2023 Activities Summary of SectorJ groups (ENG)

Activity of SectorJ Group

Unlike other government-supported hacking groups, cybercrime SectorJ hacking groups steal online information that have monetary value in real life, hack specific companies and organizations to disseminate ransomwares in the intranet, or steal important industrial confidential information and demand for ransom in return.

Among the SectorJ hacking groups, activities by a total of 78 subgroups were identified in 2023, with the activity of SectorJ94 group being the most prominent.

[Figure 1: Statistics of Activities of Top 30 SectorJ Groups identified in 2023]

SectorJ hacking groups identified in 2023 carried out the highest number of attacks on workers and systems in government agencies, followed by financial sectors.

[Figure 2: Statistics of Industries Targeted in 2023]

The following map illustrates the countries targeted by SectorJ groups in 2023, with darker shades of red indicating higher frequencies of attacks. This shows that SectorJ Group conducted the most hacking activities on the United States, located in the North American continent.

[Figure 3: Countries Targeted by SectorJ Group in 2023]

Initial Access Route of SectorJ Group

Among the initial access routes used by SectorJ groups, Exploit Public-Facing Application was found to be the most prominently used access route used in 2023.

Cyber Crime hacking groups like Sector are confirmed to have utilized exploit attacks on public-facing systems as the initial penetration pathway to conduct widespread cyberattack activities targeting systems affected by specific vulnerabilities, rather than targeting specific individuals or organizations.

[Figure 4: Statistics of Initial Access Routes used by SectorJ Groups]

Vulnerabilities Exploited by SectorJ Group

Among the top 5 vulnerabilities exploited by SectorJ groups, CVE-2020-1472 (Microsoft Netlogon Privilege Escalation Vulnerability) and CVE-2023-34362 (MOVEit Transfer SQL Injection Vulnerability) were most prominently exploited in 2023.

SectorJ group is confirmed to have extensively utilized the CVE-2020-1472 (Microsoft Netlogon Privilege Escalation Vulnerability) due to its ability to secure persistence, evade detection, acquire privileges for accessing sensitive data, and perform lateral movement, thus potentially spreading the scope of damage.
Additionally, the group exploited CVE-2023-34362 (MOVEit Transfer SQL Injection Vulnerability), enabling them to steal sensitive data through attacks on externally accessible web applications or gain access to the target’s internal network. This access can be leveraged for various attacks such as ransomware deployment, cryptocurrency mining.

[Figure 5: Statistics of Top 5 Vulnerabilities Exploited by SectorJ Group in 2023]



Target System


Privilege Escalation Vulnerability

Microsoft Netlogon


SQL Injection Vulnerability

MOVEit Transfer


Remote Code Execution Vulnerability

Microsoft Windows Search


Remote Code Execution Vulnerability

Apache Log4j2


Privilege Escalation Vulnerability

MOVEit Transfer

[Table 1: Top 5 Vulnerabilities Exploited by SectorJ Group in 2023]

SectorJ Group Attack Target Systems Statistics

Software vulnerabilities are typically categorized into server and client types. Hacking groups, strategically positioned at the heart of networks, exploit vulnerabilities within server systems to facilitate further attacks on internal networks.

Among the top 5 attack target systems by SectorJ groups, the greatest number of attacks were carried out on the Oracle WebLogic Server, the web application server in 2023.

This is believed to be aimed at establishing a foothold to infiltrate internal organizational systems and for the purpose of exfiltrating high-value information, thus making server-type systems the primary target of the attacks.

[Figure 6: Statistics of Top 5 Attack Target Systems of SectorJ Group in 2023]

Open Source and Freeware Tools Utilized by SectorJ Group

Among the top 5 open source and freeware tools utilized by SectorJ groups, the penetration testing tool “Cobalt Strike” was identified as the most frequently used tool in 2023.

It is analyzed that Cobalt Strike was most utilized due to its ability to efficiently control targets through various functions such as privilege escalation, information exfiltration, and command and control (C2) communication.

[Figure 7: Statistics of Top 5 Open Source and Freeware Tool used by SectorJ Group in 2023]

Tool Name


Cobalt Strike

Penetration Testing Tool


Remote Execution Program


Remote Control Program


Windows Credential Information Collection Tool


Messenger Program

[Table 2: Top 5 Open Source and Freeware Tool used by SectorJ Group in 2023]

The full report detailing each event together with IoCs (Indicators of Compromise) and recommendations is available to existing NSHC ThreatRecon customers. For more information, please contact service@nshc.net.