Threat actor
threat_actor:tstark
Threat-actor handle associated with exploit development, trial firewalls, malware experimentation, and the development of multiple attacks.
Threat-actor handle associated with exploit development, trial firewalls, malware experimentation, and the development of multiple attacks.
“we had a guy who used the handle of TStark”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | libxselinux.so | Explicit | 174 |
| outgoing | EXPLOITS | WebAssembly vulnerability | Explicit | 174 |
| outgoing | USES | UEFI bootkit | Uncertain | 174 |
TStark USES libxselinux.so
TStark was observed developing and using the libxselinux.so userland rootkit on a threat-actor device.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We found him working on a rootkit at the time. It was called libxselinux.so”
TStark EXPLOITS WebAssembly vulnerability
TStark was associated with exploiting a previously unknown WebAssembly vulnerability that injected an iframe into proxies.
Explicit Confidence 97% · Craig Jones EP 174 Details
“he’s got a completely new injection there, like a new vulnerability in web assembly”
TStark USES UEFI bootkit
TStark's group was observed experimenting with a UEFI bootkit on a firewall, although the attempt failed and bricked the device.
Uncertain Confidence 92% · Andrew Brandt EP 174 Details
“They were really trying to figure out if they could get this bootkit to run on a firewall”