Deployed against carefully selected targets, the new backdoor combs through the drives of compromised systems for files of interest before exfiltrating them to Google Drive
This week, ESET researchers published their analysis of a previously undocumented backdoor that the ScarCruft APT group has used against carefully selected targets. ScarCruft is an espionage group that has been operating since at least 2012 and mainly takes aim at South Korea.
The group’s new backdoor, which ESET named Dolphin, has a wide range of spying capabilities as it can monitor drives and portable devices, exfiltrate files, log keystrokes, take screenshots, and steal credentials from web browsers.
Watch the video to learn more about the group’s new spying tool and campaigns.
Full technical details are available here: Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin