BackdoorDiplomacy

Overview

BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.

Naming & attribution

BackdoorDiplomacy is tracked under 1 names across the industry. It uses 15 documented ATT&CK techniques — more than 43% of the 174 groups tracked here. Activity attributed since at least 2017.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• GALLIUM China — 8 shared techniques (21% overlap)
• Metador — 4 shared techniques (20% overlap)
• Whitefly — 4 shared techniques (20% overlap)
• INC Ransom — 6 shared techniques (18% overlap)
• Volatile Cedar — 3 shared techniques (18% overlap)
• FIN13 — 10 shared techniques (17% overlap)

Targets

Government · Telecommunications

Regions

Albania · Croatia · Georgia · Iran · Libya · Namibia · Poland · Qatar · Saudi Arabia · Sri Lanka · Sudan · Uzbekistan

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 15 techniques across 7 tactics

Tools & malware (5)

Turian · China Chopper · Mimikatz · NBTscan · QuasarRAT

Reporting (1)

• BackdoorDiplomacy: Upgrading from Quarian to Turian — Adam Burgher