ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > Subgroup: Pat Bear, APT-C-37

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Subgroup: Pat Bear, APT-C-37

NamesPat Bear (Qihoo 360)
APT-C-37 (Qihoo 360)
Racquet Bear (CrowdStrike)
CountrySyria Syria
SponsorSyrian Electronic Army
MotivationInformation theft and espionage
First seen2015
DescriptionA subgroup of Syrian Electronic Army (SEA), Deadeye Jackal.

(Qihoo 360) Since October 2015, the Pat Bear Organization (APT-C-37) has launched a well-organized, targeted and persistent attack against the “Islamic State”. Watering hole was used to delivery sample in this attack. The malicious samples were mainly disguised as chat software and some common software in specific fields. This Trojan has many functions such as stealing messages, contacts, WhatsApp and Telegram data, and uploading files using FTP. After reversing and correlation, we found that there is a strong correlation between the Pat Bear Organization and the Golden Rat issue, so this attack activity belongs to another branch of the Syrian Electronic Army.
ObservedSectors: Defense.
Countries: Egypt, Israel and “Islamic State”.
Tools usedDroidJack, H-Worm, njRAT, SpyNote RAT, SSLove RAT.

Last change to this card: 01 January 2023

Download this actor card in PDF or JSON format

Previous: Subgroup: Goldmouse, APT-C-27
Next: TA2101, Maze Team

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]