Sowbug

G0054UnknownEspionage0 reports from 0 vendors

Sowbug has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets. Sowbug has been seen mounting classic espionage attacks by stealing documents from the organizations it infiltrates.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	G0054

Targeting

Sectors: Government

Victim countries: Argentina, Ecuador, Brazil, Brunei, Peru, Malaysia

MITRE ATT&CK techniques (9)

T1003 T1036.005 T1039 T1056.001 T1059.003 T1082 T1083 T1135 T1560.001

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names Sowbug, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Sowbug. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (4)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G0054
symantec.comhttps://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments
cfr.orghttps://www.cfr.org/interactive/cyber-operations/sowbug
attack.mitre.orghttps://attack.mitre.org/groups/G0054/