Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · BackdoorDiplomacy · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

BackdoorDiplomacy

  • BackDip
  • CloudComputating
  • Quarian

MITRE G0135 ↗

BackdoorDiplomacy — ATT&CK roseBA

attack rose · 15 techniques across 7 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2020-5902

Analyst brief

misp-galaxy + mitre-attack

An APT group that we are calling BackdoorDiplomacy, due to the main vertical of its victims, has been targeting Ministries of Foreign Affairs and telecommunication companies in Africa and the Middle East since at least 2017.

Observed targets (as stated by the sources)

11 countries · 2 sectors
LibyaSudanAlbaniaCroatiaGeorgiaPolandIranQatarSaudi ArabiaSri LankaUzbekistan

assessed originnot stated by sourcesobserved targets · 11

countries · 11

  • Libya
  • Sudan
  • Albania
  • Croatia
  • Georgia
  • Poland
  • Iran
  • Qatar
  • Saudi Arabia
  • Sri Lanka
  • Uzbekistan

sectors · 2

  • Government
  • Telecomms

also stated: Namibia

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

15 techniques · 7 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Persistence

    1 technique

  4. Stealth

    5 techniques

  5. Discovery

    3 techniques

  6. Collection

    1 technique

  7. Command and control

    2 techniques

select a technique

Arsenal

2 malware · 3 tools
Malware
Malware · 2ATT&CK
TurianS0647 ↗
China ChopperS0020 ↗
Tools
Tools · 3ATT&CK
MimikatzS0002 ↗
NBTscanS0590 ↗
QuasarRATS0262 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs BackdoorDiplomacy is cited as exploiting

none on KEV
  1. CVE-2020-59022026-10-17
    1. “BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “In one specific instance, we observed the operators exploit an F5 BIP-IP vulnerability ( CVE-2020-5902 ) to drop a Linux backdoor.”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

    3. “In their investigation ESET discovered a Quarian Linux variant sample sharing a C2 server with Windows variants, which was reportedly deployed by exploiting a known RCE vulnerability (CVE-2020-5902) in F5 Networks’ BIG-IP traffic management user interface or configuration utility.”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

2 sources
  1. 1.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian
  2. 2.attack.mitre.org/groups/G0135

Track BackdoorDiplomacy on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.