TA505__2019__SectorJ04_Group_s_Increased_Activity_in_2019.pdf

SectorJ04's 2019 activity is analyzed, focusing on its shift from targeted operations to broader distribution across Europe, North America, and Asia, the deployment of multiple backdoor families (ServHelper, FlawedAmmy RAT, RMS RAT, AdroMut, FlowerPippi), and changes in infection chains (MSI, NSIS, SFX) with spear phishing. The report documents evolving spam methods, digital signatures used to authenticate malware, IoCs, and MITRE ATT&CK mappings, highlighting ongoing, sophisticated campaigns by a Russian-based cybercrime group targeting sectors from finance to healthcare.