Kasablanka
- First seen
- 2022-09-01 00:00:00
- Origin
- MA
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:01:23
Targeted industries: financial-services government-and-public-sector energy-and-utilities
Targeted regions: country_code:ru
Context
The Kasablanka group is a cyber-criminal organization that has specifically targeted Russia between September and December 2022, using various payloads delivered through phishing emails containing socially engineered lnk files, zip packages, and executables attached to virtual disk image files.
Reports & references
- ESET — Bladehawk Android Espionage Kurdish (report)
- Cisco Talos — Yorotrooper Espionage Campaign Cis Turkey Europe (report)
- Cisco Talos — Get A Loda This (report)