Asia.According to a blog post by Elastic senior security research engineer Remco Sprooten, in that region of the world, network-based detection and prevention technologies are the de facto method for securing many environments.
Executive Summary
REF2924 is a threat actor observed using the Naplistener malware, targeting regions in southern and southeast Asia. Their primary activity involves data theft through network-based attacks, exploiting environments that rely heavily on network detection technologies.
Goals & Targeting
The actor aims to steal data, possibly for financial or espionage purposes. They target industries in regions like southern and Southeast Asia, exploiting the reliance on network-based detection systems for potential entry points.
Enhanced Description
REF2924, identified by Elastic Security Labs, deploys the C#-based Naplistener malware to steal data. Targeted regions include southern and Southeast Asia, where network-based security is prevalent. The group's motivation appears to be financial gain or espionage. Their operations are regional with a focus on sectors likely holding sensitive information.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
No specific campaigns linked, but consistent activity in target regions suggests steady operational tempo focused on data theft.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Low confidence due to limited data, particularly on motivation and specific targets. Gaps include unknown targeting sectors, goals beyond data theft, and no linked campaigns or IOCs.
No techniques linked yet.
No tools linked yet.
No campaigns linked yet.
No observed data linked yet.
No IOCs linked yet.
No references recorded yet.
0
Techniques
0
Tools
0
Campaigns
0
IOCs
0
Observed Data
0
Tactics