ScarCruft updates its toolset – Week in security with Tony Anscombe

Deployed against carefully selected targets, the new backdoor combs through the drives of compromised systems for files of interest before exfiltrating them to Google Drive

This week, ESET researchers published their analysis of a previously undocumented backdoor that the ScarCruft APT group has used against carefully selected targets. ScarCruft is an espionage group that has been operating since at least 2012 and mainly takes aim at South Korea.

The group’s new backdoor, which ESET named Dolphin, has a wide range of spying capabilities as it can monitor drives and portable devices, exfiltrate files, log keystrokes, take screenshots, and steal credentials from web browsers.

Watch the video to learn more about the group’s new spying tool and campaigns.

Full technical details are available here: Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin

Connect with us on FacebookTwitterLinkedIn and Instagram.

Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center

Newsletter

Discussion