Pirpi (RSFuncs / sslshell)

Custom Windows RAT used by APT3 (Gothic Panda / TG-0110 / UPS) in browser zero-day campaigns. Group is attributed to Guangzhou Bo Yu Information Technology Co., Ltd. (Boyusec), a MSS contractor. On 27 November 2017 the U.S. DOJ unsealed an indictment against Boyusec employees Wu Yingzhuo, Dong Hao and Xia Lei for intrusions into Moody's, Siemens and Trimble between 2011 and 2017.

family

Pirpi

first seen

Dec 31, 2009

publisher

U.S. Department of Justice