SaintBear__2021__Analysis-Report-on-Lorec53-Group.pdf

NSFOCUS Security Labs presents a detailed assessment of the Lorec53 APT group, covering its formation, objectives, operational characteristics, and a chronology of attacks from March to July 2021 that combine spear-phishing, watering-hole exploits, and malware delivery (including LorecCPL, LorecDocStealer, and smokeloader) against Georgian and Ukrainian targets, illustrating the group’s use of compromised infrastructure and cross-actor techniques to enhance reach.