# ProjectSauron: threat group profile

> ProjectSauron is an espionage group thought to operate from United States, with suspected state backing. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/projectsauron
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > ProjectSauron

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 6 |
| Thought to operate from | United States |
| Suspected backing | United States |
| Motive | Espionage |
| Other names | 4 |
| Public reports | 5 |

## Who is ProjectSauron?

ProjectSauron is an espionage group thought to operate from United States, with suspected state backing. Public reporting about it is still limited.

### Also known as

Strider, Sauron, Project Sauron, G0041

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods.  Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes. As such, all artifacts are customized per given target, reducing their value as indicators of compromise for any other victim.  Usually APT campaigns have a geographical nexus, aimed at extracting information within a specific region or from a given industry. That usually results in several infections in countries within that region, or in the targeted industry around the world. Interestingly, ProjectSauron seems to be dedicated to just a couple of countries, focused on collecting high value intelligence by compromising almost all key entities it could possibly reach within the target area.  The name, ProjectSauron reflects the fact that the code authors refer to ‘Sauron’ in the Lua scripts.

## Who does ProjectSauron go after?

**Sectors:** Government, Military

**Countries and victims named:** Russia, Iran, Belgium, China, Sweden, Rwanda

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about ProjectSauron

- https://securelist.com/analysis/publications/75533/faq-the-projectsauron-apt/
- https://www.cfr.org/interactive/cyber-operations/project-sauron
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf
- https://attack.mitre.org/groups/G0041/

## Frequently asked questions

### Who is ProjectSauron?

ProjectSauron is an espionage group thought to operate from United States, with suspected state backing. Public reporting about it is still limited.

### Where is ProjectSauron thought to be based?

Public reporting places ProjectSauron as operating from United States, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does ProjectSauron target?

In public reporting, sectors named include government and military, and 6 countries and victims are named, including Russia, Iran, Belgium and China.

### How do I know if ProjectSauron is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact