• First known sample

  • Discovery

  • Current status

    –°onsidered active
  • Type

    Cyber-espionage malware
  • Targeted platforms

    Windows , SPARC
  • TOP targeted countries

    Central Asia , Europe , South East Asia
  • Connected attacks

  • Purpose/Functions

  • Implant

    SBZ framework

  • Description

    SBZ is a complex framework that supports multiple exfiltration methods and complicated networking infrastructure, including addressing, redirection, and routing. SBZ probably refers to STRAITBIZZARE, a cyber-espionage platform used by the Equation Group. It is also interesting to note the overlap between the Interface IDs from the DanderSpritz samples from the ShadowBrokers’ dump “Lost in Translation” and the Interface IDs in the framework we were able to correlate. Our two private reports provided technical information on the Windows and SPARC variants respectively.

    APT trends report Q2 2022