Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
9
techniques
2
software
10,060
corpus matches
profile
Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015.
techniques
9 attributed · most-instrumented first
software
2 malware & tools attributed
Felismus
S0171
Starloader
S0188
read this carefully
10,060 corpus matches is not attribution
That count is indicators which exhibit techniques Sowbug is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
collection · credential-access
showing 30 of 10,060