# Sowbug: threat group profile

> Sowbug is an espionage group with suspected backing from Unknown. Public reporting links it to 9 attack techniques, and to attacks on government organisations, with 6 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/sowbug
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > Sowbug

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 9 (plus 4 sub-techniques) |
| Countries and victims named | 6 |
| Thought to operate from | Not known |
| Suspected backing | Unknown |
| Motive | Espionage |
| Other names | 1 |
| Public reports | 3 |

## Who is Sowbug?

Sowbug is an espionage group with suspected backing from Unknown. Public reporting links it to 9 attack techniques, and to attacks on government organisations, with 6 countries and victims named.

### Also known as

G0054

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Sowbug has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets. Sowbug has been seen mounting classic espionage attacks by stealing documents from the organizations it infiltrates.

## How does Sowbug attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 9 linked to Sowbug. Some techniques belong to more than one stage. Public reporting also lists 4 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (0)

- None linked in public reporting.

### 3. Getting in (0)

- None linked in public reporting.

### 4. Running code (1)

- T1059: Command and Scripting Interpreter

### 5. Staying in (0)

- None linked in public reporting.

### 6. Taking control (0)

- None linked in public reporting.

### 7. Hiding (1)

- T1036: Masquerading

### 8. Disabling defences (0)

- None linked in public reporting.

### 9. Stealing passwords (2)

- T1003: OS Credential Dumping
- T1056: Input Capture

### 10. Looking around (3)

- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1135: Network Share Discovery

### 11. Spreading (0)

- None linked in public reporting.

### 12. Gathering data (3)

- T1039: Data from Network Shared Drive
- T1056: Input Capture
- T1560: Archive Collected Data

### 13. Keeping contact (0)

- None linked in public reporting.

### 14. Taking data out (0)

- None linked in public reporting.

### 15. Causing damage (0)

- None linked in public reporting.

## Who does Sowbug go after?

**Sectors:** Government

**Countries and victims named:** Argentina, Ecuador, Brazil, Brunei, Peru, Malaysia

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about Sowbug

- https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments
- https://www.cfr.org/interactive/cyber-operations/sowbug
- https://attack.mitre.org/groups/G0054/

## Frequently asked questions

### Who is Sowbug?

Sowbug is an espionage group with suspected backing from Unknown. Public reporting links it to 9 attack techniques, and to attacks on government organisations, with 6 countries and victims named.

### Where is Sowbug thought to be based?

Public reporting places Sowbug as a group with suspected backing from Unknown. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Sowbug target?

In public reporting, sectors named include government, and 6 countries and victims are named, including Argentina, Ecuador, Brazil and Brunei.

### How does Sowbug attack?

Public reporting links Sowbug to 9 attack techniques. Most of them are about looking around, gathering data and stealing passwords.

### How do I know if Sowbug is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact