Luckycat
Luckycat is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Civil Society and NGOs sector. It uses 7 MITRE ATT&CK techniques.
- Techniques
- 7
- Exploited CVEs
- No CVE data
- First seen
- Apr 16, 2012
- Last seen
- Apr 16, 2012
- Record updated
Who They Target.
Sectors · 1
How They Operate · MITRE ATT&CK.
7 techniques across 5 of 14 tacticsReconnaissance1
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
Resource Development·
Initial Access3
T1189
Drive-by Compromise
Drive-by Compromise
T1203
Exploitation for Client Execution
Exploitation for Client Execution
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
Execution·
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access·
Discovery1
T1083
File and Directory Discovery
File and Directory Discovery
Lateral Movement·
Collection1
T1005
Data from Local System
Data from Local System
Command and Control·
Exfiltration1
T1041
Exfiltration Over C2 Channel
Exfiltration Over C2 Channel
Impact·
Arsenal · Malware And Tools.
- SabPubmalware
Indicators Of Compromise.
TLP:AMBER1 indicator on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Luckycat.
An advanced persistent threat entity responsible for targeted espionage operations utilizing both Windows-based tools and Mac OS X backdoors such as SabPub and MaControl.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.