Threat Assessment: Hangover Threat Group
Summary: Unit 42 published a threat assessment on the Hangover threat group (also known as Neon, Viceroy Tiger, and MONSOON), a cyberespionage group first observed in December 2013 attacking a telecom corporation in Norway, which now deploys BackConfig malware against government and military organizations in South Asia. The group's initial access vector is spear-phishing with local and topical South Asia news lures that lead victims to download and execute a weaponized Microsoft Office document, after which BackConfig establishes backdoor communication for espionage and potential data exfiltration.
Bottom line: A group tracked since 2013 has refined its lure to regional news that its government and military targets already read, and Unit 42 notes indicators of Hangover activity in the U.S. and Europe - so the topical-lure playbook is not confined to South Asia.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026