[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQyvmuusX53x8QhovmhVMtSDTBKB6o3LlUKiAWKVoZ7A":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":11,"target_industries":12,"target_countries":15,"incident_types":35,"references":37,"techniques":38,"technique_count":39,"created_at":40,"seoMetadata":41,"schemaOrg":45},"Sandman APT","sandman-apt",[],"First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866\u002FRed Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.","CN","China",[13,14],"Government","Telecommunications",[16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"Middle East","Southeast Asian","France","Egypt","Sudan","South Sudan","Libya","Turkey","Saudi Arabia","Oman","Yemen","Sri Lanka","India","Pakistan","Iran","Afghanistan","Kuwait","Iraq","United Arab Emirates",[36],"Espionage",[],[],0,"2023-12-19T02:15:02.747915+00:00",{"title":42,"metaDescription":43,"keywords":44},"Sandman APT Threat Actor Profile | Precursor Intelligence","First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifi...","Sandman APT, threat actor, APT, cyber threat, threat intelligence, Government, Telecommunications, China, CN",{"@context":46,"@type":47,"name":6,"alternateName":48,"description":9,"url":49,"mainEntityOfPage":50,"location":52},"https:\u002F\u002Fschema.org","Organization",[],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fsandman-apt",{"@type":51,"@id":49},"WebPage",{"@type":53,"name":10},"Country"]