Cybersecurity incident
Date: 2017-09-28 00:00:00
Affected organization: International Security and Arms Control Department, Ministry of Foreign Affairs
Affected country: Belarus
Industry: Public Administration
Event type: Exploitive
Event subtype: Exploitation of End Hosts
Motive: Political-Espionage
Actor: Undetermined
Actor type: Criminal
Actor country: Undetermined
Description: A threat actor targeted the government of Belarus for espionage purposes, using a tool known as Travle or PYLOT, which is believed to be an update of malware used by NetTraveler. Between June and August the threat actor sent a total of 20 unique emails to various government entities. The emails contained a series of subject lines revolving around Zapad-2017, a joint exercise between the Russian and Belarusian militaries.