Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists

Summary: Unit 42 has attributed a series of attacks beginning over four years ago to a group it code-named Scarlet Mimic, which primarily targets Uyghur and Tibetan activists and their supporters, along with government organizations in Russia and India that track activist and terrorist activities. The group centers its attacks on a Windows backdoor called FakeM, first described by Trend Micro in 2013, and has since deployed two additional FakeM variants, nine distinct loader malware families, and Trojans targeting Mac OS X and Android, using spear-phishing and a 2013 watering hole attack.

Key Takeaway: Unit 42 states it cannot identify which attacks succeeded against which organizations, but notes the tools have been under development for years, suggesting an active adversary successful in some percentage of its operations - and the group has begun expanding from PCs to mobile devices.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related