Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Thrip · Unknown · assessed origin Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Thrip

  • G0076
  • ATK78

state sponsor · UnknownMITRE G0076 ↗

Thrip — ATT&CK roseTH

attack rose · 4 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.

Observed targets (as stated by the sources)

1 countries · 1 sectors
United States

assessed originnot stated by sourcesobserved targets · 1

countries · 1

  • United States

sectors · 1

  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

4 techniques · 4 of 15 tactics

  1. Resource development

    1 technique

  2. Execution

    1 technique

  3. Command and control

    1 technique

  4. Exfiltration

    1 technique

select a technique

Arsenal

1 malware · 2 tools
Malware
Malware · 1ATT&CK
CatchamasS0261 ↗
Tools
Tools · 2ATT&CK
PsExecS0029 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

6 sources
  1. 1.cfr.org/interactive/cyber-operations/thrip
  2. 2.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecom…
  3. 3.attack.mitre.org/groups/G0076
  4. 4.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
  5. 5.cyberthreat.thalesgroup.com/sites/default/files/2022-05/THALES%20THREAT%20HANDBOOK…
  6. 6.attack.mitre.org/groups/G0076

Track Thrip on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.