Cyber Espionage Alert: LilacSquid Targets IT, Energy, and Pharma Sectors

LilacSquid is a previously undocumented cyber-espionage threat actor active since at least 2021, conducting a cross-regional data-theft campaign against IT, energy, and pharmaceutical sectors. The adversary uses exploited internet-facing vulnerabilities and compromised RDP credentials to establish long-term access, deploying MeshAgent and a custom Quasar-derived RAT (PurpleInk) via InkLoader/InkBox; recent variants simplify functionality to avoid detection. The campaign also uses SSF tunneling and shares multiple TTP overlaps with North Korean APTs such as Andariel/Lazarus.