Home > List all groups > Sphinx

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Sphinx

NamesSphinx (Qihoo 360)
APT-C-15 (Qihoo 360)
MotivationInformation theft and espionage
First seen2014
Description(Qihoo 360) Operation Sphinx is a cyber-espionage activity in the Middle East. The main victims are political and military organizations in Egypt, Israel and possibly other countries. Sensitive data theft is what the attackers plotted for during the period from June, 2014 to November, 2015 when the activity was in its prime. We encountered some timestamps of the samples to be as early as December, 2011 which suggests the attack might be started much earlier, though further sound proof is needed. The main approach of Sphinx is watering hole attack on social web sites. Until now, we have obtained 314 pieces of sample malicious codes and 7 C2 domains.
ObservedCountries: Egypt, Israel.
Tools usedAnubisSpy, Havex RAT, njRAT, ROCK.

Last change to this card: 21 May 2020

Download this actor card in PDF or JSON format

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
PGP Download PGP key