Scarab
- First seen
- 2012-01-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Profile updated
- 2026-07-07 12:01:13
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:ru country_code:us
Context
Scarab APT was first spotted in 2015, but is believed to have been active since at least 2012, conducting surgical attacks against a small number of individuals across the world, including Russia and the United States. The backdoor deployed by Scarab in their campaigns is most commonly known as Scieron.
Reports & references
- web.archive.org — Scarab Attackers Took Aim Select Russian Targets 2012 (report)
- sentinelone.com — Chinese Threat Actor Scarab Targeting Ukraine (report)