Dolphin

Malware updated 7 months ago (2024-05-04T20:58:41.440Z)
Download STIX
Preview STIX
Dolphin is a malicious software (malware) that was reportedly used by an unidentified group against South Korea in December 2022. The malware, named after the codenames of Xerox PARC's range of workstations which all began with the letter D, including Dolphin, Dorado, Dicentra, and others, infiltrates systems to exploit and damage them, often stealing personal information or disrupting operations. This malware, along with others such as Chinotto, BLUELIGHT, GOLDBACKDOOR, and most recently M2RAT, were used by this group to conduct cyber attacks, adding commodity malware like Amadey into the mix to confuse attribution. A device known as Flipper Zero, featuring a monochrome 128x64 pixel screen with a cyber-dolphin greeting, has been flagged by Brazil's national telecoms regulator Anatel for serving illicit purposes or facilitating crimes. Despite similar devices being available in Brazil, the Flipper Zero has come under scrutiny due to its potential misuse, possibly including acting as a conduit for malware like Dolphin. The device has become controversial due to its potential for hacking and pentesting, symbolized by the crying dolphin image displayed when attempting to turn off the tool. In addition to its use in cyber warfare, the name Dolphin also refers to a technology-focused think-tank in Beijing. Despite the decline in revenue for Alibaba's core e-commerce business last year due to high competition, Dolphin continues to provide insights and analysis in the tech industry. However, it's important to differentiate between these two uses of the term 'Dolphin', one referring to a dangerous malware, and the other a legitimate think-tank.
Description last updated: 2024-05-04T16:27:05.729Z
What's your take? (Question 1 of 3)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
BLUELIGHT is a possible alias for Dolphin. The BLUELIGHT malware, first observed in early 2021, was used as the final payload in a multistage attack. This attack involved a watering-hole assault on a South Korean online newspaper, an Internet Explorer exploit, and another ScarCruft backdoor. The attack process included multiple components li
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Backdoor
Malware
Windows
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Dolphin Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
Securelist
4 months ago
CERT-EU
8 months ago
CERT-EU
9 months ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
2 years ago
CERT-EU
a year ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
ESET
2 years ago
ESET
2 years ago