Threat ActorSweet Specter
Description
Sweet Specter is a group with alleged ties to The People's Republic of China. In October of 2024, a report by OpenAI documented Sweet Specter trying to spear phish OpenAI employees to install the SugarGh0st RAT as well as using ChatGPT for vulnerability research and scripting assistance. Ultimately their goal was to exfiltrate information for corporate espionage.
Sweet Specter is believed to be affiliated with APT27 (Iron Taurus), Twill Typhoon (Stately Taurus), and Leopard Typhoon.
Common Vulnerabilities and Exposures
Targeted Industries
- Artificial Intelligence
- Government
Objectives
Exfiltration of data on Artifical Intelligence companies, corporate espionage.
Known Tools Used
- SugarGh0st RAT
- Sweet Specter
- Tunnel Specter
Known Infection Vectors
- CVE-2021-26855 (ProxyLogon)
- CVE-2021-34473 (ProxyShell)
References
Influence and cyber operations: an update (OpenAI)
https://cdn.openai.com/threat-intelligence-reports/influence-and-cyber-operations-an-update_October-2024.pdf
