Lancefly

Lancefly, a threat actor potentially associated with China, has been identified as the group behind an ongoing cyberespionage campaign targeting organizations in South and Southeast Asia. The targets include government bodies, aviation companies, educational institutions, and telecommunication sectors. These attacks have been carried out using a custom-written malware known as Merdoor, as discovered by researchers at Symantec's Threat Hunter Team. This backdoor malware is believed to have existed since 2018 and has been used in various campaigns, including activities observed in 2020, 2021, and more recently, continuing into the first quarter of 2023. The primary motivation behind these campaigns appears to be intelligence gathering. The recent Lancefly activity is notable not only for its use of the Merdoor backdoor but also for the low prevalence of this backdoor around Russian locations and the highly targeted nature of these attacks. The powerful backdoor, Merdoor, which was initially thought to be connected to Russia, has shown significant activity in Russian places during 2020 and 2021, and continued into the first quarter of 2023. Despite some overlaps and shared tools that might suggest links between Lancefly and other Advanced Persistent Threat (APT) groups, there are no strong enough connections to attribute the development of the Merdoor backdoor to any already-known attack group. This indicates that Lancefly operates independently, making it a unique threat to cybersecurity. It's crucial for organizations, especially those in the targeted sectors, to stay vigilant and implement robust security measures to counter such sophisticated threats.