InfoSecBulletin Cybersecurity for mankind
SentinelLabs and QGroup GmbH have conducted a joint investigation, revealing the presence of an enigmatic APT group. This group has set its sights on telco service providers in Europe and Asia, indicating an extensive cyberespionage endeavor.
SentinelLabs researcher Aleksandar Milenkoski says that a secretive APT group is using a complex modular backdoor. The backdoor is built on Lua, a programming language used mainly in embedded applications.
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
Sandman has developed a new type of backdoor called LuaJIT platform. This is not commonly seen in cyber threats. The whole operation is careful and deliberate, with minimal and calculated actions within infected networks. The main objective is to minimize the chances of being detected.
Sandman, an advanced threat actor, has recently been observed targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent.
At the LABScon security conference, Milenkoski revealed that his group utilizes a malware known as LuaDream. This malware can extract system and user information, enabling more precise attacks.
“The implementation of LuaDream indicates a well-execuThe SentinelLabs researcher mentioned that the APT group behind this project is difficult to identify. However, they emphasized that the project is well-established, maintained, and actively developed on a large scale.
The fact that we have identified 36 unique LuaDream components and the project supports multiple protocols for C2 communication imply that this is a large-scale project. The LuaDream staging chain is expertly crafted to elude detection and counter analysis, effortlessly deploying the malware to memory,” he concluded.
SentinelLabs has confirmed that the LuaDream malware does not contain any backdoor capabilities targeting the LuaJIT platform. The threat actor leverages LuaJIT as a means to seamlessly infiltrate targeted organizations with backdooMilenkoski stated that even though the data shows that telcos in different parts of the world are being targeted by a cyberespionage group, LuaDream cannot be linked to any specific threat actor. This suggests that LuaDream may be the result of a hacker-for-hire service.dor.
SentinelLabs researchers also called attention to the use of the Lua programming language, noting that the use of LuaJIT in the context of APT malware is very rare.
In the past, threat hunters have seen highly modular, Lua-utilizing malware associated with high-end APTs like Flame, Animal Farm and Project Sauron, but the Sandman APT discovery suggests the developmental paradigm has trickled down to a broader set of actors, SentinelLabs researchers posited at the conference.
The LuaDream malware is similar to another malware called “DreamLand”. Kaspersky discovered this similarity in March 2023 while investigating APT activities against a government entity in Pakistan.
According to Milenkoski, these correlations suggest the existence of a potential wider campaign, indicating that Sandman’s actions may go as far back as 2022.
