Threat Spotlight: Group 72

Talos describes ‘Group 72’ (associated with Operation SMN/Axiom) as a sophisticated, well-funded threat actor targeting high-value organizations in manufacturing, aerospace, defense and media across the US and parts of Asia using watering-hole attacks, spear-phishing, SQL injection and exploit-based initial access (several CVEs cited) to deploy multiple remote access trojans (Ghost RAT, Poison Ivy, HydraQ, HiKit, Zxshell, DeputyDog, Derusbi, PlugX); the report includes IoCs (ClamAV names, Snort signature IDs), domain/email registration patterns, and recommended product protections.