Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies | Symantec Blogs

Symantec details a targeted cyber-espionage campaign attributed to the Thrip group, using living-off-the-land techniques and a mix of custom malware and off-the-shelf tools to compromise satellite communications, geospatial imaging, telecoms, and a defense contractor across the United States and Southeast Asia. The investigation highlights PsExec and PowerShell for lateral movement, multiple Trojan and info-stealer families (Rikamanu, Catchamas, Mycil, Spedear, Syndicasec), and the role of Symantec's Targeted Attack Analytics in detecting the activity.