REF5961 is a cyber-espionage group targeting ASEAN diplomatic entities with custom malware.
REF5961 is a cyber-espionage group discovered by Elastic on the network of a Foreign Affairs Ministry from an ASEAN member state. They primarily target diplomatic entities like foreign affairs ministries. Their arsenal includes custom malware tools such as EAGERBEE, RUDEBIRD, and DOWNTOWN. Defenders should hunt for these malware signatures and scrutinize lateral movement indicators, especially considering their co-location with other groups like REF2924.
Elastic's security team has published a report on REF5961, a cyber-espionage group they found on the network of a Foreign Affairs Ministry from a member of the Association of Southeast Asian Nations (ASEAN). Elastic says it found the group's tools next to the malware of another cyber-espionage group it tracks as REF2924. REF5961's arsenal includes malware such as EAGERBEE, RUDEBIRD, and DOWNTOWN.
REF5961 is a cyber-espionage group that primarily targets high-profile diplomatic entities like foreign affairs ministries.
REF5961 uses custom malware tools named EAGERBEE, RUDEBIRD, and DOWNTOWN.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.