Sowbug
MITRE ATT&CK: G0054 View on attack.mitre.org
Aliases: Sowbug
- First seen
- 2015-01-01 00:00:00
- Primary motivation
- espionage
- Sophistication
- intermediate
- Resource level
- government
- Actor type
- Espionage
- Related IoCs
- 1
- Last IoC activity
- 2026-07-18 09:15:16
- Profile updated
- 2026-07-07 12:32:18
Targeted industries: government-and-public-sector
Targeted regions: country_code:br country_code:ar country_code:cl country_code:pe country_code:vn country_code:my
Context
Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015.
Detection coverage
- 1 YARA rules
- 149 Sigma rules
Malware & tools used
- File and Directory Discovery (attack-pattern)
- Data from Network Shared Drive (attack-pattern)
- Archive via Utility (attack-pattern)
- Windows Command Shell (attack-pattern)
- Keylogging (attack-pattern)
- Network Share Discovery (attack-pattern)
- Match Legitimate Resource Name or Location (attack-pattern)
- OS Credential Dumping (attack-pattern)
- System Information Discovery (attack-pattern)
- Felismus (malware)
- Starloader (malware)
Reports & references
- Broadcom/Symantec — Sowbug Cyber Espionage Group Targets South American And Southeast Asian Governments (report)
- cfr.org — Sowbug (report)
- MITRE ATT&CK — G0054 (report)