SOA
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2014-09-23
- Last seen
- 2014-09-23
- Updated
- 2026-10-17 11:51
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
SOA, also known by its alias SOA, is a threat actor based in the United States of America. The actor has been observed using a watering hole approach, compromising the legitimate jQuery website to inject malicious code that redirects visitors to exploit kits delivering credential‑stealing malware. This technique targets privileged enterprise IT accounts, aiming to harvest authentication details for lateral movement within corporate networks. No public attribution to a state sponsor or criminal consortium has been made. The September 2014 jQuery compromise represents a representative campaign illustrating the actor’s focus on supply‑chain‑style initial access and credential harvesting.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.