Loading threat actor…
SweetSpecter is a suspected China-based cyber-espionage threat actor publicly identified in 2023 and also tracked as TGR-STA-0043. The group has been associated with spear-phishing operations and the delivery of SugarGh0st RAT, a remote-access trojan used to gain control of victim systems, execute commands, capture screenshots, and exfiltrate data. Reporting has linked SweetSpecter to targeting of governments, particularly in Asia, the Middle East, and Africa, and to attempted targeting of a U.S.-based artificial intelligence company’s employees in 2024. SweetSpecter’s tradecraft includes reconnaissance, vulnerability research, social-engineering development, and phishing-lure refinement. Observed activity includes researching vulnerable software versions and CVEs, studying content management systems used abroad, exploring internet-wide scanning methods, and seeking ways to use offensive tooling for server exploitation. The actor has also used AI services to assist with scripting, debugging, development, and anomaly-detection evasion, indicating an effort to improve operational efficiency during intermediate phases of intrusion activity rather than to create novel capabilities. The group has conducted spear-phishing campaigns using messages crafted to appear as legitimate support-related communications and malicious attachments designed to trigger malware execution on Windows systems. Known behavior supports classification as an espionage-oriented actor focused on initial access, credentialed or interactive post-compromise control via remote-access malware, and data theft. No high-confidence evidence indicates ransomware or extortion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Experimenting with and integrating generative-AI services into operations, specifically for reconnaissance, vulnerability research, and scripting.
Chinese state-sponsored threat actor using LLMs for advanced post-compromise commands and spear-phishing, including targeting OpenAI employees.
China-linked cyber-espionage activity using spear-phishing with malicious ZIP attachments to deliver SugarGh0st RAT; leveraged ChatGPT for reconnaissance, vulnerability research, scripting, and social-engineering content generation.
China-based activity cluster reported to have used AI assistance for reconnaissance, vulnerability research, and scripting support in support of spear-phishing attempts targeting OpenAI employees and others, with an emphasis on exploiting software vulnerabilities and evading detections.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.