SIGHTGRAB
SIGHTGRAB is a Windows executable written in C that captures and stages stolen data on victim devices.[1] SIGHTGRAB was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1119 | Automated Collection |
SIGHTGRAB has autonomously captured screen shots at regular intervals.[1] |
|
| Enterprise | T1005 | Data from Local System |
SIGHTGRAB has captured and staged stolen data in folders named using a captured timestamp in the format of YYYY-MM-DD-HH-MM.[1] |
|
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
SIGHTGRAB has saved captured screenshots of victim devices to |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | ||
| Enterprise | T1106 | Native API |
SIGHTGRAB has leveraged Windows Native API keys to execute functions to include |
|
| Enterprise | T1027 | .013 | Obfuscated Files or Information: Encrypted/Encoded File |
SIGHTGRAB has used XOR encrypted strings with a single-byte key of 0x41.[1] |
| Enterprise | T1113 | Screen Capture |
SIGHTGRAB has captured screenshots of victim devices and has saved them incrementally within created folders.[1] |
|
| Enterprise | T1124 | System Time Discovery |
SIGHTGRAB has gathered the compromised victims time to be used in the naming conventions of created folders.[1] |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1059 | NIMBUS MANTICORE |
SIGHTGRAB has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1] |