BackdoorDiplomacy is a cyber espionage group first observed to be active since at least 2017, focusing its operations primarily on diplomatic entities and telecommunication companies. The group is widely believed to be associated with China, and its core motivation is intelligence gathering and the exfiltration of sensitive information for strategic interests. A key distinguishing characteristic of BackdoorDiplomacy is its consistent exploitation of internet-exposed applications for initial access, followed by the deployment of custom backdoors like Turian, which is an evolution of the older Quarian backdoor. The group also actively scans for and steals data from removable media such as USB drives. BackdoorDiplomacy is also tracked under the aliases CloudComputating and Calypso, and its Turian backdoor shares similarities with Whitebird, used by the Calypso group.

Aliases del actor

BackDipCloudComputatingQuarianTurian