Threat Spotlight: Group 72
Summary: Cisco Talos, working with other security companies, is highlighting and disrupting the threat actor it tracks as Group 72, a long-standing group tied to Operation SMN (named Axiom by Novetta) that targets high-value intellectual property in manufacturing, industrial, aerospace, defense and media, almost exclusively in the United States, Japan, Taiwan and Korea. Talos describes the group as sophisticated and well funded with a defined software development methodology, using watering-hole attacks, spear-phishing and web-based tactics, exploits for CVE-2014-0322, CVE-2012-4792, CVE-2012-1889 and CVE-2013-3893, SQL injection, and multiple remote access trojans rather than a single preferred RAT.
What's compelling: Group 72 is assessed as possibly running its own vulnerability research team hunting 0-days in Windows, and its tools and infrastructure overlap with other threat groups - suggesting it may be part of a larger organization with many separate teams, or that groups share tactics, code and personnel.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-1889CVE-2012-4792CVE-2013-3893CVE-2014-0322
- Related
- CVE-2013-3893: Microsoft Internet Explorer Resource Management Errors Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025CVE-2012-4792: Microsoft Internet Explorer Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jul 23, 2024CVE-2012-1889: Microsoft XML Core Services Memory Corruption Vulnerability Known Exploited Vulnerabilities · Jun 08, 2022