Suckfly

Overview

Suckfly is a China-based threat group that has been active since at least 2014.

Naming & attribution

Suckfly is tracked under 1 names across the industry. It uses 5 documented ATT&CK techniques — more than 13% of the 174 groups tracked here. Activity attributed since at least 2014.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• INC Ransom — 3 shared techniques (11% overlap)
• FIN6 — 4 shared techniques (10% overlap)
• Silence — 3 shared techniques (10% overlap)
• menuPass China — 4 shared techniques (9% overlap)
• GALLIUM China — 3 shared techniques (9% overlap)
• BlackByte — 4 shared techniques (8% overlap)

TTPs — 5 techniques across 5 tactics

Tools & malware (1)

Nidiran

Reporting (2)

• Indian organizations targeted in Suckfly attacks — DiMaggio, J
• Suckfly: Revealing the secret life of your code signing certificates — DiMaggio, J