ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Dorshel

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Dorshel

NamesDorshel
CategoryMalware
TypeBackdoor
Description(Symantec) In 2014, Symantec observed the Dragonfly group compromise legitimate software in order to deliver malware to victims, a practice also employed in the earlier 2011 campaigns. In the 2016 and 2017 campaigns the group is using the evasion framework Shellter in order to develop Trojanized applications. In particular, Backdoor.Dorshel was delivered as a trojanized version of standard Windows applications.
Information<https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel>

Last change to this tool card: 22 April 2020

Download this tool card in JSON format

Previous: DoppelPaymer
Next: DoubleAgent

All groups using tool Dorshel

ChangedNameCountryObserved

APT groups

 Energetic Bear, DragonflyRussia2010-Oct 2020X

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key