Re:StrongPity: Advanced Persistent Threat
by jcrawfordor on Monday October 10, 2016 @11:37AM
(#12677679)
The "persistent" in APT refers to the threat actor, not the tools themselves. So this is an APT because the threat actor has shown persistence by e.g. using multiple SWCs over a period of time and evolving their techniques. The individual tools used by the threat actor may not persist and in fact often don't, as APTs are much more likely to cover their tracks since they have a longer-term vision.
[ Parent
| on HN ]
Not to mention they can reinfect via download and the malware scans the system[1] for:
- putty.exe
- filezilla.exe
- winscp.exe
- mstsc.exe
- mRemoteNG.exe
The malware also has the capabilities to fetch new instructions, so there's no telling what happens when any particular software is detected.
[1] https://securelist.com/blog/research/76147/on-the-strongpity... (linked in the first line of this thread's article)