Suckfly APT

Type: Cyber espionage/ Cyber criminal

Status: Active

Active Since/Discovered: 2014/2015

Last Report: June 2016

Targets: US, India, Saudi Arabia

Target Sectors: Healthcare, government, IT


  • At least 45 hacking tools and custom malware
  • Backdoor.Nidiran
  • Backdoor.Nidiran!g1
  • Hacktool
    • Password theft, reconnaissance and lateral movement

Preferred Attack Vector:  Spear phishing, Watering hole attacks and exploits


  • CVE-2014-6332
  • Custom malware signed with authentic code-signing certificates
  • Credential theft


  • Known for stealing code-signing certificates
  • Uses many of the same malware delivery techniques as the PlugX and Korplug campaigns
  • May be associated with Blackfly
Privacy Settings
We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
Consent to display content from Youtube
Consent to display content from Vimeo
Google Maps
Consent to display content from Google