TEMP.Periscope

TEMP.Periscope, also known as APT40 and TEMP.Jumper among other names, is a threat actor group with a nexus to China that has been active since at least 2013. This group is known for its cyber espionage activities primarily targeting maritime-related entities across various sectors such as engineering, shipping and transportation, manufacturing, defense, government offices, and research universities. The group has seen a recent resurgence in activity, showcasing a revised toolkit while still leveraging a large library of malware shared with multiple other suspected Chinese groups. In July 2021, the U.S. Justice Department indicted four members of this group for hacking tens of government organizations, private businesses, and universities worldwide between 2011 and 2018. The group's modus operandi includes overlapping targeting strategies, tactics, techniques, and procedures (TTPs) with another group known as TEMP.Jumper. Their arsenal of tools includes AIRBREAK, a JavaScript-based backdoor, and Beacon, a backdoor commercially available as part of the Cobalt Strike software platform. Cybersecurity agencies from several countries including Australia, Canada, Germany, Japan, New Zealand, South Korea, the U.K., and the U.S. have issued a joint advisory warning about the group's capabilities to rapidly exploit disclosed flaws. TEMP.Periscope has been observed targeting organizations across various countries, including the United States. The group's recent spike in activity and their ability to adapt and revise their toolkit underscore the ongoing threat they pose to global cybersecurity.