CYBERSECURITYTRACKER
Permanent story citation

Update to the REF2924 intrusion set and related campaigns

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7941

As cited

Copy frozen at (site build).

threat intel

Update to the REF2924 intrusion set and related campaigns

Elastic Security Labs published updated findings on the REF2924 intrusion set, expanding on research originally released in December 2022 with new malware analysis, additional discoveries, and connections to related intrusions.

Why it matters: Security teams tracking advanced persistent threats need current intelligence on REF2924 campaigns and their tooling to detect and respond to associated attacks in their environment.

Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary