Researchers have observed new activity by a previously unknown threat actor targeting telecommunication providers in the Middle East, Western Europe, and the South Asian subcontinent in August 2023. The actor, dubbed Sandman, is currently not attributed to a specific origin and has been identified using a modular backdoor, now named “LuaDream”, that is believed to be under active development. LuaDream is based on the LuaJIT platform, which is the “just-in-time compiler for the Lua scripting language.” The malware’s focus is to exfiltrate system and user data as well as manage actor-provided plugins. Although researchers interrupted the observed attack chain before plugins were deployed, they suspect that LuaDream has additional capabilities to do further damage. LuaDream is believed to be a variant of a new malware strain called “DreamLand”; researchers stated that “the use of Lua-based malware is something of a rarity in the threat landscape, having been previously observed in only three different instances since 2012.” Researchers explained that the latest Sandman activities are “characterized by strategic lateral movement to specific targeted workstations and minimal engagement”, which suggests that the actor is using a specific approach to minimize the risk of detection. While the initial access vector is currently unclear, administrative credentials have been observed being exfiltrated and reconnaissance has been conducted to breach targeted machines as well as deploy LuaDream. Technical details as well as indicators of compromise (IOCs) associated to Sandman and LuaDream can be viewed in the report linked below.