PerSwaysion
- First seen
- 2019-08-01 00:00:00
- Origin
- VN
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:09:41
Targeted industries: financial-services technology-and-telecommunications professional-services
Targeted regions: country_code:us country_code:uk country_code:sg
Context
PerSwaysion is a threat actor known for conducting phishing campaigns targeting high-level executives. They have been active since at least August 2019 and are believed to be based in Vietnam. PerSwaysion has recently updated their techniques, using more direct phishing methods and leveraging Microsoft 365 to steal credentials.
Reports & references
- blog.group-ib.com — Perswaysion (report)
- blog.scarletshark.com — Perswaysion Threat Actor Updates Their Techniques And Infrastructure E9465157A653 (report)