New Tool Set Found Used Against Organizations in the Middle East, Africa and the US
Summary: Unit 42 observed a series of apparently related attacks against organizations in the Middle East, Africa and the U.S., tracked as CL-STA-0002 and assessed with medium confidence to align with nation-state actors, though no specific nation-state or group was confirmed. The tool set included Ntospy, a custom DLL registered as a Network Provider named credman to capture credentials during authentication, a reduced Mimikatz variant called Mimilite, and Agent Racoon, a .NET backdoor using DNS queries to telemetry.geoinfocdn[.]com for command and control.
Bottom line: The attackers registered a fake Network Provider to harvest credentials every time a victim authenticated, and used filenames like ntoskrnl.dll and KB200812134.txt to pass as Windows and Microsoft Update components - so a tool that looks native may be the one collecting your passwords.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026