Sowbug — ATT&CK profile, 9 techniques

Overview

Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015.

Naming & attribution

It uses 9 documented ATT&CK techniques — more than 26% of the 174 groups tracked here. Activity attributed since at least 2015.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Sowbug	Symantec Security Response

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

admin@338 China — 4 shared techniques (24% overlap)
Darkhotel South Korea — 5 shared techniques (18% overlap)
APT18 China — 3 shared techniques (17% overlap)
APT5 China — 5 shared techniques (15% overlap)
RedCurl — 6 shared techniques (14% overlap)
APT1 China — 4 shared techniques (14% overlap)

Malware families with tracked indicators

One family attributed to Sowbug, with 15 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

StarLoader 15 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Government

Regions

Argentina · Brazil · Brunei · Ecuador · Malaysia · Peru

TTPs — 9 techniques across 5 tactics

Discovery

Collection

Tools & malware (2)

Starloader · Felismus

Reporting (1)

Sowbug: Cyber espionage group targets South American and Southeast Asian governments — Symantec Security Response