# VICEROY TIGER: threat group profile

> VICEROY TIGER is a threat group thought to operate from India. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/viceroy-tiger
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > VICEROY TIGER

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 1 |
| Thought to operate from | India |
| Other names | 5 |
| Public reports | 12 |

## Who is VICEROY TIGER?

VICEROY TIGER is a threat group thought to operate from India. Public reporting about it is still limited.

### Also known as

OPERATION HANGOVER, Donot Team, APT-C-35, SectorE02, Orange Kala

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> VICEROY TIGER is an adversary with a nexus to India that has historically targeted entities throughout multiple sectors. Older activity targeted multiple sectors and countries; however, since 2015 this adversary appears to focus on entities in Pakistan with a particular focus on government and security organizations. This adversary consistently leverages spear phishing emails containing malicious Microsoft Office documents, malware designed to target the Android mobile platform, and phishing activity designed to harvest user credentials. In March 2017, the 360 Chasing Team found a sample of targeted attacks that confirmed the previously unknown sample of APT's attack actions, which the organization can now trace back at least in April 2016. The chasing team named the attack organization APT-C-35. In June 2017, the 360 Threat Intelligence Center discovered the organization’s new attack activity, confirmed and exposed the gang’s targeted attacks against Pakistan, and analyzed in detail. The unique EHDevel malicious code framework used by the organization.

## Who does VICEROY TIGER go after?

**Countries and victims named:** Germany

See threats by industry: https://www.edgeprotect.io/industries

## Public reports about VICEROY TIGER

- https://github.com/jack8daniels2/threat-INTel/blob/master/2013/Unveiling-an-Indian-Cyberattack-Infrastructure-appendixes.pdf
- https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/
- https://www.netscout.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia
- https://ti.360.net/blog/articles/donot-group-is-targeting-pakistani-businessman-working-in-china-en/
- https://www.crowdstrike.com/blog/viceroy-tiger-delivers-new-zero-day-exploit/index.html
- https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/
- https://unit42.paloaltonetworks.com/threat-assessment-hangover-threat-group/
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
- https://blog.cyble.com/2021/07/22/donot-apt-group-delivers-a-spyware-variant-of-chat-app/
- https://adversary.crowdstrike.com/en-US/adversary/viceroy-tiger
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html

## Frequently asked questions

### Who is VICEROY TIGER?

VICEROY TIGER is a threat group thought to operate from India. Public reporting about it is still limited.

### Where is VICEROY TIGER thought to be based?

Public reporting places VICEROY TIGER as operating from India. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does VICEROY TIGER target?

In public reporting, 1 countries and victims are named, including Germany.

### How do I know if VICEROY TIGER is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact