Ankura CTIX FLASH Update - September 26, 2023

Malware Activity

New Report Details Activity of Previously Unknown Threat Actor "Sandman" and Associated "LuaDream" Backdoor

Researchers have observed new activity by a previously unknown threat actor targeting telecommunication providers in the Middle East, Western Europe, and the South Asian subcontinent in August 2023. The actor, dubbed Sandman, is currently not attributed to a specific origin and has been identified using a modular backdoor, now named "LuaDream", that is believed to be under active development. LuaDream is based on the LuaJIT platform, which is the "just-in-time compiler for the Lua scripting language." The malware's focus is to exfiltrate system and user data as well as manage actor-provided plugins. Although researchers interrupted the observed attack chain before plugins were deployed, they suspect that LuaDream has additional capabilities to do further damage. LuaDream is believed to be a variant of a new malware strain called