Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data

Trend Micro's report documents the TICK cyberespionage group and its Operation ENDTRADE campaign, detailing a suite of multi-stage malware families (ABK, BBK, Avenger, down_new, Tomato, Snack, among others) used to steal proprietary and classified data from Japanese organizations and subsidiaries in China, employing spearphishing, AV evasion, steganography, and carefully crafted C2 infrastructure; the analysis maps the techniques to MITRE ATT&CK, provides IoCs, and highlights ongoing development and expansion of capabilities.