Hello everyone and welcome to the CyberWire's Research Saturday.

I'm Dave Bitner and this is our weekly conversation with researchers and analysts

tracking down threats and vulnerabilities,

and solving some of the hard problems of protecting ourselves in a rapidly evolving

cyberspace.

Thanks for joining us. Seedworm is a

a group that we have been following since 2017.

That's Al Kooli, he's director of product management at Symantec.

The research we're discussing today is titled Seed Worm.

Group Compromises Government agencies, oil and gas,

NGOs, telecoms, and IT firms.

We have a regular list of cyber adversaries

that as a intelligence organization we track and monitor and

seedworm is amongst them and I suspect I don't recall back early 2007 how we first started on the tracking of seed worm.

But typically we have proactive threat hunting activities that we undertake as an intelligence

organization where we go out and both look to update the profiles of cyber actors we follow as well as discover new ones and I suspect that's how they

came on our radar through one of our regular hunting activities.

Yeah well let's dig into some of the specifics here about Seed Worm and the specific things

that you all outline in this publication here.

In this particular case, how did they catch your attention?

This is kind of interesting. They actually caught our attention as part of one of the activities I just talked about, which is regularly updating our profile of APT 28, which is a group that is of high interest to many of our customers.

So we routinely seek out changes in their activity.

...