SoWaT
- First seen
- 2020-05-01 00:00:00
- Malware type
- botnet
- Family
- Malware family
- Profile updated
- 2026-07-07 12:55:23
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:cn country_code:us
Context
This is an implant used by APT31 on home routers to utilize them as ORBs.
Reports & references
- cert.ssi.gouv.fr — Certfr 2021 Ioc 003 (report)
- twitter.com — 1417823714922610689 (report)
- blog.sekoia.io — My Teas Not Cold An Overview Of China Cyber Threat (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Sowat (report)
- imp0rtp3.wordpress.com — Sowat (report)
- twitter.com — 1417910729005490177 (report)