Sandman APT

First seen

2023-01-01 00:00:00

Origin

CN

Primary motivation

espionage

Sophistication

advanced

Resource level

government

Actor type

Espionage

Profile updated

2026-07-07 11:46:10

Targeted industries: government-and-public-sector technology-and-telecommunications

Context

First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.