File · Scarab · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06
Scarab
sigil · no ATT&CK coverage stated
Analyst brief
misp-galaxyScarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small number of individuals across the world, including Russia and the United States. The backdoor deployed by Scarab in their campaigns is most commonly known as Scieron.
Observed targets (as stated by the sources)
3 countries · 0 sectorsassessed origin · Chinaobserved targets · 3
countries · 3
- Russia
- Ukraine
- United States
as stated by MISP galaxy / ransomware.live — not inferred
Detections
5 rules · Sigma · QRadar · CortexIndicator
Known-malicious file hash observedAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Indicator
Malicious HashesAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Generated by skopnix from this finding, each with false-positive notes. Open the list →
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
2 sourcesTrack Scarab on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.