[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frW0f4pbf3wye-00fX4E3BzvgE8u22lJEZ888n7k2GcQ":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":10,"target_industries":11,"target_countries":12,"incident_types":13,"references":14,"techniques":16,"technique_count":17,"created_at":18,"seoMetadata":19,"schemaOrg":23},"Lancefly","lancefly",[],"Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia. They use a custom backdoor named Merdoor, developed since 2018, and employ various tactics to gain access, including phishing emails, SSH credential brute-forcing, and exploiting server vulnerabilities. Additionally, Lancefly has been observed using a newer version of the ZXShell rootkit and tools like PlugX and ShadowPad RAT, which are typically associated with Chinese-speaking APT groups.",null,[],[],[],[15],"https:\u002F\u002Fsymantec-enterprise-blogs.security.com\u002Fblogs\u002Fthreat-intelligence\u002Flancefly-merdoor-zxshell-custom-backdoor",[],0,"2023-11-05T02:15:02.959887+00:00",{"title":20,"metaDescription":21,"keywords":22},"Lancefly Threat Actor Profile | EdgeProtect","Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia. They use a custom backdoor named Merdoor, developed sinc...","Lancefly, threat actor, APT, cyber threat, threat intelligence",{"@context":24,"@type":25,"name":6,"alternateName":26,"description":9,"url":27,"mainEntityOfPage":28},"https:\u002F\u002Fschema.org","Organization",[],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Flancefly",{"@type":29,"@id":27},"WebPage"]