Syncro

ATP Sandbox Adv. HeuristicsNetskope IPS

Description

Syncro is a legitimate remote management tool that cyberattackers can abuse.

Stats

First seen: November 2024
Last seen: September 2026

Alert name variants

Alert Name	Engine
Binary.Trojan.Syncro	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Syncro	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC UNC3313.SYNCRO data exfiltration outbound traffic detected	IPS-SWG
MALWARE-CNC UNC3313.SYNCRO data exfiltration response inbound traffic detected	IPS-SWG
MALWARE-CNC Win.SYNCRO C2 authentication response inbound detected	IPS-SWG
MALWARE-CNC Win.SYNCRO C2 device-state beacon inbound detected	IPS-SWG
MALWARE-CNC Win.SYNCRO C2 device-state beacon outbound detected	IPS-SWG
MALWARE-CNC Win.SYNCRO C2 initial authentication outbound detected	IPS-SWG
MALWARE-CNC Win.SYNCRO defense evasion addon update detected	IPS-SWG
MALWARE-CNC Win.SYNCRO.UNC3313 C2 config inbound detected	IPS-SWG
MALWARE-CNC Win.SYNCRO.UNC3313 C2 sync outbound detected	IPS-SWG
MALWARE-CNC Win.Trojan.Syncro policy retrieval inbound detected	IPS-SWG
MALWARE-CNC Win.Trojan.Syncro policy retrieval outbound detected	IPS-SWG
MALWARE-CNC Win.Trojan.Syncro UNC3313 implant update feed inbound	IPS-SWG
MALWARE-CNC Win.Trojan.Syncro UNC3313 implant update-check outbound	IPS-SWG

Related blogs

Cloud Threats Memo: State-sponsored Threat Actors Continue to Abuse Legitimate Cloud Services

December 19, 20222 min read