ITG14

Threat Actor updated 7 months ago (2024-05-04T21:17:43.915Z)
Download STIX
Preview STIX
ITG14, a threat actor identified in the cybersecurity industry, has recently been linked to malicious activities involving the Domino Backdoor. X-Force researchers have found substantial evidence connecting the Domino Backdoor to ITG14’s Carbanak Backdoor. The Domino Backdoor not only shares significant code overlap with the Lizar family of malware, also known as Tirion or Diceloader, but it also demonstrates considerable similarities with malware associated with the Lizar Toolkit, both of which are attributed to ITG14. The observed collaboration between members of ITG14 and former members of ITG23 is consistent with past occurrences. This cooperation further expands the potential reach and impact of these threat actors, possibly leading to more sophisticated and damaging cyberattacks. However, while there is considerable overlap between the Domino Backdoor and ITG14's tools, this alone is insufficient for definitive attribution. Additional evidence supporting the connection between the Domino Backdoor and ITG14 includes the observation by X-Force analysts that two of the Domino Backdoor command-and-control (C2) addresses belonging to MivoCloud closely match C2 addresses previously used by ITG14 for SSH-based Backdoors. These findings suggest a preference on the part of an ITG14 developer for using MivoCloud for some of their C2 addresses. While this information does not conclusively attribute the Domino Backdoor to ITG14, it adds to the mounting evidence of ITG14's involvement.
Description last updated: 2024-05-04T21:13:03.138Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
FIN7 is a possible alias for ITG14. FIN7, also known as Carbanak, Carbon Spider, Cobalt Group, and Navigator Group, is a notorious cybercrime group that has been active since 2012. The group is recognized for its advanced combination of malware and social engineering tactics, having executed numerous successful attacks against global
3
Diceloader is a possible alias for ITG14. Diceloader is a type of malware, short for malicious software, that is designed to infiltrate and damage computer systems. It can infect systems through various means such as suspicious downloads, emails, or websites, often without the user's knowledge. Once inside a system, it can steal personal in
2
Tirion is a possible alias for ITG14. Tirion, also known as Lizar or DiceLoader, is a type of malware developed by the threat group ITG14, also known as FIN7. First reported in March 2020, Tirion has been observed in numerous ITG14 campaigns up until the end of 2022. This malicious software can infiltrate systems through suspicious down
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Backdoor
Loader
Ransomware
Infostealer
Malware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Lizar Malware is associated with ITG14. Lizar, also known as Tirion or Diceloader, is a malicious software developed by the threat group ITG14. It's designed to exploit and damage computers or devices, infiltrating systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operatiUnspecified
2
The Carbanak Malware is associated with ITG14. Carbanak is a notorious malware developed by the cybercrime collective known as FIN7, also referred to as Carbon Spider, Cobalt Group, and Navigator Group. The group, which has been active since 2012, is of Russian origin and has been particularly focused on exploiting the restaurant, gambling, and Unspecified
2
The Conti Malware is associated with ITG14. Conti is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. Often spreading through suspicious downloads, emails, or websites, it can steal personal information, disrupt operations, or hold data hostage for ransom. Notably, Conti was linked to several raUnspecified
2
The Domino Backdoor Malware is associated with ITG14. The Domino Backdoor is a type of malware that has been linked to multiple threat groups, highlighting the complexity of tracking these actors and their operations. This malicious software, designed to exploit and damage computers or devices, can steal personal information, disrupt operations, or holUnspecified
2
The Carbanak Backdoor Malware is associated with ITG14. The Carbanak Backdoor is a notorious malware, designed to exploit and damage computer systems. It is associated with the FIN7 threat group, also known as the "Carbanak Group", although not all usage of the Carbanak Backdoor can be directly linked to FIN7. This malicious software infiltrates systems Unspecified
2
The Project Nemesis Malware is associated with ITG14. Project Nemesis is a malicious software, or malware, that was first advertised on the dark web in December 2021. It is designed to exploit and damage computer systems by infiltrating them through suspicious downloads, emails, or websites. Once inside, Project Nemesis can steal personal information, Unspecified
2
The Dave Loader Malware is associated with ITG14. Dave Loader, also known as Domino Backdoor, is a potent malware that has been utilized in various cybercrime operations. This malicious software is designed to infiltrate computer systems and compromise user data, often without the victim's knowledge. It can be delivered through dubious downloads, eUnspecified
2
The Domino Malware is associated with ITG14. Domino is a malicious software that infiltrated various systems, most notably IBM Domino Server and ESET Mail Security for IBM Domino, causing significant disruptions and data breaches. The malware was particularly potent due to its ability to exploit vulnerabilities in one system and trigger a domiUnspecified
2
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The Trickbot/conti Syndicate Threat Actor is associated with ITG14. The Trickbot/Conti syndicate, also known as ITG23, is a threat actor group associated with various malicious activities. Since late February 2023, this group has been linked to Domino Backdoor campaigns utilizing the Dave Loader, a tool used to load malware onto targeted systems. The IBM Security X-Unspecified
2
Source Document References
Information about the ITG14 Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more