First observed
Campaign
C0021 first observed
The campaign source marks this as the beginning of the known activity window.
MITRE ATT&CKSource
ActiveMITRE ATT&CK
C0021
C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. C0021's technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected APT29 activity.
First observedNov 1, 2018
Last observedNov 1, 2018
Attributed actors0
Source-backed events1
Attribution
Who has been linked to this activity
Each relationship retains its own confidence and source.
No actor attribution is currently available.
Activity
Campaign timeline
Every date says what it measures so catalog dates are not confused with publication dates.
About the context below
CVEs, techniques, malware, and indicators in the sections below are associated with an attributed actor. They are useful investigative context, but the campaign source does not necessarily link every item directly to this campaign.
Investigation context
What the attributed actors are known to use
Use this material to guide hunting and prioritization, then confirm each relationship against its cited source.
Related vulnerabilities 0
No linked CVEs are available.
ATT&CK techniques 0
No linked techniques are available.
Malware and tools 0
No linked malware or tools are available.
Indicators 0
No source-linked indicators are available.
Sources
Evidence behind this page
Open the original material before making an attribution or response decision.