LilacSquid is an organized cybercriminal group targeting Active Directory environments since 2021.
Analyst brief
LilacSquid is an APT actor active since at least 2021, targeting a variety of industries worldwide. They typically gain initial access by exploiting vulnerabilities and using compromised RDP credentials. After compromise, they deploy MeshAgent and a customized QuasarRAT version called PurpleInk to maintain control, and use Secure Socket Funneling for data exfiltration. Defenders should focus on monitoring RDP access attempts, suspicious RAT behavior, and anomalous network tunneling activities.
LilacSquid
unknown
LilacSquid is an APT actor targeting a variety of industries worldwide since at least 2021. They use tactics such as exploiting vulnerabilities and compromised RDP credentials to gain access to victim organizations. Their post-compromise activities involve deploying MeshAgent and a customized version of QuasarRAT known as PurpleInk to maintain control over infected systems. LilacSquid has been observed using tools like Secure Socket Funneling for data exfiltration.