{
	"id": "d1d730bb-cdcb-498d-a0e8-8c7942aa7989",
	"created_at": "2026-04-06T00:14:07.242275Z",
	"updated_at": "2026-04-10T13:12:48.326132Z",
	"deleted_at": null,
	"sha1_hash": "9b9c639527fe02a622a9559e1a612c4628da4c49",
	"title": "Syrian Electronic Army (SEA), Deadeye Jackal",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 58997,
	"plain_text": "Syrian Electronic Army (SEA), Deadeye Jackal\r\nArchived: 2026-04-05 22:45:21 UTC\r\nHome \u003e List all groups \u003e Syrian Electronic Army (SEA), Deadeye Jackal\r\n APT group: Syrian Electronic Army (SEA), Deadeye Jackal\r\nNames\r\nSyrian Electronic Army (self given)\r\nSyria Malware Team (self give)\r\nDeadeye Jackal (CrowdStrike)\r\nATK 196 (Thales)\r\nTAG-CT2 (Recorded Future)\r\nCountry Syria\r\nMotivation Information theft and espionage\r\nFirst seen 2011\r\nDescription (Qihoo 360) In April 2011, only days after anti-regime protests escalated in Syria,\r\nSyrian Electronic Army (SEA) emerged on Facebook to support the government’s\r\nSyrian President Bashar al-Assad. In May 5, 2011 the Syrian Computer Society\r\nregistered SEA’s website (syrian-es.com). Because Syria's domain registration\r\nauthority registered the hacker site, some security experts have written that the group\r\nwas supervised by the Syrian state. SEA claimed on its webpage to be no official\r\nentity, but 'a group of enthusiastic Syrian youths who could not stay passive towards\r\nthe massive distortion of facts about the recent uprising in Syria'. As soon as May\r\n27, 2011 SEA had removed text that denied it was an official entity. On the new\r\npage, the description of 'not an official entity' was removed, only says that it was\r\nestablished by a group of young Syrian enthusiasts to combat the use of the Internet,\r\nespecially people that use of Facebook in Syria to 'spread hatred' and 'destroy peace'.\r\nThe Syrian Electronic Army uses spam, website defacement, malware, phishing and\r\ndenial of service attacks against political opposition groups, Western news agencies,\r\nhuman rights groups and seemingly neutral websites for Syrian conflicts. It also\r\nattacked government websites in the Middle East and Europe as well as US defense\r\ncontractors. The Syrian Electronic Army is the first Arab organization to set up a\r\npublic Internet army on its national network to openly launch cyber-attacks on its\r\nenemies.\r\nSyrian Electronic Army has 2 subgroups:\r\n1. Subgroup: Goldmouse, APT-C-27\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=0f16cba0-5b7f-449b-95a6-0ca000e9a63e\r\nPage 1 of 2\n\n2. Subgroup: Pat Bear, APT-C-37\nObserved\nSectors: Defense, Government, High-Tech, Media, Retail, Telecommunications and\ndissidents.\nCountries: Canada, France, UK, USA and Middle East.\nTools used AndoServer, SandroRAT, SilverHawk, SLRat, SpyNote RAT.\nOperations performed\nMid 2016\nIn recent years, the group has seemingly kept a low profile, but the\nSEA hasn't ceased activity: it's altered tactics and is now delivering\ncustom Android malware to opponents of the Assad regime for the\npurposes of surveillance.\nJan 2018\nLookout researchers have uncovered a long-running surveillance\ncampaign tied to Syrian nation-state actors, which recently started\nusing the novel coronavirus as its newest lure to entice its targets to\ndownload malware.\nCounter operations\nMay 2018\nTwo Members of Syrian Electronic Army Indicted for Conspiracy\nAug 2021\nTaking Action Against Hackers in Pakistan and Syria\nInformation\nLast change to this card: 26 December 2021\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=0f16cba0-5b7f-449b-95a6-0ca000e9a63e\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=0f16cba0-5b7f-449b-95a6-0ca000e9a63e\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=0f16cba0-5b7f-449b-95a6-0ca000e9a63e"
	],
	"report_names": [
		"showcard.cgi?u=0f16cba0-5b7f-449b-95a6-0ca000e9a63e"
	],
	"threat_actors": [
		{
			"id": "2f498e6b-3f0e-4f26-8cc7-52121e675643",
			"created_at": "2023-01-06T13:46:38.447274Z",
			"updated_at": "2026-04-10T02:00:02.978901Z",
			"deleted_at": null,
			"main_name": "Deadeye Jackal",
			"aliases": [
				"SyrianElectronicArmy"
			],
			"source_name": "MISPGALAXY:Deadeye Jackal",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "76fc6d92-0710-4640-bfa7-3000fe3940a5",
			"created_at": "2022-10-25T16:07:24.251595Z",
			"updated_at": "2026-04-10T02:00:04.911951Z",
			"deleted_at": null,
			"main_name": "Syrian Electronic Army (SEA)",
			"aliases": [
				"ATK 196",
				"Deadeye Jackal",
				"Syria Malware Team",
				"Syrian Electronic Army",
				"TAG-CT2"
			],
			"source_name": "ETDA:Syrian Electronic Army (SEA)",
			"tools": [
				"AndoServer",
				"CypherRat",
				"SLRat",
				"SandroRAT",
				"SilverHawk",
				"SpyNote",
				"SpyNote RAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c2cc9aa5-1853-4de1-8849-cb3f28c7728e",
			"created_at": "2022-10-25T16:07:24.256045Z",
			"updated_at": "2026-04-10T02:00:04.912815Z",
			"deleted_at": null,
			"main_name": "Goldmouse",
			"aliases": [
				"APT-C-27",
				"ATK 80",
				"Golden Rat",
				"Goldmouse"
			],
			"source_name": "ETDA:Goldmouse",
			"tools": [
				"Bladabindi",
				"GoldenRAT",
				"Jorik",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2c385a7d-0217-46d8-a451-29ac6fe58aaf",
			"created_at": "2023-01-06T13:46:38.937468Z",
			"updated_at": "2026-04-10T02:00:03.151838Z",
			"deleted_at": null,
			"main_name": "APT-C-27",
			"aliases": [
				"Golden RAT",
				"ATK80",
				"GoldMouse"
			],
			"source_name": "MISPGALAXY:APT-C-27",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0769c188-62ce-44ee-8e9d-1067f3d3c083",
			"created_at": "2022-10-25T16:07:24.259063Z",
			"updated_at": "2026-04-10T02:00:04.913621Z",
			"deleted_at": null,
			"main_name": "Pat Bear",
			"aliases": [
				"APT-C-37",
				"Pat Bear",
				"Racquet Bear"
			],
			"source_name": "ETDA:Pat Bear",
			"tools": [
				"Bladabindi",
				"CypherRat",
				"DroidJack",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Iniduoh",
				"Jenxcus",
				"Jorik",
				"Kognito",
				"Njw0rm",
				"SSLove RAT",
				"SpyNote",
				"SpyNote RAT",
				"WSHRAT",
				"dinihou",
				"dunihi",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434447,
	"ts_updated_at": 1775826768,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9b9c639527fe02a622a9559e1a612c4628da4c49.pdf",
		"text": "https://archive.orkl.eu/9b9c639527fe02a622a9559e1a612c4628da4c49.txt",
		"img": "https://archive.orkl.eu/9b9c639527fe02a622a9559e1a612c4628da4c49.jpg"
	}
}