Dalbit
- Origin
- CN
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:08:03
Targeted industries: technology-and-telecommunications financial-services professional-services
Context
The group usually targets vulnerable servers to breach information including internal data from companies or encrypts files and demands money. Their targets of attack are usually Windows servers that are poorly managed or are not patched to the latest version. Besides these, there are also attack cases that targeted email servers or MS-SQL database servers.
Reports & references
- asec.ahnlab.com — 56941 (report)
- asec.ahnlab.com — 56236 (report)
- asec.ahnlab.com — 47455 (report)
- blog.sekoia.io — My Teas Not Cold An Overview Of China Cyber Threat (report)