image credit: pixabay
Likely state-sponsored, the threat group initially engaged in cyberespionage attacks, but then attempted to extort victims, claiming to have exfiltrated and encrypted data. The recovery of the impacted files, however, was not possible, due to the destructive nature of the attack.
Dubbed Apostle, the wiper used in these attacks was later updated with encryption capabilities, becoming a fully-functional piece of ransomware.
Comments are closed.
