Names | IAmTheKing (Kaspersky) | |
Country | ![]() | |
Motivation | Information theft and espionage | |
First seen | 2018 | |
Description | (Kaspersky) On October 1, 2020, the DHS CISA agency released information about a malware family called SlothfulMedia, which they attribute to a sophisticated threat actor. We have been tracking this set of activity through our private reporting service, and we would like to provide the community with additional context. In June 2018, we published the first report on a new cluster of activities that we named IAmTheKing, based on malware strings discovered in a malware sample from an unknown family. Amusingly, other strings present inside of it invited “kapasiky antivirus” to “leave [them] alone”. | |
Observed | Sectors: Defense, Education, Energy, Government. Countries: Malaysia, Russia, Ukraine. | |
Tools used | JackOfHearts, KingOfHearts, LaZagne, Mimikatz, ProcDump, PsExec, QueenOfClubs, QueenOfHearts. | |
Information | <https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/> |
Last change to this card: 19 October 2020
Download this actor card in PDF or JSON format
Previous: Hurricane Panda
Next: Icefog, Dagger Panda
Thailand Computer Emergency Response Team (ThaiCERT) Follow us on![]() ![]() |
Report incidents |
|
![]() |
+66 (0)2-123-1234 | |
![]() |
report@thaicert.or.th | |
![]() |
Download PGP key |