ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > AtlasCross

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: AtlasCross

NamesAtlasCross (NSFOCUS)
MotivationInformation theft and espionage
First seen2023
Description(NSFOCUS) After an in-depth study of the attack process, NSFOCUS Security Labs found that this APT attacker is quite different from known attacker characteristics in terms of execution flow, attack technology stack, attack tools, implementation details, attack objectives, behavior tendency and other main attribution indicators. The technical level and cautious attitude shown by this attacker during this activity are also worthy of attention.

Therefore, NSFOCUS Security Labs identified the orchestrator of this event as a new attacker and named it AtlasCross.

NSFOCUS Security Labs validated the high-level threat attributes of AtlasCross in terms of development technology and attack strategy through an in-depth analysis of its attack metrics. At this current stage, AtlasCross has a relatively limited scope of activity, primarily focusing on targeted attacks against specific hosts within a network domain. However, the attack processes they employ are highly robust and mature. NSFOCUS Security Labs deduce that this attacker is highly likely to deploy this attack process into larger-scale network attack operations.

The organizational origin of the AtlasCross attacker cannot be determined.
Tools usedAtlasAgent, DangerAds.

Last change to this card: 12 October 2023

Download this actor card in PDF or JSON format

Previous: Aquatic Panda

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]