Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage - Securelist

GReAT researchers detail Poseidon Group, a Portuguese-speaking targeted-attack actor that has operated since at least 2005, crafting custom malware implants and conducting global campaigns to steal information from corporate networks via spear-phishing with embedded payloads. The report outlines the actor’s evolving toolkit, notable operational practices (including privilege escalation, lateral movement, and data exfiltration), emphasis on commercial espionage, regional victim patterns (especially Brazil), and indicators such as sinkholed C2 domains and non-state sponsorship, with remediation and IOC sharing for affected organizations.