Summary
This technical report provides an analysis of the tactics, techniques, and procedures (TTPs) employed by Advanced Persistent Threat (APT) groups during the first half of 2024. It outlines significant incidents and emerging patterns observed by Cyble Research & Intelligence Labs from January to June 2024. The report details how APT groups have evolved their attack techniques, including the use of phishing, malware deployment, and exploitation of vulnerabilities for initial access. It also highlights the targeted sectors, which include critical infrastructure, financial institutions, and government agencies, particularly in regions experiencing geopolitical tensions such as Ukraine and Israel. The report identifies key vulnerabilities exploited by APTs and lists various malware families employed in these attacks. Additionally, it discusses the command and control communications methods that have become increasingly difficult to detect. The report aims to provide readers with detailed observations, timelines, and mitigation strategies to enhance their security against APT attacks.
