WildCard__2024__WildCard_The_APT_Behind_SysJoker_Targets_Critical_Sectors_in_Israel.pdf

The report identifies a new APT group named WildCard, initially detected with the SysJoker malware targeting Israel’s educational sector in 2021, and traces its evolution through increasingly sophisticated variants (DMAdevice, AppMessagingRegistrar, RustDown) that masquerade as legitimate software and leverage OneDrive as dead drops and a Rust-based backdoor for multi-platform targeting, with C2 infrastructure and links to Operation ElectricPowder, signaling sustained, high-skill campaigns against Israeli critical sectors and complex, multi-stage intrusion capabilities.