Thrip

Overview

Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques.

Naming & attribution

Thrip is tracked under 1 names across the industry. It uses 4 documented ATT&CK techniques — more than 9% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT33 Iran — 3 shared techniques (9% overlap)
• Storm-1811 — 3 shared techniques (9% overlap)
• FIN8 — 3 shared techniques (8% overlap)
• FIN6 — 3 shared techniques (7% overlap)
• Mustang Panda China — 4 shared techniques (5% overlap)
• Contagious Interview North Korea — 3 shared techniques (5% overlap)

Targets

Private sector

Regions

United States

TTPs — 4 techniques across 4 tactics

Tools & malware (3)

PsExec · Mimikatz · Catchamas

Reporting (1)

• Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies — Security Response Attack Investigation Team