[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuc-O94t-srtQUQHp_ccEHN2qk-J7T4iP76xN7vpjSPU":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":11,"target_industries":12,"target_countries":13,"incident_types":14,"references":15,"techniques":17,"technique_count":18,"created_at":19,"seoMetadata":20,"schemaOrg":24},"Tstark","tstark",[],"TStark is a threat actor identified by X-Ops, associated with a cluster of devices that executed the bookmark buffer overflow exploit targeting CVE-2020-15069 (T1203). The actor exhibited odd telemetry behavior indicative of intermittent VPN usage, switching between IP addresses geolocated to Hong Kong and Chengdu. Analysis revealed malware samples for Mac OS X and iOS, as well as IFRAME injection code exploiting a WebAssembly vulnerability (T1189). Additionally, TStark was linked to the development of libsophos.so and the deployment of malicious payloads across their devices.","CN",null,[],[],[],[16],"https:\u002F\u002Fnews.sophos.com\u002Fen-us\u002F2024\u002F10\u002F31\u002Fpacific-rim-timeline\u002F",[],0,"2024-11-14T02:15:06.198877+00:00",{"title":21,"metaDescription":22,"keywords":23},"Tstark Threat Actor Profile | EdgeProtect","TStark is a threat actor identified by X-Ops, associated with a cluster of devices that executed the bookmark buffer overflow exploit targeting CVE-20...","Tstark, threat actor, APT, cyber threat, threat intelligence, CN",{"@context":25,"@type":26,"name":6,"alternateName":27,"description":9,"url":28,"mainEntityOfPage":29,"location":31},"https:\u002F\u002Fschema.org","Organization",[],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Ftstark",{"@type":30,"@id":28},"WebPage",{"@type":32,"name":10},"Country"]