Donot APT group is a cybercrime group that is believed to be operating out of Russia. They are known for conducting cyber espionage and intellectual property theft against government and military organizations, as well as companies in the aerospace, defense, and high-tech industries. The group has been active since at least 2016 and is known for using a variety of tactics, techniques, and procedures (TTPs) to conduct their attacks.
One of the key TTPs used by the Donot APT group is the use of custom-developed malware. The group has been known to use a variety of malware, including remote access trojans (RATs), keyloggers, and data exfiltration tools. They also use phishing and spear-phishing tactics to trick victims into giving them access to their systems.
The group is known to use a variety of infrastructure to conduct their attacks, including compromised servers and domain names. They also use a range of encryption and obfuscation techniques to hide their activities.
It is important for organizations to be aware of the threat posed by the Donot APT group and to take steps to protect themselves from their attacks. This includes implementing strong security controls, such as firewalls, intrusion detection and prevention systems, and endpoint security solutions, as well as educating employees about the risks of phishing and spear-phishing. Additionally, organizations should also have incident response plans in place to quickly and effectively respond to a security incident.
The recent malicious campaign includes the invitation list of IDEAS named Invitation_list_IDEAS.xls.