LuckyMouse

LuckyMouse, also known as Budworm, Emissary Panda, and APT27, is a threat actor that has been involved in several high-profile cyber-espionage activities. The group has demonstrated its ability to develop and deploy advanced cyber tools, targeting various operating systems including MacOS, Linux, and iOS. In 2020 and 2021, new malware samples attributed to LuckyMouse were discovered by Talent-Jump. In addition to this, the group has shown an inclination towards exploiting recent vulnerabilities, as indicated by ESET Research's findings that LuckyMouse, along with other threat actors such as Tick, Winnti Group, and Calypso, likely used Microsoft Exchange vulnerabilities to compromise email servers globally. In February and March of 2021, LuckyMouse was noted for its involvement in exploiting these vulnerabilities, compromising the email servers of governmental entities in the Middle East and South America. It was observed that the group had access to the exploit as a zero day, indicating their advanced capabilities. Moreover, LuckyMouse has also been implicated in the deployment of a previously unseen variant of its SysUpdate backdoor, demonstrating the group's active development of cyber-espionage tools. More recently, in September 2022, ESET detected LuckyMouse using a malicious update of the Cobra DocGuard software to implant a variant of the Korplug malware into the systems of a Hong Kong-based gambling company. This attack was not the first against the same company; LuckyMouse had compromised it a year earlier in September 2021. Further, in June 2023, the group was reported to have compromised CCTV cameras of the Directorate General of Highways in Taiwan. These instances illustrate the persistent threat posed by LuckyMouse and its ongoing efforts to infiltrate and compromise key infrastructure and organizations worldwide.